Windows Forum

Ask something
Discussion Locked

Terminal Services logon

0 helpful
9 replies

by ahroo

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
32-bit client on a w95machine. I can not logon to the terminal services server (which has ADir, DHCP and DNS running)The administrator account can logon, but each domain user account cannot. I get a message saying that the servers' local security policy will not allow interactive logons. I have looked and not found the interactive logon line in either the local or domain security policies. Help!! :O)

9 replies

by hdekken

I think the problem is that the user is believed to logon locally by terminal Server.

The location of the policies you are looking for is in Usermanager (on NT server)=> policies => User rights....

Try these and please tell me if it worked.
Good luck...

by fgarber

There are a couple of thing you need to check.
1. Make sure in the user rights that log on locally and log on from network are allowed for domain users.

2. Do the same for Authenticated Users.

Terminal server authentication works differently than NT server because you can have anonymous users.

by shanghai sam

Your problem is that it sounds like your terminal server is also a DC. By default, only Domain Admins for the domain will be allowed to login locally to DCs. (This applies to TS logins to DCs as well!) I don't recommend allowing all domain users login locally rights to the domain controller, because unless you are willing to play lots of allow/deny games with a modified OU structure for DCs, you will be allowing all users to login to ALL domain controllers in that domain!!! To TS to a DC, the user should be a member of the Domain Admins group.

However, if you choose to open this security hole, you need to modify the Default Domain Controllers Policy (Right click the Domain Controllers OU in AD Users & Computers > Properties > Group Policy). The setting for who can login locally can be found in the following directory:

Computer Configuration
Windows Settings
Security Settings
Local Policies
User Rights Assignment

Find the GPO specifying "Log on locally"

Finally, if you are running TS in Remote Administration mode, then the connection has specific properties that prevent the terminal session from being created. Open Terminal Services Configuration on the server, open the connections folder, and get to the properties of the desired connection (RDP-Tcp most likely). Under the security of that connection, the users that need to be able to connect in Remote admin mode need permissions here.

That should get you going in a few directions. Good luck.

by steve

I would create a Terminal Services User Group. Then goto to the security policy of that computer. If it's a DC, then goto domain controller security policy. Goto to the section for logon locally. Assign the group log on locally rights.

This discussion is closed to new replies.