Log on as a service Policy

i'm working issue caused log on service policy being applied , enforced top of domain hierarchy. basically, settings of policy restrictive. so, administrators have used work around undesirable. time log on service right needed , account not explicitly listed in policy, have made service account member of local administrators group. i'd decrease number of accounts in local admins group, , i'm looking way undo policy.

i change domain policy not configured, but, looking @ managed settings , see on local security policy consoles, appears if made change, local policy revert default , network service have right log on service.

does have experience trying undo gpo setting? have determine in advance servers affected undoing policy , endure painful maintenance window requiring server reboots , granting right appropriate?

if current service accounts in local admin group, should able run service. @ least, have service accounts , in our domain setting not configured. if working now, work then. said, big changes set test system first mimic do, , configure identical live system. way before big, can verify going work. it's better have tested procedure / plan of attack. , should happen, @ least have done due diligence in testing.

Windows Server  >  Group Policy