Solved

Can't add domain security groups to local groups on Server 2003 R2

Posted on 2014-09-22
5
230 Views
Last Modified: 2014-09-22
Hello everyone, I'm in the process of phasing out some of our older Server 2003 and 2003 R2 machines and after demoting one of them ( was a DC) I found that users could no longer log on remotely to that server using terminal services. Additionally I began having permissions problems with workgroup clients accessing printers etc. on that server. Only way to connect was to enter username in the form of domain\username where that wasn't required before.

After poking around I found that the local security group "Remote Desktop Users" on that TS was empty. I tried to add the "domain\Remote Desktop Users" group to the local group, but for some reason any search of the domain for any group would yield no results. I can add specific domain users to that local group and they can then sign onto TS as expected, but I can't seem to add any domain group to any local group.

Any thoughts? Thanks in advance
0
Comment
Question by:jostafew
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 29

Accepted Solution

by:
becraig earned 500 total points
ID: 40337354
The suggested path for this, would be creating a domain group for all your user (not a "Built-in" group)

Then simply add that group to the local RDP group on the server in question.

e.g..  
Create new group in AD "NewRDPUsers"
Add all the required users to the group
Then add that group to the local RDP user group on the server.
0
 
LVL 16

Expert Comment

by:ThinkPaper
ID: 40337620
What type of group is "domain\Remote Desktop Users"? Is it a Global or Universal? Change it to global and see if it allows you to add to the builtin group. But as becraig mentioned, best practice would be to assign rights to your custom RDP group versus using the default built-in local group.
0
 
LVL 3

Author Closing Comment

by:jostafew
ID: 40337660
Thanks becraig, your solution did the job.
0
 
LVL 3

Author Comment

by:jostafew
ID: 40337666
ThinkPaper, the domain\Remote Desktop Users is a Built In group, can't seem to change it to Global or Universal.

Still a little puzzled as to what changed though; no GP changes, no user group changes or anything along those lines, simply demoted the server and then RDS broke. When I have a moment I think I'm going to turn up a 2k3 VM and make it a member server, then see if this is the default behaviour on a new system or whether something broke after the demotion. Thanks to both of you.
0
 
LVL 16

Expert Comment

by:ThinkPaper
ID: 40337705
You won't be able to change the type for builtin groups.. but you can modify the type for the DOMAIN/RDPgroup
0

Featured Post

Free eBook: Backup on AWS

Everything you need to know about backup and disaster recovery with AWS, for FREE!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article was originally published on Monitis Blog, you can check it here . Today it’s fairly well known that high-performing websites and applications bring in more visitors, higher SEO, and ultimately more sales. By the same token, downtime…
A hard and fast method for reducing Active Directory Administrators members.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question