Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is the issue... Domain admins can only RDP to two of my servers if the domain admins group is in the remote desktop users group.
If you remove the domain admin group from the remote desktop users group doamin admins will receive and error when attempting to RDP. As soon as you add the Domain admin group back to the remote desktop users group domain admins can then log back in.

I have only seen this behavior on these two servers. Any idea what could be causing it?

share|improve this question
Are the Domain Admins not in the local administrators group, perhaps? – HopelessN00b Mar 19 '13 at 15:12
the domain admins group is in the local administrators group. – user1892330 Mar 19 '13 at 16:22
Have you looked at the security logs? Can domain administrators log in at the console? – Harry Johnston Mar 22 '13 at 2:50

You might want to take a look at the local security policy on the two machines in question. Specifically "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services" under Local Policies/User Rights Assignment.

If they are DCs, you may also want to check the default domain controller GPO for the same settings under Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/User Rights Assignment.

share|improve this answer
Thanks for the suggestion. They are not DCs. Also, "Allow log on through Remote Desktop Services" and "Deny log on through Remote Desktop Services" under Local Policies/User Rights Assignment. No groups are listed under the deny policy. Allow has both Administrators group and Remote Desktop users group. So things look good there. Thank you for suggestion – user1892330 Mar 19 '13 at 15:59
Also check the "allow log on locally" and "access this computer from the network" settings. IIRC, both are required for RDP access. – Harry Johnston Mar 22 '13 at 2:52
Probably best to just check the Windows Logs and see why Windows is denying the logon at this point. – Chris S Apr 23 '13 at 12:33

You may need to also check the Discretionary Access Control List that governs access rights to the RDP protocol. In Windows 2008, you can do this by going to:

1.) Administrative Tools, Remote Desktop Services and then clicking on "Remote Desktop Session Host Configuration"

2.) Inside RDSH Configuration, right mouse click on "RDP-TCP" under Connections, and select "Properties"

3.) Finally, click on the Security tab. It is here where you can view and adjust the Access Control List. See if for whatever reason Administrators have been denied access, and/or add the Domain Admins group explicitly here with Full Control access.

Good luck!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.