Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I try to RDP into a Server 2008 Terminal Server, I get a message that says "Access Denied" and an OK button. I setup the licensing mode correctly (per user) and also have setup to allow all remote connections. I get the following in the security event log:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          28/06/2012 12:01:16
Event ID:      4656
Task Category: File System
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      FQDN COMPUTER 
A handle to an object was requested.

    Security ID:        DOMAIN\ACCOUNT
    Account Name:       ACCOUNT
    Account Domain:     DOMAIN
    Logon ID:       0xbbe3f

    Object Server:      Security
    Object Type:        File
    Object Name:        C:\Windows\System32\ServerManager.msc
    Handle ID:      0x0

Process Information:
    Process ID:     0x60c
    Process Name:       C:\Windows\System32\mmc.exe

Access Request Information:
    Transaction ID:     {00000000-0000-0000-0000-000000000000}
    Accesses:       READ_CONTROL
                WriteData (or AddFile)
                AppendData (or AddSubdirectory or CreatePipeInstance)

    Access Reasons:     READ_CONTROL:   Granted by  D:(A;;0x1200a9;;;BA)
                SYNCHRONIZE:    Granted by  D:(A;;0x1200a9;;;BA)
                WriteData (or AddFile): Not granted
                AppendData (or AddSubdirectory or CreatePipeInstance):  Not granted
                WriteEA:    Not granted
                ReadAttributes: Granted by ACE on parent folder D:(A;;0x1301bf;;;BA)
                WriteAttributes:    Not granted

    Access Mask:        0x120196
    Privileges Used for Access Check:   -
    Restricted SID Count:   0
Event Xml:
<Event xmlns="">
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <TimeCreated SystemTime="2012-06-28T15:01:16.975080700Z" />
    <Correlation />
    <Execution ProcessID="540" ThreadID="556" />
    <Computer>FQDN COMPUTER/Computer>
    <Security />
    <Data Name="SubjectUserSid">S-1-5-21-205301047-3902605089-2438454170-21511219</Data>
    <Data Name="SubjectUserName">ACCOUNT</Data>
    <Data Name="SubjectDomainName">DOMAIN</Data>
    <Data Name="SubjectLogonId">0xbbe3f</Data>
    <Data Name="ObjectServer">Security</Data>
    <Data Name="ObjectType">File</Data>
    <Data Name="ObjectName">C:\Windows\System32\ServerManager.msc</Data>
    <Data Name="HandleId">0x0</Data>
    <Data Name="TransactionId">{00000000-0000-0000-0000-000000000000}</Data>
    <Data Name="AccessList">%%1538
    <Data Name="AccessReason">%%1538:   %%1801  D:(A;;0x1200a9;;;BA)
                %%1541: %%1801  D:(A;;0x1200a9;;;BA)
                %%4417: %%1805
                %%4418: %%1805
                %%4420: %%1805
                %%4423: %%1811  D:(A;;0x1301bf;;;BA)
                %%4424: %%1805
    <Data Name="AccessMask">0x120196</Data>
    <Data Name="PrivilegeList">-</Data>
    <Data Name="RestrictedSidCount">0</Data>
    <Data Name="ProcessId">0x60c</Data>
    <Data Name="ProcessName">C:\Windows\System32\mmc.exe</Data>

Any ideas?

share|improve this question

Looks like it is trying to open server manager when you first login, but the user doesn't have permission to do so.

Is the user logging in a local administrator on the server?

In server manager, click "Do not show me this console at logon" on the first screen.

share|improve this answer
up vote 0 down vote accepted

This was the solution:

The remote desktop service is running using “LocalSystem” account. If you compare this registry key with other working server, you can see that you need to leave this server running with “NT AuthorityNetworkService”.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.