Domain Users cannot RDP but Admin group users can

Hi guys, need your urgent help. I have worked day and night on this issue. Basically the domain users if rdp to the server, it will get disconnected right away after place in domain account with password. However if logged on using console, I am getting
the below error message:
You cannot log on because the logon method you are using is not allowed on this computer. Please see your network administrator for more information.
I have checked few items to remediate the issues:
1. Done checked - Allow Log on through Remote Desktop Services RDP users group are in.
2. Domain users are added to local RDP users group.
3. KB 2667402 installed.
4. Restarted the RDP service.
Please take note this server have RDS installed as well as Citrix client version 7.
Evan Ting

Hi Evan,
Do you have any progress？
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]

Similar Messages

DW CS5.5 "Put" cannot ftp but Manage Site Test can

In DW CS 5.5 Build 11.5, clicking on "Put" or "Get" generates the error message "An FTP error occurred - cannot make connection to the host" but at Site>Manage Sites>Server>Test, I get "Adobe DW CS 5.5 connected to your Web server successfully". Is there more than one place in DW to configure FTP? Thank you.

After not working for a week, suddenly today DW works. "Put" and "Get" both connect. The only thing I did in the interim was successfully run Site>Manage Sites>Server>Test several times over several days. I am grateful for whatever fixed the problem, but I cannot explain it. I thank those of you here who read and considered my question.

Allow connection to RDS applicatoins and restrict RDP connection for domain users

I have configured RDS setup, with the following Roles: RD Web Access, RD Gate Way, RD Connection Broker, RD Session Host and RD Licensing.
the problem is that the domain users can't run the published applications unless I add the "Domain Users" group into the remote desktop users on the RDS servers, but now all domain users can connect RDP to the RDS servers.
so we need domain users to connect to the RDS published applications and restricting them from connecting RDP to the RDS servers, in addition I can see that internal servers are accessible from outside through the RD gateway server.
any ideas ?

Hi,
Thank you for posting in Windows Server Forum.
For a test you can create one group, assign the specified user under that group. Add that group under “Remote Desktop User” local group. For getting access to published Remote Application you can simply assign\add the group under collection properties of the
application and that user can get access.
For restricting user to server remotely, you can add that group of user under “Deny logon through remote desktop service” under User Rights assignment. Also you can check “Deny
New User Logons to an RD Session Host Server” settings.
Hope it helps!
Thanks.
Dharmesh Solanki

Domain Users are allowed by default to join domain

Hi everyone !
Recently i install Windows Server 2012 Standard
Configure Active Directory Domain Services
Create simple user "test1"
then i go to windows 7 client and join domain with this "test1" user.
and i shocked how is it possible that a simple domain user which is not a part of any domain admin or admin group and can join or rejoin domain successfully.
Help me to get out of this how can i restrict simple domain user to join domain and why it was by default ?

> then i go to windows 7 client and join domain with this "test1" user.
By default, EVERY user can join up to 10 clients to the domain.
> and i shocked how is it possible that a simple domain user which is not
Why shocked? What's the issue when users join computers to the domain?
> Help me to get out of this how can i restrict simple domain user to join
> domain and why it was by default ?
Create a GPO, link it to the domain, move it up to above "Default Domain
Policy" and configure Computer - Policies - Windows Settings - Security
Settings - Local Settings - User Rights Assignment: Add Workstations to
the domain.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Create a "Domain User"

From here [url http://e-docs.bea.com/aldsp/docs30/admin/security.html#wp1090018]
I found that only a "domain user" can do what I am trying to do. However, the only user account created during creation of the domain is "weblogic" which appears not to be a domain user, but merely an administrator. I was not prompted to create a domain user when I created the domain. So, can someone tell me how to do this?
Thanks,
Jeff

A "domain user" is simply a user in the domain. The "weblogic" account is a "domain user".
To create more "domain users", go to the documentation for WebLogic Server, and search on : create a user
http://edocs.bea.com/wls/docs92/index.html

Can we map three BPC users with single domain user

Hi..
When we map the three BPC users in the ABAP server in the program UJA3_WRITE_SYS_USERS with domain user,can we map with only one domain user for all three BPC users or we have to use three different domain users to map the three BPC users?
Please do reply
Thanks
Bobby

yep
u can map three bpc user with single domain user.
but domain user must have management roles.

Difference between AD domain user and local user

Hello, I think the title is self explanatory. I am trying to figure out difference between AD domain user and local user. SAP Help wasnt very helpful.
Thanks.

Hi,
It's about where the user accounts are kept. Domain users are users that are entered into the domain users group on a domain controller. These domain users can be centrally managed at the server. Whereas the local users are the users created in the local system.
In BPC, you can select users from either of them or in combination as well. However, If you want to make change in the local user credentials, you need to login to the system in which the user has been created and make the changes there. On the other hand, changes to domain users can be made from any domain connected machine with the right software and the necessary rights. The changes only need to be made once.
Hope this helps.

Unity 7.0 - AD Domain Admin Group

I have Unity 7.0 with failover, AD, and Exchange 2010. Unity accounts are created in AD in the Domain Admin Group. Most that I have read states if Unity is a domain controller it needs to be in the Domain Admin group. I do not know how to see if Unity is a domain controller and do not know why (previous to me), Unity was setup in the Domain Admin Group.
Can you help me understand why Unity might be setup in the Domain Admin Group, reasons?
Thanks,

Melinda;
-> if you use the tools depot option in the unity server you will see an option called dc\gc reconnect tool to check if unity looks at itself as a domain controller; here is a link that will give you more informaiton on this tool; http://www.ciscounitytools.com/Applications/Unity/DCGCReconnect/Help/DCGCConnectionManager.htm
-> Can you clarify if you are asking whether the unity reference account ( unityinstall/unimgstoresvc/unitydirsvc) needs to be domain admin or not ? If you query is related to the above mentioned accounts ; what permissions do they need is documented in the following link;
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/unity/5x/installation/guide/umexfo/5xcuigumefox/5xcuigumefo070.html
-i hope this helps.

General users can't open web analysis reports as html

Hi guys,
I am facing an issue about Web Analysis. When I use the version pre-9, I can access web analysis directly with html client or java client.Then I set each user with each POV. Now I am using EPM11.1.1.3, I can just access web analysis by workspace.Then if I would like to access java client, I click Tools->links->web analysis studio. While I access html client by clicking explore in the workspace toolbar. However, if the user doesn't belong to admin group, I can't find the explore toolbar. Then I can't access html client. As we know, not all web analysis users should be admin users. This issue puzzles me very much. Is there someone who can give some good suggestions? Thanks a lot.

Hi, you don't mention what roles you have assigned to the current users (except Admin), which as you stated isn't a good idea ;-)
You need to add Analyst & Explorer roles for your users.
Check out the full list of roles in Appendix A under the Reporting and Analysis section, in the Security Admin Guide (epm_security.pdf)
http://download.oracle.com/docs/cd/E12825_01/nav/portal_2.htm
Cheers, Iain

User Accounts in Domain Admins group do not have full administrative rights to the server

Our server was fine until recently one day we lost admin access for admin user accounts. If we log in to the server with the Domain Admin account, this account has full admin access to the server and can install and launch all programs and even all server
admin tools. If we log into the server with a user account which is in the Domain Admins group, that account cannot install software or launch Services.MSC. Even IE will not load any page and crash with a "Not Responding" Error.
The server has no viruses we even ran SFC /SCANNOW and it did repair from corrupted files but that didn't fix the issue.
Any ideas?

Hi Rick,
May be UAC is blocking installtion. Have it disabled and see if it helps. Ensure you have domain admin groups added into local administrators group.
Alos Check these links please.
https://social.technet.microsoft.com/Forums/en-US/b5300f28-6a2a-4760-8b80-97a2da0f87c1/2012-domain-admin-user-cannot-install-programs-on-a-domain-windows-7-pc?forum=winserverDS
https://social.technet.microsoft.com/Forums/en-US/0ca040de-52ac-4259-bf78-c22436fd04d4/domain-users-with-domain-admins-right-cannot-install-programs-or-open-server-manager?forum=winserverDS
Thanks,
Umesh.S.K

MS Office 2013 cannot open on user account but admin account can open ms office 2013

Hello
Before I have to use office 2010 proplus it not have problem for open ms office on user account after i have to upgrad to ms office 2013 version(15.0.4551.1512) i got problem cannot open ms office 2013 on user account but can open ms office 2013 on admin
account. I try to grant user account permision full control on C:\Program Files\Microsoft Office 15 but not working. Micorsoft support pro plus has remote to my pc and told me to change registry by add permision full control user account on hkey_current-User\software
then restart but not work. I have to uninstall and reinstall MS Office 2013 or repair it not working to open user account. MS Support told me to try download Office 2013 trial version to install it working to open on user account but Trail version is
15.0.4420.1017 and try to open mail on outlook it slow reponse. now this case still cannot solve. I don't know who can fix this or not. Please advices Thank you.

Hello Tony
Thank you for your reply
I checked event log not have any error for this. I click word , excell and all ms office not have any pop. I have to add user account permission full control by list below . It not working.
- C:\Program Files\Microsoft Office
- C:\Program Files\Microsoft Office 15
I had to post this on Microsoft Community . After MS Support ask my pc join network or not i told my pc join network . He told me to post this forum.
I give you more information to try something.
I have to created new account for local computer and add new account to users group after that i try to log on local pc by use new account and try to open ms office excel , word etc.. It can open.
I have to log on to domain by account user on domain it cannot open MS office but i have to add this account user to administrators groups. It can open ms office. If i change that account to users group and try to open ms office . It cannot open and
not have pop up and error.
If you need more information please let me know. Thank you

Can not add Domain User to Local Admin Group Win8.1

Hello,
I am trying to add a domain user to the local admin account on a Win8.1 Enterprise computer. When I click the check name button it asks me to enter network credentials even though I am signed in to the computer with a domain admin account. When I try to
type in any of my domain admin accounts it says "The Username or Password is incorrect". Even though I used that same account to login with. I can successfully ping all 3 of my DCs from the computer and have tried putting my second DC as the primary
DNS and my third DC as the primary DC and same problem. I have checked for Active Directory errors on the DC and everything says it is running fine on the DC in server manager. I have this problem on multiple computers. Some of the computers it will work on
but 90% of them it won't allow me to add the local user to the local admin group.
DCs are running Win Server 2008 R2 Enterprise.
Any help would be greatly appreciated.
Thank You

I would suggest you to use Restricted Group(via GPO) to add domain users/group to a local admins group
1)Create a new group in Active Driectory
Create a new group in Active Driectory that you wish to add to every workstations local administrator group. DO NOT add any users to this group at this time.
2.
Create a new GPO
Create a new group policy object and link it to the desired OU. Make sure that the GPO you are using covers the OU that the WORKSTATIONS you are wanting to give users local administrative rights over.
3.
Edit the newly created GPO
Navigate within the newly created GPO to Computer Configuration -> Policies -> Windows Settings -> Security Settings --> Restricted Groups
4.
Add your new Active Directory group to the Restricted Group
Right-click the Restricted Groups folder and select "Add Group" to add your new Active Directory group to the Restricted Group. In the Group field, type the name of the newly created Active Directory group and click "OK"
5.
Add the Restricted Group to the local administrator group
In the Restricted Group Properties windows click "Add" under the section titled "This group is a member of:" Type "Administrators" (without the quotes and yes it is plural), in the Group Membership window and click "OK"
6.
Wait for GPO updates to apply to the workstations
Once your users receive their updated group policy settings every workstation within the OU you specified will have your new Active Directory group as a member of the local administrators group. If you need to force the GPO update on a specific workstation,
run "gpupdate /force" in a command window on that workstation.
7.
Add a user or group of users to the Active Directory Restricted Group
When you are ready, or in a position where you need to provide local workstation admin rights you can simply add the users or group of users to the Active Directory group that you created for use with Restricted Groups within your Active Directory Management
Console.

Cannot delegate Reporting Services Web access to domain user / group, User does not have required permissions

Hi
I have an SCCM 2012 SP1 CU3 installation on a Server 2008 R2 + SQL 2008 R2.
I'm having trouble delegating Reporting Services Web Access to a standard domain user.
I have followed the instructions from these blogs:
http://blog.coretech.dk/kea/creating-the-reporting-user-role-in-configmgr-2012/
http://www.wolffhaven45.com/blog/sccm/assigning-users-to-configmgr-reportusers-group-in-sccm-2012/
No matter how I try, I cannot get the reports to show for a standard domain user. In the console no reports are showing and in the web access I get
"User domain\user does not have required permissions........"
The only thing that is consistenly working when I test is to put the AD Group on the Security Role "Full Administrator".
Then everything will show up.
Any ideas on how to troubleshoot this?

Thanks everyone for helping me with tips. I have now solved the problem. It was the permissions from SCCM that did not replicate to the Reporting Server.
In srsrp.log I got these error messages:
Could not retrieve the reporting service name for instance 'MSSQLSERVER'
Invalid class
Could not stop the reporting serviceAfter googling a litte I found these 2 sites with similiar problems:http://social.technet.microsoft.com/Forums/en-US/d4a7f93a-506f-4e3f-b5fc-bd2b087277da/ssrs-permissions-do-not-add?forum=configmanagergeneral
http://www.microtom.net/microsoft-system-center/software-distribution/sccm-2012-reporting-services-do-not-install
So I ran the command for SQL 2008 R2: mofcomp.exe C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqlmgmproviderxpsp2up.mof
and BAAM, everything started to work =)
/ALX

Adding a domain user to Local Admin Groups using MDT 2012

I don't know if this will help anyone, but it did me after weeks of searching. If you are trying to add a domain user or domain groups to the local administrators group using MDT, simply go to the cs.ini and add "SkipAdminAccounts=No".
But the administrators accounts page will only appear if you choose to join a domain.

Correct, if you were to go into the %DeployRoot%\Scripts\DeployWiz_Definition_ENU.xml file you would see the entry for the DeployWiz_AdminAccounts.xml page as follows:
<Pane id="AdministratorAccounts" reference="DeployWiz_AdminAccounts.xml">
<Condition><![CDATA[ UCase(Property("SkipAdminAccounts")) = "NO" and UCase(Property("DeploymentType"))<>"REPLACE" and Property("DeploymentType")<>"CUSTOM" and Property("JoinDomain") <> "" ]]></Condition>
</Pane>
Most Wizard Pages are displayed by default, and you can turn them off by using the SkipXxxXxxxxx Page variable to hide them during wizard execution. This page is different, since it was added for MDT 2012, the MDT team decided to leave it *OFF* by default,
instead you must explicitly turn off the SkipAdminAccounts variable by setting it to "NO".
Additionally, you would not need to display this page if you were running a Refresh or a Custom Task Sequence.
Finally, this page does not actually *create* accounts, instead it just adds pre-existing user accounts and adds them to the local Administrators group. This scenario is only valid when you are joining the machine to a domain, so you must Join to the Domain.
If you are interested in adding other local users to the Administrators Group, you should write a script to create the account(s) and add them to the local group. Windows 8.1 has some *gotchas* that have to do with Microsoft Accounts, but that's a different
Story :^).
Keith Garner - keithga.wordpress.com

Domain user network share browsing slow, but domain admin is fast

I've seen quite a few threads about slow network share browsing in Windows 7, and I've tried every fix to no avail. I did notice something that has not been mentioned in any threads that I've seen though, and that's the behavior is different when using
a user account with administrative privileges.
Environment: SBS2011, domain, 14 Windows 7 PC's that all exhibit the same behavior
As an account in the domain users group, browse to a network share with approx. 400 items to display, and it takes 4-5 seconds for explorer to show them. Same delay exists when creating new folders in this folder. Displaying this folder in any
way reproduces this delay, whether navigating up or down the file system, or by going straight to the share's UNC path.
Folders with fewer items have less of a delay, the effect seems proportional.
As an account in the domain admins group, navigation is lickety split. Tested with two different administrative accounts. Tested on multiple PC's. Also took a user account that exhibited the issue, added them as a member of domain admins,
and this resolved the issue for that user account.
Any ideas?

Did you ever find a solution to this issue?
We are running into a similar issue. We have a few specific Domain Users who are reporting difficulty navigating or searching network shares. Searching a small folder of files is taking 30+ seconds. All of our domain admins can search the
same folder instantly. If we add this Domain User into Domain Admins his searching is instant, when we demote him back down to Domain user its slow again. The Domain User is having the same issue no matter what computer he uses. Us Domain
Admins can log into the same computer and it comes up with search results instantly, log out and log back in as the Domain User and suddenly its slow again.
Any help would be appreciated.

Domain Users cannot RDP but Admin group users can

Similar Messages

Maybe you are looking for