I have added a server
srv09 to the "logOnWorkstations" for an active directory account
adAccount1. It previously had 8 other server names in the field and the account can access them, but Remote desktop-ing into the new server fails with the following error
"The system administrator has limited the computers you can log on with. [..]"
This event shows up on the server as expected as a
4625 Error Event with
failure Reason: User not allowed to logon at this computer. Status: 0xC000006e sub status: 0xc0000070
So I check my ad setting and they look good.
get-aduser adAccount1 -properties * | select Logonworkstation LogonWorkstations ----------------- srv01,srv02,srv03,srv04,srv05,srv06,srv07,srv08,srv09
I thought maybe DNS wasn't working properly and checked that
resolved properly on both
srv09 and the client computer attempting the remote desktop connection.
I don't know how to troubleshoot the issue further. The server is on a different Vlan then the other servers, so I tried a wireshark capture on
srv09, but all I see is rds traffic between the client and server. Does anyone know the process of how the Logonworkstation attribute is processed during log in? Does the domain controller proved a list of approved computers to the client or the server?
Just to be clear my goal is to allow adAccount1 to access only the 9 identified servers and right now it can access all but one.