Remote desktop policy works on Windows 7, but not on Windows 8

Question

Hey all,
           We have a mixed environment of Windows 7 and Windows 8.1 machines.
Our standard policy enables remote desktop on all machines (and another part of the policy sets the groups allowed to remote access).
On windows 7, we are able to RDP to all machines
On windows 8.1, remote clients cannot connect, with a timeout error. This occurs from other Windows 7 or Windows 8 machines.
I have confirmed:
- The policy has applied (by looking in the registry under HKLM\software\policies\Microsoft\windowsNT\Terminal services)
- The windows firewall is letting the RDP traffic through (and the issue still occurs if the firewall is off)
- The group policy templates being used in the policy are Windows 8.1 and the GPO was created on a Windows 8.1 machine
- If I set the registry key HKLM\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections = 0, manually or via GP Prefs, it still does not work
- There are no visible errors in the application, system or security logs
- I have compared registry snapshots before and after the change below and cannot see any differences in the relevant keys
If I take the machine out of the OU and place it into a "noPolicy" OU, connections still do not work (after setting the regkey above) - however, if I use the GUI to turn off remote desktop then turn it back on, it works. I can then place the computer
back in the original OU (where policy is applied) and it still works.
All this leads me to believe that remote desktop is not being turned on "properly" (for want of a better term) by group policy and doing so via the GUI is doing something different/additional.
So...
- Has anyone seen this before ?
- Anyone know how to turn on some sort of trace logging for this ? I have been unable to find a setting for this as yet ?
Thanks.

Answer 1

Hi Ben,
Did this happen to all Windows 8.1 clients?
>>however, if I use the GUI to turn off remote desktop then turn it back on, it works. I can then place the computer back in the original OU (where policy is applied) and it still works.
Did we try restarting the machine to tackle the issue, for sometimes restarting can be helpful.
>>Anyone know how to turn on some sort of trace logging for this ?
I am not sure this is what we want for tracing this issue, but for tracing group policy processing, Gpsvc.log can be helpful.
Regarding how to collect Gpsvc.log, the following blog can be referred to for more information.
Userenvlog for Windows Vista/2008/Win7
http://blogs.technet.com/b/mempson/archive/2010/01/10/userenvlog-for-windows-vista-2008-win7.aspx
Best regards,
Frank Shen