Solved

Group "Remote Desktop Users" can´t connect to W2k8 Terminal Server

Posted on 2009-03-29
4
4,505 Views
Last Modified: 2013-11-21
Hello,

i hope you can help me. I have a W2k8 Std. Terminal Server. At the moment i have the problem that no user i add localy to the "Remote Desktop Users" Group can´t connct. With my admin account i have no problems to connect but if i want to log on with a domain user i recive the message "To log on this remote computer, you must be granted ......"

At active directory the checkbox "deny this user permission to log..." for this user are not active. I started the license diagnostic on this terminal server with the result that all is ok (status green). If i take a look at the eventlog i see the following:

################################################################

System - Event ID: 1004

The terminal server cannot issue a client license.  It was unable to issue the license due to a changed (mismatched) client license, insufficient memory, or an internal error. Further details for this problem may have been reported at the client's computer.

Security - Event ID: 4625

An account failed to log on.
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: testuser
Account Domain: TEST

Failure Reason: The user has not been granted the requested logon type at this machine.
Status: 0xc000015b
Sub Status: 0x0

################################################################

I have installed 20 User CALS. Both the TS server and the TS Lic server configured for User CALS.

After 2 days i have no more ideas. Did you have any idea how i can solve this problem.

Thanks
Chris
0
Comment
Question by:Quixtos
  • 2
  • 2
4 Comments
 
LVL 31

Accepted Solution

by:
Henrik Johansson earned 500 total points
ID: 24014013
The license problem: Is TS aware of the location of the TS licensing server? If TS licensing isn't located on DC, this nead to be configured by either using local Server Manager or using GPO
Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Licensing\Use the specified Terminal Services licensing server

The grant permission problem:
Check the policy setting includes the Remote Desktop Users and not only Administrators.
Computer Configuration\Policies\Security Settings\Local Policies\User Rights Assignment\Allow log on through Terminal Services
0
 

Author Comment

by:Quixtos
ID: 24014102
ok i see only the group "domain\domain admins" under Allow log on through Terminal Services. How can i add the local Remote Desktop Users Group?
0
 

Author Comment

by:Quixtos
ID: 24014179
I hate this Guy in my company how delete the "Remote Desktop Users" from this Policy!

TOMORROW IS D-DAY MY UNKOWN FRIEND. I WILL FIND YOU! ;o)

THANKS for the fast solution henjoh09!
0
 
LVL 31

Expert Comment

by:Henrik Johansson
ID: 24014200
Run RSOP.msc (Resultant Set Of Policies) to evaluate where the policy setting is propagated from.
After that, use Group Policy Management Console (GPMC) to set the policy setting by either edit the existing GPO or create a new GPO linked to an OU closer to the computer object.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

We recently had an issue where out of nowhere, end users started indicating that their logins to our terminal server were just showing a "blank screen." After checking the usual suspects -- profiles, shell=explorer.exe in the registry, userinit.exe,…
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now