Open Group Policy Management from the Administrative Tools.

Right click the ‘Default Domain Controllers Policy’ and choose ‘Edit’.

Choose Computer Configuration –> Policies -> Windows Settings –> Security Settings –> Local Policies –> User Rights Assignment and double right click in the right pane ‘Allow log on locally’.

Click ‘Add User or Group’.

Click Browse

Type in the box ‘besadmin’ and click ‘Check Names’.

Click ‘OK’.