Active Directory and Terminal Server

[bankajac]

I have a domain controller (Server 1) and a termianl server (Server 2). I set up a user in AD and make them a member of the Remote Desktop Users. I granted the Remote Desktop Users the right to lon on through Terminal Services. I can log on through Remote Desktop as the Administrator but not the user which I set up. What am I missing here?

I will be installing terminal services licenses once I get this working. Is it better to have the terminal server also be the licenses server or should I make the other server the license server?

Thanks in advance.

[bankajac]

I have tried everything and I cannot log on to the through terminal services as the user I set up. I can log on locally to the terminal server. I made the domain controller also the license server but the terminal server cannot locate the license server automatically. I have to manually enter the computer name. Any help will be greatly appreciated.

Thanks

[+BudMan MVC]

If your having problems locating your lic server

http://support.microsoft.com/kb/279561/

How to override the license server discovery process in Windows Server 2003 Terminal Services

http://technet2.microsoft.com/WindowsServe...3.mspx?mfr=true

Set preferred Terminal Server license servers

Not sure exactly what you mean by "I have to manually enter the computer name."

[bankajac]

Thanks for the reply Budman, but I resolved the license server. I just cannot figure out why I cannot log on to the terminal server through a terminal session with a user other than the Administrator. On the domain controller (in Domain Security Settings) I configured to allow Remote Desktop Users to connect through terminal services. I made the user a member of the Remote Desktop Group. On the terminal server in local security policy I configured Administrators and Remote Desktop Users to log on through terminal services. Here if I remove the Administrators group then I cannot log on through terminal services at all.

I apologize but I am very new to Active Directory. I am just trying to learn by doing. I was under the impression that the above is all I had to do to log on through terminal services. I am not sure why it only lets the administrator log and not the user who is the member of the Remote Desktop Group. It keeps on giving me the message that only members of the Remote Desktop Group can log on through termianl services. The user I careted is a member of the Remote Desktop Group. I just don't understand.

[+BudMan MVC]

If I am reading what you have done correctly - you have not put the user in the LOCAL Remote Desktop users Group on the terminal server itself.. But in the domain group called the same thing.

This user needs to be placed in "termianl server (Server 2)." Local RD users group..

http://technet2.microsoft.com/WindowsServe...3.mspx?mfr=true

Enabling users to connect remotely to the server.

[bankajac]

That's right. Shouldn't that work? On the termainl server, I garnted the Remote Desktop Users (Domain Group) the right to log on through terminal services.

[+BudMan MVC]

So you put the Domain Remote Desktop Users into the Local RD Users group?

Put the domain "USER" account you want to access the terminal server into the terminal servers local Remote Desktop Users group.

From the previous link I gave

--

It is highly recommended that you use the Remote Desktop Users group to grant individuals access to terminal servers, rather than assigning the required permissions manually

Caution: If you alter the default permissions on the Remote Desktop Users group or remove this group, members of this group might lose the ability to log on remotely to terminal servers.

--

This error "only members of the Remote Desktop Group can log on through termianl services." would sure point to you not having the account in this group.

http://technet2.microsoft.com/WindowsServe...3.mspx?mfr=true

Add users to the Remote Desktop Users group

[bankajac]

Budman thank you very much for taking the time to help a novice. You are a genious. Everything is working great now. I have two more issues I have to learn or resolve and I will be ready to use this server.

First, I have configured DHCP on the server. Once I did that I knew that I was going to lose internet connectivity. I have learned that what I need to do is to enable DNS forwarding for internet connections. In the forwarders area of the DNS server I typed in my ISP address of the DNS servers. The internet does not work. This is the area I amtotally lost on. Can you hel pme with this also?

My second issue is that I want my terminal server users to have access to a shared printer on Server 1 (I know that this is also the domain controller and should not be a print server). What I did to allow TS users to connect is what you said above except I created a group call TS App Users and made them a member of the Local RD Users group. That way I can just add users to that domain group and give them access to the TS server. I want those same users to have access to the printer but when I log on and try to connect to the printer in AD it says that I don have rights on that computer to connect. It would benice if I can somehow set up the TS User group to have access to the printer as well as the shared folder without the user havain to do anything, but I think that I am getting ahead of myself. That way when a TS App User logs on, the have a mapped drive to the share and a printer all set up. I say that I am getting ahead of myself because this probably involves scripting.

I thank you in advance for taking your valuable time to help me.

[bankajac]

I just got my first issue resolved. When I set up DHCP I picked a scope of 192.168.0.100 - 192.168.0.200. The gateway is 192.168.0.1. When I disabled DHCP on the router, I did not change the device IP to 192.168.0.1. I could not ping and IP address outside the network. Now that I can connect to the internet from the servers and the clients, I will work on the printer and share issue I mentioned above. I feel like I am learning alot setting this up. The best way to learn for me is to do.

[ShadowPHP]

  bankajac said:

My second issue is that I want my terminal server users to have access to a shared printer on Server 1 (I know that this is also the domain controller and should not be a print server). What I did to allow TS users to connect is what you said above except I created a group call TS App Users and made them a member of the Local RD Users group. That way I can just add users to that domain group and give them access to the TS server. I want those same users to have access to the printer but when I log on and try to connect to the printer in AD it says that I don have rights on that computer to connect. It would benice if I can somehow set up the TS User group to have access to the printer as well as the shared folder without the user havain to do anything, but I think that I am getting ahead of myself. That way when a TS App User logs on, the have a mapped drive to the share and a printer all set up. I say that I am getting ahead of myself because this probably involves scripting.

Printers

You could try and use a logon script for TS Users that would automatically connect to a printer.

To connect to printers use con2prt.exe. It should be located in your Windows/System32 directory on Server 2003.

Shared Drive

In said logon script, put a line saying

net use S: \\server\shared

to connect the S drive to \\server\shared