Active Directory and Terminal Server


Recommended Posts

I have a domain controller (Server 1) and a termianl server (Server 2). I set up a user in AD and make them a member of the Remote Desktop Users. I granted the Remote Desktop Users the right to lon on through Terminal Services. I can log on through Remote Desktop as the Administrator but not the user which I set up. What am I missing here?

I will be installing terminal services licenses once I get this working. Is it better to have the terminal server also be the licenses server or should I make the other server the license server?

Thanks in advance.

Link to comment
https://www.neowin.net/forum/topic/506510-active-directory-and-terminal-server/
Share on other sites

I have tried everything and I cannot log on to the through terminal services as the user I set up. I can log on locally to the terminal server. I made the domain controller also the license server but the terminal server cannot locate the license server automatically. I have to manually enter the computer name. Any help will be greatly appreciated.

Thanks

If your having problems locating your lic server

http://support.microsoft.com/kb/279561/

How to override the license server discovery process in Windows Server 2003 Terminal Services

http://technet2.microsoft.com/WindowsServe...3.mspx?mfr=true

Set preferred Terminal Server license servers

Not sure exactly what you mean by "I have to manually enter the computer name."

Thanks for the reply Budman, but I resolved the license server. I just cannot figure out why I cannot log on to the terminal server through a terminal session with a user other than the Administrator. On the domain controller (in Domain Security Settings) I configured to allow Remote Desktop Users to connect through terminal services. I made the user a member of the Remote Desktop Group. On the terminal server in local security policy I configured Administrators and Remote Desktop Users to log on through terminal services. Here if I remove the Administrators group then I cannot log on through terminal services at all.

I apologize but I am very new to Active Directory. I am just trying to learn by doing. I was under the impression that the above is all I had to do to log on through terminal services. I am not sure why it only lets the administrator log and not the user who is the member of the Remote Desktop Group. It keeps on giving me the message that only members of the Remote Desktop Group can log on through termianl services. The user I careted is a member of the Remote Desktop Group. I just don't understand.

If I am reading what you have done correctly - you have not put the user in the LOCAL Remote Desktop users Group on the terminal server itself.. But in the domain group called the same thing.

This user needs to be placed in "termianl server (Server 2)." Local RD users group..

http://technet2.microsoft.com/WindowsServe...3.mspx?mfr=true

Enabling users to connect remotely to the server.

So you put the Domain Remote Desktop Users into the Local RD Users group?

Put the domain "USER" account you want to access the terminal server into the terminal servers local Remote Desktop Users group.

From the previous link I gave

--

It is highly recommended that you use the Remote Desktop Users group to grant individuals access to terminal servers, rather than assigning the required permissions manually

Caution: If you alter the default permissions on the Remote Desktop Users group or remove this group, members of this group might lose the ability to log on remotely to terminal servers.

--

This error "only members of the Remote Desktop Group can log on through termianl services." would sure point to you not having the account in this group.

http://technet2.microsoft.com/WindowsServe...3.mspx?mfr=true

Add users to the Remote Desktop Users group

Budman thank you very much for taking the time to help a novice. You are a genious. Everything is working great now. I have two more issues I have to learn or resolve and I will be ready to use this server.

First, I have configured DHCP on the server. Once I did that I knew that I was going to lose internet connectivity. I have learned that what I need to do is to enable DNS forwarding for internet connections. In the forwarders area of the DNS server I typed in my ISP address of the DNS servers. The internet does not work. This is the area I amtotally lost on. Can you hel pme with this also?

My second issue is that I want my terminal server users to have access to a shared printer on Server 1 (I know that this is also the domain controller and should not be a print server). What I did to allow TS users to connect is what you said above except I created a group call TS App Users and made them a member of the Local RD Users group. That way I can just add users to that domain group and give them access to the TS server. I want those same users to have access to the printer but when I log on and try to connect to the printer in AD it says that I don have rights on that computer to connect. It would benice if I can somehow set up the TS User group to have access to the printer as well as the shared folder without the user havain to do anything, but I think that I am getting ahead of myself. That way when a TS App User logs on, the have a mapped drive to the share and a printer all set up. I say that I am getting ahead of myself because this probably involves scripting.

I thank you in advance for taking your valuable time to help me.

I just got my first issue resolved. When I set up DHCP I picked a scope of 192.168.0.100 - 192.168.0.200. The gateway is 192.168.0.1. When I disabled DHCP on the router, I did not change the device IP to 192.168.0.1. I could not ping and IP address outside the network. Now that I can connect to the internet from the servers and the clients, I will work on the printer and share issue I mentioned above. I feel like I am learning alot setting this up. The best way to learn for me is to do.

  bankajac said:

My second issue is that I want my terminal server users to have access to a shared printer on Server 1 (I know that this is also the domain controller and should not be a print server). What I did to allow TS users to connect is what you said above except I created a group call TS App Users and made them a member of the Local RD Users group. That way I can just add users to that domain group and give them access to the TS server. I want those same users to have access to the printer but when I log on and try to connect to the printer in AD it says that I don have rights on that computer to connect. It would benice if I can somehow set up the TS User group to have access to the printer as well as the shared folder without the user havain to do anything, but I think that I am getting ahead of myself. That way when a TS App User logs on, the have a mapped drive to the share and a printer all set up. I say that I am getting ahead of myself because this probably involves scripting.

Printers

You could try and use a logon script for TS Users that would automatically connect to a printer.

To connect to printers use con2prt.exe. It should be located in your Windows/System32 directory on Server 2003.

Shared Drive

In said logon script, put a line saying

net use S: \\server\shared

to connect the S drive to \\server\shared

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • LibreWolf 140.0.2-1 by Razvan Serea LibreWolf is an independent “fork” of Firefox, with the primary goals of privacy security and user freedom. It is the community run successor to LibreFox. LibreWolf is designed to increase protection against tracking and fingerprinting techniques, while also including a few security improvements. This is achieved through our privacy and security oriented settings and patches. LibreWolf also aims to remove all the telemetry, data collection and annoyances, as well as disabling anti-freedom features like DRM. LibreWolf features: Latest Firefox — LibreWolf is compiled directly from the latest build of Firefox Stable. You will have the the latest features, and security updates. Independent Build — LibreWolf uses a build independent of Firefox and has its own settings, profile folder and installation path. As a result, it can be installed alongside Firefox or any other browser. No phoning home — Embedded server links and other calling home functions are removed. In other words, minimal background connections by default. User settings updates Extensions firewall: limit internet access for extensions. Multi-platform (Windows/Linux/Mac/and soon Android) Community-Driven Dark theme (classic and advanced) LibreWolf privacy features: Delete cookies and website data on close. Include only privacy respecting search engines like DuckDuckGo and Searx. Include uBlockOrigin with custom default filter lists, and Tracking Protection in strict mode, to block trackers and ads. Strip tracking elements from URLs, both natively and through uBO. Enable dFPI, also known as Total Cookie Protection. Enable RFP which is part of the Tor Uplift project. RFP is considered the best in class anti-fingerprinting solution, and its goal is to make users look the same and cover as many metrics as possible, in an effort to block fingerprinting techniques. Always display user language as en-US to websites, in order to protect the language used in the browser and in the OS. Disable WebGL, as it is a strong fingerprinting vector. Prevent access to the location services of the OS, and use Mozilla's location API instead of Google's API. Limit ICE candidates generation to a single interface when sharing video or audio during a videoconference. Force DNS and WebRTC inside the proxy, when one is being used. Trim cross-origin referrers, so that they don't include the full URI. Disable link prefetching and speculative connections. Disable disk cache and clear temporary files on close. Disable form autofill. Disable search and form history...and more. Notes: To receive automatic updates, you may refer to the unofficial LibreWolf-WinUpdater that employs a scheduled task to accomplish the same. Download: LibreWolf 64-bit | Portable 64-bit |~100.0 MB (Open Source) Download: LibreWolf 32-bit | Portable 32-bit | Other Operating Systems Links: LibreWolf Home Page | Addons | Screenshot | Reddit Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • At least it doesn't reset your defaults lol. Back to Bing, MSN and Copilot lol. Wait, that's a feature, not a bug?
    • Exactly what I was going to say, lmao. Pro-grade where? I have the S24 Ultra and there are only marginal differences between that series and the S25 series. Hell, even the S23 and S22 series is similar. Samsung stopped trying years ago.
    • Are you asking us or telling us my friend?
    • Performance and bloating is my main concern.
  • Recent Achievements

    • Week One Done
      Hartej earned a badge
      Week One Done
    • One Year In
      TsunadeMama earned a badge
      One Year In
    • Week One Done
      shaheen earned a badge
      Week One Done
    • Dedicated
      Cole Multipass earned a badge
      Dedicated
    • Week One Done
      Alexander 001 earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      562
    2. 2
      +FloatingFatMan
      182
    3. 3
      ATLien_0
      170
    4. 4
      Skyfrog
      108
    5. 5
      Som
      106
  • Tell a friend

    Love Neowin? Tell a friend!