I am running Windows Server 2003 domain and implementing the Remote Desktop Users group without any problems to manage who has access to remote into the Domain Controller.

I recently set up a virtual machine running Windows XP for users to remote into to work from home. Right now only domain administrators can log in. For other users, even those that are members of the Remote Desktop Users group, I get

"The local policy of this system does not permit you to logon interactively"

I know that I can get edit the local policy to add users but is there a way I can get it to use AD to allow logons based on the user group I already have?


It sounds like you've got a GPO linked in your domain that is altering the "Allow logon through Terminal Services" user right. A quick inspection of the "User Rights Assignment" settings under "Local Policies" under "Security Settings" in the "Windows Settings" node of "Computer Configuration" in a "Resultant Set of Policy" would confirm if this is the case.

Generally I don't recommend playing around with this user right for exactly the reasons you're seeing-- it "breaks" the default behavior of the "Remote Desktop Users" group.

Once you know if this is what's happening you can make an informed decision about changing the GPO to prevent what you're seeing from happening.

| improve this answer | |
  • Actually you can just look in the Local Security Policy under Administrative tools to see the associated right and it's current value. No need to run RSOP. If the setting is being configured by a GPO the icon will be different and the setting will be unavailable for making a direct change to it. – joeqwerty Aug 10 '11 at 22:58
  • @joeqwerty: True dat, but RSoP will let you see which GPO is forcing down the change. In this case I figured that would probably be nice so that the OP could track down why that GPO was applying to client computers en masse. – Evan Anderson Aug 10 '11 at 22:59
  • True enough. I didn't think of that. That's why you're on the top of the leader board and I'm not. :) – joeqwerty Aug 10 '11 at 23:06
  • Hm. It's undefined when I look through RSOP :\ I logged into the computer as local admin and it IS set by the domain, to allow Administrator and Remote Desktop Users to log in! The users I am testing with this are in the group. I tried manually adding one to the policy and then logging in again, and I get this slightly different error message: You do not have access to log in to this session. – brandon Aug 11 '11 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.