On a Windows NT Server that is a Backup Domain Controller (BDC), Maria receives 'Unable to log on locally' when attempting to sign in to install software. What should be configured to allow her to log on at the console?

Introduction / Context:
Windows NT uses user-rights assignments to control who can sign in at the console ('Log on locally'). On domain controllers (including BDCs), this right is usually restricted to Administrators and certain operator groups. If a user lacks that right, NT will explicitly deny the local logon attempt.

Given Data / Assumptions:

• The computer is a Backup Domain Controller (BDC), not a standalone server.
• Maria needs to log on at the console to install software.
• The error indicates a rights problem, not a password or account lockout issue.

Concept / Approach:
Granting the 'Log on locally' right is done via User Manager for Domains → Policies → User Rights. Best practice is to add the user to (or create) a group that already has that right (for example, Administrators or Server Operators) rather than granting rights directly to individual users, which eases administration and auditing.

Step-by-Step Solution:

Verification / Alternative check:
Run 'whoami /priv' or check effective group membership and rights to confirm the 'Log on locally' right is present.

Why Other Options Are Wrong:

• Defining a 'local account' on a domain controller is not applicable; DCs use domain accounts only.
• Control Panel toggles or environment variables do not grant security rights.
• None of the above is incorrect because the rights assignment is the correct remedy.

Common Pitfalls:
Granting broad rights directly to users instead of roles; always prefer group-based assignments.

Final Answer:
In User Manager for Domains, assign Maria to a group that has the right to log on locally