Running a Windows server 2003 Active Directory running in 2000 functional level.
Comprised of 3 DC's, all W2K3
The problem I am having is this:
I have a W2K3 R2 SP2 member server that is being used as an RDP application server.
I need to use an AD group to give local RDP login rights onto the member server, and restrict the users to only have RDP rights to that particular server. The users are also required to run in a pre-defined environment running one application.
In the past (different server) this has worked with local accounts inside the remote desktop users group, and assigning the environment details inside the RPD profile settings.
I have tried the following steps to try and make this work, but to no avail.
* Added AD group into the Member servers "Remote desktop users group"
* Created an OU and moved the RDP member Server into it.
* Created a Domain Local Security group containing the necessary Domain Global security group in the new OU
* Created a GPO to allow the log on through through terminal service right, and applied to this OU
GPO contains: windows settings-> Security Settings-> Local Policies -> User Rights Assignment -> Policy= "Allow log on through Terminal Services": Policy settings= "My Domain Local Security group containing the Domain Global security group "
This is from the Member server application log:
"Security policy in the Group policy objects has been applied successfully."
Unfortunelty I am still getting the error message:
" To log on to this remote computer, you must be granted the Allow lon on through Terminal Services right. By default, members of the Remote Destop Users group have this right. If you are not a member of the Remote Desktop Users group or another group that has this right, or if the Remote Desktop User group does not have ths right, you must be granted this right manually. "
It also seems that I can't RDP to the server as Domain\domain admin, or Local admin same result
Security Event log from the memeber server shows:
Logon Failure:
Reason: The user has not been granted the requested
logon type at this machine
User Name: Username
Domain: Domain-Name
Logon Type: 10
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: HOSTNAME
Caller User Name: HOSTNAME$
Caller Domain: Domain
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 3808
Transited Services: -
Source Network Address: xxx.xxx.xxx.xxx
Source Port: 2010
Other Variables:
The Member server is running on VMware ESX 3.5
Member server firewall is turned off
Remote desktop is enabled on this member server
Start Free Trial
