Solved

Clients unable to RDP into workstations

Posted on 2016-10-28
5
34 Views
Last Modified: 2016-12-02
We are running a standard Windows 2008 Ad environment with Windows 7 workstations.  Many of our users Remote Desktop into their workstations.  We control RDP access via GPO settings and this has worked fine.  Specifically the GPO setting 'Allow logon through Terminal Services' is set for Builtin\Administrators and Builtin\Remote Desktop Users groups.

Recently, various users in our network have not been able to RDP into their workstations even though they are members of the Remote Desktop group and the GPO policy settings have been successfully applied.  This problem does NOT occur for domain admins.  The only work around that we have been able to find is if we also add NT Authority\Authenticated Users to the setting 'Access this computer from the network'.  Once we do that and in combination with the Remote Desktop Users group GPO, users are able to RDP into the machines without issue.

Unfortunately, 'Access this computer from the network' setting is a STIG violation if you include NT Authority\Authenticated Users and as I understand this should not have any bearing on RDP access anyway.  

Can someone tell me why changing these settings is effecting RDP access and what bearing 'Access this computer from the network' setting has.

Thanks
0
Comment
Question by:sagdoc
  • 2
5 Comments
 
LVL 38

Expert Comment

by:Hypercat (Deb)
ID: 41864544
Simply put, the "access this computer from the network" right is required to be able to access resources on the computer from the network.  I assume this would include being able to log on to a remote desktop session. The Users group normally has this right.  Is the Users group missing from the local security policy/access this computer from the network on the workstations?
0
 

Author Comment

by:sagdoc
ID: 41867282
The Users group is missing from local security policy/ access this computer from the network, but that is by design since it is also removed from the GPO.  Since they are members of the Remote Desktop group then that should be sufficient?
0
 
LVL 38

Accepted Solution

by:
Hypercat (Deb) earned 500 total points
ID: 41867470
You can use the "Allow logon through Remote Desktop Services" right instead:

https://technet.microsoft.com/en-us/library/dn221985(v=ws.11).aspx

Enable this policy and add the Remote Desktop Users group to the list, and you should be OK.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 41909925
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Can't log in to windows 7 11 59
Why does my computer not boot? 12 48
Windows 7 Lock taskbar 8 35
Inaccessible Boot Device after restore from backup image 19 66
Local Printing Using Remote Desktop Windows 7 sometimes has issues with printing to a local printer using a Remote Desktop Connection (RDC). The 1st step is to verify that printers are checked on the Local Resources tab of the Remote Desktop C…
Let’s list some of the technologies that enable smooth teleworking. 
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question