Your network contains an Active Directory domain named contoso.com. The domain contains a domain
controller named DC1 that runs Windows Server 2012.
A user named User1 attempts to log on to DO, but receives the error message shown in the exhibit. (Click the
Exhibit button.)

You need to ensure that User1 can log on to DC1.
What should you do?

A.
Modify the Account is sensitive and cannot be delegated setting of the User1 account.

B.
Grant User1 the Allow log on locally user right.

C.
Modify the Logon Workstations setting of the User1 account.

D.
Add User1 to the Remote Management Users group.

Explanation:
Domain controllers, by default, restrict the types of user accounts that have the ability to log on locally.
Domain controllers, by default, restrict the types of user accounts that have the ability to log on locally.
By default, only members of the Account Operators, Administrators, Backup Operators, Print Operators,
andServer Operators groups have the Allowed logon locally system right. If you want to grant a user account
theability to log on locally to a domain controller, you must either make that user a member of a group that
alreadyhas the Allowed logon locally system right or grant the right to that user account.
Edit Default Domain Controllers Policy
Expand Computer Configuration, Policies, Windows Settings, Security Settings, Local Policies, click UserRights
Assignment.
Double-click Allow Logon Locally.
http://technet.microsoft.com/en-us/library/ee957044(v=ws.10).aspx