Networks

Ask something
Question Locked

Domain Local Remote Desktop Users Group

0 helpful
6 replies

by chrissthom

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This question seems fairly simple but still has me scratching my head.

I am wondering what the purpose is for the "Remote Desktop Users" domain local group that resides in the BuiltIn container that comes in any domain by default.

The description is:

Members in this group are granted the right to logon remotely.

You would think that any domain user member of this group could establish a Remote Desktop session to any domain member computer except for domain controllers (since you need to be a domain admin to connect to DCs). However, I have tested with users who are domain members and also members of this group. They continue to get rejected until they are added to the Remote Desktop Users local group which resides on the server they you are trying to connect to. The domain local Remote Desktop Users group seems to have no affect that I can determine.

Does anyone know what the purpose of the "Remote Desktop Users" group is?

Thanks

6 replies

by cg it

in a Windows AD environment, RRAS controls remote access into the network. The default for RRAS is to deny connections unless specifically allowed. [or use a RADIUS server for authentication]

the local machine remote access is local machine specific. the machine it's self not AD authenticates users.

There are Windows servers that are used in a non domain environment [workgroup] and the servers local machine remote desktop provides a method of remote access to the server.

by alanedwards

We have just had a similar debate at work on this.
The Build-it one is there for the DCs, as they have no local security accounts. Member servers use their local ones.

Of course you would have to grant the user the right to log on to the DC as well as adding them into the RDUG.

And of course, you only log onto a DC when you really have to (hence admin paks etc) so you wouldn't want to put anybody into them, would you!

by d.k

Hello Chris,

I guess Microsoft has tried to not make it too easy for you to join someone to such an insecure group...

The idea is that you join someone to this group AND also enable the 'logon through terminal services' option in the default domain policy (tab: localpol> user rights assignment).

I hope this works for you! But remember you allow remote conn. on all workstations in your domain!

by wanwisa_u

Thanks for d.k. I have problem that Remote Desktop use my_computer's_domain\user. I changed to use Terminal Services in Advance Setting option. Delete the current credential. It's good. It remember username and password for me. Not to bother again over and over when remote to another server.

This discussion is closed to new replies.