Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This is my first time setting up or even using active directory.

I set it up, and added the computers(Actually VMs in Hyper V) to the active directory, and if if I use hyper-V to connect to the VMs, I am able to use users from the active directory domain to login to the VMs.

However, if I try to login via remote desktop, I get this error:

The connection was denied because the user account is not authorized for remote login.

I have tried:
- From within active directory, i have added the group that my user is in to Remote Desktop users.
- On the VM itself, adding the active directory group(that contains the user I am trying to login with) to Allow log on through Remote Desktop Services in Local Security Policy.

I still have the same authorization denied error.

How do I properly setup a group in active directory to be able to login with remote desktop on all of my Virtual Machines?

Thanks!

share|improve this question
    
Is the Remote Desktop Services role installed on the VM? –  KJ-SRS Aug 20 '12 at 22:21

5 Answers 5

What operating system ??

Is this host a Domain Controller?

  1. Start-->Run-->secpol.msc

    Security Settings\Local Policies\User Rights Assignment

    Right pane --> double-click on Allow log on through Remote Desktop Services --> Add Users or Group --> enter Remote Desktop Users

  2. Start-->Run-->services.msc

    Look for Remote Desktop Services and make sure the Log on account is Network System, not Local Service.

  3. Check your event logs.

share|improve this answer
    
This is an older post but for future reference to somebody that got stuck (as I did) the answer given above by Amit Naidu really hits the spot. The problem in my opinion is that adding a user to the group "Remote Desktop Users" (on your Active Directory) is not enough, afterwards you need to change your LOCAL machine policies with the command (as above) secpol.msc and add the Active Directory group "Remote Desktop Users" to your LOCAL allowed remote users. Also do the check mentioned on the second step it can troubleshoot your problem. Amit, thank you for your time and knowledge. –  user164238 Mar 12 '13 at 21:47

Add the users in question to the Remote Desktop Users group on each local machine.

share|improve this answer
    
I added the group that the users were a part of on the local machine and i was still getting that error. Interestingly, i added the user itself, and now instead of a popup with that error, RDP connects and just gives a "Access is denied" at the login screen. Any other thoughts? –  user1308743 Aug 20 '12 at 21:25

At first glance I would say you did the right things...
About the only thing that comes to mind is that you used the wrong type of group.
Distribution group in stead of security group.

share|improve this answer
1  
I am using security groups, which my understanding is it's the correct group to use, right? –  user1308743 Aug 20 '12 at 21:48
    
Yes, that's right. In that case I am at a loss too. This ought to work as far as I know. –  Tonny Aug 20 '12 at 21:56
    
It is a security group you're after –  Aceth Aug 20 '12 at 23:03

Try looking at Group Policy as well have you changed anything there? What OS's .. have you got the right level of security on the RDP sessions? i.e. Vista and above?

Anything in the event logs? on local machines. MDMarra's answer should have worked.. what sort of set up have you got? OS's inside VM's etc?

share|improve this answer

Checking the Remote Desktop Services service is very important and also helps to restart it.

I was having the same problem and it was killing me. First thing to do is see if a non domain admin can RDP to and different server. If they can then you just need to worry about a local setting on that Terminal Server.

In my case I added the needed users to Remote Desktop Users group on the DC and then set the Domain Policy in Group Policy Management Console - Group Policy Objects - rt click your default domain policy - edit - Policies - Windows Settings - Security Settings - Local Policies - User Rights Assignment - Allow log on through remote desktop services. Add "Remote Desktop Users" to this policy.

Then run: gpupdate /force

Then from your Terminal Server: Start - Administrative Tools - Remote Desktop Services - Remote Desktop Session Host Configuration - RDP-Tcp - rt clk - properties - security - Add - Domain Users - Grant then User Access and Guest Access - OK.

Then you have to go to services on the Terminal Server and restart the Remote Desktop Services service. Otherwise the RDP-Tcp setting won't take effect right away.

All users that are part of the Remote Desktop Users group and Domain Users group should now connect.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.