0

I have a Windows Server 2016 VM running on Azure. It is joined to an Azure Active Directory. Remote Desktop Services are installed and seem to be working properly.

I am trying to allow users from Azure AD to log into the server. The problem is that only users that are in the 'AAD DC Administrators' group can log in. All other users get this error message 'The requested session access is denied'

I've made sure that the AAD users are in the 'Remote Desktop Users' local group. I've also added those users to the Session Collection properties user groups in Remote Desktop Services.

I'm not really sure what other permissions user need to be able to log into the server. I obviously can't keep all of the users in the AAS DC Admins group.

JonathanDavidArndt
  • 1,424
  • 3
  • 20
  • 29
Sequenzia
  • 191
  • 2
  • 6

2 Answers2

1

Not sure if its documentation somewhere or supported (NOT TO BE DONE ON PRODUCTION) but i have been able to create my own group to manage RDP on Azure AD Domain service.

Steps

Created group in Azure AD and added members (MyRDPGroup), waited about 15 - 20 mins for replication.

enter image description here

On a already Azure AD Domain Service Joined VM using Group Policy management added the newly created group (MyRDPGroup) to the GPO policy that adds accounts to the Local Administrator group.

enter image description here

When added the GPO looked like below.

enter image description here

Waited about 15 - 20 mins for replication. Did a 'gpupdate /force' on member VM and reboot.

I was then able to login to any Azure AD Domain Service joined VM with credential for member of group (MyRDPGroup).

Just test right now and it still work. Hope this helps.

harrymc
  • 483
  • 3
  • 11
Hannel
  • 651
  • 4
  • 9
  • Thanks for the help. I think I can make it work like this also but I was trying to avoid making all the users local admins but I might have to. Thanks again. – Sequenzia Feb 12 '18 at 13:50
  • You can actually add group to the local 'Remote Desktop Users' group using the same process. Thought your goal was not to give then Admin access to the DC – Hannel Feb 12 '18 at 16:58
0

Check/ Try this:

Start → Run → secpol.msc

Security Settings\Local Policies\User Rights Assignment

Right pane → double-click on Allow log on through Remote Desktop Services → Add Users or Group → enter Remote Desktop Users

micahmckittrick
  • 198
  • 4