1

When I add a new user to our on premise Active Directory, I want to assign that account to specific security group such as “Prod Group”, “Developer Group” or “Support Group”.

My goal is to control the user access to specific type of VM environments such that “Support Group” users can only access VMs I categorize as Support they can’t access any Production VMs.

I'm a developer by trait so I'm not very familiar with how to do this, I google many places such as this link to help me and here is what I've done so far:

Create user & group in Active Directory Users and Computers:

  1. Create a group: Developer Group
  2. Add it to parent group: Remove Desktop Users
  3. Create a user: MyDomain\rdptest
  4. Assign user MyDomain\rdptest to “Developer Group”

enter image description here enter image description here

Create Organization Unit:

  1. Create an Organization Unit under our domain calls “Test Computers”
  2. Assign a test VM to this newly created Organization Unit, this VM is a member of the "Domain Computers"

Create Group Policy Object via Group Policy Management:

  1. Create a GPO calls “Dev RDP Access” under the "Test Computer" organization unit.
  2. Edit this GPO so it has the following settings:

enter image description here

enter image description here

Link Group Policy Object:

  1. Link “Dev RDP Access” GPO to the Organization Unit “Test Computers”
  2. Enforce “Dev RDP Access” group policy on the Organization Unit “Test Computers”
  3. Assign the security group “Developer Group” to the Group Policy “Dev RDP Access”

enter image description here

Push the Active Directory policy update:

  1. I run the command from the DC machine to force the policy to be synced to the machine I want to test my RDP on: gpupate /force
  2. I also tried to run the PowerShell command gpupdate just to make sure: Invoke-Command -ComputerName TEST_PC -ScriptBlock {gpupdate /force}

enter image description here

After doing all that, I still can’t seem to RDP into the machine itself due to this error.

enter image description here

Do you see any issues in the steps I posted and if I missed anything? I research a bit more and some suggested:

"Members of the domain Remote Desktop Users group are not automatically members of the local Remote Desktop Users group on your RDS server. You need to add the domain Remote Desktop Users group to the local Remote Desktop Users group on the server."

Is this the step I am missing if so how to do it from Active Directory because if we have to go to each VM to do this then it defeat the purpose of central management which Active Directory tries to solve.

Edit: I think I did this step, pls see below image:

enter image description here

enter image description here

  • 2
    You can add the domain security group to the local Remote Desktop Users group by using Group Policy Preferences in a GPO linked to the domain or to a specific OU. – joeqwerty Apr 7 '20 at 16:16
  • Based on your suggestion, I "think" I already did this. I right click on "Dev RDP Access" and click Edit to bring up its Group Policy Management Editor. Under Computer Configuration > Policies > Windows Settings > Security Settings > Restricted Groups , I see my user group that I created which is MyDomain/Developer Group. – Fylix Apr 7 '20 at 16:32
0

Thanks to Joeqwerty suggestion I was able to get this to work, I would like to put it here so other can find it helpful down the road. This last step is not very clearly laid out on most of the tutorial or resource I came across while researching this issue.

So the idea is after you set everything up like I did, your domain group - mydomain\Develop Group still not really tie to the local machine.

You need to go to the GPO that govern the RDP and do the following:

  1. Assign that group to have at least the built in Remote Desktop User group or the built in administrator group because either one of this is required to RDP into any machine.
  2. Set the local policy of the VMs so they allow the "Developer Group" to access the VM from the network.

In #1, Expand to Computer Configuration > Policies > Windows Settings > Security Settings > Restricted Groups. Assign either built in local group Administrators or Remote Desktop Users.

In #2, Right click “Support RDP Access” and select Edit to bring up its Group Policy Management Editor. Expand to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment. You need to assign the "Developer Group" to two policies: Access this computer from the network & Allow log on through Remote Desktop Services

You should see this in your GPO settings when it completes:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.