I came across a situation on our network where we needed to give a local user the right to "Log on as a Service" on one of our servers. This was to support a LOB application that we run on a server here in our office. The problem I had was that for both the "Log on as a service" and the "Log on as a Batch job" the "Add User or Group" button was greyed out. This is because our SBS 2003 box has a Domain Group Policy which sets the rights to these services at a Domain level and stops any changes being made elsewhere...