Link to home
Start Free TrialLog in
Avatar of nammari
nammari

asked on

Remote Desktop does not work on the domain controller

I just installed a new domain controller (the first one in the forest), and still in the phase to setup all OUs, users and GPs. The server is Windows 2003 x64 Standard edition.

Now, for some reason I cannot Terminal Service/Remote Desktop the domain controller (only this machine, the rest of the servers I can access as usual). I am using the Administrator account, and the administrator is listed in the GP that deals with Terminal Service, also the terminal service is enabled. when I try to login using the Administrator username and password it gives me the following error message:

"To log on this remote computer, you must be granted the Allow log on through Terminal Services right.  By default, members of the Remote Desktop Users group have this right.  If you are not a member of the Remote Desktop Users group or another group that has this right, or if the Remote Desktop User Group does not have this right, you must be granted this right manually."


I tried everything, I removed all the policies and reinstall them again, trying different users with different groups.... etc
But no luck... Your help is much appreciated....

Rami
Avatar of Brian Pierce
Brian Pierce
Flag of United Kingdom of Great Britain and Northern Ireland image

I suspect that you have enabled the Termonal Services GPO in the default domain policy, not the domain controllers policy. Either configure the Domain Controllers policy for terminal services or  just check on the domain controller that remote desktop is enabled. On the DC, right click My Computer, select Properties and enable Remote Desktop in the Remote Tab.
Avatar of nammari
nammari

ASKER

Hi KCTS,

I already did that, the TS is enabled on that computer.. I can connect to the TS, it asks for the user name and password, but once I click Ok, then it give me that message.

I am really confused now since I changed the policy many times, and I am not sure which policy is now used (the local one or the AD one)!!!


Your help is much appreciated,
Rami
Avatar of nammari

ASKER

Any update guys?
On a domain controller the default setting for "Log on locally" in Local Security Settings does not include TSinternetUser group.  This is a security feature to protect the DC.
So, open Local Security Settings, Local Policies, User Rights Assignment, Log on locally, add the TSinternetUser group and/or the group to allow.
fs
Avatar of nammari

ASKER

I tried that but didn't help... Can you please send me the settings to configure the Remote Desktop connection on the DC?
Also, do you have a recommended Group Policy for Domain and Domain Controllers?

Thanks,
rami
ASKER CERTIFIED SOLUTION
Avatar of nammari
nammari

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of nammari

ASKER

The author has found and posted the solution to this problem, please close this question as solved by the author