Local account credentials and licensing

Hello, we have a Windows 2008 R2 server used for terminal services.
The server is configured and is working fine.
All domain users can login without issues.
If we login with a domain administrator account, this server successfully contacts the license server and validates.
However, we have the server locked with a local administrator account, as there is an application that runs in the background.
Because of this, we are encountering the error: "The Remote Desktop Session Host Server Configuration tool is running with local account credentials. In Licensing Diagnosis, the Total Number of licenses Available value may be inaccurate." It gives
the warning that we have a number of days before the remote services is disabled.
Obviously we don't want this to happen.
My questions is if this will actually be disabled, even though we have validated with the license server before with a domain account?
Do we have to have server locked with a domain account to get rid of this error?
Many Thanks,
Ravi

Hi Ravi,
Thank you for your posting in Windows Server Forum.
Yes, to get rid from this error and for better result you must always attach License server with Domain account. Means you need to join the server to a domain. Because the error which you are facing is due to “Issue with Credential” as License server
can’t identify the local user account credentials. In your case, you need to lock server with domain account.
Please check below article.
Licensing Diagnosis: Problems and Resolutions
http://blogs.msdn.com/b/rds/archive/2008/02/01/licensing-diagnosis-problems-and-resolutions.aspx
Hope it helps!
Thanks.
Dharmesh Solanki

Similar Messages

Windows 8 Sysprep - Can't skip local account creation and autologon fails, wrong admin password.

Using Windows 8 x64 Enterprise, Sysprep pauses to ask me to create a local user, which I don't want.
If I enable SkipSystemOOBE and SkipUserOOBE in OOBE under Microsoft-Windows-Shell-Setup sysprep (in oobe mode) will skip user creation and autologon works. But it only works correctly once. If I run sysprep again, when it tries to autologon
it will say that I have the wrong password for the local account. After I type in the password manually it works. If I use the same password for the local administrator account as for the autologon account, it looks to have the encrypted password
twice with an equal sign after it.
What I need to know:
How to skip local user account creation (we run on a domain but I have it connect through scripts later)
How to fix the autologon issue
Do I need the local administrator account enabled for this to work?
I have my unattend.xml file attached.
<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
<settings pass="oobeSystem">
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<AutoLogon>
<Password>
<Value>[removed]</Value>
<PlainText>false</PlainText>
</Password>
<Username>[removed]</Username>
<LogonCount>2</LogonCount>
<Enabled>true</Enabled>
</AutoLogon>
<FirstLogonCommands>
<SynchronousCommand wcm:action="add">
<Order>1</Order>
<CommandLine>c:\folder\abatchfile.bat</CommandLine>
<RequiresUserInput>false</RequiresUserInput>
</SynchronousCommand>
</FirstLogonCommands>
<OOBE>
<HideEULAPage>true</HideEULAPage>
<HideOEMRegistrationScreen>true</HideOEMRegistrationScreen>
<HideOnlineAccountScreens>true</HideOnlineAccountScreens>
<HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE>
<NetworkLocation>Work</NetworkLocation>
<HideLocalAccountScreen>true</HideLocalAccountScreen>
<ProtectYourPC>3</ProtectYourPC>
</OOBE>
<TimeZone>Eastern Standard Time</TimeZone>
<DisableAutoDaylightTimeSet>false</DisableAutoDaylightTimeSet>
<RegisteredOrganization>Company Name</RegisteredOrganization>
<RegisteredOwner>CompanyName</RegisteredOwner>
</component>
<component name="Microsoft-Windows-International-Core" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<UserLocale>en-US</UserLocale>
<UILanguage>en-US</UILanguage>
<SystemLocale>en-US</SystemLocale>
<InputLocale>en-US</InputLocale>
</component>
</settings>
<settings pass="specialize">
<component name="Microsoft-Windows-Shell-Setup" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<ComputerName>*</ComputerName>
</component>
</settings>
<cpi:offlineImage cpi:source="wim:[removed]/sources/install.wim#Windows 8 Enterprise" xmlns:cpi="urn:schemas-microsoft-com:cpi" />
</unattend>

The user accounts-creation page in Windows Welcome is suppressed if a user or a group is added to a local security group. Add a user or a group to a local security group by doing one of the following:
Create a local user.
Add a domain user to a local security group with the Microsoft-Windows-Shell-Setup | UserAccounts unattended installation setting.
To suppress the user accounts-creation page in Windows Welcome, without creating a local user, use one of the following workarounds:
Workaround 1
If the computer is already joined to a domain, use the following XML example to add the Domain Users security group to the Local Users security group.
<DomainAccounts>
<DomainAccountList wcm:action="add">
<DomainAccount wcm:action="add">
<Group>Users</Group>
<Name>Domain Users</Name>
</DomainAccount>
<Domain>FabrikamDomain</Domain>
</DomainAccountList>
</DomainAccounts>
Because joining a domain automatically adds the Domain Users security group to the Local Users security group, the DomainAccounts command does not affect the membership of the Local Users group. However, using this XML example to join a domain will also suppress
the user accounts-creation page in Windows Welcome.
Workaround 2
Use the Sysprep/Quit command to set the following registry value to 1:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE\UnattendCreatedUser
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”

Using HTML DB account credentials

Using HTML DB account credentials and login page, I created two groups - one for managers and one for users. The schema is to be shared and has other groups that should not be allowed to view the application. When setting rights on the page items (queries, tabs), only one group can be added. I would like managers to be able to view pages 1,2, and 3 and users to be able to view pages 1 and 2. When granting the managers rights to page 3 and users rights to page 1 and 2, this works fine for the users, but managers cannot view pages 1 and 2. If I add managers to the users group, they cannot access page 3. What is the best practice for doing this?

Thank you for responding. I apologize for being Anonymous, that was not my intention. I implemented the authentication scheme by going to the Page Definition and selecting the Region. Going down to the Authorization section, I selected an Authorization Scheme with the users that I wish to have permissions. The ability to use compound rules sounds like what I need.
Doris

Run As Account Credentials Distribution (More Secure option)

Hi
I am bit confused "in which scenarios, we should distribute Run as Account credentials to Resource Pool".
I mean we have bydefault three Resource Pools (AD Assignment, All Management Servers and Notification Resource Pool) in SCOM and we create two more pools basically for Network Device Monitoring and Unix/Linux Monitoring.
Lets take an example- I have to discover and monitor Unix computers and Network devices. So I have configured one Run As Account for Unix Monitoring and one SNMP v2 Run as account for Network Device Monitoring. So in these both scenarios, on which basis
I should distribute these Run as Account credentials and to which computers/resource pools?
Please let me know if anybody know about this.
Thanks in advance.
Abhinav | MCTS-Server Virtualization

For Unix runas account, you should distribute the account to all UNIX machines and SNMP runas account is distributed to machines which run the network discovery rule.
Roger
This is not correct.
For UNIX/Linux monitoring, the credentials should be distributed to your custom "UNIX/Linux monitoring resource pool" or whatever your choose to call it. There is no UNIX/Linux monitoring resource pool out of the box - you need to create one, and
it can be any combination of management servers you want (or you certainly can use the all management servers resource pool if you have a small environment and no dedicate UNIX MS's).
For network monitoring (SNMP), the credentials are automatically distributed to the correct entities when you create the account in the discovery wizard (to network discovery servers class or something like that - I don't have a console in front of me...).
There is no need to manually set up distribution of these credentials.
Please answer responsibly.
Jonathan Almquist | SCOMskills, LLC (http://scomskills.com)

Syncronization: How can i store mail for different accounts remotely, and copy most important mails manually to local folders on two devices?

Hello. I have two devices and two accounts, so what i want is this:
I only want to store mail from both accounts in a remote place and copy most important mails to local folders.
(I will be grateful for any ideas as to where/how this "cloud" can be - specially free places)
* Can I have a copy of these local folders in both devices and the remote storage?
* Could i synchronize devices so that: when i move a mail to a local folder in any device, its copied to the same folders in
the other device and the remote storage place?
* The remote storage place will have many other folders. When I open Thunderbird, I also want to see these and the mail
inside, and also be able to move mail from the inbox to these folders.
* One of the accounts is gmail. In Account Setting tool, there is an option for synchronization. If there is no easier way, I can have mail for other account copied to gmail, and just syncronize gmail mail. For this, how will I copy my present folder structure to gmail. And how can I syncronize the local folders on the two devices?
Thanks in advance.

The first awkwardness I see is that there's no obvious format in which to store messages remotely such that you can work with them in an email client. It may be possible to set the "Local Directory" option in the account in Thunderbird to point at some remote folder (DropBox comes to mind) but I have never tried this and I'd be nervous about what happens if connection can't be made, or if you happened to access it from two different places simultaneously. The other concern is that mail stores get big, quickly, and you'd be forever uploading and downloading large (multi gigabyte) files. Thunderbird stores what looks like a folder containing many separate messages as one big file, so there's no simple opportunity for incremental changes to be up/down loaded.
The whole idea of Local Folders in Thunderbird is to detach messages from servers, so they don't track what happens on servers. I say this to point out the distinction between files stored locally and permanently ("Local Folders"), versus cached copies of online files ("synchronized"). It's not safe to regard your synchronized folders as permanent.
So, synchronized folders on an IMAP server are "mirrored" in Thunderbird so you do have a local (albeit temporary and transient) copy of messages; this is done mainly to avoid repeatedly downloading messages if you re-read them, and it makes searching faster an more efficient. But these "synchronized" message track what's being done on the server, and so if they are deleted anywhere, all synchronized devices will at some point also see the deleted messages vanishing. (Unless you made a local copy in the Local Folders account.)
I use a gmail account pretty much as you have described; I copy or move messages to that account so they are visible in my phone, my tablet, my own laptop and my works computer. It's free, and it's "in the cloud"; the only reservation I have is its privacy. There are other providers (e.g. 1&1/gmx) who don't seem to have the data collection fetish that google thrives on.
It's fairly simple to create filters in Thunderbird to automatically copy messages to your "cloud account"; even better is to set up forwarding rules on the other accounts' servers, so your messages are automatically sent on and waiting for you when you next login, already in the cloud account.

I have two Creative Cloud accounts, occurred by accident, I wish to merge them and have all my details and licenses under one account, how do I do that?

I have two Creative Cloud accounts, occurred by accident, I wish to merge them and have all my details and licenses under one account, how do I do that?
This is due to the different changes Adobe has gone through and unfortunately I used different emails at certain times.

Under one Adobe ID you can have one CC only,if by accident you have purchased two CC under one account, it needs to be cancelled & refunded, please contact Adobe Support at
http://adobe.ly/yxj0t6
Regards
Rajshree

How can I install WebOfTrust for a local account and save the profile so that it transfers to domain accounts that log on to that specific computer?

We are creating images through ghost server to clone onto several laptops and one of the features we need to have configured is the Web of Trust extension in Firefox. I have configured a local account on the machine and set up Web of Trust and then copied the profile image in regedit to the default profile image and saved this. WOT works for local accounts but whenever I try domain accounts, Web of Trust needs to be disabled and re-enabled.

Try using Web of Trust support:
http://www.mywot.com/en/support
Or post in their user support forum:
http://www.mywot.com/en/forum

Recently I logout from App Store and immediately I logged .after that I clicked the FaceTime and it is asking for signin.so I entered the credentials and clicked on signin .at that I got one pop up like rupees 5 deducted from your carrier account

Recently I logout from App Store and immediately I logged into the App Store .After that I clicked the FaceTime and it is asking for signin.so I entered the credentials and clicked on signin .at that moment I got one pop up like rupees 5/- deducted from your carrier account
from that moment onwards its keep on deducting the amount from mobile money account.its nothing but when I am enable the feature like FaceTime and imessage you are keep on deducting the amount from the carrier account
actually I can use the FaceTime and iMessage through internet right
then how can you deduct the amount from carrier even if the Internet is on in my mobile
can you please resolve this issue asap
iam facing this issue from so many days
but today very frequently the amount got deducted
if you need any information regarding this please let me know
i facing so many problem in my iPhone after installing iOS 7.0
from that time onwards repeadtly facing the performance issues
can you please check it with high priority
actualy now I'm not even switch on the Internet because of money deduction every time of rupees 5/-
one more issue was if iam trying to on the cellular data ,when i on the cellular data I.e., 2Giam not getting the internet
if enable the 3G and off it immediatly then I am getting Internet for that day
one that day if I off and on the cellular data,then it works correctly

Recently I logout from App Store and immediately I logged into the App Store .After that I clicked the FaceTime and it is asking for signin.so I entered the credentials and clicked on signin .at that moment I got one pop up like rupees 5/- deducted from your carrier account
from that moment onwards its keep on deducting the amount from mobile money account.its nothing but when I am enable the feature like FaceTime and imessage you are keep on deducting the amount from the carrier account
actually I can use the FaceTime and iMessage through internet right
then how can you deduct the amount from carrier even if the Internet is on in my mobile
can you please resolve this issue asap
iam facing this issue from so many days
but today very frequently the amount got deducted
if you need any information regarding this please let me know
i facing so many problem in my iPhone after installing iOS 7.0
from that time onwards repeadtly facing the performance issues
can you please check it with high priority
actualy now I'm not even switch on the Internet because of money deduction every time of rupees 5/-
one more issue was if iam trying to on the cellular data ,when i on the cellular data I.e., 2Giam not getting the internet
if enable the 3G and off it immediatly then I am getting Internet for that day
one that day if I off and on the cellular data,then it works correctly

EWS API - Impersonating to update a calendar item created by any other user than a service account, raise an error "Access is denied. Check credentials and try again."

Hi,
I am new to using EWS managed APIs.
Following is the issue:
1. I am using a service account e.g. [email protected]. This user is a global administrator and also has ApplicationImpersonation role assigned. (Sign into Online Office 365 account -> Admin -> select "Exchange" tab- > select Permissions
on the left panel -> create an impersonation role -> assign ApplicationImpersonation in Roles: and [email protected] in Members: -> Click on save)
2. Create a calendar item by other user for e.g. [email protected], and invite an attendee - [email protected].
3. In a c# program, I connect to EWS service using a service account - [email protected], fetch its calendar events. If organizer of an event is some other user - [email protected] then
I use impersonation in the following way to update the calendar event/item properties- subject, body text etc.
        private static void Impersonate(string organizer)
            string impersonatedUserSMTPAddress = organizer;
            ImpersonatedUserId impersonatedUserId =
                new ImpersonatedUserId(ConnectingIdType.SmtpAddress, impersonatedUserSMTPAddress);
            service.ImpersonatedUserId = impersonatedUserId;
4. It was working fine till yesterday afternoon. Suddenly, it started throwing an exception "Access is denied. Check credentials and try again." Whenever I try to
update that event.
       private static void FindAndUpdate(ExchangeService service)
            CalendarView cv = new CalendarView(DateTime.Now, DateTime.Now.AddDays(30));
            cv.MaxItemsReturned = 25;
            try
                FindItemsResults<Item> masterResults = service.FindItems(WellKnownFolderName.Calendar, cv);
                foreach (Appointment item in masterResults.Items)
                    if (item is Appointment)
                        Appointment masterItem = item as Appointment;
                        if (!masterRecurEventIDs.Contains(masterItem.ICalUid.ToString()))
                            masterItem.Load();
                            if (!masterItem.Subject.Contains(" (Updated content)"))
                                //impersonate organizer to update and save for further use
                                Impersonate(masterItem.Organizer.Address.ToString());
                                // Update the subject and body
                                masterItem.Subject = masterItem.Subject + " (Updated content)";
                                string currentBodyType = masterItem.Body.BodyType.ToString();
                                masterItem.Body = masterItem.Body.Text + "\nUpdated Body Info:
xxxxxxxxxxxx";
                                // This results in an UpdateItem operation call to EWS.
                                masterItem.Update(ConflictResolutionMode.AutoResolve);
                                // Send updated notification to organizer of an appointment
                                CreateAndSendEmail(masterItem.Organizer.Address.ToString(), masterItem.Subject);
                                masterRecurEventIDs.Add(masterItem.ICalUid.ToString());
                            else
                                Console.WriteLine("Event is already updated. No need to update again.:\r\n");
                                Console.WriteLine("Subject: " + masterItem.Subject);
                                Console.WriteLine("Description: " + masterItem.Body.Text);
            catch (Exception ex)
                Console.WriteLine("Error: " + ex.Message);
5. What could be an issue here? Initially I thought may be its a throttling policy which is stopping same user after making certain API call limits for the day, but I am still seeing this issue today.
Any help is appreciated.
Thanks

Your logic doesn't sound correct here eg
2. Create a calendar item by other user for e.g. [email protected], and invite an attendee - [email protected]
3. In a c# program, I connect to EWS service using a service account - [email protected], fetch its calendar events. If organizer of an event is some other user - [email protected] then
I use impersonation in the following way to update the calendar event/item properties- subject, body text etc.
When your connecting to [email protected] mailbox the only user that can make changes to items within
abccalendar is abc (or ABC's delegates). If your impersonating the Organizer of the appointment pqr that wouldn't work unless the organizer had rights to abc's calendar. If you want to make updates to a calendar
appointment like that you should connect to the Organizers mailbox first update the original, send updates and then accept the updates.
When you impersonate your impersonating the security context of the Mailbox your impersonating so its the same a logging on as that user in OWA or Outlook.
Cheers
Glen

On Windows Server 2008, local account passwords are reset when the server is rebooted. Why, and how do we fix?

We are running a commercial application on a Windows 2008 Server. After reboot, we cannot access the application because two services fail to start. The reason they fail to start is that the passwords to the local user accounts tied to those services have
either been deleted or reset to a different value. In order to restart the application, we must reset the passwords of these two local accounts, then stop and restart all the application's services. According to the application's maker, the accounts
must be local.
My colleague believes the passwords are being deleted or reset as a result of a global domain policy. Is this likely?
Assuming my colleague is correct, is there anything we can do locally to prevent these passwords from being deleted or reset when the server reboots? If not, what is the most granular change we can ask our AD adminstrators to make to the policy, so
that these local accounts are not touched at reboot.
Thanks.

Hello,
have you configured the accounts to have the permission "Log on as a service"? I have seen that this is not given to the account and therefore the service fails to start.
Best regards
Meinolf Weber
MVP, MCP, MCTS
Microsoft MVP - Directory Services
My Blog: http://blogs.msmvps.com/MWeber
Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
Twitter:

Automatically sync IMAP account (provider) and LOCAL account (my Mac)

Hi everybody
I've searched a lot but didn't find an answer yet. Maybe someone can give me a hint.
I'm looking for a functionality similar to E-Mail favourites in WIndows. The target is to automatically make a copy of some folders in my IMAP account to my LOCAL account. I need to have access to my old E-Mails even when I'm not connected to the Internet.
Any ideas?
Greets
Hger

Hger wrote:
Hi everybody
I've searched a lot but didn't find an answer yet. Maybe someone can give me a hint.
I'm looking for a functionality similar to E-Mail favourites in WIndows. The target is to automatically make a copy of some folders in my IMAP account to my LOCAL account. I need to have access to my old E-Mails even when I'm not connected to the Internet.
go to mail preferences->accounts->advanced and check the option "Keep copies of messages for offline viewing"->"all messages and attachments". then you'll have them on your mac and will be able to use them even when not connected to internet.
Any ideas?
Greets
Hger

Local Account and individual password

I am recently using Windows 10.
I have connected my computer to my Microsoft account (my hotmail account).
My login password of my computer becomes my login password of my hotmail account.
And I cannot disconnect my Microsoft account with the name that I used before.
I want to ask if
(1) I can set individual account passwords of my computer and my email?
(2) I can reset a local account with the name that I have used before?

On Thu, 26 Mar 2015 10:40:04 +0000, Marco Pokia wrote:
I am recently using Windows 10.
I have connected my computer to my Microsoft account (my hotmail account).
My login password of my computer becomes my login password of my hotmail account.
And I cannot disconnect my Microsoft account with the name that I used before.
This forum, as per the name, is for Windows 10 Phone issues. Please repost
your question to one of the Windows 10 for PCs/tablets forums.
Paul Adare - FIM CM MVP
Don't drop dead. Do, please, drop seriously, painfully, disablingly,
repulsively, incurably, but not fatally ill. -- Mike Andrews

Difference between- LOGGINGin to SQL SERVER AGENT as LOCAL-ACCOUNT and NETWORK-SERIVICE

By defauld SQL-SERVER-AGENT is set to log in as local account... What is the difference between logging in to sql server agent as local account or as network service...??

By defauld SQL-SERVER-AGENT is set to log in as local account... What is the difference between logging in to sql server agent as local account or as network service...??
Hello ,
Read and make out the difference
http://stackoverflow.com/questions/510170/the-difference-between-the-local-system-account-and-the-networ
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684272(v=vs.85).aspxk-service-acco
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684190(v=vs.85).aspx
As a best practice use Account with minimum privileges to run SQL Server agent
Please mark this reply as the answer or vote as helpful, as appropriate, to make it useful for other readers

Local accounts and active directory

I'm reposting this from the Tiger forums. I suspect that is more user-oriented and this question isn't. Apologies if this is the wrong place for it.
I've been working on getting the Macs where I work bound to Active Directory and I'm not clear on how local accounts are (or are not) affected by it.
I bound one of our Macs to AD and tested it out. It let me log in with Windows NT accounts. Cool. It gave me single sign-on access to network shares. Cool.
As a test, I had created a local account that had the same login and password as a network account, but I noticed after signing in, that the account didn't behave like a network account (i.e., no single sign-on access.) So, it appears that if a local account has the same login as a network account, the machine treats it fully as a local account. Sound reasonable.
But... here's the twist.
Where I work, we have about 15-20 Macs, none have ever been bound to AD, all running with local accounts. (The previous Mac tech didn't know how to do this which is why it's set up that way.) I was hoping that I could change the local accounts to match the network accounts, but obviously that's not going to work. If a local machine account won't behave like a network account, how do I go about setting up the current Macs as AD machines without forcing the users to recreate their whole set up under a whole new login? Is there a way to do it?

Rick,
OS X always checks local Netinfo directory first and if user is not found in netinfo it will check other directories based on order specified in Directory Access.
Here are the steps to follow to bind you macs to AD and still keep existing user home folders:
- bound machine to AD
- rename existing local-user home folder
- delete existing local-user (since you renamed his home folder no data will be lost)
- login AD account to cache his AD credential; this will create a new default home folder
- delete newly created home folder and rename original home folder based on AD shortname
- change ownership of this home folder to reflect AD account (use chown, see man page on how to use it)

The "Microsoft Store" app and local account

Hi
With Windows 8.1 Update,
I use some local account.
When I log on to one of them, I open
the "Microsoft Store" app and
I access through a Microsoft account.
At this point, I noticed that my local account
is completely switched to the Microsoft account.
How come? How do I prevent this?
Thanks
Bye
Balubeto

Hi Balubeto,
Firstly, follow these steps to disconnect the Microsoft account:
1. Open change PC settings;
2. Click Accounts link in the right navigation bar;
3. The below screen appear:
click Disconnect , you will switch to the local account.
After that, if you want to access Windows Store, follow this method to avoid making the whole PC switching to the Microsoft Account:
Click Sign in each app separately instead (not recommended) link at the bottom of the page, you will connect the Microsoft account just to this app.
Karen Hu
TechNet Community Support
Doing in this way, I could also install or update some apps for all users?
Thanks
Bye
Balubeto

Local account credentials and licensing

Similar Messages

Maybe you are looking for