Interactive Logon not Allowed windows 2003 ADS

Posted on 2007-11-29
Medium Priority
Last Modified: 2013-12-04
Please read question carefully first !!!

1. I have a Domain Controller DC1 up and running
2. I created a user 'Aditya' in 'Manager' OU. (He is Member of Domain Users)
3. No GPO is applied on the OU Manager
4. One client PC1 is joined to domain.
5. I can normally logon to domain through PC1 using UID: Aditya (Physically sitting on the client PC1)
6. Now, I am on PC2 in the same network which is not joined to domain, Here I RDP to PC1 where I select UID: Aditya and enter password and Choose Domain DC1 (instead of 'PC1 this computer')
7. This time I can't logon it says "The local policy of this system does not permit you to logon interactively"
8. Then I changed such as Aditya = Member of Domain Administrators + Domain Users and then I can logon correctly using the same way described in step 6
9. I have also done these steps http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q247/9/89.ASP&NoWebContent=1#appliesto
and disabled Smartcard use for logon.
Where I am missing....
Question by:sunilcomputer
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 21

Accepted Solution

from_exp earned 400 total points
ID: 20373358
it looks like you should configure pc1 remote access to allow domain user Aditya logon via remote desktop
properties of my computer - remote - select remote users
LVL 30

Expert Comment

ID: 20373366
So you have a user ID that can log onto the workstation when sitting in front of the console, but not when attempting to RDP, correct?  Confirm that the user in question is a member of the Remote Desktop Users group on the PC or been granted equivalend rights, as discussed here: http://support.microsoft.com/kb/289289

Assisted Solution

balmasri earned 200 total points
ID: 20373459
check the following:
Aditya is added to users allowed to use remote desktop on the remote tab
add Aditya to the Local Group on PC1 Remote desktop users
Check the group policy object which linked to the OU where PC1 is resides on and add the account Aditya to the following items [ it's better to add remote desktop users group ]:
allow logon through terminal services.
allow logon locally.
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.


Author Comment

ID: 20373506
The user Aditya is a user on the domain DC1 not on PC1 and hence can't be added to RDP users on PC1 and there is also no group exists "Domain Users" on PC1. In your situation shall I need to add all of my hundreds of users to all the systems joined to domain.
Another thing while on the when domain I set Aditya = Domain Administrator it lets me log in perfectly through PC1 using RDP.

1. I have full Admin Rights on the Workstation PC1 and can easily RDP PC1(Local Machine) as well
2. I have a domain user Aditya which can logon to DC1 sitting physically on the workstation PC1
3. But when the user Aditya sits on another system PC2 (which is not joined to domain) he RDP to PC1 using following credentials:
Username: Aditya
Password: 141741x
Domain: DC1
then the message comes up.
LVL 21

Expert Comment

ID: 20373613
if PC1 is a member of a domain, you CAN add domain userAditya  to local remote desktop users group.

Assisted Solution

dbarker2 earned 200 total points
ID: 20374178
You must on PC1 either add Aditya to the Remote desktop user group or the Local Administrator group.

Author Comment

ID: 20380962
I added Aditya to RDP Users on DC1
Then it started allowing Aditya to logon to DC1. Working scenario is following:
Aditya is sitting on PC2
He RDP to PC1 using Followinf Credentials:
Username: Aditya
Password: 141741x
Domain: DC1
Now another error message comes up that ......you are not allowed to logon to this session.
Another problem this way is once the user Aditya is a member of RDP Users on the domain he can directly RDP to DC1 without using PC1.

My Requirement is:
I need to logon Aditya on PC1 using his domain account (Physically sitting on PC1).
I need to logon Aditya on PC1 using his domain account (Physically sitting on PC2) where all the GPOs will be applied on the PC1\Aditya. (As I use do using VNC applications)
The user Aditya may be out of Network on a wan link. Aditya has the admin password of PC1
Router is properly configured & he can RDP to PC1 with no probs.
Aditya should never be able to RDP to DC1 directly he should only be able to logon to PC1.

LVL 21

Expert Comment

ID: 20381056
you should add user Aditya  to the local remote desktop users group on PC1, not on the DC

Author Comment

ID: 20381097
Domain users are not listed in PC1 to be added in RDP Users.
LVL 21

Expert Comment

ID: 20381162
start-control panel-administrative tools- computer management-local users and groups-groups-remote desktop users-add-advanced-find now.
you'll get the list of ALL users and groups available in the domain
you should be logged in to the pc1 with administrative rights to do that

Author Closing Comment

ID: 31411649
I discovered It was a DNS Issue. Finally I added the user to RDP group in PC1 and it worked.
Thanks you all.

Featured Post

Get real performance insights from real users

Key features:
- Total Pages Views and Load times
- Top Pages Viewed and Load Times
- Real Time Site Page Build Performance
- Users’ Browser and Platform Performance
- Geographic User Breakdown
- And more

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses
Course of the Month9 days, 20 hours left to enroll

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question