Guest DD Posted July 9, 2007 Posted July 9, 2007 May I know for remote desktop user, they should under which member group ? RAS & IAS group ? Do I need to allow them local locally under the Domain controller policy ? What is the actual configuration (under which group & etc )for the new remote desktop user ?
Guest Vera Noest [MVP] Posted July 9, 2007 Posted July 9, 2007 Re: New remote desktop user Assuming that the server runs Windows 2003, all you have to do is to make your users members of the local built-in group "Remote Desktop Users" on the server. _________________________________________________________ Vera Noest MCSE, CCEA, Microsoft MVP - Terminal Server TS troubleshooting: http://ts.veranoest.net ___ please respond in newsgroup, NOT by private email ___ =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 09 jul 2007 in microsoft.public.windows.terminal_services: > May I know for remote desktop user, they should under which > member group ? RAS & IAS group ? > > Do I need to allow them local locally under the Domain > controller policy ? > > What is the actual configuration (under which group & etc )for > the new remote desktop user ?
Guest DD Posted July 10, 2007 Posted July 10, 2007 Re: New remote desktop user using windows 2000, can't find the built-in group "remote desktop user "Vera Noest [MVP]" wrote: > Assuming that the server runs Windows 2003, all you have to do is to > make your users members of the local built-in group "Remote Desktop > Users" on the server. > _________________________________________________________ > Vera Noest > MCSE, CCEA, Microsoft MVP - Terminal Server > TS troubleshooting: http://ts.veranoest.net > ___ please respond in newsgroup, NOT by private email ___ > > =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 09 jul > 2007 in microsoft.public.windows.terminal_services: > > > May I know for remote desktop user, they should under which > > member group ? RAS & IAS group ? > > > > Do I need to allow them local locally under the Domain > > controller policy ? > > > > What is the actual configuration (under which group & etc )for > > the new remote desktop user ? >
Guest Brett I. Holcomb Posted July 10, 2007 Posted July 10, 2007 Re: New remote desktop user If I remember Win 2000 doesn't have that group. You have to grant them some access but I'm not at work with my notes and can't remember. You might check the MS knowledge base as that's where I found the note. If If I remember I put in the error message I got back. I looked for it in the KB but can't find it right now and my notes are at work. DD wrote: > using windows 2000, can't find the built-in group "remote desktop user > > "Vera Noest [MVP]" wrote: > >> Assuming that the server runs Windows 2003, all you have to do is to >> make your users members of the local built-in group "Remote Desktop >> Users" on the server. >> _________________________________________________________ >> Vera Noest >> MCSE, CCEA, Microsoft MVP - Terminal Server >> TS troubleshooting: http://ts.veranoest.net >> ___ please respond in newsgroup, NOT by private email ___ >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 09 jul >> 2007 in microsoft.public.windows.terminal_services: >> >>> May I know for remote desktop user, they should under which >>> member group ? RAS & IAS group ? >>> >>> Do I need to allow them local locally under the Domain >>> controller policy ? >>> >>> What is the actual configuration (under which group & etc )for >>> the new remote desktop user ?
Guest Vera Noest [MVP] Posted July 10, 2007 Posted July 10, 2007 Re: New remote desktop user Windows 2000 doesn't have this group, it was introduced with Windows 2003. In W2K, you have to give users the user right to "Log on Locally" to the Terminal Server. _________________________________________________________ Vera Noest MCSE, CCEA, Microsoft MVP - Terminal Server TS troubleshooting: http://ts.veranoest.net ___ please respond in newsgroup, NOT by private email ___ =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 10 jul 2007 in microsoft.public.windows.terminal_services: > using windows 2000, can't find the built-in group "remote > desktop user > > "Vera Noest [MVP]" wrote: > >> Assuming that the server runs Windows 2003, all you have to do >> is to make your users members of the local built-in group >> "Remote Desktop Users" on the server. >> _________________________________________________________ >> Vera Noest >> MCSE, CCEA, Microsoft MVP - Terminal Server >> TS troubleshooting: http://ts.veranoest.net >> ___ please respond in newsgroup, NOT by private email ___ >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 09 jul >> 2007 in microsoft.public.windows.terminal_services: >> >> > May I know for remote desktop user, they should under which >> > member group ? RAS & IAS group ? >> > >> > Do I need to allow them local locally under the Domain >> > controller policy ? >> > >> > What is the actual configuration (under which group & etc >> > )for the new remote desktop user ?
Guest DD Posted July 13, 2007 Posted July 13, 2007 Re: New remote desktop user I have lllowed the user local on locally from the Domain controlled policy.yes, but users sometime can login sometime can not login" message" you are not authorise to logon locally. "Vera Noest [MVP]" wrote: > Windows 2000 doesn't have this group, it was introduced with > Windows 2003. > In W2K, you have to give users the user right to "Log on Locally" > to the Terminal Server. > > _________________________________________________________ > Vera Noest > MCSE, CCEA, Microsoft MVP - Terminal Server > TS troubleshooting: http://ts.veranoest.net > ___ please respond in newsgroup, NOT by private email ___ > > =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 10 jul > 2007 in microsoft.public.windows.terminal_services: > > > using windows 2000, can't find the built-in group "remote > > desktop user > > > > "Vera Noest [MVP]" wrote: > > > >> Assuming that the server runs Windows 2003, all you have to do > >> is to make your users members of the local built-in group > >> "Remote Desktop Users" on the server. > >> _________________________________________________________ > >> Vera Noest > >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> TS troubleshooting: http://ts.veranoest.net > >> ___ please respond in newsgroup, NOT by private email ___ > >> > >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 09 jul > >> 2007 in microsoft.public.windows.terminal_services: > >> > >> > May I know for remote desktop user, they should under which > >> > member group ? RAS & IAS group ? > >> > > >> > Do I need to allow them local locally under the Domain > >> > controller policy ? > >> > > >> > What is the actual configuration (under which group & etc > >> > )for the new remote desktop user ? >
Guest Vera Noest [MVP] Posted July 13, 2007 Posted July 13, 2007 Re: New remote desktop user Can you give the *exact* error message? If it works sometimes, and sometimes not, I would guess that there's a problem with the GPO which contains the "Log On Locally" user right, and the GPO is not always applied. Check the EventLog on the Terminal Server for any warnings or errors. What is the role of the Terminal Server in the domain? It is not your DC, I hope? _________________________________________________________ Vera Noest MCSE, CCEA, Microsoft MVP - Terminal Server TS troubleshooting: http://ts.veranoest.net ___ please respond in newsgroup, NOT by private email ___ =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 13 jul 2007 in microsoft.public.windows.terminal_services: > I have lllowed the user local on locally from the Domain > controlled policy.yes, but users sometime can login sometime can > not login" message" you are not authorise to logon locally. > > > "Vera Noest [MVP]" wrote: > >> Windows 2000 doesn't have this group, it was introduced with >> Windows 2003. >> In W2K, you have to give users the user right to "Log on >> Locally" to the Terminal Server. >> >> _________________________________________________________ >> Vera Noest >> MCSE, CCEA, Microsoft MVP - Terminal Server >> TS troubleshooting: http://ts.veranoest.net >> ___ please respond in newsgroup, NOT by private email ___ >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 10 jul >> 2007 in microsoft.public.windows.terminal_services: >> >> > using windows 2000, can't find the built-in group "remote >> > desktop user >> > >> > "Vera Noest [MVP]" wrote: >> > >> >> Assuming that the server runs Windows 2003, all you have to >> >> do is to make your users members of the local built-in group >> >> "Remote Desktop Users" on the server. >> >> _________________________________________________________ >> >> Vera Noest >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> TS troubleshooting: http://ts.veranoest.net >> >> ___ please respond in newsgroup, NOT by private email ___ >> >> >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 09 >> >> jul 2007 in microsoft.public.windows.terminal_services: >> >> >> >> > May I know for remote desktop user, they should under >> >> > which member group ? RAS & IAS group ? >> >> > >> >> > Do I need to allow them local locally under the Domain >> >> > controller policy ? >> >> > >> >> > What is the actual configuration (under which group & etc >> >> > )for the new remote desktop user ?
Guest DD Posted July 17, 2007 Posted July 17, 2007 Re: New remote desktop user The error ""The local policy of this system does not permit you to logon interactively" Already granted this user can logon locally in Domain policy. It is my DC, I know is not recommended , but we only have two DC , so no choice. "Vera Noest [MVP]" wrote: > Can you give the *exact* error message? > > If it works sometimes, and sometimes not, I would guess that > there's a problem with the GPO which contains the "Log On Locally" > user right, and the GPO is not always applied. > Check the EventLog on the Terminal Server for any warnings or > errors. > > What is the role of the Terminal Server in the domain? It is not > your DC, I hope? > _________________________________________________________ > Vera Noest > MCSE, CCEA, Microsoft MVP - Terminal Server > TS troubleshooting: http://ts.veranoest.net > ___ please respond in newsgroup, NOT by private email ___ > > =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 13 jul > 2007 in microsoft.public.windows.terminal_services: > > > I have lllowed the user local on locally from the Domain > > controlled policy.yes, but users sometime can login sometime can > > not login" message" you are not authorise to logon locally. > > > > > > "Vera Noest [MVP]" wrote: > > > >> Windows 2000 doesn't have this group, it was introduced with > >> Windows 2003. > >> In W2K, you have to give users the user right to "Log on > >> Locally" to the Terminal Server. > >> > >> _________________________________________________________ > >> Vera Noest > >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> TS troubleshooting: http://ts.veranoest.net > >> ___ please respond in newsgroup, NOT by private email ___ > >> > >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 10 jul > >> 2007 in microsoft.public.windows.terminal_services: > >> > >> > using windows 2000, can't find the built-in group "remote > >> > desktop user > >> > > >> > "Vera Noest [MVP]" wrote: > >> > > >> >> Assuming that the server runs Windows 2003, all you have to > >> >> do is to make your users members of the local built-in group > >> >> "Remote Desktop Users" on the server. > >> >> _________________________________________________________ > >> >> Vera Noest > >> >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> >> TS troubleshooting: http://ts.veranoest.net > >> >> ___ please respond in newsgroup, NOT by private email ___ > >> >> > >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 09 > >> >> jul 2007 in microsoft.public.windows.terminal_services: > >> >> > >> >> > May I know for remote desktop user, they should under > >> >> > which member group ? RAS & IAS group ? > >> >> > > >> >> > Do I need to allow them local locally under the Domain > >> >> > controller policy ? > >> >> > > >> >> > What is the actual configuration (under which group & etc > >> >> > )for the new remote desktop user ? >
Guest Vera Noest [MVP] Posted July 17, 2007 Posted July 17, 2007 Re: New remote desktop user Since the TS is running on your DC, you have to grant this right in the Default Domain Controller Policy, not the Default Domain Policy. _________________________________________________________ Vera Noest MCSE, CCEA, Microsoft MVP - Terminal Server TS troubleshooting: http://ts.veranoest.net ___ please respond in newsgroup, NOT by private email ___ =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 17 jul 2007 in microsoft.public.windows.terminal_services: > The error ""The local policy of this system does not permit you > to logon interactively" > > Already granted this user can logon locally in Domain policy. > It is my DC, I know is not recommended , but we only have two DC > , so no choice. > > > "Vera Noest [MVP]" wrote: > >> Can you give the *exact* error message? >> >> If it works sometimes, and sometimes not, I would guess that >> there's a problem with the GPO which contains the "Log On >> Locally" user right, and the GPO is not always applied. >> Check the EventLog on the Terminal Server for any warnings or >> errors. >> >> What is the role of the Terminal Server in the domain? It is >> not your DC, I hope? >> _________________________________________________________ >> Vera Noest >> MCSE, CCEA, Microsoft MVP - Terminal Server >> TS troubleshooting: http://ts.veranoest.net >> ___ please respond in newsgroup, NOT by private email ___ >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 13 jul >> 2007 in microsoft.public.windows.terminal_services: >> >> > I have lllowed the user local on locally from the Domain >> > controlled policy.yes, but users sometime can login sometime >> > can not login" message" you are not authorise to logon >> > locally. >> > >> > >> > "Vera Noest [MVP]" wrote: >> > >> >> Windows 2000 doesn't have this group, it was introduced with >> >> Windows 2003. >> >> In W2K, you have to give users the user right to "Log on >> >> Locally" to the Terminal Server. >> >> >> >> _________________________________________________________ >> >> Vera Noest >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> TS troubleshooting: http://ts.veranoest.net >> >> ___ please respond in newsgroup, NOT by private email ___ >> >> >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 10 >> >> jul 2007 in microsoft.public.windows.terminal_services: >> >> >> >> > using windows 2000, can't find the built-in group "remote >> >> > desktop user >> >> > >> >> > "Vera Noest [MVP]" wrote: >> >> > >> >> >> Assuming that the server runs Windows 2003, all you have >> >> >> to do is to make your users members of the local built-in >> >> >> group "Remote Desktop Users" on the server. >> >> >> _________________________________________________________ >> >> >> Vera Noest >> >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> >> TS troubleshooting: http://ts.veranoest.net >> >> >> ___ please respond in newsgroup, NOT by private email ___ >> >> >> >> >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on >> >> >> 09 jul 2007 in >> >> >> microsoft.public.windows.terminal_services: >> >> >> >> >> >> > May I know for remote desktop user, they should under >> >> >> > which member group ? RAS & IAS group ? >> >> >> > >> >> >> > Do I need to allow them local locally under the Domain >> >> >> > controller policy ? >> >> >> > >> >> >> > What is the actual configuration (under which group & >> >> >> > etc )for the new remote desktop user ?
Guest DD Posted July 18, 2007 Posted July 18, 2007 Re: New remote desktop user Granted default Domain Controller policy.Encountered same problem. "Vera Noest [MVP]" wrote: > Since the TS is running on your DC, you have to grant this right in > the Default Domain Controller Policy, not the Default Domain > Policy. > _________________________________________________________ > Vera Noest > MCSE, CCEA, Microsoft MVP - Terminal Server > TS troubleshooting: http://ts.veranoest.net > ___ please respond in newsgroup, NOT by private email ___ > > =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 17 jul > 2007 in microsoft.public.windows.terminal_services: > > > The error ""The local policy of this system does not permit you > > to logon interactively" > > > > Already granted this user can logon locally in Domain policy. > > It is my DC, I know is not recommended , but we only have two DC > > , so no choice. > > > > > > "Vera Noest [MVP]" wrote: > > > >> Can you give the *exact* error message? > >> > >> If it works sometimes, and sometimes not, I would guess that > >> there's a problem with the GPO which contains the "Log On > >> Locally" user right, and the GPO is not always applied. > >> Check the EventLog on the Terminal Server for any warnings or > >> errors. > >> > >> What is the role of the Terminal Server in the domain? It is > >> not your DC, I hope? > >> _________________________________________________________ > >> Vera Noest > >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> TS troubleshooting: http://ts.veranoest.net > >> ___ please respond in newsgroup, NOT by private email ___ > >> > >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 13 jul > >> 2007 in microsoft.public.windows.terminal_services: > >> > >> > I have lllowed the user local on locally from the Domain > >> > controlled policy.yes, but users sometime can login sometime > >> > can not login" message" you are not authorise to logon > >> > locally. > >> > > >> > > >> > "Vera Noest [MVP]" wrote: > >> > > >> >> Windows 2000 doesn't have this group, it was introduced with > >> >> Windows 2003. > >> >> In W2K, you have to give users the user right to "Log on > >> >> Locally" to the Terminal Server. > >> >> > >> >> _________________________________________________________ > >> >> Vera Noest > >> >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> >> TS troubleshooting: http://ts.veranoest.net > >> >> ___ please respond in newsgroup, NOT by private email ___ > >> >> > >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 10 > >> >> jul 2007 in microsoft.public.windows.terminal_services: > >> >> > >> >> > using windows 2000, can't find the built-in group "remote > >> >> > desktop user > >> >> > > >> >> > "Vera Noest [MVP]" wrote: > >> >> > > >> >> >> Assuming that the server runs Windows 2003, all you have > >> >> >> to do is to make your users members of the local built-in > >> >> >> group "Remote Desktop Users" on the server. > >> >> >> _________________________________________________________ > >> >> >> Vera Noest > >> >> >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> >> >> TS troubleshooting: http://ts.veranoest.net > >> >> >> ___ please respond in newsgroup, NOT by private email ___ > >> >> >> > >> >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on > >> >> >> 09 jul 2007 in > >> >> >> microsoft.public.windows.terminal_services: > >> >> >> > >> >> >> > May I know for remote desktop user, they should under > >> >> >> > which member group ? RAS & IAS group ? > >> >> >> > > >> >> >> > Do I need to allow them local locally under the Domain > >> >> >> > controller policy ? > >> >> >> > > >> >> >> > What is the actual configuration (under which group & > >> >> >> > etc )for the new remote desktop user ? >
Guest Vera Noest [MVP] Posted July 18, 2007 Posted July 18, 2007 Re: New remote desktop user I'm sorry, but then I don't know where the problem lies. I've never run TS on a DC, and I don't have a W2K server either to test this scenario. _________________________________________________________ Vera Noest MCSE, CCEA, Microsoft MVP - Terminal Server TS troubleshooting: http://ts.veranoest.net ___ please respond in newsgroup, NOT by private email ___ =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 18 jul 2007 in microsoft.public.windows.terminal_services: > Granted default Domain Controller policy.Encountered same > problem. > > > > "Vera Noest [MVP]" wrote: > >> Since the TS is running on your DC, you have to grant this >> right in the Default Domain Controller Policy, not the Default >> Domain Policy. >> _________________________________________________________ >> Vera Noest >> MCSE, CCEA, Microsoft MVP - Terminal Server >> TS troubleshooting: http://ts.veranoest.net >> ___ please respond in newsgroup, NOT by private email ___ >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 17 jul >> 2007 in microsoft.public.windows.terminal_services: >> >> > The error ""The local policy of this system does not permit >> > you to logon interactively" >> > >> > Already granted this user can logon locally in Domain policy. >> > It is my DC, I know is not recommended , but we only have two >> > DC , so no choice. >> > >> > >> > "Vera Noest [MVP]" wrote: >> > >> >> Can you give the *exact* error message? >> >> >> >> If it works sometimes, and sometimes not, I would guess that >> >> there's a problem with the GPO which contains the "Log On >> >> Locally" user right, and the GPO is not always applied. >> >> Check the EventLog on the Terminal Server for any warnings >> >> or errors. >> >> >> >> What is the role of the Terminal Server in the domain? It is >> >> not your DC, I hope? >> >> _________________________________________________________ >> >> Vera Noest >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> TS troubleshooting: http://ts.veranoest.net >> >> ___ please respond in newsgroup, NOT by private email ___ >> >> >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on 13 >> >> jul 2007 in microsoft.public.windows.terminal_services: >> >> >> >> > I have lllowed the user local on locally from the Domain >> >> > controlled policy.yes, but users sometime can login >> >> > sometime can not login" message" you are not authorise to >> >> > logon locally. >> >> > >> >> > >> >> > "Vera Noest [MVP]" wrote: >> >> > >> >> >> Windows 2000 doesn't have this group, it was introduced >> >> >> with Windows 2003. >> >> >> In W2K, you have to give users the user right to "Log on >> >> >> Locally" to the Terminal Server. >> >> >> >> >> >> _________________________________________________________ >> >> >> Vera Noest >> >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> >> TS troubleshooting: http://ts.veranoest.net >> >> >> ___ please respond in newsgroup, NOT by private email ___ >> >> >> >> >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote on >> >> >> 10 jul 2007 in >> >> >> microsoft.public.windows.terminal_services: >> >> >> >> >> >> > using windows 2000, can't find the built-in group >> >> >> > "remote desktop user >> >> >> > >> >> >> > "Vera Noest [MVP]" wrote: >> >> >> > >> >> >> >> Assuming that the server runs Windows 2003, all you >> >> >> >> have to do is to make your users members of the local >> >> >> >> built-in group "Remote Desktop Users" on the server. >> >> >> >> _______________________________________________________ >> >> >> >> __ Vera Noest >> >> >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> >> >> TS troubleshooting: http://ts.veranoest.net >> >> >> >> ___ please respond in newsgroup, NOT by private email >> >> >> >> ___ >> >> >> >> >> >> >> >> =?Utf-8?B?REQ=?= <DD@discussions.microsoft.com> wrote >> >> >> >> on 09 jul 2007 in >> >> >> >> microsoft.public.windows.terminal_services: >> >> >> >> >> >> >> >> > May I know for remote desktop user, they should >> >> >> >> > under which member group ? RAS & IAS group ? >> >> >> >> > >> >> >> >> > Do I need to allow them local locally under the >> >> >> >> > Domain controller policy ? >> >> >> >> > >> >> >> >> > What is the actual configuration (under which group >> >> >> >> > & etc )for the new remote desktop user ?
Recommended Posts