Cannot logon to TS

[Dale Miller]

I have a Windows 2003 Server running Terminal Services. I want to add
another user to be able to log onto the Terminal Server. Whenever she
tries, she gets "To logon to this remote computer, you must be granted the
Allow Logon Through Terminal Services right." error message. I go into
GPEdit.msc, and find the "Allow Logon Through Terminal Services" property,
and see the one user who currently has this right ... but the "Add" button
is greyed out.

I also go into Active Directory, and into the new user's properties. The
"deny logon through terminal services" check box is NOT checked.

Why can I not change the Group Policy?

Any suggestions?

Thanks.

Dale

 

[Josh Rosenberg [MSFT]]

Re: Cannot logon to TS

The problem probably isn't GP, so much as lack of correct group membership.
Try adding your user to the Remote Desktop Users group.

--
Josh Rosenberg [MSFT]
SDE - Terminal Services


"Dale Miller" <dale@designwaresystems.com> wrote in message
news:eMRpng$8HHA.5164@TK2MSFTNGP05.phx.gbl...
>I have a Windows 2003 Server running Terminal Services. I want to add
> another user to be able to log onto the Terminal Server. Whenever she
> tries, she gets "To logon to this remote computer, you must be granted the
> Allow Logon Through Terminal Services right." error message. I go into
> GPEdit.msc, and find the "Allow Logon Through Terminal Services" property,
> and see the one user who currently has this right ... but the "Add" button
> is greyed out.
>
> I also go into Active Directory, and into the new user's properties. The
> "deny logon through terminal services" check box is NOT checked.
>
> Why can I not change the Group Policy?
>
> Any suggestions?
>
> Thanks.
>
> Dale
>
>

 

[Dale Miller]

Re: Cannot logon to TS

Josh,

Thanks for the reply.

Yes, the user is a member of the Remote Desktop Users group. I have also
added her (even though I don't want to leave it this way .. .it was just to
try and resolve the problem) to the Domain Admins, Administrators, Print
Operators, and Domain Users groups.

Dale

"Josh Rosenberg [MSFT]" <joshrose@online.microsoft.com> wrote in message
news:uD0fi%23$8HHA.2752@TK2MSFTNGP06.phx.gbl...
> The problem probably isn't GP, so much as lack of correct group
membership.
> Try adding your user to the Remote Desktop Users group.
>
> --
> Josh Rosenberg [MSFT]
> SDE - Terminal Services
>
>
> "Dale Miller" <dale@designwaresystems.com> wrote in message
> news:eMRpng$8HHA.5164@TK2MSFTNGP05.phx.gbl...
> >I have a Windows 2003 Server running Terminal Services. I want to add
> > another user to be able to log onto the Terminal Server. Whenever she
> > tries, she gets "To logon to this remote computer, you must be granted
the
> > Allow Logon Through Terminal Services right." error message. I go into
> > GPEdit.msc, and find the "Allow Logon Through Terminal Services"
property,
> > and see the one user who currently has this right ... but the "Add"
button
> > is greyed out.
> >
> > I also go into Active Directory, and into the new user's properties.
The
> > "deny logon through terminal services" check box is NOT checked.
> >
> > Why can I not change the Group Policy?
> >
> > Any suggestions?
> >
> > Thanks.
> >
> > Dale
> >
> >
>

 

[Soo Kuan Teo [MSFT]]

Re: Cannot logon to TS

Very interesting. Does this issue only happen to this particular user? Can
you please try if this issue repro on other user account?
Just to be sure, you need to add her user account to the Terminal Server's
'Remote Desktop Users' group, not the domain controller's.
Thanks
Soo Kuan



--
This posting is provided "AS IS" with no warranties, and confers no rights.

"Dale Miller" <dale@designwaresystems.com> wrote in message
news:eLn11GI9HHA.3716@TK2MSFTNGP03.phx.gbl...
> Josh,
>
> Thanks for the reply.
>
> Yes, the user is a member of the Remote Desktop Users group. I have also
> added her (even though I don't want to leave it this way .. .it was just
> to
> try and resolve the problem) to the Domain Admins, Administrators, Print
> Operators, and Domain Users groups.
>
> Dale
>
> "Josh Rosenberg [MSFT]" <joshrose@online.microsoft.com> wrote in message
> news:uD0fi%23$8HHA.2752@TK2MSFTNGP06.phx.gbl...
>> The problem probably isn't GP, so much as lack of correct group
> membership.
>> Try adding your user to the Remote Desktop Users group.
>>
>> --
>> Josh Rosenberg [MSFT]
>> SDE - Terminal Services
>>
>>
>> "Dale Miller" <dale@designwaresystems.com> wrote in message
>> news:eMRpng$8HHA.5164@TK2MSFTNGP05.phx.gbl...
>> >I have a Windows 2003 Server running Terminal Services. I want to add
>> > another user to be able to log onto the Terminal Server. Whenever she
>> > tries, she gets "To logon to this remote computer, you must be granted
> the
>> > Allow Logon Through Terminal Services right." error message. I go into
>> > GPEdit.msc, and find the "Allow Logon Through Terminal Services"
> property,
>> > and see the one user who currently has this right ... but the "Add"
> button
>> > is greyed out.
>> >
>> > I also go into Active Directory, and into the new user's properties.
> The
>> > "deny logon through terminal services" check box is NOT checked.
>> >
>> > Why can I not change the Group Policy?
>> >
>> > Any suggestions?
>> >
>> > Thanks.
>> >
>> > Dale
>> >
>> >
>>
>
>

 

[Dale Miller]

Re: Cannot logon to TS

Soo,

Thanks for the reply.

This happens to every user I try and add. I have just tried to add a test
user with the same result. I added this test user to the "Remote Desktop
Users Group" and not the Domain Admins this time ... with the same result.

Thanks for your help.

Dale

"Soo Kuan Teo [MSFT]" <sookuant@online.microsoft.com> wrote in message
news:O$QyKBJ9HHA.396@TK2MSFTNGP06.phx.gbl...
> Very interesting. Does this issue only happen to this particular user? Can
> you please try if this issue repro on other user account?
> Just to be sure, you need to add her user account to the Terminal Server's
> 'Remote Desktop Users' group, not the domain controller's.
> Thanks
> Soo Kuan
>
>
>
> --
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
> "Dale Miller" <dale@designwaresystems.com> wrote in message
> news:eLn11GI9HHA.3716@TK2MSFTNGP03.phx.gbl...
> > Josh,
> >
> > Thanks for the reply.
> >
> > Yes, the user is a member of the Remote Desktop Users group. I have
also
> > added her (even though I don't want to leave it this way .. .it was just
> > to
> > try and resolve the problem) to the Domain Admins, Administrators, Print
> > Operators, and Domain Users groups.
> >
> > Dale
> >
> > "Josh Rosenberg [MSFT]" <joshrose@online.microsoft.com> wrote in message
> > news:uD0fi%23$8HHA.2752@TK2MSFTNGP06.phx.gbl...
> >> The problem probably isn't GP, so much as lack of correct group
> > membership.
> >> Try adding your user to the Remote Desktop Users group.
> >>
> >> --
> >> Josh Rosenberg [MSFT]
> >> SDE - Terminal Services
> >>
> >>
> >> "Dale Miller" <dale@designwaresystems.com> wrote in message
> >> news:eMRpng$8HHA.5164@TK2MSFTNGP05.phx.gbl...
> >> >I have a Windows 2003 Server running Terminal Services. I want to add
> >> > another user to be able to log onto the Terminal Server. Whenever
she
> >> > tries, she gets "To logon to this remote computer, you must be
granted
> > the
> >> > Allow Logon Through Terminal Services right." error message. I go
into
> >> > GPEdit.msc, and find the "Allow Logon Through Terminal Services"
> > property,
> >> > and see the one user who currently has this right ... but the "Add"
> > button
> >> > is greyed out.
> >> >
> >> > I also go into Active Directory, and into the new user's properties.
> > The
> >> > "deny logon through terminal services" check box is NOT checked.
> >> >
> >> > Why can I not change the Group Policy?
> >> >
> >> > Any suggestions?
> >> >
> >> > Thanks.
> >> >
> >> > Dale
> >> >
> >> >
> >>
> >
> >
>

 

[Vera Noest [MVP]]

Re: Cannot logon to TS

You wrote that you tried to modify the local policy on the server.
Have you checked the settings of domain-wide GPOs?
You can run the Resultant Set of Policies (RSoP) to see all GPOs
which affect this user on this server.

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"Dale Miller" <dale@designwaresystems.com> wrote on 11 sep 2007 in
microsoft.public.windows.terminal_services:

> Soo,
>
> Thanks for the reply.
>
> This happens to every user I try and add. I have just tried to
> add a test user with the same result. I added this test user to
> the "Remote Desktop Users Group" and not the Domain Admins this
> time ... with the same result.
>
> Thanks for your help.
>
> Dale
>
> "Soo Kuan Teo [MSFT]" <sookuant@online.microsoft.com> wrote in
> message news:O$QyKBJ9HHA.396@TK2MSFTNGP06.phx.gbl...
>> Very interesting. Does this issue only happen to this
>> particular user? Can you please try if this issue repro on
>> other user account? Just to be sure, you need to add her user
>> account to the Terminal Server's 'Remote Desktop Users' group,
>> not the domain controller's. Thanks
>> Soo Kuan
>>
>>
>>
>> --
>> This posting is provided "AS IS" with no warranties, and
>> confers no
> rights.
>>
>> "Dale Miller" <dale@designwaresystems.com> wrote in message
>> news:eLn11GI9HHA.3716@TK2MSFTNGP03.phx.gbl...
>> > Josh,
>> >
>> > Thanks for the reply.
>> >
>> > Yes, the user is a member of the Remote Desktop Users group.
>> > I have
> also
>> > added her (even though I don't want to leave it this way ..
>> > .it was just to
>> > try and resolve the problem) to the Domain Admins,
>> > Administrators, Print Operators, and Domain Users groups.
>> >
>> > Dale
>> >
>> > "Josh Rosenberg [MSFT]" <joshrose@online.microsoft.com> wrote
>> > in message news:uD0fi%23$8HHA.2752@TK2MSFTNGP06.phx.gbl...
>> >> The problem probably isn't GP, so much as lack of correct
>> >> group
>> > membership.
>> >> Try adding your user to the Remote Desktop Users group.
>> >>
>> >> --
>> >> Josh Rosenberg [MSFT]
>> >> SDE - Terminal Services
>> >>
>> >>
>> >> "Dale Miller" <dale@designwaresystems.com> wrote in message
>> >> news:eMRpng$8HHA.5164@TK2MSFTNGP05.phx.gbl...
>> >> >I have a Windows 2003 Server running Terminal Services. I
>> >> >want to add
>> >> > another user to be able to log onto the Terminal Server.
>> >> > Whenever
> she
>> >> > tries, she gets "To logon to this remote computer, you
>> >> > must be
> granted
>> > the
>> >> > Allow Logon Through Terminal Services right." error
>> >> > message. I go
> into
>> >> > GPEdit.msc, and find the "Allow Logon Through Terminal
>> >> > Services"
>> > property,
>> >> > and see the one user who currently has this right ... but
>> >> > the "Add"
>> > button
>> >> > is greyed out.
>> >> >
>> >> > I also go into Active Directory, and into the new user's
>> >> > properties.
>> > The
>> >> > "deny logon through terminal services" check box is NOT
>> >> > checked.
>> >> >
>> >> > Why can I not change the Group Policy?
>> >> >
>> >> > Any suggestions?
>> >> >
>> >> > Thanks.
>> >> >
>> >> > Dale

 

[Dale Miller]

Re: Cannot logon to TS

Vera,

Thanks for the response.

Are not the domain-wide GPOs manged by running GPEdit? I have run GPEdit,
and tried to modify the "Allow logon to Terminal Services" policy, but the
ADD button is greyed out! I ran RSOP.msc while logged on as my test user.
However, the managment console that came up has a great deal of information
contained in it. I'm not exactly sure where to look to find the key info.

Dale


"Vera Noest [MVP]" <vera.noest@remove-this.hem.utfors.se> wrote in message
news:Xns99A8E4BD150CEveranoesthemutforsse@207.46.248.16...
> You wrote that you tried to modify the local policy on the server.
> Have you checked the settings of domain-wide GPOs?
> You can run the Resultant Set of Policies (RSoP) to see all GPOs
> which affect this user on this server.
>
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> "Dale Miller" <dale@designwaresystems.com> wrote on 11 sep 2007 in
> microsoft.public.windows.terminal_services:
>
> > Soo,
> >
> > Thanks for the reply.
> >
> > This happens to every user I try and add. I have just tried to
> > add a test user with the same result. I added this test user to
> > the "Remote Desktop Users Group" and not the Domain Admins this
> > time ... with the same result.
> >
> > Thanks for your help.
> >
> > Dale
> >
> > "Soo Kuan Teo [MSFT]" <sookuant@online.microsoft.com> wrote in
> > message news:O$QyKBJ9HHA.396@TK2MSFTNGP06.phx.gbl...
> >> Very interesting. Does this issue only happen to this
> >> particular user? Can you please try if this issue repro on
> >> other user account? Just to be sure, you need to add her user
> >> account to the Terminal Server's 'Remote Desktop Users' group,
> >> not the domain controller's. Thanks
> >> Soo Kuan
> >>
> >>
> >>
> >> --
> >> This posting is provided "AS IS" with no warranties, and
> >> confers no
> > rights.
> >>
> >> "Dale Miller" <dale@designwaresystems.com> wrote in message
> >> news:eLn11GI9HHA.3716@TK2MSFTNGP03.phx.gbl...
> >> > Josh,
> >> >
> >> > Thanks for the reply.
> >> >
> >> > Yes, the user is a member of the Remote Desktop Users group.
> >> > I have
> > also
> >> > added her (even though I don't want to leave it this way ..
> >> > .it was just to
> >> > try and resolve the problem) to the Domain Admins,
> >> > Administrators, Print Operators, and Domain Users groups.
> >> >
> >> > Dale
> >> >
> >> > "Josh Rosenberg [MSFT]" <joshrose@online.microsoft.com> wrote
> >> > in message news:uD0fi%23$8HHA.2752@TK2MSFTNGP06.phx.gbl...
> >> >> The problem probably isn't GP, so much as lack of correct
> >> >> group
> >> > membership.
> >> >> Try adding your user to the Remote Desktop Users group.
> >> >>
> >> >> --
> >> >> Josh Rosenberg [MSFT]
> >> >> SDE - Terminal Services
> >> >>
> >> >>
> >> >> "Dale Miller" <dale@designwaresystems.com> wrote in message
> >> >> news:eMRpng$8HHA.5164@TK2MSFTNGP05.phx.gbl...
> >> >> >I have a Windows 2003 Server running Terminal Services. I
> >> >> >want to add
> >> >> > another user to be able to log onto the Terminal Server.
> >> >> > Whenever
> > she
> >> >> > tries, she gets "To logon to this remote computer, you
> >> >> > must be
> > granted
> >> > the
> >> >> > Allow Logon Through Terminal Services right." error
> >> >> > message. I go
> > into
> >> >> > GPEdit.msc, and find the "Allow Logon Through Terminal
> >> >> > Services"
> >> > property,
> >> >> > and see the one user who currently has this right ... but
> >> >> > the "Add"
> >> > button
> >> >> > is greyed out.
> >> >> >
> >> >> > I also go into Active Directory, and into the new user's
> >> >> > properties.
> >> > The
> >> >> > "deny logon through terminal services" check box is NOT
> >> >> > checked.
> >> >> >
> >> >> > Why can I not change the Group Policy?
> >> >> >
> >> >> > Any suggestions?
> >> >> >
> >> >> > Thanks.
> >> >> >
> >> >> > Dale

 

[Vera Noest [MVP]]

Re: Cannot logon to TS

What is the role of your TS in the domain? It's not a Domain
Controller also, I hope?
No, gpedit.msc gives you the local policy, and that's exactly why the
setting is grayed out. It's defined higher up.
Start the administrative tool Active Directory Users and Computers,
right-click on the domain - Properties - Group Policy tab.
Or better still, download and install the Group Policy Management
Console:
http://www.microsoft.com/windowsserver2003/gpmc/default.mspx
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"Dale Miller" <dale@designwaresystems.com> wrote on 12 sep 2007 in
microsoft.public.windows.terminal_services:

> Vera,
>
> Thanks for the response.
>
> Are not the domain-wide GPOs manged by running GPEdit? I have
> run GPEdit, and tried to modify the "Allow logon to Terminal
> Services" policy, but the ADD button is greyed out! I ran
> RSOP.msc while logged on as my test user. However, the managment
> console that came up has a great deal of information contained
> in it. I'm not exactly sure where to look to find the key info.
>
> Dale
>
>
> "Vera Noest [MVP]" <vera.noest@remove-this.hem.utfors.se> wrote
> in message
> news:Xns99A8E4BD150CEveranoesthemutforsse@207.46.248.16...
>> You wrote that you tried to modify the local policy on the
>> server. Have you checked the settings of domain-wide GPOs?
>> You can run the Resultant Set of Policies (RSoP) to see all
>> GPOs which affect this user on this server.
>>
>> _________________________________________________________
>> Vera Noest
>> MCSE, CCEA, Microsoft MVP - Terminal Server
>> TS troubleshooting: http://ts.veranoest.net
>> ___ please respond in newsgroup, NOT by private email ___
>>
>> "Dale Miller" <dale@designwaresystems.com> wrote on 11 sep 2007
>> in microsoft.public.windows.terminal_services:
>>
>> > Soo,
>> >
>> > Thanks for the reply.
>> >
>> > This happens to every user I try and add. I have just tried
>> > to add a test user with the same result. I added this test
>> > user to the "Remote Desktop Users Group" and not the Domain
>> > Admins this time ... with the same result.
>> >
>> > Thanks for your help.
>> >
>> > Dale
>> >
>> > "Soo Kuan Teo [MSFT]" <sookuant@online.microsoft.com> wrote
>> > in message news:O$QyKBJ9HHA.396@TK2MSFTNGP06.phx.gbl...
>> >> Very interesting. Does this issue only happen to this
>> >> particular user? Can you please try if this issue repro on
>> >> other user account? Just to be sure, you need to add her
>> >> user account to the Terminal Server's 'Remote Desktop Users'
>> >> group, not the domain controller's. Thanks
>> >> Soo Kuan
>> >>
>> >>
>> >>
>> >> --
>> >> This posting is provided "AS IS" with no warranties, and
>> >> confers no
>> > rights.
>> >>
>> >> "Dale Miller" <dale@designwaresystems.com> wrote in message
>> >> news:eLn11GI9HHA.3716@TK2MSFTNGP03.phx.gbl...
>> >> > Josh,
>> >> >
>> >> > Thanks for the reply.
>> >> >
>> >> > Yes, the user is a member of the Remote Desktop Users
>> >> > group. I have
>> > also
>> >> > added her (even though I don't want to leave it this way
>> >> > .. .it was just to
>> >> > try and resolve the problem) to the Domain Admins,
>> >> > Administrators, Print Operators, and Domain Users groups.
>> >> >
>> >> > Dale
>> >> >
>> >> > "Josh Rosenberg [MSFT]" <joshrose@online.microsoft.com>
>> >> > wrote in message
>> >> > news:uD0fi%23$8HHA.2752@TK2MSFTNGP06.phx.gbl...
>> >> >> The problem probably isn't GP, so much as lack of correct
>> >> >> group
>> >> > membership.
>> >> >> Try adding your user to the Remote Desktop Users group.
>> >> >>
>> >> >> --
>> >> >> Josh Rosenberg [MSFT]
>> >> >> SDE - Terminal Services
>> >> >>
>> >> >>
>> >> >> "Dale Miller" <dale@designwaresystems.com> wrote in
>> >> >> message news:eMRpng$8HHA.5164@TK2MSFTNGP05.phx.gbl...
>> >> >> >I have a Windows 2003 Server running Terminal Services.
>> >> >> >I want to add
>> >> >> > another user to be able to log onto the Terminal
>> >> >> > Server. Whenever
>> > she
>> >> >> > tries, she gets "To logon to this remote computer, you
>> >> >> > must be
>> > granted
>> >> > the
>> >> >> > Allow Logon Through Terminal Services right." error
>> >> >> > message. I go
>> > into
>> >> >> > GPEdit.msc, and find the "Allow Logon Through Terminal
>> >> >> > Services"
>> >> > property,
>> >> >> > and see the one user who currently has this right ...
>> >> >> > but the "Add"
>> >> > button
>> >> >> > is greyed out.
>> >> >> >
>> >> >> > I also go into Active Directory, and into the new
>> >> >> > user's properties.
>> >> > The
>> >> >> > "deny logon through terminal services" check box is NOT
>> >> >> > checked.
>> >> >> >
>> >> >> > Why can I not change the Group Policy?
>> >> >> >
>> >> >> > Any suggestions?
>> >> >> >
>> >> >> > Thanks.
>> >> >> >
>> >> >> > Dale

 

[Dale Miller]

Re: Cannot logon to TS

Vera,

Yes, it is a 2 person office, and they weren't going to buy a second server
for TS. They are aware of the risks.

Thanks for the info. Have them up and running.

Dale

"Vera Noest [MVP]" <vera.noest@remove-this.hem.utfors.se> wrote in message
news:Xns99A96494B8092veranoesthemutforsse@207.46.248.16...
> What is the role of your TS in the domain? It's not a Domain
> Controller also, I hope?
> No, gpedit.msc gives you the local policy, and that's exactly why the
> setting is grayed out. It's defined higher up.
> Start the administrative tool Active Directory Users and Computers,
> right-click on the domain - Properties - Group Policy tab.
> Or better still, download and install the Group Policy Management
> Console:
> http://www.microsoft.com/windowsserver2003/gpmc/default.mspx
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> ___ please respond in newsgroup, NOT by private email ___
>
> "Dale Miller" <dale@designwaresystems.com> wrote on 12 sep 2007 in
> microsoft.public.windows.terminal_services:
>
> > Vera,
> >
> > Thanks for the response.
> >
> > Are not the domain-wide GPOs manged by running GPEdit? I have
> > run GPEdit, and tried to modify the "Allow logon to Terminal
> > Services" policy, but the ADD button is greyed out! I ran
> > RSOP.msc while logged on as my test user. However, the managment
> > console that came up has a great deal of information contained
> > in it. I'm not exactly sure where to look to find the key info.
> >
> > Dale
> >
> >
> > "Vera Noest [MVP]" <vera.noest@remove-this.hem.utfors.se> wrote
> > in message
> > news:Xns99A8E4BD150CEveranoesthemutforsse@207.46.248.16...
> >> You wrote that you tried to modify the local policy on the
> >> server. Have you checked the settings of domain-wide GPOs?
> >> You can run the Resultant Set of Policies (RSoP) to see all
> >> GPOs which affect this user on this server.
> >>
> >> _________________________________________________________
> >> Vera Noest
> >> MCSE, CCEA, Microsoft MVP - Terminal Server
> >> TS troubleshooting: http://ts.veranoest.net
> >> ___ please respond in newsgroup, NOT by private email ___
> >>
> >> "Dale Miller" <dale@designwaresystems.com> wrote on 11 sep 2007
> >> in microsoft.public.windows.terminal_services:
> >>
> >> > Soo,
> >> >
> >> > Thanks for the reply.
> >> >
> >> > This happens to every user I try and add. I have just tried
> >> > to add a test user with the same result. I added this test
> >> > user to the "Remote Desktop Users Group" and not the Domain
> >> > Admins this time ... with the same result.
> >> >
> >> > Thanks for your help.
> >> >
> >> > Dale
> >> >
> >> > "Soo Kuan Teo [MSFT]" <sookuant@online.microsoft.com> wrote
> >> > in message news:O$QyKBJ9HHA.396@TK2MSFTNGP06.phx.gbl...
> >> >> Very interesting. Does this issue only happen to this
> >> >> particular user? Can you please try if this issue repro on
> >> >> other user account? Just to be sure, you need to add her
> >> >> user account to the Terminal Server's 'Remote Desktop Users'
> >> >> group, not the domain controller's. Thanks
> >> >> Soo Kuan
> >> >>
> >> >>
> >> >>
> >> >> --
> >> >> This posting is provided "AS IS" with no warranties, and
> >> >> confers no
> >> > rights.
> >> >>
> >> >> "Dale Miller" <dale@designwaresystems.com> wrote in message
> >> >> news:eLn11GI9HHA.3716@TK2MSFTNGP03.phx.gbl...
> >> >> > Josh,
> >> >> >
> >> >> > Thanks for the reply.
> >> >> >
> >> >> > Yes, the user is a member of the Remote Desktop Users
> >> >> > group. I have
> >> > also
> >> >> > added her (even though I don't want to leave it this way
> >> >> > .. .it was just to
> >> >> > try and resolve the problem) to the Domain Admins,
> >> >> > Administrators, Print Operators, and Domain Users groups.
> >> >> >
> >> >> > Dale
> >> >> >
> >> >> > "Josh Rosenberg [MSFT]" <joshrose@online.microsoft.com>
> >> >> > wrote in message
> >> >> > news:uD0fi%23$8HHA.2752@TK2MSFTNGP06.phx.gbl...
> >> >> >> The problem probably isn't GP, so much as lack of correct
> >> >> >> group
> >> >> > membership.
> >> >> >> Try adding your user to the Remote Desktop Users group.
> >> >> >>
> >> >> >> --
> >> >> >> Josh Rosenberg [MSFT]
> >> >> >> SDE - Terminal Services
> >> >> >>
> >> >> >>
> >> >> >> "Dale Miller" <dale@designwaresystems.com> wrote in
> >> >> >> message news:eMRpng$8HHA.5164@TK2MSFTNGP05.phx.gbl...
> >> >> >> >I have a Windows 2003 Server running Terminal Services.
> >> >> >> >I want to add
> >> >> >> > another user to be able to log onto the Terminal
> >> >> >> > Server. Whenever
> >> > she
> >> >> >> > tries, she gets "To logon to this remote computer, you
> >> >> >> > must be
> >> > granted
> >> >> > the
> >> >> >> > Allow Logon Through Terminal Services right." error
> >> >> >> > message. I go
> >> > into
> >> >> >> > GPEdit.msc, and find the "Allow Logon Through Terminal
> >> >> >> > Services"
> >> >> > property,
> >> >> >> > and see the one user who currently has this right ...
> >> >> >> > but the "Add"
> >> >> > button
> >> >> >> > is greyed out.
> >> >> >> >
> >> >> >> > I also go into Active Directory, and into the new
> >> >> >> > user's properties.
> >> >> > The
> >> >> >> > "deny logon through terminal services" check box is NOT
> >> >> >> > checked.
> >> >> >> >
> >> >> >> > Why can I not change the Group Policy?
> >> >> >> >
> >> >> >> > Any suggestions?
> >> >> >> >
> >> >> >> > Thanks.
> >> >> >> >
> >> >> >> > Dale

 

[Vera Noest [MVP]]

Re: Cannot logon to TS

OK, I can understand that 2 servers for 2 persons is a bit of an
overkill
I'm glad that the problem is solved, and thanks for letting us
know, Dale!
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"Dale Miller" <dale@designwaresystems.com> wrote on 12 sep 2007 in
microsoft.public.windows.terminal_services:

> Vera,
>
> Yes, it is a 2 person office, and they weren't going to buy a
> second server for TS. They are aware of the risks.
>
> Thanks for the info. Have them up and running.
>
> Dale
>
> "Vera Noest [MVP]" <vera.noest@remove-this.hem.utfors.se> wrote
> in message
> news:Xns99A96494B8092veranoesthemutforsse@207.46.248.16...
>> What is the role of your TS in the domain? It's not a Domain
>> Controller also, I hope?
>> No, gpedit.msc gives you the local policy, and that's exactly
>> why the setting is grayed out. It's defined higher up.
>> Start the administrative tool Active Directory Users and
>> Computers, right-click on the domain - Properties - Group
>> Policy tab. Or better still, download and install the Group
>> Policy Management Console:
>> http://www.microsoft.com/windowsserver2003/gpmc/default.mspx
>> _________________________________________________________
>> Vera Noest
>> MCSE, CCEA, Microsoft MVP - Terminal Server
>> TS troubleshooting: http://ts.veranoest.net
>> ___ please respond in newsgroup, NOT by private email ___
>>
>> "Dale Miller" <dale@designwaresystems.com> wrote on 12 sep 2007
>> in microsoft.public.windows.terminal_services:
>>
>> > Vera,
>> >
>> > Thanks for the response.
>> >
>> > Are not the domain-wide GPOs manged by running GPEdit? I
>> > have run GPEdit, and tried to modify the "Allow logon to
>> > Terminal Services" policy, but the ADD button is greyed out!
>> > I ran RSOP.msc while logged on as my test user. However, the
>> > managment console that came up has a great deal of
>> > information contained in it. I'm not exactly sure where to
>> > look to find the key info.
>> >
>> > Dale
>> >
>> >
>> > "Vera Noest [MVP]" <vera.noest@remove-this.hem.utfors.se>
>> > wrote in message
>> > news:Xns99A8E4BD150CEveranoesthemutforsse@207.46.248.16...
>> >> You wrote that you tried to modify the local policy on the
>> >> server. Have you checked the settings of domain-wide GPOs?
>> >> You can run the Resultant Set of Policies (RSoP) to see all
>> >> GPOs which affect this user on this server.
>> >>
>> >> _________________________________________________________
>> >> Vera Noest
>> >> MCSE, CCEA, Microsoft MVP - Terminal Server
>> >> TS troubleshooting: http://ts.veranoest.net
>> >> ___ please respond in newsgroup, NOT by private email ___
>> >>
>> >> "Dale Miller" <dale@designwaresystems.com> wrote on 11 sep
>> >> 2007 in microsoft.public.windows.terminal_services:
>> >>
>> >> > Soo,
>> >> >
>> >> > Thanks for the reply.
>> >> >
>> >> > This happens to every user I try and add. I have just
>> >> > tried to add a test user with the same result. I added
>> >> > this test user to the "Remote Desktop Users Group" and not
>> >> > the Domain Admins this time ... with the same result.
>> >> >
>> >> > Thanks for your help.
>> >> >
>> >> > Dale
>> >> >
>> >> > "Soo Kuan Teo [MSFT]" <sookuant@online.microsoft.com>
>> >> > wrote in message
>> >> > news:O$QyKBJ9HHA.396@TK2MSFTNGP06.phx.gbl...
>> >> >> Very interesting. Does this issue only happen to this
>> >> >> particular user? Can you please try if this issue repro
>> >> >> on other user account? Just to be sure, you need to add
>> >> >> her user account to the Terminal Server's 'Remote Desktop
>> >> >> Users' group, not the domain controller's. Thanks
>> >> >> Soo Kuan
>> >> >>
>> >> >>
>> >> >>
>> >> >> --
>> >> >> This posting is provided "AS IS" with no warranties, and
>> >> >> confers no
>> >> > rights.
>> >> >>
>> >> >> "Dale Miller" <dale@designwaresystems.com> wrote in
>> >> >> message news:eLn11GI9HHA.3716@TK2MSFTNGP03.phx.gbl...
>> >> >> > Josh,
>> >> >> >
>> >> >> > Thanks for the reply.
>> >> >> >
>> >> >> > Yes, the user is a member of the Remote Desktop Users
>> >> >> > group. I have
>> >> > also
>> >> >> > added her (even though I don't want to leave it this
>> >> >> > way .. .it was just to
>> >> >> > try and resolve the problem) to the Domain Admins,
>> >> >> > Administrators, Print Operators, and Domain Users
>> >> >> > groups.
>> >> >> >
>> >> >> > Dale
>> >> >> >
>> >> >> > "Josh Rosenberg [MSFT]" <joshrose@online.microsoft.com>
>> >> >> > wrote in message
>> >> >> > news:uD0fi%23$8HHA.2752@TK2MSFTNGP06.phx.gbl...
>> >> >> >> The problem probably isn't GP, so much as lack of
>> >> >> >> correct group
>> >> >> > membership.
>> >> >> >> Try adding your user to the Remote Desktop Users
>> >> >> >> group.
>> >> >> >>
>> >> >> >> --
>> >> >> >> Josh Rosenberg [MSFT]
>> >> >> >> SDE - Terminal Services
>> >> >> >>
>> >> >> >>
>> >> >> >> "Dale Miller" <dale@designwaresystems.com> wrote in
>> >> >> >> message news:eMRpng$8HHA.5164@TK2MSFTNGP05.phx.gbl...
>> >> >> >> >I have a Windows 2003 Server running Terminal
>> >> >> >> >Services. I want to add
>> >> >> >> > another user to be able to log onto the Terminal
>> >> >> >> > Server. Whenever
>> >> > she
>> >> >> >> > tries, she gets "To logon to this remote computer,
>> >> >> >> > you must be
>> >> > granted
>> >> >> > the
>> >> >> >> > Allow Logon Through Terminal Services right." error
>> >> >> >> > message. I go
>> >> > into
>> >> >> >> > GPEdit.msc, and find the "Allow Logon Through
>> >> >> >> > Terminal Services"
>> >> >> > property,
>> >> >> >> > and see the one user who currently has this right
>> >> >> >> > ... but the "Add"
>> >> >> > button
>> >> >> >> > is greyed out.
>> >> >> >> >
>> >> >> >> > I also go into Active Directory, and into the new
>> >> >> >> > user's properties.
>> >> >> > The
>> >> >> >> > "deny logon through terminal services" check box is
>> >> >> >> > NOT checked.
>> >> >> >> >
>> >> >> >> > Why can I not change the Group Policy?
>> >> >> >> >
>> >> >> >> > Any suggestions?
>> >> >> >> >
>> >> >> >> > Thanks.
>> >> >> >> >
>> >> >> >> > Dale