Re: terminal server access on a domain controller

I was too quick in saying that this worked, it's working but now when I log
this user in to their office desktop, I have the same restrictions - one of
them being that they can't access their local drives.

"John Bowden" wrote:

thanks for the information. that worked

"Vera Noest [MVP]" wrote:

Disclaimer: I haven't tested this on a DC.

The mechanism to solve this problem is called "loopback
processing" of the GPO.
You'll find it here in your GP editor:

Computer Configuration - Administrative Templates - System -
Group Policy
"User Group Policy loopback processing mode" - "Replace"

231287 - Loopback Processing of Group Policy
http://support.microsoft.com/?kbid=231287

Note that using the policy setting to hide the local drives is just
a cosmetic thing. It does *not* provide any security and it does
*not* lock your users out of the local drives. They will still show
up in nearly every programs "Save as.." or "File Open.." dialog, as
well as from a command window.
So be sure that you check your NTFS permissions on the file system,
and whatever you do, do not give these users elevated user rights.

And besides the CALs, you will need TS CALs as well.

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?Sm9obiBCb3dkZW4=?=
<JohnBowden@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote on 18 jun 2007 in
microsoft.public.windows.terminal_services:

I have a site that has purchased one server. We have since
discovered that we need a few of the users to access the server
remotely using RDP through terminal services. Now I know that
it's not a good idea to run terminal services on a domain
controller but for now, it needs to be done until they can
afford another server. The server is running 2003 standard
server and has 5 user cals installed.

I would like to set up two users that need remote access to
allow them to use thier computers in the office and when they
are out of the office, they need remote access. I have set up
the GPO for terminal services and it works fine when they are
out but unfortunatly, it locks them out of their local computer
when they are in the office. Things such as not being able to
access their local drive because I've restricted them from
accessing the server local drives are some of the problems.

I've put the GPO in the domain controller list but the user
settings are what I need to figure out how to enable ONLY when
they log in remotely. I don't know how I can do this.

Can anyone help out?
Thanks

.

Relevant Pages

  • Re: terminal server access on a domain controller
    ... MCSE, CCEA, Microsoft MVP - Terminal Server ... Note that using the policy setting to hide the local drives ... server remotely using RDP through terminal services. ... I've put the GPO in the domain controller list but the user ...
    (microsoft.public.windows.terminal_services)
  • Re: terminal server access on a domain controller
    ... processing" of the GPO. ... Note that using the policy setting to hide the local drives is just ... MCSE, CCEA, Microsoft MVP - Terminal Server ... I would like to set up two users that need remote access to ...
    (microsoft.public.windows.terminal_services)
  • Re: Computer build ok for my server?
    ... What are terminal services? ... You can do this via RWW if you can spare two desktops when this remote access is needed. ... You don't want to use the administrative sessions on the server for this purpose--that's both risky and not within licensing bounds. ...
    (microsoft.public.windows.server.sbs)
  • Re: Computer build ok for my server?
    ... Terminal Services is a "role" for Windows Server 200X. ... screen refreshes and keystrokes are passed over the connection. ... It requires another copy of Windows Server, ... to providing a desktop for such remote access, ...
    (microsoft.public.windows.server.sbs)
  • Remote access??
    ... I want to use the built in service of remote access on the server 2000 ... Is the remote access "terminal services" On ... Windows server standard or does it have to be pro or 2003?? ...
    (microsoft.public.windows.server.general)