Domain user remotely access his desktop via RDP

[zillah2004]

Hi

How can I let a domain user ?John Allen? from his home to access his desktop (WS-A) at work via RDP.

First he would access his work network ( environment Active Directory 2003

) via VPN and then how can I let him to access his desktop (not the server) at work via RDP ??

Could someone post step by step how should I configure that ? Is it through server local policy (gpedit.msc) or domain policy (gpmc.msc ) or something else ? I have got only one server which is AD as well

Remote Desktop is enabled on WS-A.

I tried to google for it by using this key :

? add user to remote desktop groups Active Directory ? but I could not get what I am looking for :

http://www.google.com.au/search?hl=en&...mp;aq=f&oq=

http://www.computing.net/answers/windows-2...stion/5604.html

Thanks

[Silver_Guy]

Hey Zillah

Do you know if the firewall that he vpn's onto allows RDP into the business? You shouldn't need to make any changes in active directory unless want to take away the hassle of going to each computer to enable remote desktop

There is a good chance that the inbound connection is being blocked by the firewall

[zillah2004]

Hi Silver_Guy

What I did for testing purpose , I can vpn to the work's network with account that has previlidge for VPN as well John Allen he can vpn to the work's network.

Then I can RDP to (WS-A ,,,,,John Allen's PC) with local admin account not John Allen account.

That means if there is firewall preventing VPN connection it would have denied local admin account from logging in ,,,,,wouldn't it ?

Thanks

[Dragzo0o0]

You'll probably need to add the John Allen user account to the WS-A computers Remote Desktop Users group

On the WS-A Copmuter - Right Click Computer - Manage - Local Users and Groups - Groups - Remote Desktop Users

[zillah2004]

  Quote

On the WS-A Copmuter - Right Click Computer - Manage - Local Users and Groups - Groups - Remote Desktop Users

I can not do that because user is not locally created it is a domain user ,,,therefore if you search him on local PC you won't be able to find him.

[Xeron]

  zillah2004 said:

I can not do that because user is not locally created it is a domain user ,,,therefore if you search him on local PC you won't be able to find him.

Try it. You can add domain users to the local workstation groups. Just use DOMAIN\USERNAME syntax, or when the search box comes up, click the locations button and select Entire Directory.

[zillah2004]

  Quote

I logged in to WS-A as local admin then as a domain admin,,,,,in both cases I have got those

http://img13.imageshack.us/i/p3adminloggedinf.jpg/

I could not find an option to add a domain user (not a local user) Remote Desktop

[Ringer]

did you login to the domain or just the local computer because if you logged into the domain it should show the domain in the list

also on the select users screen you can type in the username "domain\username" and it should take it.

[zillah2004]

  Quote

did you login to the domain or just the local computer

Since i am not at work now,,,what I did I vpn to the work network then I RDP to WS-A (192.168.0.10) then I logged in to this workstation (used by Allen John) as a domain admin (not local admin), although I tried local admin as well.

But I could not see any domain users ,,,,I do not what mistake I am doing.

Thanks

[Ringer]

when you are at the login screen on WS-A use the domain admin account. in the format DOMAIN\USERNAME you will then be logging into the domain on that computer with your admin account you should then be able to see the domain listed in the location box

[zillah2004]

  Quote

when you are at the login screen on WS-A use the domain admin account. in the format DOMAIN\USERNAME you will then be logging into the domain on that computer with your admin account you should then be able to see the domain listed in the location box

I tried that same thing

[TurboTuna]

That screenshot you posted looks like the computer isn't on the domain. Strange.

[zillah2004]

  Quote

when you are at the login screen on WS-A use the domain admin account. in the format DOMAIN\USERNAME you will then be logging into the domain on that computer with your admin account you should then be able to see the domain listed in the location box

Do you thing because you are doing that locally and I am doing it through VPN ??

I have to try locally to log in to WS-A as a domain admin not a local admin and see if I can add John Allen.

Meanwhile could you please try to log in as a local admin and then try to use VPN and see if you are facing same my problem

Thanks

[VPuccetti]

  zillah2004 said:

Do you thing because you are doing that locally and I am doing it through VPN ??

I have to try locally to log in to WS-A as a domain admin not a local admin and see if I can add John Allen.

Meanwhile could you please try to log in as a local admin and then try to use VPN and see if you are facing same my problem

Thanks

Alrighty Zillah you have a couple issues not being talked about here.

1.) IF the person is connecting through VPN, it does NOT matter if their "home" computer (from where the client is accessing) is on the domain because the RDP protocol uses a port, 3389, which should be open on the VNC side.

2.) On the computer the person is trying to remote into (at work), that person (if it is THEIR computer and on your domain) always has access and can be viewed at the "Remote Desktop" area for "Select Remote Users" (Mine is "mydomain\victor"

3.) If a firewall is on, then you need to open the ports which you can do by creating a GPO on the server level, and making 3389 open on the localsubnet.

I've read what you've wrote, and I am VERY VERY confused by what you are trying to say. If you want them to authenticate with your domain WHILE they log in at home, you'd need some type of VPN service like Cisco's software to establish a VPN connection and then their home computer would have to be put on the domain.

Please check these settings and reply back:

- When you try and access RDP, are you making sure the Username is "Yourdomain\John Allen"? Sometimes when you RDP the "Log Onto" will be set for the LOCAL account, and not your domain.

- Go into your CMD prompt and do "ping -a 127.0.0.1" and the computer name should be "ws-a.yourdomain.local" correct?

- On the server level do a gpmc.sc or gpedit.msc (i always use gpmc.msc) and on your default policy navigate to "Computer Config - Administrative Templates - Network Connection - Windows Firewall - Domain Profile.

Here you can enable and define "Allow Remote Desktop Exception" If your VPN and local IP scheme are the same, then you can just do "Allow unsolicited incoming messages from" and add localsubnet (but if your VPN and LAN are different IP schemes, the VPN'd person will NOT be able to access their computer via RDP)

Edited December 17, 2009 by Unholee

[zillah2004]

Thanks

  Quote

When you try and access RDP, are you making sure the Username is "Yourdomain\John Allen"?

I have got this screen locally and via VPN :

User name : support,,,,,,,,,,,,,,,,,,,,,,,,,,member of the domain admin group,,,,,if I write username like this "AML\support" , (Log on to) option will gray out.

Password : forum

Log on to : AML,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,This is my domain name at work,,,,,drop down menu there is another option if I want to login to "This computer"

  Quote

Sometimes when you RDP the "Log Onto" will be set for the LOCAL account, and not your domain.

For sure this is not the case , and If this is case you can not login unless John Allen user was created locally on WS-A, and since John Allen was created as domain user I can not login.

Even with the username "support" memeber of the domain admin I can not login to WS-A if "Log On to" is set for the LOCAL account.

I can access this WS-A as domain admin user locally and via VPN (that means I do not have an issue with Firewall , with port , exception,,,,,,etc),,,,,,,,,,now at this stage leave domain user (Allen John) aside,,,,,,why cann't I add a domain user on WS-A to "Remote Desktop Users" on WS-A ???????

To add a domain user to "Remote Desktop Users" on any workstation do I need to configure any thing on the server ?

After that I can troubleshoot in case if Allen John can not get connected remotely to his workstation

[VPuccetti]

How much of this are you doing on the SERVER and CLIENT (at the domain) level?

I have an iPhone and I can access my work desktop via my VPN and I can also access my home computer via the internet... If you would like we can try and do Remote Assistance... I am just not understanding your terminology and comparing it to your picture (which has a COMPLETELY different computer name btw), I am just not getting it 100%.

I do not mean any disrespect by this, but are you using a translating site or is English a 2nd language?

Edited December 17, 2009 by Unholee

[sc302 Veteran]

this is why I haven't answered here....it gives me a headache trying to read this and follow it. If someone can put it into some form of legible english I can probably add in my two cents.

[zillah2004]

  Quote

this is why I haven't answered here....it gives me a headache trying to read this and follow it. If someone can put it into some form of legible english I can probably add in my two cents.

Keep your two cents for yourself, I do not bother if you do answer this or not.

[zillah2004]

  Quote

I am just not understanding your terminology and comparing it to your picture (which has a COMPLETELY different computer name btw), I am just not getting it 100%.

Thanks Unholee

To answer your question, real computer name is P3, for the fourm purpose I have just named it WS-A.

  Quote

I have got this screen locally and via VPN :

User name : support,,,,,,,,,,,,,,,,,,,,,,,,,,member of the domain admin group,,,,,if I write username like this "AML\support" , (Log on to) option will gray out.

Password : forum

Log on to : AML,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,This is my domain name at work,,,,,drop down menu there is another option if I want to login to "This computer"

The screen that I have meant in the quote above is similar to one below :

http://www.bristol.ac.uk/is/computing/advi...ogon-prompt.png

What I want to say if I want to log in I don't need to use this syntax : AML\support, because AML is already chosen in the : " Log on to " option.

  Quote

If you would like we can try and do Remote Assistance...

I appreciate your help and I do not mind to call you if you PM your phone number.

Thanks

[zillah2004]

  Quote

did you login to the domain or just the local computer because if you logged into the domain it should show the domain in the list

also on the select users screen you can type in the username "domain\username" and it should take it.

The problem was with ' TCP/IP Properties' > DNS section was pointing mistakenly to a default gateway (router) ip address 192.168.0.1 which it should not.

When I changed that to point to the domain controller (server 2003 and DNS as well) ip address 192.168.0.50 it worked like a charm.

Now when if I log in into any workstation (physically in front of a PC or via VPN) as a domain admin I can add a domain user to " Remote Desktop Properties "

[sc302 Veteran]

gateway should be your router, dns should only be your Active Directory DNS (no internet dns servers should be in the primary or secondary dns lookup).

hope that helps you.