Explanation

Box 1: Yes
User1 is an administrator and has the Allow log on through Remote Desktop Services.
Box 2: No
User2 is a member of Group2 which has the Deny log on through Remote Desktop Services.
Box 3: Yes
User3 is a member of the administrators group and has the Allow log on through Remote Desktop Services.
Note: Deny permissions take precedence over Allow permissions. If a user belongs to two groups, and one of them has a specific permission set to Deny, that user is not able to perform tasks that require that permission even if they belong to a group that has that permission set to Allow.
References:
https://docs.microsoft.com/en-us/azure/devops/organizations/security/about-permissions?view=azure-devops&ta