?
Solved

Can't add domain security groups to local groups on Server 2003 R2

Posted on 2014-09-22
5
Medium Priority
?
238 Views
Last Modified: 2014-09-22
Hello everyone, I'm in the process of phasing out some of our older Server 2003 and 2003 R2 machines and after demoting one of them ( was a DC) I found that users could no longer log on remotely to that server using terminal services. Additionally I began having permissions problems with workgroup clients accessing printers etc. on that server. Only way to connect was to enter username in the form of domain\username where that wasn't required before.

After poking around I found that the local security group "Remote Desktop Users" on that TS was empty. I tried to add the "domain\Remote Desktop Users" group to the local group, but for some reason any search of the domain for any group would yield no results. I can add specific domain users to that local group and they can then sign onto TS as expected, but I can't seem to add any domain group to any local group.

Any thoughts? Thanks in advance
0
Comment
Question by:jostafew
  • 2
  • 2
5 Comments
 
LVL 29

Accepted Solution

by:
becraig earned 2000 total points
ID: 40337354
The suggested path for this, would be creating a domain group for all your user (not a "Built-in" group)

Then simply add that group to the local RDP group on the server in question.

e.g..  
Create new group in AD "NewRDPUsers"
Add all the required users to the group
Then add that group to the local RDP user group on the server.
0
 
LVL 16

Expert Comment

by:ThinkPaper
ID: 40337620
What type of group is "domain\Remote Desktop Users"? Is it a Global or Universal? Change it to global and see if it allows you to add to the builtin group. But as becraig mentioned, best practice would be to assign rights to your custom RDP group versus using the default built-in local group.
0
 
LVL 3

Author Closing Comment

by:jostafew
ID: 40337660
Thanks becraig, your solution did the job.
0
 
LVL 3

Author Comment

by:jostafew
ID: 40337666
ThinkPaper, the domain\Remote Desktop Users is a Built In group, can't seem to change it to Global or Universal.

Still a little puzzled as to what changed though; no GP changes, no user group changes or anything along those lines, simply demoted the server and then RDS broke. When I have a moment I think I'm going to turn up a 2k3 VM and make it a member server, then see if this is the default behaviour on a new system or whether something broke after the demotion. Thanks to both of you.
0
 
LVL 16

Expert Comment

by:ThinkPaper
ID: 40337705
You won't be able to change the type for builtin groups.. but you can modify the type for the DOMAIN/RDPgroup
0

Featured Post

NEW Veeam Backup for Microsoft Office 365 1.5

With Office 365, it’s your data and your responsibility to protect it. NEW Veeam Backup for Microsoft Office 365 eliminates the risk of losing access to your Office 365 data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
The article explains the process to deploy a Self-Service password reset portal I developed a few years ago. Hopefully, it will prove useful to someone.  Any comments, bug reports etc. are welcome...
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

579 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question