Beware: Adding user account to "Pro Tools Users Group" leads to logon failure @reboot

[rann]

Hi All,

Just wanted to give a heads-up/word-of-warning; I ran into a rather tricky issue that took me a while to figure out. It might actually be a bug, but not sure.

About a month ago I installed Pro Tools 11.1.2 and AIR Instrument Expansion Pack 2, I've played around a bit and had a few reboots since that time too, no strange things so far.

About a week ago I noticed this new "Pro Tools Users Group" Local Group on My System. After a little googling, it seemed to me to be intended for users that would run Pro Tools with elevated privileges for certain system resources. That sounded interresting so i added my account to that group and forgot all about it..

Until I rebooted tonight and got an obscure login message which at first I thought was related to Microsoft Live-ID account integration in Windows 8.1; I would enter my correct username and password, but the system told me I was using an incorrect password; I could not logon with my regular user account.

I logged on with an administrator account and couldn't figure out what was going on, the account wasn't locked, password was fine although the logon screen was adamant about my password typing failures apparently.

I tried a runas /user:myuser cmd.exe as an admin and got another error:

"the user has not been granted the requested logon type at this computer"

If I would intentionally use another/fake password, I would get an "incorrect password" error, so this way I realized my password was correct.

After some further research and googling I finally found the culprit: It was the "Pro Tools Users Group" membership of my user that was causing my user account to not be able to logon.

This is due to the fact that the "Pro Tools Users Group" is in the "Deny log on locally" Local Group Policy! I suppose the installer did this, and maybe even for a reason, but this might not be clear to everyone (the group is named innocently enough imho).

If you are having maddening logon troubles, logon as an administrator, start a cmd.exe and start gpedit.msc. Navigate to Computer Configuration - Windows Settings - Security Settings - Local Policies - User Rights Assignments - Deny log on locally. You can either remove Pro Tools Users Group from this list or remove your own user from this group in the first place.

So! Not sure if this is a bug, but I'm sure someone that might run into this would be happy with this post

Greets,


Rubin!

[ChuckS]

PT is the only app that I've ever encountered that creates users and a group behind the scenes. Kind of an odd approach and interesting from a security standpoint.

[rann]

Actually, that is not so much what worries me (VMware Workstation does create a user for example, as do certain parts of the .NET framework, as does Oracle Database).

What does worry me is the innocent naming of the Group, suggesting you can just add users to it, which will in effect lock you out; I think that is a bug in and of itself .