-1

I came into work last week, checked my first ticket (easy to fix one), RDP'd into the server needed for this and the login did not work. After clicking 'connect' I got the "Unable to Log You on Because of an Account Restriction" message. Checked another server (all machines are 2008R2/2012R2), the same message. No, I do not habe an empty password, not using network auth, my clint is Windows 10 (1607).

Here is what I did:

  • Used another client (Win10.1607), same ou, same setup. Can perfectly login from anywhere to anywhere (so I am asuming it's no my user account or a GPO)
  • Checked servers: I can RDP into all my DC's and a few other machines (2008R2/2012R2), looks random to me (all server in the same OU, no special software installed)
  • Deleted the mstsc cache (%appdata%..\local\Microsoft\Terminal Server Client* )
  • Cleaned up HCU\SOFTWARE\Microsoft\Terminal Server Client
  • Watched the eventlogs: nothing. Absolutely nothing. So I assume it's my client, not the servers. But I can RDP into all my servers at home and in another (customers) network ...
  • Checked date/time on client/server (0.0002ms apart)
  • Checked account restrictions on ma account (neither time nor machine restrictions are present)
  • Checked if logon at the console works (vm/ilo): works perfectly fine with my credentials
  • Checked if Share-Access would work (\\server\share): Does not work, I am seeing the same error message. Works from clientB, but not from alientA.
  • When doing the same thing from one of the 'working' machines (sever or client), everything is fine.

Any Ideas where to look for this? It is haunting me into my sleep :-(

Updates: Surely I checked the local policies on the server(s). any changes would have surprised me - there are a lot of servers. Also checked the clients GPO, nothing.

16
  • Try logging on with a different account.
    – Greg Askew
    Sep 27, 2016 at 11:45
  • First, a good sleep is required for solving stuff... Anyway, maybe there's a local GPO that blocks it (allow\deny remote\network access under security settings). Can you post results of 'gpresult /h gpresoprt.html'?
    – EliadTech
    Sep 27, 2016 at 11:47
  • @GregAskew: does not work either (eg 'administrator', the default and first domain admin). Not from this client. Works from other clients/servers.
    – bjoster
    Sep 27, 2016 at 12:27
  • @EliadTech: my client is not member of the domain, so my report is rather short. The gpresult of the server(s) are somewhat larger, but due to the intimate details I am not allowed to post it completely. I checked the resultset before (using rsop.msc) and found nothing (no User/Group restrictions). Do you have any special places I should have look at?
    – bjoster
    Sep 27, 2016 at 12:31
  • You can RDP to and from servers and desktops that belong to the domain. You cannot RDP from this PC1 that is in workgroup mode. Is there a different PC2 that is also in workgroup that you can try to RDP from?
    – Clayton
    Sep 27, 2016 at 13:16

1 Answer 1

0

The solution in my case was the option "Restrict delegation of Credentials to remote Servers".

Basically, there is a new Group policy settings that can prevent a system to pass credentials to a remote server. This was exactly the issue. you can find this setting in your lokal oder domain group policy under:

Computer Configuration > Administrative Templates > System > Credential Delegation 

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .