Can't logon with any local admin account

[DesktopJinx]

I have two admin accounts on my T61p, a local "Config" and a domain "DesktopAdmin". I logged on with Config last night to initiate a backup before I take this new road warrior on its first excursion... but the desktop never appears. A black empty screen with the mouse pointer in the middle, even a half-hour later.

DesktopAdmin works fine, so I shrug, delete Config, recreate it... same problem. So I shrug, create Test as a standard user, it works fine, make Test an admin... same problem.

So the old T43p gets called back up for one more mission.

You're probably wondering what I did to upset the T61p so... since I'd last used "Config" I'd updated Firefox and Super Flexible File Synchronizer, and I told the On Screen Display to shut up. I could try undoing those changes, but if this machine is going to be this cranky less than two weeks into its life -- I've already had to uninstall and reinstall Office because Outlook hung every time it was opened -- then it's getting nuked back to bare metal. But this can't-logon behavior is so odd, I thought I'd poke my head out of my shell to see if anyone else had ever seen it.

Anybody ever seen or heard of such a thing?

[jdhurst]

Make sure the admin accounts are enabled. The main admin account in Vista is disabled by default. Otherwised, I don't know.
... JDH

[DesktopJinx]

It happened AGAIN.

Fresh load from scratch. Last thing I did was load Office 2007 and Access Connections... that was several hours and a reboot ago, with at least a dozen logons with multiple administrator accounts since then, but a half hour ago, suddenly they all stopped working. (Last time I had one that still worked, this time... none of them can logon.) All I've done is use Outlook and Firefox (and the latter only on Microsoft's website).

The accounts are enabled, and even work for UAC elevation prompts, but the desktop never appears. "Welcome" sits for 20 seconds or so, then the screen goes black with the mouse pointer in the middle and it sits... and sits...

I'm crushed.

[DesktopJinx]

Retrace your steps, no matter how little sense they make, and stumble over the problem...

It's not enough to be a member of the Administrators group to logon. The account must ALSO be a member of the Users group.

By default, the Users group includes NT AUTHORITY\INTERACTIVE and Authenticated Users, which covers every local user and every user of every trusted NT domain.

Of course, if you don't TRUST every user of every trusted NT domain to logon to your machine, you don't want those in your local Users group. I'd removed them (as I've always done for Windows 2000 machines) and *poof*

So I added all of the members of Administrators to Users and now they can all logon.

I'm guessing this is either a UAC thing or there's a User Right that's assigned to Users but not Administrators. (It's not "Allow log on locally" because Administrators is included there. In fact, the only one given to Users but not Administrators is "Increase a process working set.")