How to assign remote users from GPO/users not authorized

Question

My account and my admins can remote into any machine on the network, but standard users get an "user not authorized" error. The only solution I've found is to manually add the users to the Approved Remote Users on the local machine. How can I do this server side?

I have everyone added to the Remote Desktop Users and the Remote Desktop Users enabled in the GPO Local Policy -> User Rights Assignment -> Allow terminal services (remote desktop) users. I figured this would be enough but the only way I have been able to make it work thus far, is to add these groups manually to the users machines.

When I go to remote in, I get a "the connection was denied because the user account is not authorized for remote login"

score 2 · Answer 1 · answered May 17 '16 at 02:56

2

The domain Remote Desktop Users group is for granting access to your Domain Controllers, not your RDS servers. You need to add your domain users and/or groups to the local Remote Desktop Users group on each of your RDS servers.

This article was written for Windows Server 2003 but is applicable as it relates to the usage and purpose of the domain Remote Desktop Users group:

https://technet.microsoft.com/en-us/library/cc756898(v=ws.10).aspx

answered May 17 '16 at 02:56

joeqwerty

109,901
6
81
172

Thanks for responding. I'm not looking for users to remote into servers. I want to sit at my and be able to login as them to their machines. We're a small shop so I have everyone's password. It's easier to maintain things than walking around to every machine. Does this still apply? I looked at the article and couldn't figure out how to make it local – tjcinnamon May 17 '16 at 15:59

score 1 · Accepted Answer · answered May 18 '16 at 17:27

1

As you said, you need to add the to the local Remote Desktop Users group. If you want to set it up "server side", the solution is to create an AD group, add the needed accounts to that group, then create a GPO setting "Restricted groups":

http://social.technet.microsoft.com/wiki/contents/articles/20402.active-directory-group-policy-restricted-groups.aspx

answered May 18 '16 at 17:27

curropar

631
3
18

I'll give this a try this weekend and let you know the results. – tjcinnamon May 19 '16 at 14:15
This worked perfect. On my non-DC and server policy I added a resricted group of Remote Desktop users and then needed to add that group to allow terminal services (Remote desktop) in User Rights Assignemtn – tjcinnamon May 21 '16 at 16:51
Glad to hear it helped! :) – curropar May 23 '16 at 08:30

How to assign remote users from GPO/users not authorized

2 Answers2