Solved

Clients unable to RDP into workstations

Posted on 2016-10-28
5
41 Views
Last Modified: 2016-12-02
We are running a standard Windows 2008 Ad environment with Windows 7 workstations.  Many of our users Remote Desktop into their workstations.  We control RDP access via GPO settings and this has worked fine.  Specifically the GPO setting 'Allow logon through Terminal Services' is set for Builtin\Administrators and Builtin\Remote Desktop Users groups.

Recently, various users in our network have not been able to RDP into their workstations even though they are members of the Remote Desktop group and the GPO policy settings have been successfully applied.  This problem does NOT occur for domain admins.  The only work around that we have been able to find is if we also add NT Authority\Authenticated Users to the setting 'Access this computer from the network'.  Once we do that and in combination with the Remote Desktop Users group GPO, users are able to RDP into the machines without issue.

Unfortunately, 'Access this computer from the network' setting is a STIG violation if you include NT Authority\Authenticated Users and as I understand this should not have any bearing on RDP access anyway.  

Can someone tell me why changing these settings is effecting RDP access and what bearing 'Access this computer from the network' setting has.

Thanks
0
Comment
Question by:sagdoc
  • 2
5 Comments
 
LVL 38

Expert Comment

by:Hypercat (Deb)
ID: 41864544
Simply put, the "access this computer from the network" right is required to be able to access resources on the computer from the network.  I assume this would include being able to log on to a remote desktop session. The Users group normally has this right.  Is the Users group missing from the local security policy/access this computer from the network on the workstations?
0
 

Author Comment

by:sagdoc
ID: 41867282
The Users group is missing from local security policy/ access this computer from the network, but that is by design since it is also removed from the GPO.  Since they are members of the Remote Desktop group then that should be sufficient?
0
 
LVL 38

Accepted Solution

by:
Hypercat (Deb) earned 500 total points
ID: 41867470
You can use the "Allow logon through Remote Desktop Services" right instead:

https://technet.microsoft.com/en-us/library/dn221985(v=ws.11).aspx

Enable this policy and add the Remote Desktop Users group to the list, and you should be OK.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 41909925
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

OfficeMate Freezes on login or does not load after login credentials are input.
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum editing capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question