We've got a standalone (non-domain) server where "Deny log on through Terminal Services" contains "Everyone" -- ok, we didn't want that, not sure how it got set, but whatever.

We removed it ...and "Everyone" came back.

Tried adding "Guest" to the deny list, removing "Everyone" ...which ended up with the setting containing "Everyone, Guest"

Clearly there's another setting somewhere that's preempting this one, but it beats me which one.

Any ideas?

("Everyone" is being shown as reset upon reloading the Local Security Settings window, so it's possible that it's not actually being changed in the underlying store, and just shows the change in the UI)