Accidentally removed the ability to use remote desktop

Question

Hi,
Thanks to anyone that can assist.
Using SBS2011 Standard:
Whilst remotely connected and investigating ways to allow an ordinary domain user to have login access to the server, I inadvertently removed the ability of the primary domain admin user to gain access with remote desktop. By primary domain admin
user, I mean the default user created for administrative purposes at SBS set up/install time.
I was able to regain remote desktop access by adding this user to the Remote Desktop Users group. However this is really a workaround rather than proper corrective action. I know that this is not necessary in a basic default setup of SBS2011 as there are
other almost identical servers I look after where I have not needed to do this and yet still have remote desktop connection capability with "out of the box" settings.
Also, I would really like to find out what mistake I made so that I can avoid doing this again.
Tricky

Answer 1

Hello Larry,
Your suggestion of comparing ADUC across servers was one that I had already thought of and done but I did not notice any differences. Nonetheless, your post suggested to me that I ought to recheck my steps, so I revisited it and was mortified to find that
somehow the admin user was no longer a member of Administrators. I am baffled as to how I managed to achieve this because to the best of my memory, Administrators group membership was not one of the things I looked at in connection with my intent (read on
for my logic in this respect).
I suspect that this might be the problem! I will attempt to rectify and return to this thread in due course.
WRT granting a user logon rights at the server, I hear what you are saying and even said the same to myself. But let's just for the moment look at the real world rather than the ideal world. Many SBS installations are in the types of businesses that are,
let's face it, small (after all that is what the first S in SBS stands for). Such business cannot afford qualified IT personel and as such need to designate certain trusted members of staff to carry out some of the things that, if they had any, IT personel
would normally do. For example, swapping external USB hdd's and monitoring backup success/failure.
Rather than allow them to logon to the server as an administrator, safer I would have thought to allow them to logon as a user. Unless you can tell me of a way that this can be done from a user logon at their client PC? My knowledge is not encyclopaedic
so I am open to suggestions of a better way if such a way exists.
Tricky