0

Here is the issue... Domain admins can only RDP to two of my servers if the domain admins group is in the remote desktop users group.
If you remove the domain admin group from the remote desktop users group doamin admins will receive and error when attempting to RDP. As soon as you add the Domain admin group back to the remote desktop users group domain admins can then log back in.

I have only seen this behavior on these two servers. Any idea what could be causing it?

Improve this question
3
  • Are the Domain Admins not in the local administrators group, perhaps?
    – HopelessN00b
    Mar 19, 2013 at 15:12
  • the domain admins group is in the local administrators group.
    – user1892330
    Mar 19, 2013 at 16:22
  • Have you looked at the security logs? Can domain administrators log in at the console?
    – Harry Johnston
    Mar 22, 2013 at 2:50

2 Answers 2

Reset to default
1

You might want to take a look at the local security policy on the two machines in question. Specifically "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services" under Local Policies/User Rights Assignment.

If they are DCs, you may also want to check the default domain controller GPO for the same settings under Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/User Rights Assignment.

Improve this answer
3
  • Thanks for the suggestion. They are not DCs. Also, "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services" under Local Policies/User Rights Assignment. No groups are listed under the deny policy. Allow has both Administrators group and Remote Desktop users group. So things look good there. Thank you for suggestion
    – user1892330
    Mar 19, 2013 at 15:59
  • Also check the "allow log on locally" and "access this computer from the network" settings. IIRC, both are required for RDP access.
    – Harry Johnston
    Mar 22, 2013 at 2:52
  • Probably best to just check the Windows Logs and see why Windows is denying the logon at this point.
    – Chris S
    Apr 23, 2013 at 12:33
1

You may need to also check the Discretionary Access Control List that governs access rights to the RDP protocol. In Windows 2008, you can do this by going to:

1.) Administrative Tools, Remote Desktop Services and then clicking on "Remote Desktop Session Host Configuration"

2.) Inside RDSH Configuration, right mouse click on "RDP-TCP" under Connections, and select "Properties"

3.) Finally, click on the Security tab. It is here where you can view and adjust the Access Control List. See if for whatever reason Administrators have been denied access, and/or add the Domain Admins group explicitly here with Full Control access.

Good luck!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .