Solved

Can't add domain security groups to local groups on Server 2003 R2

Posted on 2014-09-22
5
226 Views
Last Modified: 2014-09-22
Hello everyone, I'm in the process of phasing out some of our older Server 2003 and 2003 R2 machines and after demoting one of them ( was a DC) I found that users could no longer log on remotely to that server using terminal services. Additionally I began having permissions problems with workgroup clients accessing printers etc. on that server. Only way to connect was to enter username in the form of domain\username where that wasn't required before.

After poking around I found that the local security group "Remote Desktop Users" on that TS was empty. I tried to add the "domain\Remote Desktop Users" group to the local group, but for some reason any search of the domain for any group would yield no results. I can add specific domain users to that local group and they can then sign onto TS as expected, but I can't seem to add any domain group to any local group.

Any thoughts? Thanks in advance
0
Comment
Question by:jostafew
  • 2
  • 2
5 Comments
 
LVL 29

Accepted Solution

by:
becraig earned 500 total points
ID: 40337354
The suggested path for this, would be creating a domain group for all your user (not a "Built-in" group)

Then simply add that group to the local RDP group on the server in question.

e.g..  
Create new group in AD "NewRDPUsers"
Add all the required users to the group
Then add that group to the local RDP user group on the server.
0
 
LVL 16

Expert Comment

by:ThinkPaper
ID: 40337620
What type of group is "domain\Remote Desktop Users"? Is it a Global or Universal? Change it to global and see if it allows you to add to the builtin group. But as becraig mentioned, best practice would be to assign rights to your custom RDP group versus using the default built-in local group.
0
 
LVL 3

Author Closing Comment

by:jostafew
ID: 40337660
Thanks becraig, your solution did the job.
0
 
LVL 3

Author Comment

by:jostafew
ID: 40337666
ThinkPaper, the domain\Remote Desktop Users is a Built In group, can't seem to change it to Global or Universal.

Still a little puzzled as to what changed though; no GP changes, no user group changes or anything along those lines, simply demoted the server and then RDS broke. When I have a moment I think I'm going to turn up a 2k3 VM and make it a member server, then see if this is the default behaviour on a new system or whether something broke after the demotion. Thanks to both of you.
0
 
LVL 16

Expert Comment

by:ThinkPaper
ID: 40337705
You won't be able to change the type for builtin groups.. but you can modify the type for the DOMAIN/RDPgroup
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ACTIVE DIRECTORY, EXCHANGE 3 58
Forest and doamin tree 3 26
Advanced Auditing issue 3 23
Trust DNS Resolution for Unqualified Names 3 11
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

860 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question