Sign in
Microsoft.com
 
Windows Server TechCenter
 
 
 
Windows Server TechCenter > Windows Server Forums > Terminal Services > how to enable TErminal Sewrvices on a Win2008 Domain Controller
Ask a questionAsk a question
Search Forums:
 

Answerhow to enable TErminal Sewrvices on a Win2008 Domain Controller

  • Friday, November 06, 2009 8:23 PMTCCK Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
     have everythign installed and ADministrators group can RDP in but the Remote Desktop Users security group cannot RDP into the server and it says tey do not have permission to.

    I rememeber on a Windows 2003 Server DC you had to change some of the local domain controller group policies but I cannot find them here on Windows 200 Server.

    HELP if any one has a document on this I would greatly appreciate it!!
     

Answers

All Replies

  • Friday, November 06, 2009 8:37 PMKristin L. GriffinMVP, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    TCCK,

    Do you get this error? "You do not have access to logon to this Session".

    First, I don't recommend this setup.

    Than being said, I think the setting you need to change is to add the "Log on Locally" right in the dc policy.

    I have not tried this on a 2k8 server, but I know it was the setting you needed to change in 2k.

    http://support.microsoft.com/default.aspx?scid=kb;en-us;q247989

    Hope this helps,

    Kristin L. Griffin

    Co-Author of the Windows Server 2008 Terminal Services Resource Kit (and a SUPER BIG fan of the Microsoft RDV Team!!!) 
     
  • Friday, November 06, 2009 8:42 PMTP [] Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Proposed Answer
    Sign In to Vote
    0
    Sign In to Vote

    Hi,

    Make sure the Remote Desktop Users group is present in the following two places:

    1. Local Security User Rights Assignment Allow logon through Terminal Services

    - Start--Run--secpol.msc
    - In the left pane, Navigate to Security Settings\Local Policies\User rights assignment
    - In the right pane, double-click on Allow logon through Terminal Services
    - Add the Remote Desktop Users to the list

    2. RDP-Tcp listener's Security

    - Start--Run--tsconfig.msc
    - Double-click on RDP-Tcp
    - On the Security tab, add Remote Desktop Users
    - Make sure that Remote Desktop Users has User and Guest access set to Allow

    If your DC will also be a Terminal Server, then you need to add the Terminal Services Role.

    Thanks.

    -TP

     
  • Friday, November 06, 2009 9:44 PMTCCK Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    done all of this and still cannot login with any account in the Remote Desktop Users security group.

    Any otehr suggestions people, I have to have this live Monday AM for my client.  

    And yes I know TS on a DC is not recommended but all users on this site know the issues and they had it this way on thier 2003 server and no issues.
     
  • Friday, November 06, 2009 9:46 PMTP [] Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    Please post the precise error message you are receiving.

    Thanks.

    -TP
     
  • Monday, November 09, 2009 10:49 AMDanny van Dam Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    Hi,

    It's better to install a seperate server for Terminal Services if you want to use this in a production enviroment. If the server becomes unavailabe because of Terminal Server issues then your domain has no primary domain controller if you do not have a secundary domain contoller.

    Danny
    Now you can follow al the hot TS forum threads on twitter! http://www.twitter.com/mstermserv Founder of www.citrix-guru.com and www.rds-support.eu Linkedin: www.linkedin.com/in/dnyvandam
     
  • Monday, November 09, 2009 1:15 PMTP [] Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    0
    Sign In to Vote
    Hi,

    Did you get this working?  I have installed TS on DCs (2000/2003/2008) many times over the years where appropriate, and there really is not much required to enable it.  There must be something set different than default on your server or my earlier instructions would have worked.  I can help you figure out the problem, but it is essential that you post the exact error message.  Please see here:

    Installing Terminal Server on a Domain Controller

    http://technet.microsoft.com/en-us/library/cc742817(WS.10).aspx

    Thanks.

    -TP
     
  • Monday, November 09, 2009 7:58 PMKristin L. GriffinMVP, ModeratorUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    0
    Sign In to Vote
    Hi TCCK,

    I went ahead and mocked this up on a 2008 DC and it was pretty simple to achieve.  Here are my exact steps:

    1. I installed the TS role service and rebooted.

    2.  Then I tried RDPing to the DC using a domain user account. I was denied access and I got this message:

    https://cid-7a4c3e570b074961.skydrive.live.com/self.aspx/Photos/TS%20on%20a%202008%20DC/message.bmp

    3. Following the message, I made sure the Domain Users group was a member of the Remote Desktop Users Group in ADUC (by default in the Builtin folder):

    https://cid-7a4c3e570b074961.skydrive.live.com/self.aspx/Photos/TS%20on%20a%202008%20DC/aduc%20rdusers.bmp

    4. Then I opened the Local Security Policy on the DC (Admin Tools, Local Security Policy) and added the Remote Desktop Users Group to this setting: Security Settings | Local Policies | User Rights Assignment | Allow Logon Through Terminal Services (this is the setting TP first referred to and also is mentioned in the link TP provided earlier in this thread):

    https://cid-7a4c3e570b074961.skydrive.live.com/self.aspx/Photos/TS%20on%20a%202008%20DC/allow%20logon.bmp


    Tested again and all is well.  This works.

    If you still cannot get this up and running, then I agree that you have something unique going on and would like to know your exact error message.  Also please share any event log errors on the server that may be relevant.

    Hope to hear from you,


    Kristin L. Griffin

    Co-Author of the Windows Server 2008 Terminal Services Resource Kit (and a SUPER BIG fan of the Microsoft RDV Team!!!)
     
  • Friday, November 13, 2009 4:16 PMTCCK Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    0
    Sign In to Vote
    It is fixed.

    I did the change in Local Security group policy and still did not work so I went digging and I found there were 3 places in the group policy editor I had to make the exact same change not just one like in Win2003 server.

    It is fixed and working awesome now.

    Danny,

    I know this is not recommended setup but when the client refuses to pay for 2 servers because they are cheap and want it all on one unfortunately this is what you have to do, put it all on one server.