2

I have added a server srv09 to the "logOnWorkstations" for an active directory account adAccount1. It previously had 8 other server names in the field and the account can access them, but Remote desktop-ing into the new server fails with the following error

"The system administrator has limited the computers you can log on with. [..]"

This event shows up on the server as expected as a

4625 Error Event with

failure Reason: User not allowed to logon at this computer.
Status: 0xC000006e
sub status: 0xc0000070

So I check my ad setting and they look good.

get-aduser adAccount1 -properties * | select Logonworkstation 


LogonWorkstations
-----------------
srv01,srv02,srv03,srv04,srv05,srv06,srv07,srv08,srv09

I thought maybe DNS wasn't working properly and checked that nslookup srv09 resolved properly on both srv09 and the client computer attempting the remote desktop connection.

I don't know how to troubleshoot the issue further. The server is on a different Vlan then the other servers, so I tried a wireshark capture on srv09, but all I see is rds traffic between the client and server. Does anyone know the process of how the Logonworkstation attribute is processed during log in? Does the domain controller proved a list of approved computers to the client or the server?

Just to be clear my goal is to allow adAccount1 to access only the 9 identified servers and right now it can access all but one.

Improve this question
2
  • Try solutions from this discussion: [link]social.technet.microsoft.com/Forums/office/en-US/… 1. Use this setting: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Winstations\RDP-tcp "SecurityLayer", Default is 1 (SSL). -> Set this to 0. 2. On the client workstation, open the RDP file with Notepad and add the string enablecredsspsupport:i:0 3. Add the source server that the user is connecting to into the LogonTo field.
    – Vadim
    Oct 4, 2016 at 9:29
  • Create a GPO and add adAccount1 to Deny access to this computer from the network. Then apply that GPO to the other computers. Note the account will still be able to logon locally so consider also setting Deny log on locally in your GPO.
    – user2320464
    Oct 5, 2016 at 19:14

3 Answers 3

Reset to default
1
+50

I suspect you're trying to set up server admin group which cannot log into a workstation. One reason is defense against Pass-The-Hash, through Role Based Access groups.

The way to do this is put your admins in a group. Give that group access on the servers and explicitly deny access on workstations. Put this in GPO and you have it. Then when you get a new admin, you put their server admin account in one group and it has all the access it needs, and is prevented from accessing non-allowed hosts. GPO enforces all of it.

To clarify, your GPO puts the server admin group into the Remote Desktop Group on the local machines where login is allowed. And it puts them in the local login denied group on all other machines. This GPO (or a separate one) also gives the local system Remote Desktop Group (built in on Server) the permissions to use Remote Desktop.

Improve this answer
1

If all you want to do is limit who can RDP in to a computer, that particular method is pretty terrible. You should instead create an AD group with that user in it, and add that group to the Remote Desktop Users group on the servers in question.

Improve this answer
4
  • That is required to enable access (and is implemented). It would not prevent the account from being used on other computers.
    – Eric
    Sep 29, 2016 at 17:35
  • It would if you removed the user from the Domain Users group and added the new group to the Users group on the servers.
    – longneck
    Sep 29, 2016 at 18:03
  • I tried out your recommendation and the account was not restricted. "NT AUTHORITY\Authenticate Users" is the the default Users group on Windows joined machines, so I think your suggestion would also require a domain wide group policy to restrict access.
    – Eric
    Sep 29, 2016 at 18:54
  • I agree with longneck - as a general best practice, and much more practical too - authorization should be done on resource instead of on accounts. Resource owners should set and watch their own permissions. Secondly, default settings is not to allow anyone to RDP except local admins. So I don't see why you have to do it from account property, wouldn't justifying membership of the "allow RDP group" achieve the same and easier (again server owner should self-manage this because they know who should have what permission on their server).
    – strongline
    Oct 5, 2016 at 14:13
1

You can try to save RDP file with connection settings and then edit it in notepad. Add this string 

enablecredsspsupport:i:0

This will disable CredSSP security provider usage for this connection.

The second solution you can try is to add the source workstation (from wich RDP connection is initiated) to the Logonworkstations list, but i think this is not the option in most cases.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.