Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a new user account on the domain and added them to the Remote Desktop Users group.

I could login just fine locally, but when I logged in remotely I was basically told that I could not login from there using that user. I could login just fine as the administrator or anybody else other than that new account.

So I researched it a bit more and found that my setting looked like this on the local machine:

So I changed it to Allow connections only from computers running Remote Desktop with Network Level Authentication (NLA). Now when I tried this down at my office I connected with RDP just fine on another computer. But low and behold when I got home and simply try to connect to the machine, I get the message:

enter image description here

There has to be some kind of in between setting, or additional setting that I need to change on the user that allows me to connect directly via remote desktop over the VPN. At the moment I can connect by connecting to another computer on the network and then RDPing from there into my machine, but this is not ideal.

share|improve this question
up vote 4 down vote accepted

You haven't told us what the initial error you got actually was, so I'm guessing that you didn't put the user in the local administrators group. Notice that you did get a warning about this when you enabled remote desktop on a windows client.

Enabling NLA does not affect this.

share|improve this answer
So there's a local and a remote administrators group? There's one for the local computer and one for the domain? – leeand00 Oct 7 '12 at 1:40
Yes, every client (and servers except domain controllers) have a local Administrators group. Domain-joined clients/servers automatically add the Domain Admins group to the local Administrators group. The local Administrators group is also added to the local "Remote Desktop Users" group – pauska Oct 7 '12 at 1:54

NLA is an authentication model supported with RDP7 and above. You do not need to have NLA required as it appears your client does not support it.

RDP does not have any idea if you are connecting over a VPN.

In all likelyhood, there was some latency due to the user being logged on (which would inhibit group membership from being updated) or some other unknown reason (active directory propegation, peraps?) that caused the user not to appear as though they were a member of Remote Desktop Users.

Remove the requirement for NLA and try connecting again.

share|improve this answer
Okay I didn't know about AD propagation...that might have been the problem. I can log in just fine now. Thanks! – leeand00 Oct 7 '12 at 1:38
It'll get you! Intersite replication can take fifteen minutes or more. – Mitch Oct 7 '12 at 5:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.