I've got several Windows servers, all with the remote desktop session host role installed, and all normal domain users have starting getting "access is denied" messages when logging in. I've had to give normal users local administrative rights in order for them log in, but for lots of reason this is temporary and I cannot leave all users having local admin rights. Removing the session host role does fix the problem, but these servers are in an RDS farm and need the role installed.
I've checked just about everything I can think of - there were some minor GPO changes the day this started and I've gone through all the GPOs looking for anything obvious. I've removed those GPOs from the relevant OUs, and have added fresh servers, but the problem still occurs. Anyone ever seen this sort of problem with remote desktop session hosts?