Solved

Group "Remote Desktop Users" can´t connect to W2k8 Terminal Server

Posted on 2009-03-29
4
4,516 Views
Last Modified: 2013-11-21
Hello,

i hope you can help me. I have a W2k8 Std. Terminal Server. At the moment i have the problem that no user i add localy to the "Remote Desktop Users" Group can´t connct. With my admin account i have no problems to connect but if i want to log on with a domain user i recive the message "To log on this remote computer, you must be granted ......"

At active directory the checkbox "deny this user permission to log..." for this user are not active. I started the license diagnostic on this terminal server with the result that all is ok (status green). If i take a look at the eventlog i see the following:

################################################################

System - Event ID: 1004

The terminal server cannot issue a client license.  It was unable to issue the license due to a changed (mismatched) client license, insufficient memory, or an internal error. Further details for this problem may have been reported at the client's computer.

Security - Event ID: 4625

An account failed to log on.
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: testuser
Account Domain: TEST

Failure Reason: The user has not been granted the requested logon type at this machine.
Status: 0xc000015b
Sub Status: 0x0

################################################################

I have installed 20 User CALS. Both the TS server and the TS Lic server configured for User CALS.

After 2 days i have no more ideas. Did you have any idea how i can solve this problem.

Thanks
Chris
0
Comment
Question by:Quixtos
  • 2
  • 2
4 Comments
 
LVL 31

Accepted Solution

by:
Henrik Johansson earned 500 total points
ID: 24014013
The license problem: Is TS aware of the location of the TS licensing server? If TS licensing isn't located on DC, this nead to be configured by either using local Server Manager or using GPO
Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Licensing\Use the specified Terminal Services licensing server

The grant permission problem:
Check the policy setting includes the Remote Desktop Users and not only Administrators.
Computer Configuration\Policies\Security Settings\Local Policies\User Rights Assignment\Allow log on through Terminal Services
0
 

Author Comment

by:Quixtos
ID: 24014102
ok i see only the group "domain\domain admins" under Allow log on through Terminal Services. How can i add the local Remote Desktop Users Group?
0
 

Author Comment

by:Quixtos
ID: 24014179
I hate this Guy in my company how delete the "Remote Desktop Users" from this Policy!

TOMORROW IS D-DAY MY UNKOWN FRIEND. I WILL FIND YOU! ;o)

THANKS for the fast solution henjoh09!
0
 
LVL 31

Expert Comment

by:Henrik Johansson
ID: 24014200
Run RSOP.msc (Resultant Set Of Policies) to evaluate where the policy setting is propagated from.
After that, use Group Policy Management Console (GPMC) to set the policy setting by either edit the existing GPO or create a new GPO linked to an OU closer to the computer object.
0

Featured Post

The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question