Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Earlier this morning I dcpromo'ed my second server to be DC2. Everything is working great except for the fact that users aren't able to remote into it.

The user I am trying with is "cs". "Cs" is a member of Domain Users, Remote Desktop Users, and Users.

When I try with "Administrator", it works fine.

Is there a setting in the GPO I'm missing?

EDIT: Exact error message is: "The connection was denied because the user account is not authroized for remote access."

EDIT: More details: DC2 is Server 2008. When I dcpromoed, one of the first things it said was something about TS but I don't remember what it said. Not sure if that's related. DC1 is Server 2008 R2.

Solution: Easier than expected... In addition to adding the users to the "remote users" group, I had to add them to server manager > configure remote desktop > remote tab > select users. I added each individual user there, though I'm sure I could have just added the "remote users" group.

Thank you to those who tried to help. I'd upvote but I can't yet.


share|improve this question
Why are non administrators logging into a Domain Controller? – xeon Jul 6 '11 at 16:11
Simply to access a folder called "public" and open up a powerpoint. If I were in charge it would be different but alas I must work with what I'm given/allowed-to-do. – EagerToLearn Jul 6 '11 at 16:17
You have people logging in to a domain controller with RDP, using Powerpoint. Really. – pauska Jul 6 '11 at 16:32
Do I need the TS Gateway service installed? – EagerToLearn Jul 6 '11 at 17:07
@EagerToLearn - I don't mean to be rude but it you are so eager to learn I have a lesson for you - walk away from the keyboard and get someone else to do the computer work, what you've done here is beyond negligent and into farce. – Chopper3 Jul 6 '11 at 17:21

On the Domain Controller; Local Security Policy -> Local Policies -> User Rights Assignment -> Allow log on through Remote Desktop Services

Add the groups you require.

share|improve this answer
I have "Allow log on through Terminal Services". I added remote desktop users and it's still not working. Does it take time? Do I need to do a gpudate command from the client? It's a thinclient running a stripped down version of Windows so I don't know if that command would even work. – EagerToLearn Jul 6 '11 at 16:25
I just checked DC1. DC1 does have "Allow log on through Remote Desktop Services". But DC2 does not have this option. Does something need to be installed? – EagerToLearn Jul 6 '11 at 16:28

The real answer you're looking for, from an administrative stand point, is to share the folder that has your power point file on. Then have the user access that file from Start > Run > \\server\sharename. That will save them time and energy from needing to login to your new Domain Controller then finding the file that they need to use. Not to mention be 1 billion times more secure.

You don't want an answer to your original question. That iwll just leave you sad and bitter in the end when you need to reimage the computer because someone was doing something on it they shouldn't have been.

share|improve this answer
Lol thanks dude I know how to access a shared folder. The reason TS is needed is because they are thin clients running a stripped down version of Windows. This only comes with a PowerPoint viewer. The secretary needs to edit these constantly because they are announcements for each department. Each ThinClient is hooked up to a 46 inch monitor. The solution that my boss came up with was to have these TC connect to the server and run PPT from there. I have ZERO input on this matter. I would think that everyone here would have experience in dealing with incompetent bosses. – EagerToLearn Jul 6 '11 at 18:28
3 things. 1. It's all about how you sell the idea you have. You know this isn't the best solution. If you're going to be using this as a Domain Controller, you need to setup a different server to be your terminal server to remote into. Tact can you a long way with difficult bosses. Who's going to have to rebuild the domain controller and trouble shoot issues with the domain if things start going missing? 2. If you included this in your original question, it would have been helpful :) 3. Check this… – Nixphoe Jul 6 '11 at 18:58
@EagerToLearn - I appreciate you're eager to learn, however "I would think that everyone here would have experience in dealing with incompetent bosses" - not really. This is a site for professional sysadmins, in which case we often are the bosses. This isn't a site for admin staff needing to do downright dangerous things. – Mark Henderson Jul 7 '11 at 0:17
ADDS is the key to the kingdom. If you control that, you can get access to anything that relies on domain authentication. What if one of your curious interns (substitute any other one of your employees) wants to load up a key logger into the all users startup folder. Well, now they have access to your domain admin pw. Which they can now create their own accounts on your domain, now they can add key loggers to any computer on your domain and get access to your firewalls, routing device, heck your financial data. Of course this is worst case, but that is what good security practices prevent. – Nixphoe Jul 7 '11 at 14:21
What you are asking from an administrative stand point, goes against all logic and security standards for system administrators. Which is where all the feed back is coming from. Clearly your bosses are at fault here for not caring what so ever. You should really plot about the best way to get them to understand this. This won't be the last time you meet someone that doesn't understand security, as a system administrator, you need to know how to explain this and get people to understand it, to basically sell the idea behind what you are trying to get done. – Nixphoe Jul 7 '11 at 17:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.