Previously, we had a server running Windows Small Business Server 4.5 (NT4.0 based domain). We setup a new Windows 2000 server as a member of the domain to act as a terminal server and remote access VPN point. Everything worked fine.
Last week, we removed the Small Business Server, and installed a new server running Windows Server 2003, with active directory. I reconfigured the Windows 2000 Terminal Server as an additional domain controller (and secondary DNS server). All of that seems to work, and I can log into the terminal server. No one else can though. Specifically, anyone who is a member of the "Administrators" group can log in. Users who aren't get told "The system can not log you on. Access is denied.", and an Application error message is logged from the WinLogon Service (Error ID:1219) "Login rejected for user <domain>/<username>. Unable to obtain Terminal Server User Configuration. Error: Access is denied".
All computers are fully patched and up to date.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Sorry, should have mentioned that. Yeah, we're in application mode (supporting 15 remote offices over an internet based PPTP VPN. Users are members of a group I called TerminalAccess, and the policy for the comptuer has been set to allow member of this group to log in both locally and through terminal services.
If the terminal server is also a Domain Controller, then you need to edit the "default domain controllers policy" in the domain controllers OU.
Go to Computer Configuration\windows settings\security settings\local policies\User Rights Assignment
then set the following to "defined":
"Allow log on through terminal services"
Add the group you have created, _and_ the administrators group.
If you then get an error message about not being allowed to login in locally, set the following to defined also:
"Allow login locally"
and again add the group you have created.
Cheers
Martin.
Had that, didn't help. The problem isn't the log-in; the user authenticates and gets authorized all right. The problem seems to bea profile issue. FOr some reason, the system is unable to get the users profile. If I attempt to log into the terminal server with the user on the local console, I get a message saying that the profile could not be loaded, and the same "access is denied" message.
FYI, I ended up reinstalling, and it works find now. I noticed that during the installation, there were some additional steps that the server took to register the Terminal Server Licensing Service in the Active Directory. I've concluded that the problem was the fact that the server was originally a member of an NT4 domain (which, for a W2K member server is almost the same as being in no domain at all), and installed/configured a version of the TS LIcensing Server that was unable to work properly in the new W2k3 domain. Or something like that.
Business Accounts
Answer for Membership
by: PeteLongPosted on 2004-07-05 at 10:05:00ID: 11474533
How to give NON administrators Terminal Service (Remote Administration)
This must be done on a server to server level, If you require a lot of users create a GROUP called TSRemoteUsers in active directory and add your users into the group, then carry out the steps below. Ill assume we are only dealing with a couple of users.
Ill also assume you have Terminal Services (Administration Mode) installed and running on the server, if not open control panel >add remove Programs >windows components >Terminal Services, When Prompted ENSURE "Remote Administration" is selected.
1. Using an admin account open a remote admin session to the server in question.
2. Click Start >Programs >Administrative Tools >Terminal Services Configuration
3. Click Connections
4. In the right hand pane RIGHT CLICK the RDP-TCP connector and select properties
5. On the permissions tab click "ADD"
6. Add your user/group in here and select the appropriate level of access.
If it aint working ensure you not in application mode (Unless you have to be!!)
Change Between Remote Administration and Application Server Mode
http://support.microsoft.c