Solved

Can't add domain security groups to local groups on Server 2003 R2

Posted on 2014-09-22
5
228 Views
Last Modified: 2014-09-22
Hello everyone, I'm in the process of phasing out some of our older Server 2003 and 2003 R2 machines and after demoting one of them ( was a DC) I found that users could no longer log on remotely to that server using terminal services. Additionally I began having permissions problems with workgroup clients accessing printers etc. on that server. Only way to connect was to enter username in the form of domain\username where that wasn't required before.

After poking around I found that the local security group "Remote Desktop Users" on that TS was empty. I tried to add the "domain\Remote Desktop Users" group to the local group, but for some reason any search of the domain for any group would yield no results. I can add specific domain users to that local group and they can then sign onto TS as expected, but I can't seem to add any domain group to any local group.

Any thoughts? Thanks in advance
0
Comment
Question by:jostafew
  • 2
  • 2
5 Comments
 
LVL 29

Accepted Solution

by:
becraig earned 500 total points
ID: 40337354
The suggested path for this, would be creating a domain group for all your user (not a "Built-in" group)

Then simply add that group to the local RDP group on the server in question.

e.g..  
Create new group in AD "NewRDPUsers"
Add all the required users to the group
Then add that group to the local RDP user group on the server.
0
 
LVL 16

Expert Comment

by:ThinkPaper
ID: 40337620
What type of group is "domain\Remote Desktop Users"? Is it a Global or Universal? Change it to global and see if it allows you to add to the builtin group. But as becraig mentioned, best practice would be to assign rights to your custom RDP group versus using the default built-in local group.
0
 
LVL 3

Author Closing Comment

by:jostafew
ID: 40337660
Thanks becraig, your solution did the job.
0
 
LVL 3

Author Comment

by:jostafew
ID: 40337666
ThinkPaper, the domain\Remote Desktop Users is a Built In group, can't seem to change it to Global or Universal.

Still a little puzzled as to what changed though; no GP changes, no user group changes or anything along those lines, simply demoted the server and then RDS broke. When I have a moment I think I'm going to turn up a 2k3 VM and make it a member server, then see if this is the default behaviour on a new system or whether something broke after the demotion. Thanks to both of you.
0
 
LVL 16

Expert Comment

by:ThinkPaper
ID: 40337705
You won't be able to change the type for builtin groups.. but you can modify the type for the DOMAIN/RDPgroup
0

Featured Post

Free eBook: Backup on AWS

Everything you need to know about backup and disaster recovery with AWS, for FREE!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This article explains the steps required to use the default Photos screensaver to display branding/corporate images
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question