Re: GP affecting Administrator account, can't change



Mike wrote:
What seems like overnight, the Adminstrator account on our Win2k server running terminal services appears to be locked out of certian functions like our terminal server user accounts.

The administrator account shows it is part of the Adminstrators group, but when looking in active directory it only shows it as a user. There appears to be no other GP applied to this account or group it is in.

What could be causing this?
This is local Administrator account or domain admin account is affected by this policy when logged on to this Terminal Server. If this is domain administrator account and this GPO which affects this server is processing with loopback processing mode enalbed this setings will also apply to this account when it is logged on to this server.

Of course this can be also effect of settings in Local security policy on this terminal server.

--
Tomasz Onyszko [MVP]
http://wwww.w2k.pl
.



Relevant Pages

  • Re: Help with configuration
    ... Users should logon to the workstation using their domain account ... Your GPO settings do not apply to your Terminal Server. ... Folder under "All Users" on the TS. ... local workstation profile, which includes application ...
    (microsoft.public.windows.terminal_services)
  • Re: Printer
    ... MCSE, CCEA, Microsoft MVP - Terminal Server ... using the administrator account but when I log on with an AD ... I think it is missing some configuration on the server or on the ...
    (microsoft.public.windows.terminal_services)
  • Re: Can not log into my terminal server - logon error
    ... I have a test account that is member of ... "Deny this user permissions to log on to Terminal Server" in account ... "Enable Remote Desktop" in account properties is checked ... your users must be members of the local ...
    (microsoft.public.windows.terminal_services)
  • ADUC functionality fails under new Windows 2003 Terminal Server
    ... We are in the process of moving off a legacy NT4 Multi-master domain ... structure to a parallel AD 2003 Functional Forest. ... \\OLD_TS is a Windows 2000 Terminal Server, ... USER_1 is an AD account. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Logon to domain via TS server -- how to?
    ... In the AD account for this user, on the TS Profile tab, there is a check box ... that says Deny this user permissions to log on to any Terminal Server. ... Administrator account. ... of this system does not permit you to logon interactively" ...
    (microsoft.public.windows.terminal_services)