8

I have a domain controller and a member server running W2K8 R2 server. TS licensing is on the DC, TServices is on the member server. Unless I make a user a domain admin, they cannot login: they get the message that they have not been granted to the logon right in terminal services, to make sure they are a member of the RDUsers group or grant the right manually.

I have made sure they are a member of the RDUsers group, and I have also tried setting the group policy to allow RDusers to logon through terminal services, but none of it works.

Any other ideas of what I'm doing wrong?

4 Answers 4

3

The users have to be part of the RDusers group locally on the server you want to login via RDP, not only in the AD. I find this very irritating as well, if someone can provide a workaround for this it would be much appreciated.

5
  • 1
    Um how do you add a user to a member server when its not a domain controller?? AD isn't installed so no way to "Add" a user locally that I can see....
    – Mattknows
    May 2, 2011 at 18:30
  • 1
    Control Panel - Administrative Tools - Computer Management - Local Users and Groups. Then under Groups you have also the RDUsers group. Add the user you want to login with to the group, if its not in the list change Location in the dialogue to your AD domain.
    – duenni
    May 2, 2011 at 18:41
  • Okay, by adding that user locally, making them a member of the RDUsers group, AND removing the domain name in front of the username on the remote computer (a WYSE terminal, btw), it worked. This seems completely, pardon the term, retarded, and I never found mention of it anywhere else until here. Is this really the way its supposed to work? What's the point of Active Directory if you have to do this maintenance on a server other than the server that is supposed to take care of this, the AD server. Am I alone in thinking this is....wrong?
    – Mattknows
    May 2, 2011 at 20:14
  • Have you added the user locally under Users? It is enough to make the domain user a member of the local Remote Desktop User Group....But as I said before, if someone knows a better way it would be much appreciated because now you have to fiddle around with local groups everytime you want to login via RDP with another user then the administrator on every machine.
    – duenni
    May 2, 2011 at 20:34
  • 1
    No it is not wrong. The server you need to RD into has to grant access to people who want to RD into it. So you need to add that domain user id to RDUsers on your TS member server. NOT create a new local account on that server which is what it sounds like you did? Obviously the better option is to create and add a new mydomain\myTSUsers group to the RDUsers group on the TS. Then you can add users to this group and never need to touch that server again.
    – Amit Naidu
    Mar 1, 2013 at 6:00
2

Just add Domain admins or create a new security group called RDP in AD and add this new Group to the (local) Remote desktop user group of each server you build that way you can manage Remote user permission via active directory

1
  • Bad practice, making all RDP users admins of any kind! (this answer will work, however, it's a terrible idea!)
    – MC9000
    Jan 23 at 23:39
2

I had to do this in a Group Policy (I used the generic Domain Users group, but you should probably use a group created for this specifically) Add Users to Remote Desktop Users for the target computer

0

For 2008 R2, go to Start -> Administrative Tools -> Remote Desktop Services -> Remote Desktop Session Host Configuration. Under 'Connections', double click on RDP-Tcp. Go to the Security tab and make sure the Remote Desktop Users group is in this list.

1
  • 1
    I do not have Remote Desktop Services under either server under administrative tools. However I get to something quite similar on the member server under the configuration section of Terminal Server, the RDP-Tcp and the Remote Desktop Users Group is listed;however it's listed with the member server in front of it with a slash between, I can only assume that is correct.
    – Mattknows
    May 2, 2011 at 18:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .