1

I have 50+ users whom I want to give remote desktop access to multiple VM machines. Instead of adding each individual user to "Remote desktop users" I created a AD security group & added all the users in that group. Now I added that security group as an administrator as well as "Remote desktop users" groups on the VM.

Now when I am trying to do remote login to the VM with one of the users (say user1 ) then I get the error "The connection was denied because the user account is not authorized for remote login." Please note I have not explicitly added the user1 as administrator and "Remote Desktop User" group.

I have following questions 1. Can't security group be used to give remote desktop to multiple users? 2. What is the above error all about? Do I need to make any other settings to give remote desktop access? 3. I do not want to give remote desktop access to each individual user, if I can not do it by security group then how else I can do it? what is the right way?

Atul Sureka

Improve this question
7
  • Did you reboot the VM's? The changes you made to the groups won't take effect until a reboot.
    – joeqwerty
    Mar 6, 2015 at 15:30
  • Already tried rebooting but did not work.
    – Atul Sureka
    Mar 6, 2015 at 16:00
  • So your AD group is a member of the local Remote Desktop Users group? Has each user logged out and logged back in so that the new AD security group membership is reflected in their security token?
    – joeqwerty
    Mar 6, 2015 at 16:07
  • Yes AD group is member of "Administrators" and "Remote Login User" group. No they can not login/logout becase Remote desktop is not working for them.
    – Atul Sureka
    Mar 6, 2015 at 16:14
  • 1
    There's no such group as Remote Login User, it's Remote Desktop Users. I mean that they need to log out of and back into their workstations. Their security tokens will then contain the new group membership and when presented to the VM (when they connect to the VM) they should be able to log in. As of now, if their security token doesn't contain the new group membership then the VM will refuse their login attempt.
    – joeqwerty
    Mar 6, 2015 at 16:19

2 Answers 2

Reset to default
2

What you're doing should work. I have a few suggestions for debugging:

  1. Confirm that the VM is getting group policy properly.
  2. Confirm that Computer Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> Allow log on through Remote Desktop Services is undefined or allows logins.
  3. Confirm that the group is, in fact, a member of Remote Desktop Users. (You can force this through Group Policy with Computer Policies -> Windows Settings -> Security Settings -> Restricted Groups and restricting Remote Desktop Users to your group--but only if no VM should have someone other than your group in it. This setting will not only kick people and groups out but will also add people and groups if they're not already there.)
  4. Confirm that Remote Desktop Services is running as an account that has the right to look up groups in AD. (The default account should.)

I hope that helps.

Improve this answer
1
  • Thanks a lot for ur response, I checked all these things mentioned above. All of them are in place, it did not work.
    – Atul Sureka
    Mar 9, 2015 at 5:18
1

In addition to Katherine Villyard's suggestions, ensure the user accounts in question do not have Logon Workstations restrictions under account properties > Account tab > Log On To... button.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .