Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here is the issue... Domain admins can only RDP to two of my servers if the domain admins group is in the remote desktop users group.
If you remove the domain admin group from the remote desktop users group doamin admins will receive and error when attempting to RDP. As soon as you add the Domain admin group back to the remote desktop users group domain admins can then log back in.

I have only seen this behavior on these two servers. Any idea what could be causing it?

share|improve this question
    
Are the Domain Admins not in the local administrators group, perhaps? –  HopelessN00b Mar 19 '13 at 15:12
    
the domain admins group is in the local administrators group. –  user1892330 Mar 19 '13 at 16:22
    
Have you looked at the security logs? Can domain administrators log in at the console? –  Harry Johnston Mar 22 '13 at 2:50

1 Answer 1

You might want to take a look at the local security policy on the two machines in question. Specifically "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services" under Local Policies/User Rights Assignment.

If they are DCs, you may also want to check the default domain controller GPO for the same settings under Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/User Rights Assignment.

share|improve this answer
    
Thanks for the suggestion. They are not DCs. Also, "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services" under Local Policies/User Rights Assignment. No groups are listed under the deny policy. Allow has both Administrators group and Remote Desktop users group. So things look good there. Thank you for suggestion –  user1892330 Mar 19 '13 at 15:59
    
Also check the "allow log on locally" and "access this computer from the network" settings. IIRC, both are required for RDP access. –  Harry Johnston Mar 22 '13 at 2:52
    
Probably best to just check the Windows Logs and see why Windows is denying the logon at this point. –  Chris S Apr 23 '13 at 12:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.