one terminalclient can't connect to terminal server.

[siqdiz@gmail.com]

Good afternoon,

We have a windows 2000 terminal server and a windows 2003 terminal
server in our domain. Local users connect to these servers over our
LAN with HP thin clients ( windows CE based ) and with the microsoft
terminal services client on windows 2000 workstations.

This morning I had an error in the eventlog on our domaincontroller
( windows 2000 ):

Logon Failure: Reason: The user has not been granted the requested
logon type at this machine User Name: planning Domain: 2k-DC Logon
Type: 2 Logon Process: User32 Authentication Package: Negotiate
Workstation Name: 2k-DC

The user who works on a thinclient couldn't log in, he got the
following error message on his screen:

'Local policy does not permit you to log on interactively'

All users who try to log on to this terminal get this error. Wich is
strange; I checked the policies and the user accounts wether the box
was unchecked "allow to connect through terminal services". These
users can actually log onto another terminal or pc with RDP client
installed. I also checked the license server, there are still licenses
available - I should've gotten a license specific error in the
eventlog if I run out of licenses AFAIK. Maybe this problem is related
to the local CAL on the windows CE terminal client? Does anyone have a
suggestion?

Thanks in advance.

Oscar

 

[Charles Babbage]

Re: one terminalclient can't connect to terminal server.

Usual gotchas here are:

1) The Permissions on the RDP connection (via TS Config) does not have a
group/user entry for the user - default is the local "Remote Desktop Users"
group but a domain can be used

2) User/group has not been given the right to "Allow logon through Terminal
Services" via GPO or local security settings. I seem to remember that this
had to be "log on locally" on W2K but I may be wrong.

<siqdiz@gmail.com> wrote in message
news:1192021668.883748.65180@57g2000hsv.googlegroups.com...
> Good afternoon,
>
> We have a windows 2000 terminal server and a windows 2003 terminal
> server in our domain. Local users connect to these servers over our
> LAN with HP thin clients ( windows CE based ) and with the microsoft
> terminal services client on windows 2000 workstations.
>
> This morning I had an error in the eventlog on our domaincontroller
> ( windows 2000 ):
>
> Logon Failure: Reason: The user has not been granted the requested
> logon type at this machine User Name: planning Domain: 2k-DC Logon
> Type: 2 Logon Process: User32 Authentication Package: Negotiate
> Workstation Name: 2k-DC
>
> The user who works on a thinclient couldn't log in, he got the
> following error message on his screen:
>
> 'Local policy does not permit you to log on interactively'
>
> All users who try to log on to this terminal get this error. Wich is
> strange; I checked the policies and the user accounts wether the box
> was unchecked "allow to connect through terminal services". These
> users can actually log onto another terminal or pc with RDP client
> installed. I also checked the license server, there are still licenses
> available - I should've gotten a license specific error in the
> eventlog if I run out of licenses AFAIK. Maybe this problem is related
> to the local CAL on the windows CE terminal client? Does anyone have a
> suggestion?
>
> Thanks in advance.
>
> Oscar
>

 

[siqdiz@gmail.com]

Re: one terminalclient can't connect to terminal server.

On 10 okt, 16:28, "Charles Babbage"
<CharlesBabbage_at_lineone_dot_net> wrote:
> Usual gotchas here are:
>
> 1) The Permissions on the RDP connection (via TS Config) does not have a
> group/user entry for the user - default is the local "Remote Desktop Users"
> group but a domain can be used
>
> 2) User/group has not been given the right to "Allow logon through Terminal
> Services" via GPO or local security settings. I seem to remember that this
> had to be "log on locally" on W2K but I may be wrong.
>
> <siq...@gmail.com> wrote in message
>
> news:1192021668.883748.65180@57g2000hsv.googlegroups.com...
>
>
>
> > Good afternoon,
>
> > We have a windows 2000 terminal server and a windows 2003 terminal
> > server in our domain. Local users connect to these servers over our
> > LAN with HP thin clients ( windows CE based ) and with the microsoft
> > terminal services client on windows 2000 workstations.
>
> > This morning I had an error in the eventlog on our domaincontroller
> > ( windows 2000 ):
>
> > Logon Failure: Reason: The user has not been granted the requested
> > logon type at this machine User Name: planning Domain: 2k-DC Logon
> > Type: 2 Logon Process: User32 Authentication Package: Negotiate
> > Workstation Name: 2k-DC
>
> > The user who works on a thinclient couldn't log in, he got the
> > following error message on his screen:
>
> > 'Local policy does not permit you to log on interactively'
>
> > All users who try to log on to this terminal get this error. Wich is
> > strange; I checked the policies and the user accounts wether the box
> > was unchecked "allow to connect through terminal services". These
> > users can actually log onto another terminal or pc with RDP client
> > installed. I also checked the license server, there are still licenses
> > available - I should've gotten a license specific error in the
> > eventlog if I run out of licenses AFAIK. Maybe this problem is related
> > to the local CAL on the windows CE terminal client? Does anyone have a
> > suggestion?
>
> > Thanks in advance.
>
> > Oscar- Tekst uit oorspronkelijk bericht niet weergeven -
>
> - Tekst uit oorspronkelijk bericht weergeven -


First of all thanks for the quick reply Charles,

I double checked wether the user in question was able to log onto
another thin client. He actually could log onto both terminal servers
from that client. Another user ( in the same OU with the same rights )
cannot log onto the troublesom thin client, but can log onto his own
thin client ( or any thin client for that matter ). Alle fingers are
pointing at the thin client as both users can log onto other thin
clients. I read some information about CALs stored locally, could it
be that this local CAL is corrupted on the thin client?

The user permissions are set correctly according your list, Charles.

Kind regards,

Oscar