I'm reluctant to ask this again, but the circumstances are a little different. The 2008 R2 is now a demoted domain member for my email server. It has the same GP applied as my other 2003 servers. I am still unable to connect via RDP. I can connect RDP to any server/workstation on the network. RDP is enabled, and an exception is on the firewall. In 2008's firewall exceptions, the policy shows as (Remote Desktop [TCP-In]) Allow, and there is a policy above it that just says (Remote Desktop) and says blocked. I am new to 2008 so Im sorry for the ignorance, but is this the problematic policy? And can this be resolved by my 2003 DC's GP, or is this addressed locally on 2008 somehow?

  • Is this server in the same OU as the other ones? – pablo Mar 2 '11 at 17:04
  • What network profiles are the firewall rules bound to and what network profile is the server using? – joeqwerty Mar 2 '11 at 17:04
  • @pablo: yes it is in the same OU as the other member servers. @joeqwerty: The TCP-In Allow policy is bound to All. But the Remote Desktop blocked policy is bound to Domain. It is running the Domain profile...The blocked firewall policy says it is set by Administrator and cannot be changed, though this shouldn't be the case... – Seth Mar 2 '11 at 17:09
  • That should be the answer then. Set the domain profile rule to allow. – joeqwerty Mar 2 '11 at 17:11
  • cannot change, see edit above – Seth Mar 2 '11 at 17:11

IF it's not GPO and firewall rule issues, it may be a bug in Windows 2003 that I've seen on at least 4 servers over the last 2 years that causes RDP connections to be reset on connection. Sometimes booted off RDP or acted like unable to connect. Other times it'll connect but only a black screen that never gets to logon. I guess I'm saying I've seen several different causes create the same result on Server 2003 RDP. Here's things to try

Registry key was missing in the terminal services config. this hotfix should add it back. http://support.microsoft.com/kb/822664

Another solution is to log in locally and start terminal services configuration. in the RDP-tcp connection, goto properties and network adapter tab, and change from all to the internal (blue) NIC, which you may have to goto network connections to figure out which is which. the change is immediate. http://support.microsoft.com/kb/555382

Also there is a bug with some server video drivers that cause this after a Security Update in the last 2 years that requires a regedit and/or updated drivers. Google is your friend.


Use a GPO to set the relevant firewall rules (i.e. allow Remote Desktop while in domain). Remember, 2k8 R2 firewall rules are configured under "computer/windows parameters/security parameters/windows advanced firewall" (got a french locale here but this should be approaching). You should also use a WMI filter with this GPO to target only 2008 R2 servers.

This should overwrite any existing misconfiguration on your server.

  • there is no "Windows Advanced Firewall" in 2003 GP – Seth Mar 2 '11 at 18:58
  • use a Windows 7/2008 R2 GPMC – Renik Mar 2 '11 at 19:34
  • the target server is 2008 r2, but is not a controller... still possible? GPO controlled by 2003 – Seth Mar 3 '11 at 15:53

ADMX GP files are not compatible with Server 2003 ADM files. Managing a 2008 server with 2003 does not work properly as the settings necessary to manage 2008 firewall settings are not available. If 2008 firewall is enabled via 2003 GP, it will disable RDP by default for DOMAIN settings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.