Re: Had to add Administrator to Remote Desktop Users group to use

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Ok. Now I'm a little worried, but since there doesn't seem to be any other
issues in my logs, or any obvious problems with the server, I guess I'll wait
and see.

Thanks for the clarifying how "not defined" should work.

Bret

"Helge Klein" wrote:

Your solution does sound acceptable ;-) I am not sure, though, if it
is logical.

If you set the user right "Allow logon through terminal services" to
"not defined" in all policies that apply to a DC (which is the
default) then (only) members of the local group Administrators should
be able to log on over terminal services. Anyway, that is what you
have now and it works.

Generally speaking, a policy setting can have three values: on, off or
not defined. Typically, if it is set to on, a value of "1" is written
to the registry. If it is set to off, then a value of "0" is written
to the registry. If it is not defined, then nothing is written to the
registry and any previous registry entries are removed. To sum this
up: If a setting is changed to "not defined" then any previous values
should _not_ apply any more.

Helge

On 12 Jun., 14:28, bfessenden <bfessen...@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:
It does help very much, thanks!

And I think I fixed the problem. I guess that policies can apply even if you
change one back to "not defined" and run gpupdate - is that correct?

In other words, I think I must have, at some point, enabled the "Allow logon
through terminal services" in the Default Domain Controller policy, but not
put the administrators group in, or something like that, then changed it back
to "not defined".

So, I enabled it again, added administrators, ran gpupdate, then actually
changed it back to "not defined", ran gpupdate, and removed the administrator
from the remote desktop users group, and now I can login as any domain admin.

Does this sound logical, and an acceptable solution? Do GPO's still apply
the last "defined" setting, even if gpupdate is run?

Thanks.

Bret

"Helge Klein" wrote:
Login through terminal services is governed by security in two places:

- Permissions on the RDP listener
- Security option (mentioned by you): Allow/Deny through terminal
services

The group Remote Desktop Users is just a shortcut for configuring
those. You should check the settings that are in effect on your DC.

I hope this helps.

Helge

On 11 Jun., 21:29, bfessenden <bfessen...@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:
Sorry - I forgot to specify that:

I get the standard "To logon to this remote computer, you must be granted
the Allow log on through Terminal Services right..." that you would get with
a regular user not in the RDU's group.

Bret

"Helge Klein" wrote:
What error message do you get when trying to TS into the DC and the
admin account used is _not_ a member of the Remote Desktop Users?

Helge

On 11 Jun., 19:08, bfessenden <bfessen...@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:
Hi,

I just setup a new domain with one new domain controller running Windows
2003 R2 SP2. I have made no changes, aside from password policy to any GPO,
and I have added no new GPOs.

After connecting a existing terminal server as a member server to the new
domain, I could no longer RDC in with any administrator account to the
*domain controller*.

I did have to add Domain Users to the local Remote Desktop Users group on
the terminal server, and they can login to the terminal server fine. I can
also login as an administrator (either local or domain) to the terminal
server ok.

But I cannot login as an administrator to the DC, unless I add the
administrator to the Remote Desktop Users group on the DC.

I haven't been able to find any info about this, because all my searches
just end up being explanations about how to make a regular user a member of
Remote Desktop Users.

I also have not tried to implement any GPO's to "Allow login through
Terminal Services", etc., because I have never done that with any of my other
domain controllers, and I have always been able to login as an admin with no
problem (assuming the System Properties "Allow users to connect remotely" has
been checked on the DC).

Have I just mis-configured something, or is my brand new DC having a serious
issue? I wouldn't worry, except that Microsoft specifically says not to add
admins to the RDU's group.

Any help would be appreciated. Thanks.

Bret



.

Relevant Pages

  • no remote desktop for admin
    ... I can log on to the console as administrator as shown in the above output. ... Using mstsc.exe from a command prompt on the server gives me the same result ... You should also set the Terminal Services service is to start ... and I made sure that remote desktop is checked in the remote ...
    (microsoft.public.windows.terminal_services)
  • Re: Problem logging onto TS via RWW
    ... then currently the local Remote Desktop Users ... Allow log on through Terminal Services right. ... To grant a user these permissions, start the Group Policy snap-in, open ... Run "gpupdate /force" on this DC and restart the terminal server to let ...
    (microsoft.public.windows.server.sbs)
  • Re: Cannot Log Remotely Being a Remote User
    ... Double-click "Allow log on through Terminal Services" ... Remote Desktop Users if it is in the list and click the ... Well, I hope my users group permissions are well assigned, How ... I am in the way to setup a mirroring server and I ...
    (microsoft.public.windows.terminal_services)
  • Re: TS Login Problem to challenge the brightest TS Gurus
    ... I'm not finding that program on the 2003 server. ... workstation but don't find anything about Terminal Services when I ran it. ... permissions would apply since it is only one of 7 2003 Terminal Servers. ... Make sure all users are in the LOCAL Remote Desktop Users ...
    (microsoft.public.windows.terminal_services)
  • Re: no remote desktop for admin
    ... can you logon as administrator to the physical console: ... The firewall on the server is disabled, and since I am connecting locally on our LAN, the connection should not be going through the firewall on the router, at least in theory. ... You should also set the Terminal Services service is to start ... and I made sure that remote desktop is checked in the remote ...
    (microsoft.public.windows.terminal_services)