I have a system composed with few windows servers 2003 R2, one is built as the domain controller another one as a web server. I tried to remotely log on the domain controller with a wyse thin client (linux v6) using rdp. On the domain controller, I already allowed the remote desktop, enter the Domain Admin group, which an admin user is part of it, as a member of the Remote Desktop Group Users and also grant the “Remote Desktop Group Users” the right “allow to remotely log on by terminal services” at the locally level (Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment) as well as under the Domain-Controller group policy -> Computer Configuration,->Administrative Templates, ->Windows Components->Terminal Services, “enabled” Allow users to connect remotely using Terminal Services setting. The Terminal Service is up when system is on.

In the wyse side, I used the rdp add-on to connect with server address of domain controller and login with the admin username and password, however without domain name. when log on by admin user , I got

To log on to this remote computer, you must be granted the Allow log on through Terminal Services right. By default, members of the Remote Desktop Users group have this right. If you are not a member of the Remote Desktop Users group or another group that has this right, or if the Remote Desktop Users group does not have this right, you must be granted the right manually.

I also increase the number limit to connect more than 4 in group policy setting.

So I exhausted all reasons why my wyse failed to log. On the hand, my wyse used the same rdp add-on to log on the web server without any error (with same setting of local polices\user Right)


If you are unable to use terminal services to log on to a domain controller, it may be because in the Domain Controller Security Policy> Security Settings> Local Policies> User Rights Assignments> Deny Log on Through Terminal Services had been previously set to the Everyone Group (or some group you are having problems with). Even if you were to set this to "Not Defined" and ran gpupdate /force, the Domain Controller somehow retains the previous setting. In order to clear the previous setting you will need to set the Deny Log on Through Terminal Services to something like "Guests" and run gpupdate /force.

  • Tried to define "Guests" group in the "Deny Log on.. TS" policy, still not working. I also make sure that policy of Default Domain-Controller Security Policy has the same setting as well as the Domain Security group policy. – chi330 chang Jul 31 '14 at 14:56
  • It turns out an easy fix. What happened was that the original built (some adminisitrator) site specific DC group policy was never "Linked Enabled" even the GPO status is "Enabled", so the GP was not in places. By accident, I used the gpedit.msc to open the local policy and removed "everyone" from the "Deny to log on through TS" policy, I could log on, then I checked the "gpresult" to discover the GP was a N/A status. As long as I "Linked Enabled" and gupupdate /Force, all my GPO now are applied and I can log on as defined. – chi330 chang Jul 31 '14 at 18:53
  • On the other hand, I could not "Link enabled" the Domain Security gp, it broken the RDP between WTC to domain member (my IIS server). It also cut the access of the IE to use the IIS from any domain member, including DC. – chi330 chang Aug 4 '14 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.