1

I have :

  • An Active Directory with the domain name : domain.com on a machine A
  • An admin domain user named controller
  • A machine B running Windows 2008R2 joined to the AD

I want to connect to B through RDP as controller@domain.com but it doesn't work. I get the error : "The username and password didn't work ..." whereas if I connect directly in B with these credentials it works so I know the credentials are correct.
Also, if I try to connect to local users with RDP in B such the local admin, it works perfectly. The issue is only with domain users.

In order to solve the issue, I have :

  • Used different username format (controller@..., domain.com\controller)
  • Added the AD user controller to the Remote Desktop Users of the AD
  • Tried to add the AD user controller to the Local Remote Desktop Users group of the machine B but it doesn't accept it. I go to Remote settings, add user, find it and click on ok. It seems to work until I realize nothing appears in the Remote Desktop Users list. It says that the Administrator already has access. So it confuses the local administrator and the domain admin controller. I still can't connect after that obviously.

I'm really stuck at that point, any help would be great.

Thank you in advance

EDIT : I run the gpresult command (gpresult/Scope Computer) on the affected computer and here are the GPO settings applied :

GPO Security Options

Account Policies

So there is indeed a GPO applied (Default Domain Policy) but I don't think there is anything about remote access. Should disable this GPO on this computer and try again to add the domain user to the Local RD Users or should I use this GPO to add the remote access for the given domain user from the AD ?

  • Is this a lab environment? Quite unusual to see only that GPO applied to a computer in production. – Semicolon Apr 19 '18 at 21:45
  • Yes it is a lab environment, indeed – KB303 Apr 19 '18 at 21:47
1

Tried to add the AD user controller to the Local Remote Desktop Users group of the machine B but it doesn't accept it. I go to Remote settings, add user, find it and click on ok. It seems to work until I realize nothing appears in the Remote Desktop Users list

If you were unable to add the user to the Local RD Users group (as in, options were greyed out and you were unable to add anybody), and you were unable to use the "remote settings" interface to add a user to the group. It is very likely that you may have a 'Restricted Groups' Group Policy in place that is preventing local modification of the local Remote Desktop Users group.

I would suggest reviewing the Resultant Set of Policy (gpresult [run as an admin]) on the affected computers to confirm his is a possible cause.


If this is the cause, you can allow your user to access the server via RDP by:

  • adding this user to the local group by modifying the current Restricted Groups GPO (if practical),
  • exempting this computer from the Restricted Groups GPO (if practical),
  • adjusting the "Allow log on through Remote Desktop Services" User Right - directly in the Local Security Policy or via a GPO.

The method you choose to choose depends greatly upon a number of factors in your environment, including the desired access of the account to any servers currently affected by the Group Policy. But really, the greatest factor is confirming whether or not a GPO is the reason you cannot add a user to the group locally.

  • Thank you for your reply I have added the GPO to my initial Post. Do you see anything that could explain what's happening ? – KB303 Apr 19 '18 at 21:22
0

On the Win2008R2 server: Right click Computer > Properties > Remote > Select User > Add > add controller user > ok .

After that the Controller user should be able to access the 2008R2 server using RDP.

  • I would contend that this is bad form, and not easily replicated over multiple computers -- moreover, the OP has already stated that this is not working. – Semicolon Apr 19 '18 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.