up vote 0 down vote favorite
share [g+] share [fb]

I've setup a Server 2003 R2 as AD & DC. I created some test users on the dc. I also setup a Server 2003 R2 as a Terminal Server. I got licensing etc. working. What i cant get to work is that users can login to the terminal server. What i dont understand is how the terminal server should know to check for users at the DC? How do these two talk to each other? When i trie to login to the terminal server i get an error stating that says "allow login thru terminal services right" I've set this to enable in the policy,ran a gupdate /force on both servers but still i get this error. I also read somehwere that you can add the user to the rdp-tcp policies,but why would i wanna do that? The terminal server should check at the dc or am i wrong? To test things i did add the user at the rdp-tcp policies but it still doesnt work. The terminal server is a member of the dc, i added the terminal server like a normal pc to the domain. Any help is appreciated as i'm out of options :)

Thanks, Oscar

link|improve this question
To make things clear, these are two separate servers :) Thanks, Oscar. – Oscar Oct 1 '09 at 11:57
feedback

2 Answers

up vote 1 down vote

Have you joined the terminal server to the AD domain? Without joining it to a domain you will only be able to use local logins on the terminal server. The terminal server will check the DC by being joined to the AD domain that your DC is authoritative for. If the terminal server is part of the domain then it will automatically contact a DC in the background during the login process (or at least attempt to). You also need to make sure you're specifying domain credentials by either entering your username in domain\username format, user@domain.com format, or just username and selecting the domain from the dropdown.

link|improve this answer
feedback
up vote 0 down vote

You stated that you set the "allow login thru terminal services right" in your GPO, but this only tells the TS to allow logins but it doesn't tell it who to allow to login. the easiest way is to add the domain users that you want to login (Domain Users group, or another group, or individuals) to the local Remote Desktop Users group on the TS.

So, to summarize:

  1. You have to tell the TS to allow logins (which you did)

  2. You have to tell the TS who to allow to login (which you have not done)

link|improve this answer
thanks for the answers. I did add the ts to the ad server. I tried adding the remote desktop users group to the terminal server but the strange thing is that the terminal server can't see the ad server,it only lists itself. – Oscar Oct 1 '09 at 19:39
Are you sure the TS has been joined to the domain? Are you logged on to the TS as a Domain Administrator or a Local Administrator? When you try to add the group can you click the Location button and select "Entire Directory"? – joeqwerty Oct 1 '09 at 19:51
yes,i'm sure it's joined to the domain. I tried both,loggin in as a domain admin or local admin. I can select the location button but it only lists the ts server. – Oscar Oct 1 '09 at 20:40
feedback

Your Answer

 
or
required, but never shown
discard