Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a domain controller and a member server running W2K8 R2 server. TS licensing is on the DC, TServices is on the member server. Unless I make a user a domain admin, they cannot login: they get the message that they have not been granted to the logon right in terminal services, to make sure they are a member of the RDUsers group or grant the right manually.

I have made sure they are a member of the RDUsers group, and I have also tried setting the group policy to allow RDusers to logon through terminal services, but none of it works.

Any other ideas of what I'm doing wrong?

share|improve this question

The users have to be part of the RDusers group locally on the server you want to login via RDP, not only in the AD. I find this very irritating as well, if someone can provide a workaround for this it would be much appreciated.

share|improve this answer
Um how do you add a user to a member server when its not a domain controller?? AD isn't installed so no way to "Add" a user locally that I can see.... – Mattknows May 2 '11 at 18:30
Control Panel - Administrative Tools - Computer Management - Local Users and Groups. Then under Groups you have also the RDUsers group. Add the user you want to login with to the group, if its not in the list change Location in the dialogue to your AD domain. – duenni May 2 '11 at 18:41
Okay, by adding that user locally, making them a member of the RDUsers group, AND removing the domain name in front of the username on the remote computer (a WYSE terminal, btw), it worked. This seems completely, pardon the term, retarded, and I never found mention of it anywhere else until here. Is this really the way its supposed to work? What's the point of Active Directory if you have to do this maintenance on a server other than the server that is supposed to take care of this, the AD server. Am I alone in thinking this is....wrong? – Mattknows May 2 '11 at 20:14
Have you added the user locally under Users? It is enough to make the domain user a member of the local Remote Desktop User Group....But as I said before, if someone knows a better way it would be much appreciated because now you have to fiddle around with local groups everytime you want to login via RDP with another user then the administrator on every machine. – duenni May 2 '11 at 20:34
No it is not wrong. The server you need to RD into has to grant access to people who want to RD into it. So you need to add that domain user id to RDUsers on your TS member server. NOT create a new local account on that server which is what it sounds like you did? Obviously the better option is to create and add a new mydomain\myTSUsers group to the RDUsers group on the TS. Then you can add users to this group and never need to touch that server again. – Amit Naidu Mar 1 '13 at 6:00

Just add Domain admins or create a new security group called RDP in AD and add this new Group to the (local) Remote desktop user group of each server you build that way you can manage Remote user permission via active directory

share|improve this answer

I had to do this in a Group Policy (I used the generic Domain Users group, but you should probably use a group created for this specifically) Add Users to Remote Desktop Users for the target computer

share|improve this answer

For 2008 R2, go to Start -> Administrative Tools -> Remote Desktop Services -> Remote Desktop Session Host Configuration. Under 'Connections', double click on RDP-Tcp. Go to the Security tab and make sure the Remote Desktop Users group is in this list.

share|improve this answer
I do not have Remote Desktop Services under either server under administrative tools. However I get to something quite similar on the member server under the configuration section of Terminal Server, the RDP-Tcp and the Remote Desktop Users Group is listed;however it's listed with the member server in front of it with a slash between, I can only assume that is correct. – Mattknows May 2 '11 at 18:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.