Re: Remote Desktop Logon to Server

From: Rachel L Chipman (RachelLChipman_at_discussions.microsoft.com)
Date: 12/18/04 

Date: Sat, 18 Dec 2004 13:27:02 -0800

Hi -

I have been reading through this post because I am experiencing the same
problem. I have added the user to the Remote Desktop Users group but am
still unable to login via Terminal Services with that account. I am able to
login with the Administrator account.

If adjusting the domain policy is a bad, bad of getting this to work, what
is a better way of doing it?

Thank you.
Rachel

"Richard G. Harper" wrote:

> Go into AD Domain Policies, pick the DC policy and edit it, then change the
> User Rights assignments under Local Policies. Add the users you want to be
> able to log onto the DCs. Done.
>
> This is a bad, BAD idea; by the way.
>
> --
> Richard G. Harper [MVP Win9x] rgharper@email.com
> * PLEASE post all messages and replies in the newsgroups
> * for the benefit of all. Private mail is usually not replied to.
> * My website, such as it is ... http://rgharper.mvps.org/
> * HELP us help YOU ... http://www.dts-l.org/goodpost.htm
>
>
> "Chaplain Doug" <anonymous@discussions.microsoft.com> wrote in message
> news:175e01c4a174$8f795bb0$a401280a@phx.gbl...
> > Don't know why I chose the word "administrative." Indeed
> > an apparent contradiction. What I want to do is allow a
> > person to logon to the server in a restricted mode. I DO
> > NOT want them to have administrative capabilities.
> >
> > At present the only way I have been able to make their
> > remote logon work is to make them a member of the
> > Administrators group. This is not what I wanted to do. I
> > want their logon to the server to be a restricted logon
> > (not super user or administrator). How do I accomplish
> > this?
> >
> > I tried placing their user name in the local security
> > settings-local policies-user rights assignment-log on
> > locally, but they were still unable to log on after the
> > change (this was before I put them into the Administrator
> > group). What else could I try?
> >
> >
> >
> >
> >>-----Original Message-----
> >>First, it sounds like you have login restrictions on your
> > server, either
> >>from Active Directory or from the local Machine
> > Policies. You need to
> >>change whichever is in force to allow other than
> > Administrator users to log
> >>in.
> >>
> >>Your second request is a contradiction in terms. To
> > allow someone
> >>"administrative" access to a server allows them full
> > access.
> >>
> >>--
> >>Richard G. Harper [MVP Win9x] rgharper@email.com
> >>* PLEASE post all messages and replies in the newsgroups
> >>* for the benefit of all. Private mail is usually not
> > replied to.
> >>* My website, such as it is ... http://rgharper.mvps.org/
> >>* HELP us help YOU ... http://www.dts-l.org/goodpost.htm
> >>
> >>
> >>"Chaplain Doug" <anonymous@discussions.microsoft.com>
> > wrote in message
> >>news:0f0a01c4a0db$cf5c2120$a401280a@phx.gbl...
> >>> Windows 2000 Server. I want to allow a remote user to
> >>> logon to my server (via remote desktop) for some limited
> >>> work. At present, when they try to logon the server
> >>> says, "The local policy of this system does not permit
> > you
> >>> to logon interactively."
> >>>
> >>> First, what must I change to allow this user to logon to
> >>> my server remotely via remote desktop?
> >>>
> >>> Second, how can I restrict the user's activities so that
> >>> they are only able to do administrative things on the
> >>> server?
> >>>
> >>> Thanks.
> >>
> >>
> >>.
> >>
>
>
>

Relevant Pages

  • Re: Please help refresh my memory on AD DC
    ... When I boot my Laptop I reach the Logon screeen for XP Laptop and here I am ... administrator account. ... account to be able to Login so I can control it from the DC. ... A Server has websites already hosted on it in a Workgroup and now I join it ...
    (microsoft.public.windows.server.active_directory)
  • Re: Please help refresh my memory on AD DC
    ... "WEB308\administrator" does not longer exist, because DC's have no local administrator. ... The computer is now member of the domain, if you mean this and still has the local user account. ... "in order to add the server or pc I would have to have a user on the domain to logon to the domain. ... To Logon locally I would use the admin account of the Server 2003 machine. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Please help refresh my memory on AD DC
    ... they just get the result of that what the domain administrator ... They however cannot logon directly to the physical DC machine. ... administrator account. ... A Server has websites already hosted on it in a Workgroup and now I ...
    (microsoft.public.windows.server.active_directory)
  • Re: Please help refresh my memory on AD DC
    ... The users will not see anything of that basically, they just get the result of that what the domain administrator or equivalent configures there. ... They however cannot logon directly to the physical DC machine. ... administrator account. ... A Server has websites already hosted on it in a Workgroup and now I ...
    (microsoft.public.windows.server.active_directory)
  • Re: Just administrator can access TS
    ... Check RDP-TCP in the TS Config snap-in and confirm that Remote Desktop Users is there and has appropriate rights. ... Microsoft MVP - Terminal Server ... Special privileges assigned to new logon: ...
    (microsoft.public.windows.terminal_services)