I am a learner in AD and GPO's. Though I have implemented some GPO's in my environment, now a little bit confused.. My confusion is with the overriding of GPO. Basically what I am trying is that I need to enable RDP for a user to a specific server, which is not a DC. Here's my scenario:
We have a domain wide GP applied in the environment. For enabling a user for RDP, I have added him to "Allow log on through terminal services" GP. Now assume the two situations mentioned below:
I have added him to Remote desktop users group in AD. After updating the group policy, I have checked login with his credentials. But can't login, error is "the requested session access is denied".
I have removed him from the remote desktop users group of AD. And this time added him to the Remote Desktop Users group of local users and group (lusrmgr.msc) of that server. This time checking login with his credentials was successful.
I have checked the following command in that specific server and it shows that the domain wide policy is being applied in RDP setting.
gpresult /Scope Computer /v
I am a bit confused how the policy is overriden. I believe local group policy is overriden by default with domain wide policy, if domain wide policy is enabled. This shows I am wrong. Can someone please clarify this?
FYI, my DC server is Windows 2003 R2 and other servers are 2008R2.