Cannot Login : Must be a member of RDU

[Guest lozza]

Guys,

 

I cannot figure out whats going here...or what had happened. I have a test

TS Server with TS (Application Server Mode) installed and running on grace

period. I believe it is still within grace period and I get no errors in

event logs....

 

Now for some strange reason, the only way I can log onto this machine today

is intiating mstsc /console.

 

If I try and do a normal RDP to it... no go... i get the 'you must be a

member of the remote desktop users group to be able to logon and this must be

done manually'.. thats fine.... so I I have a couple groups in their anyway

(including domain admins not that I need it because domains admins is part

of local admins group... please correct me if i;m wrong?). My user account is

a memeber of these groups... I have even added my domain account directly to

the Remote Desktop Users group... done a gpudate... rebooted as well...

 

Nothing else i believe going on here. I have checked local policy to ensure

allow logon via terminal services and its set to Administrators and Remote

Desktop Users. I have checked the Deny policy also... and no one in there...

 

There is a single domain level gpo configured which runs an addAdmin script

which puts a certain AD group into all Servers Local Admins groups... nothing

else going on there...

 

All i know is, a couple of months ago, this was fine... and today I cant

seem to get into it. Its not used much so not sure when this issue started

happening. It isn't critical to get it back so quick (and I can always

rebuild it!)... but its simply annoying me as to why this machine will not

allow TS Sessions to connect in and only the one console connections. Somehow

need to backtrack what has happened and fix it... and would like understand

whats going on...

 

Any pointers would be great?

 

Lozza...

[Guest Vera Noest [MVP]]

Re: Cannot Login : Must be a member of RDU

 

Since the console session is the only sessions which always works

without a TS CAL, my guess is that the grace period is over.

 

The grace period actually starts when you install the OS and enable

Remote Desktop, so it might have started long before you realized

it.

 

You can test this by installing the TS Licensing Server and point

the TS to it. The LS should start to issue temporary licenses,

which gives you another 90 days and proves that licensing was the

issue.

 

Read this for more info on the grace period:

 

813052 - Maximizing the Windows Server 2003 Terminal Services

Evaluation Period

http://support.microsoft.com/?kbid=813052

 

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___

 

=?Utf-8?B?bG96emE=?= <lozza@discussions.microsoft.com> wrote on 21

feb 2008 in microsoft.public.windows.terminal_services:

> Guys,

>

> I cannot figure out whats going here...or what had happened. I

> have a test TS Server with TS (Application Server Mode)

> installed and running on grace period. I believe it is still

> within grace period and I get no errors in event logs....

>

> Now for some strange reason, the only way I can log onto this

> machine today is intiating mstsc /console.

>

> If I try and do a normal RDP to it... no go... i get the 'you

> must be a member of the remote desktop users group to be able to

> logon and this must be done manually'.. thats fine.... so I I

> have a couple groups in their anyway (including domain admins

> not that I need it because domains admins is part of local

> admins group... please correct me if i;m wrong?). My user

> account is a memeber of these groups... I have even added my

> domain account directly to the Remote Desktop Users group...

> done a gpudate... rebooted as well...

>

> Nothing else i believe going on here. I have checked local

> policy to ensure allow logon via terminal services and its set

> to Administrators and Remote Desktop Users. I have checked the

> Deny policy also... and no one in there...

>

> There is a single domain level gpo configured which runs an

> addAdmin script which puts a certain AD group into all Servers

> Local Admins groups... nothing else going on there...

>

> All i know is, a couple of months ago, this was fine... and

> today I cant seem to get into it. Its not used much so not sure

> when this issue started happening. It isn't critical to get it

> back so quick (and I can always rebuild it!)... but its simply

> annoying me as to why this machine will not allow TS Sessions to

> connect in and only the one console connections. Somehow need to

> backtrack what has happened and fix it... and would like

> understand whats going on...

>

> Any pointers would be great?

>

> Lozza...

[Guest lozza]

Re: Cannot Login : Must be a member of RDU

 

Vera, of all the help and direction you have given me previously... i feel so

thick (and very emabarassed) that i posted this question. Yes, just before

your reply I noticed this and corrected it by hooking the server into a TSLS

and (suprise suprise) its working... I am kind of stumbled why i didn't get a

more specific error relating to licensing though at logon attempt.

 

So all in all... sorry for wasting you time and thank you for confirming as

well.

 

I will strive to post more technically challenging questions so people will

actually learn something from experts like yourself... Projects are starting

to kick off for me, so I hope you will continue sharing your invaluable

knowledge

 

Nice one... :)

 

Lozz

 

"Vera Noest [MVP]" wrote:

> Since the console session is the only sessions which always works

> without a TS CAL, my guess is that the grace period is over.

>

> The grace period actually starts when you install the OS and enable

> Remote Desktop, so it might have started long before you realized

> it.

>

> You can test this by installing the TS Licensing Server and point

> the TS to it. The LS should start to issue temporary licenses,

> which gives you another 90 days and proves that licensing was the

> issue.

>

> Read this for more info on the grace period:

>

> 813052 - Maximizing the Windows Server 2003 Terminal Services

> Evaluation Period

> http://support.microsoft.com/?kbid=813052

>

> _________________________________________________________

> Vera Noest

> MCSE, CCEA, Microsoft MVP - Terminal Server

> TS troubleshooting: http://ts.veranoest.net

> ___ please respond in newsgroup, NOT by private email ___

>

> =?Utf-8?B?bG96emE=?= <lozza@discussions.microsoft.com> wrote on 21

> feb 2008 in microsoft.public.windows.terminal_services:

>

> > Guys,

> >

> > I cannot figure out whats going here...or what had happened. I

> > have a test TS Server with TS (Application Server Mode)

> > installed and running on grace period. I believe it is still

> > within grace period and I get no errors in event logs....

> >

> > Now for some strange reason, the only way I can log onto this

> > machine today is intiating mstsc /console.

> >

> > If I try and do a normal RDP to it... no go... i get the 'you

> > must be a member of the remote desktop users group to be able to

> > logon and this must be done manually'.. thats fine.... so I I

> > have a couple groups in their anyway (including domain admins

> > not that I need it because domains admins is part of local

> > admins group... please correct me if i;m wrong?). My user

> > account is a memeber of these groups... I have even added my

> > domain account directly to the Remote Desktop Users group...

> > done a gpudate... rebooted as well...

> >

> > Nothing else i believe going on here. I have checked local

> > policy to ensure allow logon via terminal services and its set

> > to Administrators and Remote Desktop Users. I have checked the

> > Deny policy also... and no one in there...

> >

> > There is a single domain level gpo configured which runs an

> > addAdmin script which puts a certain AD group into all Servers

> > Local Admins groups... nothing else going on there...

> >

> > All i know is, a couple of months ago, this was fine... and

> > today I cant seem to get into it. Its not used much so not sure

> > when this issue started happening. It isn't critical to get it

> > back so quick (and I can always rebuild it!)... but its simply

> > annoying me as to why this machine will not allow TS Sessions to

> > connect in and only the one console connections. Somehow need to

> > backtrack what has happened and fix it... and would like

> > understand whats going on...

> >

> > Any pointers would be great?

> >

> > Lozza...

>

[Guest Vera Noest [MVP]]

Re: Cannot Login : Must be a member of RDU

 

Glad you have the problem solved, Lozza! I wasn't 100% sure that

this was your problem, because there should have been an Event in

the EventLog stating that the server has run out of its grace

period.

It's possible though that such an Event is only generated at boot

time.

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___

 

=?Utf-8?B?bG96emE=?= <lozza@discussions.microsoft.com> wrote on 21

feb 2008 in microsoft.public.windows.terminal_services:

> Vera, of all the help and direction you have given me

> previously... i feel so thick (and very emabarassed) that i

> posted this question. Yes, just before your reply I noticed this

> and corrected it by hooking the server into a TSLS and (suprise

> suprise) its working... I am kind of stumbled why i didn't get a

> more specific error relating to licensing though at logon

> attempt.

>

> So all in all... sorry for wasting you time and thank you for

> confirming as well.

>

> I will strive to post more technically challenging questions so

> people will actually learn something from experts like

> yourself... Projects are starting to kick off for me, so I hope

> you will continue sharing your invaluable knowledge

>

> Nice one... :)

>

> Lozz

>

> "Vera Noest [MVP]" wrote:

>

>> Since the console session is the only sessions which always

>> works without a TS CAL, my guess is that the grace period is

>> over.

>>

>> The grace period actually starts when you install the OS and

>> enable Remote Desktop, so it might have started long before you

>> realized it.

>>

>> You can test this by installing the TS Licensing Server and

>> point the TS to it. The LS should start to issue temporary

>> licenses, which gives you another 90 days and proves that

>> licensing was the issue.

>>

>> Read this for more info on the grace period:

>>

>> 813052 - Maximizing the Windows Server 2003 Terminal Services

>> Evaluation Period

>> http://support.microsoft.com/?kbid=813052

>>

>> _________________________________________________________

>> Vera Noest

>> MCSE, CCEA, Microsoft MVP - Terminal Server

>> TS troubleshooting: http://ts.veranoest.net

>> ___ please respond in newsgroup, NOT by private email ___

>>

>> =?Utf-8?B?bG96emE=?= <lozza@discussions.microsoft.com> wrote on

>> 21 feb 2008 in microsoft.public.windows.terminal_services:

>>

>> > Guys,

>> >

>> > I cannot figure out whats going here...or what had happened.

>> > I have a test TS Server with TS (Application Server Mode)

>> > installed and running on grace period. I believe it is still

>> > within grace period and I get no errors in event logs....

>> >

>> > Now for some strange reason, the only way I can log onto this

>> > machine today is intiating mstsc /console.

>> >

>> > If I try and do a normal RDP to it... no go... i get the 'you

>> > must be a member of the remote desktop users group to be able

>> > to logon and this must be done manually'.. thats fine.... so

>> > I I have a couple groups in their anyway (including domain

>> > admins not that I need it because domains admins is part of

>> > local admins group... please correct me if i;m wrong?). My

>> > user account is a memeber of these groups... I have even

>> > added my domain account directly to the Remote Desktop Users

>> > group... done a gpudate... rebooted as well...

>> >

>> > Nothing else i believe going on here. I have checked local

>> > policy to ensure allow logon via terminal services and its

>> > set to Administrators and Remote Desktop Users. I have

>> > checked the Deny policy also... and no one in there...

>> >

>> > There is a single domain level gpo configured which runs an

>> > addAdmin script which puts a certain AD group into all

>> > Servers Local Admins groups... nothing else going on there...

>> >

>> > All i know is, a couple of months ago, this was fine... and

>> > today I cant seem to get into it. Its not used much so not

>> > sure when this issue started happening. It isn't critical to

>> > get it back so quick (and I can always rebuild it!)... but

>> > its simply annoying me as to why this machine will not allow

>> > TS Sessions to connect in and only the one console

>> > connections. Somehow need to backtrack what has happened and

>> > fix it... and would like understand whats going on...

>> >

>> > Any pointers would be great?

>> >

>> > Lozza...