2

I am trying to allow members of a domain security group, GlobalRDP, to RDP into certain Windows 10 PCs. I granted the GlobalRDP group the "Allow log on through Remote Desktop Services" right and that policy has been successfully deployed to the target computers.

Despite this, whenever a member of the GlobalRDP group attempts to login via RDP, they receive the following error: "The connection was denied because the user account is not authorized for remote login". A similar access denied error appears in the RDP log "User is not granted access to this connection' in CUMRDPSecurityStreamCallback::AccessCheck at 5236 err=[0x80070005]".

What made things weirder is that I also removed the RDP right for Administrators and Remote Desktop Users groups that have this right by default and I was still able to RDP in as member of the local Remote Desktop Users group.

Finally, I changed my GPO to add the GlobalRDP group to the local Remote Desktop Users group of the target PCs, and RDP worked. Despite the fact that this local group still wasn't granted the RDP login right!

Here is the setting screen from a Windows 10 workstation:

Allow log on through Remote Desktop Services user right

To address fixes that were offered in similar threads:

  • The GPO is absolutely applied to the target computers. Looking at Local Security Policy -> Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> Allow log on through Remote Desktop Services shows only the GlobalRDP group and that the policy set via GPO. The group policy results wizard shows the same thing.

  • Deny log on through Remote Desktop Services is empty (default is empty)

It seems like no matter what I change, only the default groups are granted the RDP login right. Adding the domain global group to the local group on each PC works, but smells weird to me. What did I miss? Why can't I simply manage that privilege using a domain group?

  • I'm on 1809 and my RDP user is not an admin, just Domain User and GlobalRDP. – succulent_headcrab Mar 22 at 0:45
  • Having read the question more carefully, it now sounds to me as if it is working as designed: the GlobalRDP group has the Log on through Remote Desktop Services right and is also a member of Remote Desktop Users. So there's no reason members of GlobalRDP shouldn't be able to log in. – Harry Johnston Mar 22 at 2:16
  • @HarryJohnston yup, that sounds correct. It seems as if there are 2 different mechanisms at work as noted in your answer. One is obvious and the other is frustratingly opaque. – succulent_headcrab Mar 22 at 2:26
3

Permission to establish a remote desktop session and permission to log in when using a remote desktop session are two different things. The user rights assignment settings only affect the latter.

Microsoft do provide documentation on changing the permissions that control who can establish a remote desktop session:

However, I strongly recommend that you don't mess with these settings. As Todd's answer already mentioned, adding domain users and/or groups to the Remote Desktop Users local group is the supported method for granting remote desktop access.

(Incidentally, you also need the "Access this computer from the network" right in order to establish a connection.)

  • I think this is the right answer since the WMI and the registry example in the linked articles indirectly answer the "why" that was my real question. Maybe it would be helpful if oyu edit your answer to mention the Win32_TSPermissionsSetting class and registry locations that hold the actual RDP connection rights. Thanks very much for clearing that up. – succulent_headcrab Mar 22 at 18:40
3

According to the Microsoft documentation:

To use Remote Desktop Services to successfully log on to a remote device, the user or group must be a member of the Remote Desktop Users or Administrators group and [emphasis added] be granted the Allow log on through Remote Desktop Services right.

Since the Remote Desktop Users group is granted the Allow log on through Remote Desktop Services right, adding a user or group to that group fulfills both requirements, while simply granting the right does not.

As to why both are required, I don't know.

Note that the same page specifies that the recommended best practice is:

To control who can open a Remote Desktop Services connection and log on to the device, add users to or remove users from the Remote Desktop Users group.

  • This is something that many people miss. Two conditions must be met in order to log in remotely. – joeqwerty Mar 21 at 21:38
  • You can read the links in Harry Jonhston's answer to see the why. The login right is assigned in GP while the RD connection right is managed by the Win32_TSPermissionsSetting WMI class which exposes methods to either add an account or restore the defaults (ie "Administrators" and "Remote Desktop Users") – succulent_headcrab Mar 22 at 18:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.