2

I wanted to enabled remote desktop access for a domain security group so I search and followed the instruction here to get to the setting which was shown as "Not Defined" then I change the setting to add the security group, but it didn't work still. The same "..Allow Logon.." error message still occurs. So I decided to give up and revert the GPO settings to Not Defined.

I then tried to RDP with the Administrator account that had always worked, but to my horror it is not working anymore and the same "..Allow Logon.." error is shown.

I tried to gpupdate /force but still nothing works. The document says by default for Windows Server 2008, the RDP access is enabled for Administrators, so I assume if Not Defined, my Administrator account should still log in after the GPO changes? What else do I need to do to reset the setting?

4 Answers 4

1

Log on to the server locally and check the RDP settings.

Start > Administrative Tools > Remote Desktop Services > Remote Desktop Session Host Configuration.
(This might be called Terminal Services instead of Remote Desktop Services).

In the middle of the screen in the Connections list, right-click RDP-Tcp, choose Properties. Choose the Security tab. This is the access control list of groups that have been granted or denied access to the terminal server. The GPO may have removed some groups from this list.

On my machine right now I have SYSTEM, LOCAL SERVICE, NETWORK SERVICE, Administrators, Remote Desktop Users and INTERACTIVE.
I think the important ones for you are going to be Administrators (who should have Full Control, User Access and Guest Access) and Remote Desktop Users (who should have User Access and Guest Access). If those groups are not in the list then add them.

Of course, check the membership of those groups. Hopefully all of your administrative staff are in the local Administrators group (probably via membership of DOMAIN\Domain Admins).

2
  • That's about right. I also noticed that the behavior is different on different computer eventhough the same user account is used to logged in. e.g. the computer which executed a failed login may take continue to be denied, but a new computer will be able to log in.I think it takes a while for the GPO cache to refresh locally client side.
    – Jake
    Mar 26, 2013 at 6:25
  • You edited a two and a half year old answer just to change the typeface? Jan 28, 2016 at 19:30
1

Thanks Farrukh,
this information was very useful..

Once you change default domain controller policy by changing the Allow log on through Remote Desktop Services option for any user (Domain\xyz), the RDP access to all DC's, for all type of Admins is gone and can only be made available by adding them again in this option (Allow log on through Remote Desktop Services).

Just add Administrators group in this option and the members of your domain admin or any admin group will be able to login to all domain controllers after 5 minutes.

1

Default access for Administrators and Remote Desktop Users doesn't come back if you modify Allow log on through Terminal Services settings with some specific account and then again set it to Not Configured.

You need to explicitly define Administrators and Remote Desktop Users in this case.

0

The setting from the GPO overwrites all local policies. You have to add all groups that you want to use, no just the one you'd like to add.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .