1

I have a problem. I set GPO on the "Domain Controllers" OU with "Allow Logon through Terminal Services", where I set one user group. I wanted to assign RDP access to group of technicians. But after that, I lost RDP access to all DCs with accounts in the Administrators group and even with the Domain admin accounts. When I deleted this GPO, it's not how it used to be. I still can't log in with these accounts. I have to specify them in this GPO to get the access there. But it's not set like that with the default Domain Controllers Policy. How can I set it how it was? Thank you...

  • What is the scenario where you would want to allow a group of non-Domain Admin accounts RDP access to the Domain Controllers? – twconnell Dec 9 '17 at 12:01
1

User Rights settings remain even when the GPO that configured them no longer applies.

By default, Domain Controllers have the user right of "Allow log on through Remote Desktop Services" assigned to the Builtin Administrators group. What you did with your GPO was effectively remove the Builtin Administrators group from that user right and you replaced it with your technicians group. Removing or deleting the GPO will not "reset" this user rights assignment back to it's default setting.

There are two ways to fix this:

  1. Apply a Group Policy Object that sets this user right back to the Builtin Administrators group.

  2. Log on to every Domain Controller and set this user right back to it's default setting in local Group Policy (secpol.msc).

In the future, if you want to grant this user right to a group of technicians for the Domain Controllers either do it in local Group Policy on each Domain Controller or do it with domain based Group Policy but make sure to include the Builtin Administrators group in the policy in addition to your technicians group.

  • Oh, I forgot about local GPOs. Everything makes sense now. Thank you! – devlin Dec 11 '17 at 9:11

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.