When I add a new user to our on premise Active Directory, I want to assign that account to specific security group such as “Prod Group”, “Developer Group” or “Support Group”.
My goal is to control the user access to specific type of VM environments such that “Support Group” users can only access VMs I categorize as Support they can’t access any Production VMs.
I'm a developer by trait so I'm not very familiar with how to do this, I google many places such as this link to help me and here is what I've done so far:
Create user & group in Active Directory Users and Computers:
- Create a group: Developer Group
- Add it to parent group: Remove Desktop Users
- Create a user: MyDomain\rdptest
- Assign user MyDomain\rdptest to “Developer Group”
Create Organization Unit:
- Create an Organization Unit under our domain calls “Test Computers”
- Assign a test VM to this newly created Organization Unit, this VM is a member of the "Domain Computers"
Create Group Policy Object via Group Policy Management:
- Create a GPO calls “Dev RDP Access” under the "Test Computer" organization unit.
- Edit this GPO so it has the following settings:
Link Group Policy Object:
- Link “Dev RDP Access” GPO to the Organization Unit “Test Computers”
- Enforce “Dev RDP Access” group policy on the Organization Unit “Test Computers”
- Assign the security group “Developer Group” to the Group Policy “Dev RDP Access”
Push the Active Directory policy update:
- I run the command from the DC machine to force the policy to be synced to the machine I want to test my RDP on: gpupate /force
- I also tried to run the PowerShell command gpupdate just to make sure: Invoke-Command -ComputerName TEST_PC -ScriptBlock {gpupdate /force}
After doing all that, I still can’t seem to RDP into the machine itself due to this error.
Do you see any issues in the steps I posted and if I missed anything? I research a bit more and some suggested:
"Members of the domain Remote Desktop Users group are not automatically members of the local Remote Desktop Users group on your RDS server. You need to add the domain Remote Desktop Users group to the local Remote Desktop Users group on the server."
Is this the step I am missing if so how to do it from Active Directory because if we have to go to each VM to do this then it defeat the purpose of central management which Active Directory tries to solve.
Edit: I think I did this step, pls see below image: