Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 2008 SP2 VM and I am attempting to configure it to allow people to log into it using MSTSC client. As far as I understand you can set this up locally enabling RDP and adding users to the list of those allowed.

However I would like to set things up using AD and GPOs. As per KB954369 I have my machine sat in an OU, against which I have applied policy to enable RDP and another to define restricted users. I have tried to double check these things but as far as I can see, it looks to be correct.

Edit: The domain administrator user can login via RDP. Therefore I'm ruling out any lower level network issues.

I'm a Windows admin novice and am beginning to tear my hair out and wonder if anyone can shed any light or suggest any schoolboy mistakes that I might have made. Specific pointers would of course be appreciated, but I would also be happy to be directed to more general principles, tools or techniques for debugging these things.

share|improve this question
    
Can anyone log on using RDP? –  nray Oct 5 '09 at 18:33
    
Which network are users trying to connect from? Which version of the RDP client? –  nray Oct 5 '09 at 19:04
add comment

4 Answers

up vote 1 down vote accepted

The best summary of how your GPOs are being applied is through Microsoft's Group Policy Management Console. This was a download for Windows Server 2003 domains, but I'm guessing it's built in to Windows Server 2008 domain controllers.

Run the "GPO Results Wizard" or whatver its 2008 equivalent is, and check especially for any errors applying GPOs.

share|improve this answer
    
I ended up using this and the gpresult command to see what was being applied to the box. Since it worked in one OU and not in another I narrowed it down to a faulty GPO. I looked again at the instructions for allowing RDP and when adding restricted users, you must link initially to the BUILTIN\Remote Desktop Users group and then add groups to this. I didn't realise but this BUILTIN group won't contain the same members across different uses of it. Hope that makes sense. –  Tom Duckering Oct 8 '09 at 8:37
add comment

Is the built-in firewall configured to allow RDP connections, and if so from which networks?

share|improve this answer
add comment

The newer RDP clients support a higher, certificate-based level of security around RDP connections. Is your server configured to refuse any RDP connection not using the latest-and-greatest security level?

share|improve this answer
add comment

I think I have the same problem you are describing here AND I think you have the solution... But not 100% sure. (I am following http://technet.microsoft.com/en-us/library/cc776790(WS.10).aspx)

You stated:

I looked again at the instructions for allowing RDP and when adding restricted users, you must link initially to the BUILTIN\Remote Desktop Users group and then add groups to this.

OK - I can buy all of that and I did it... But this is where you kinda lost me -

I didn't realize but this BUILTIN group won't contain the same members across different users of it.

This is where things get fuzzy.... can you try and explain that one again.

share|improve this answer
    
Tony - I think I lost you since I don't fully understand it myself. I've left that environment so I can't examine it and describe it exactly so this is from memory. I had set up RDP access in two separate cases (i.e. one set of users can RDP login to machines in one OU and another set of users can RDP to machines in a different OU). Since this policy was referring to this BUILTIN\Remote Desktop Users group in both instances but had different users then it was a moment of revelation that this group was special and necessary. Hope that helps. –  Tom Duckering Nov 20 '09 at 11:39
    
Well thanks for your input. I know I'm close here... Everything seems to be setup as it should be but I've got the feeling I'm missing something simple. gotta be with the Restricted group = Remote Desktop Users. I've created a Domain group called RDP Users and added it as a member. Added users to that RDP group. I get it, minus a few hairs... :) –  Tony Nov 20 '09 at 15:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.