Re: RWW - Local Policy connect to desktop issue

LDD15 wrote:
One step ahead of you on that one. In fact I have tried both the add
permissions as well as the replace permissions. I realize that the
replace might have erased some other permission, but at this point I
have to start trying stuff.

Anyways still no success. I have torn thru the user properties and
really dont' see a discrepancy between the test and the actual. The
only difference I see is in the logon script. For whatever reason the
actual users script (which was pre SP1) is username.bat. The test
usese (post SP1) is something like SBS_User.bat. If you open the
username.bat it just points to the SBS_User.bat anyway. So I don't
see a difference here either.

I really don't know where esle to look.

If this is just one workstation the user can't RWW / RDP into, check the
workstations "local security settings" and make sure the user, or a local
group the user is a member of, hasn't been added to the "deny logon through
terminal services" user right assignments.


Thanks again.

"Jason Miller [SBS MVP]" wrote:

You might be able to set the default SBS template (user) permissions
to the affected user to get the account reset to expected values.

In Server Management | Users, click the hyperlinked task to change
user permissions. The on-screen wizard will allow you to either
replace or update the permissions on the affected user account (you
select the user during the wizard, and you can opt to "reset"
permissions, or you can "add" the template permissions to any
existing permissions). I'd opt to add permissions in your case and
see if that helps. You might start with just standard user
template, and/or Mobile User template.

After you update the permissions, check the problem user account's
ability to connect! :)

Jason

"LDD15" <LDD15@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:241A40C1-5D05-4685-A5CF-5CBBFB6B84DA@xxxxxxxxxxxxxxxx
OK, after further digging, the upgrade to SP1 forced the Windows
firewall on
all clients. On that client, I went to the advanced tab of the
firewall properties and enabled the Remote Desktop service. The the
test user can logon remotely. However, the original user that I am
trying to allow still cannot. So at this point I imagine that it is
a matter of comparing users, which I am working on. The only
difference I currently see between the two is
that the user which can't logon is in one additional group. The
domain power
users group. Any additional ideas? Thanks.

"LDD15" wrote:

Thanks for your continued help!

Ok, I created a test account, used the Mobile users template,
added the user
to the Remote Desktop Users group, explicitly listed the new user
on the client under system properties->Remote Users. I have the
same issue with this
user. So it is a user issue right? What am I leaving out?

"Jason Miller [SBS-MVP]" wrote:

Glad to hear SP1 went well. From here, I'd test with a clean user
account
and if that checks out to work on that system, try the affected
user account
on a test clean XP Pro system, joined to domain via
http://servername/connectcomputer - to rule out user account
and/or workstation issues.

"LDD15" <LDD15@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:7637F528-5BE4-427C-8A30-4ACFC393C41F@xxxxxxxxxxxxxxxx
Ok, The SP1 update is complete. And as you suggested the "Deny ~"
checkbox
is
in the Terminal Services Profile Tab. However, it is unchecked
and the
user
still can't logon to their client.

Any other ideas?

Thank you.

"Jason Miller [SBS-MVP]" wrote:

As replied in your earlier thread - you might check the user's
account
properties, under the Terminal Services Profile tab to ensure
there is no
check box in the field that will "Deny this user permissions to
log on to
any Terminal Server".

"LDD15" <LDD15@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:01120AA9-9C39-49FA-9651-EC9556BFA979@xxxxxxxxxxxxxxxx
Domain Users
Mobile Users
Remote Desktop Users
RRW Users
the associated distubution group (The?????Co)

"Cris Hanna [SBS-MVP]" wrote:

What security groups is this user a member of?

--
Cris Hanna [SBS-MVP]
-------------------------------------------------
Microsoft MVPs
Independent Experts (MVPs do not work for MS)
Real World Answers
---------------------------------------------------------
Please do not contact me directly regarding issues

"LDD15" <LDD15@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:58229B7F-D55D-4B34-B5D9-C44DCB30DCD2@xxxxxxxxxxxxxxxx
Hey all,

I am having a similar problem to what Dabbler was. I have
followed
Jason's
instructions for explicetly allowing the user but have not
had success.
Here
are the details.

SBS 2003 domain
The user can logon to RWW but cannot connect to their
'computer at
work'.
They receive the same message, "The local policy of this
system does
not
permit you lot log on interactivly' when they get the logon
screen
of
that
client.

However, the admin can logon to that same machine.

Any ideas?

Thanks.


Any ideas?

"Jason Miller [SBS-MVP]" wrote:

> Hi Dabbler,
>
> Under System Properties, near the check box to "Allow
users to
connect remotely
> to this computer" there is an option button to "Select
Remote Users".
>
> Is your user's domain account explicitly listed as
permitted to
connect remotely?
>
>
> As your user is in the local Power Users group, not the
Administrators group,
> it will have to be explicitly listed with permissions in
order to
connect
> via Remote Desktop.
>
> Hope that helps,
>
> Jason Miller
> Microsoft Small Business Specialist, MCP, SBS-MVP
>
>
> D> I have a client who is using Windows XP Media edition
to try
and
do
> D> remote
> D> web workplace to his work pc running XP Pro. VPN is up
and running,
> D> we get
> D> the RWW page to chose the his PC and when we get the PC
logon
screen
> D> we get
> D> the error:
> D> "The local policy of this system does not permit you to
logon
> D> interactively"
> D> The Remote Assistance and Remote Desktop are checked on
the
Computer
> D> Properties. The user is added to mobile users, remote
desktop,
remote
> D> web
> D> workplace users groups on SBS 2003
> D> The user is configured as a power user, not
administrator. Can
anyone
> D> suggest what I can loook at to get this guy up and
running?
> D>
> D> Thanks much!
> D>
>
>
>

--
/kj


.