0

I've recently started having a problem where users can no longer log into the RDS server. They get 'Access is denied'.

enter image description here

If I add them to Domain Admins, they are able to get on without issue. I've checked Local Security Policy > Local Policies > User Rights Assignments > All log on through Remote Desktop Services. It has the appropriate groups assigned. I even added Domain Users to include everyone, but the users still get the access denied unless they are in the domain admins group.

I've checked the event log and the only 2 events associated with the security log are 2 4634 events that say An account was logged off. One with Logon Type 3 and the other with Logon Type 10.

Any ideas as to what could be casuing the issue?

  • RDP service in trouble, I guess the symptom is there even if you restart the server ? If the restart does not solve the issue try with a user without any GPO applied to it, a local user in worst case – yagmoth555 May 31 '18 at 13:04
  • I think it has to be a permissions / authentication issue because it's happening to both the RDS servers in the domain. – FLAdmin May 31 '18 at 13:46
  • Make sure no gpo remove your right to logon, which is why I suggest to test out with a user without GPO. – yagmoth555 May 31 '18 at 14:17
  • "access denied" is too generic to troubleshoot as it could means so many things. If the affected server is fresh install, I would consider new build, reinstall and try again. You could also try resetting the affected account to "Local System", reset the RDS service to "Network Service and see if this fix the problem. – Sunny J. May 31 '18 at 14:27
  • Access Denied is very generic. I ran into this issue recently. In my case the server was not able to get in contact with the domain controller in order to authenticate users. I did an nslookup for the domain controller on the server and didn't get a response. After looking at my dns settings on the server. I saw that I was missing my DNS suffixes. After adding them in everything worked as intended. – Prescient Aug 6 at 20:55
1

Domain Admins always have remote desktop logon rights, but other users need to be granted this privilege explicitly. It sounds like your Domain Users may have been removed from the local permissions group.

Places to Check:

  • Ensure that Domain Users are added to the RDS server's "Remote Desktop Users" local security group.
  • Open Remote Desktop Session Host Configuration and check the properties for the RDP-Tcp connection. Make sure that nobody modified the security in this location. The security tab should still include "Remote Desktop Users" with 'User Access' and 'Guest Access' allowed.
  • Still on the RDP-Tcp Properties dialog, ensure that the security layer setting is "Negotiate" and the encryption level is "Client Compatible" unless you are required to set that higher.
  • Check a GPResult for the following:
    • Allow log on through Remote Desktop Services should be set to Administrators, Remote Desktop Users.
    • Deny log on through Remote Desktop Services should be set to Guests and ideally Local account, Guests.
    • Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Session Host > Connections > *Allow users to connect remotely by using Remote Desktop Services* should be set to either Not configured or Enabled.
  • I've checked and all the security settings are set as they should be and I still get the access denied error. – FLAdmin May 31 '18 at 14:15
  • There are no audit failure events in the Security event log? – SturdyErde May 31 '18 at 14:17
  • No, that's the odd thing. I get 2 log off events. They are identical except for that the logon types are different. One is type 3 the other is type 10. – FLAdmin May 31 '18 at 14:22
  • Interesting - those numbers do make sense. Logon type 3 is "Network Logon" and logon type 10 is "Remote Interactive" (RDS). But those are both success events, right? – SturdyErde May 31 '18 at 14:25
  • Here's a shot in the dark--any chance that somebody messed with the ACL on the Users folder? If you're getting successful logoffs, maybe the access denied message is coming from a post-authentication process. – SturdyErde May 31 '18 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.