Windows Forum

Ask something
Discussion Locked

Logon Message

0 helpful
3 replies

by lynnsims

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I Server running "Windows2000 Server" and Terminal Services. I am the "Admin" user of the server. I have 5 workstations running "Windows2000 Pro" that are connected to this server, users of these workstations are "Domain Users". I can logon to "all"computers, through Terminal Services. However, none of the other users "Domain Users" are able to logon to the server through "Terminal Services". the Logon Message I get back is "The local policy of this system does not permit you to logon interactively." All the permissions in "user" properties are set to accept "Terminal Service Users". What can I do that will allow "Domain Users" to logon to "Terminal Services"???
HELP!!!
Lynnn Sims

3 replies

by ian mclaws

You're getting into a dangerous ground, here. Domain controllers will not, by default, allow user accounts to log on to it, it will only validate them to logon elsewhere. This is for security reasons, users have no business having local access to a domain controller's resources. You are getting this message because when a user connects to a terminal server, their actions are performed on the server itself as a local call.
You have two choices. You can eliminate the error message completely by going into the domain controller security policy (from the admin tools menu) and allowing your domain users the right to log on locally (you'll find it in "user rights"). The downside of this is the loss of security involved. Or, preferentially, you should configure another 2000 server as a member server running terminal services.
If you do enable user access to your controller, make absolutely sure you have plugged all of the Microsoft default "everyone - full control" permissions holes beforeallowing a user connection. This will preserve SOME security, at least.

Good luck,

Ian

This discussion is closed to new replies.