Is there a best practice for allowing support rep to login to a user's account?

1. How do I grant allow log on locally permissions to domain user accounts?

How do I grant allow log on locally permissions to domain user accounts?

Run "gpedit. msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> User Rights Assignment. If any accounts or groups other than the following are granted the "Allow log on locally" user right, this is a finding.