I came across a situation on our network where we needed to give a local user the right to "Log on as a Service" on one of our servers. This was to support a LOB application that we run on a server here in our office. The problem I had was that for both the "Log on as a service" and the "Log on as a Batch job" the "Add User or Group" button was greyed out. This is because our SBS 2003 box has a Domain Group Policy which sets the rights to these services at a Domain level and stops any changes being made elsewhere. To get around this I did the following: 1) Logon to the server in question as Domain Administrator. Open up the Active Directory Users & Computers (ADUC) snap-in. 2) Right click on the Domain and choose Properties. Click on the Group Policy tab and open the group policies. You have to do this unless you install the GPMC on the server. 3) Create a new Group Policy and name it something appropriate. 4) Navigate to Computer Configuration / Windows Settings / Security Settings / Local Policies / User...