Option "Deny this user permissions to logon to a Remote Desktop Session Host Server" tuned on

Last week a lot of users start to complain that they can´t access my TS Server, where there are several Remote Apps published in my TS Gateway server. Everything was fine in the last 3 years.
We´re investigating an issue related to the Oracle IDM application, maybe the reconcilliantion process is enabling the "Deny this user permissions to logon to a Remote Desktop Session Host Server" option, without our permission
But the investigation of the problem will take longer, so, i need a method to remove the checkbok of the option, via script or automated method, while we´re investigating the issue, because the users calls, we uncheck the option and everything is fone again,
but several hours later, the checkbos appears checked (on) again
I could´t find the option in powershell, nor ADSIEdit/Attribute editor.
I even couldn´t find the name of the field
I need to create a qucik-script to sweep the AD, and uncheck the optin, automatically, untill the problem is solved

Some new information:
1) The Oracle IDM/OAM solution was "Guilty".
For some reason, during a regular updated schedulted task for the IDM solution, the field was found with no info, and the software "thought" that the default parameter was "enabled" and all affected users got the "deny" option checked (this is a weird
"reverse" misunderstanding, because the proper state is "disabled" in AD, but the software set it to "Enabled", ebcause "thinks" that is "TSAllowLogon", in fact is the oposite meaning.
2) I could find the "allowLogon" or "TSAllowLogon", but it is inside a "UserParameter" option, like a multi-valued option:
Get-ADUser -Filter {SAMAccountNAme -eq '<USERNAME>'} -Properties UserParameters
The result was:
UserParameters : CtxCfgPresent P☺CtxCfgPresent????☺CtxCfgFlags1????☺CtxShadow????*☻☺CtxMinEncryptionLevel?
The exact same, as seeing in ADSI Edit/Advanced Attribute Editor, but i can see in a 3rd party LDAP browser, the LDAP browser decoded the field, showing a lot of other informations, like AllowLogon=0, among others

Similar Messages

How can I Deny permissions to logon to Remote Desktop Session Host server in powershell script?

I am need of some assistance please. I am a system admin and I am trying to create a script that will assist with the tedious tasks I have to do with disabling a user that no longer works for the company.
I have created a script so far that will reset the users passwords and remove them from all groups (minus domain users).
I am trying to make it where it will deny permissions to logon to Remote Desktop Session Host server as well as give full mailbox permission to the manager in Exchange Server 2010.
I know with Exchange 2010, I will need to add the Powershell snapin. Is there a way for this to be added into the script? I am thinking to add the code:
add-pssnapin Microsoft.exchange.management.powershell.e2010
Is there another way to do this? Any help or recommendations would be much appreciated.
$ou = Get-ADUser -SearchBase "<*OU info here*>" -Filter * |
Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "<*Password here*>" -Force)
foreach ($user in $ou) {
$UserDN = $user.DistinguishedName
Get-ADGroup -LDAPFilter "(member=$UserDN)" | foreach-object {
if ($_.name -ne "Domain Users") {remove-adgroupmember -identity $_.name -member $UserDN -Confirm:$False} }

Why not just disable the account?Why are you searching an OU foro users when you just want to terminate one user?
You can remotely connect an exchange session and manipulate the mailbox permissions. You do not load a snap-in except on the Exchange server.
$Session=New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://<FQDN of Exchange 2013 Client Access server>/PowerShell/
Import-PSSession $Session
# exchange commands here
\_(ツ)_/
We have a checklist we have to go through with the tasks listed. We have to keep to the account enabled until HR changes
the status which is usually 30-90 days depending. Managers sometimes need to access the accounts to retrieve information, etc. We put the users in an OU; once we are given permission from the manager we move forward in the removal.

[Forum FAQ] Troubleshoot the error "The Remote Desktop Session Host server is in Per User licensing mode and No Redirector Mode"

Symptom
RD License server is a key component of RDS. It licenses users to access RDS servers.
After purchase the required RDS CALs, we need to activate the RDS License server and install the purchased RDS CALs. However, during the installation or after installation, we may face errors
about RDS License.
In most cases, the following error may occur.
Error:
The Remote Desktop Session Host server is in Per User licensing mode and No Redirector Mode, but license server "Server name" does not have any installed licenses with the following
attributes:
Product version: Windows Server 2012
Licensing mode: Per User
License type: RDS CALs
Troubleshooting
1. Check whether the RD License Configuration is configured properly and there are no Warnings in the Event.
2. The License Server should be part of 'RD Server License' group in Active Directory Domain Services.
3. Check if the Licensing Mode is correct.
- To change the Licensing Mode we can use RD Licensing diagnose, PowerShell cmdlet and Group Policy.
Via PowerShell cmdlet:
To change the licensing mode on RDSH/RDVH:
$obj = get-wmiobject -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting
$obj.ChangeMode(value)
# Value can be 2 - per Device, 4 - Per user
Via Group Policy
Path: Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Licensing
Use the specified RD license servers = FQDN of server name
Set the Remote Desktop licensing mode =
Per User
However, if issue persists, please provide detailed information and post the question in the
Remote Desktop Services (Terminal Services) forum.
Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

Hi Richard,
You need to uninstall Remote desktop session host feature. After removing it, you will default two connections which does not need to purchase RD CALs'.
Thanks,
Umesh.S.K

The remote desktop session host configuration & Remote session shadowing options missing in Windows server 2012.

Hi All,
I am using a Windows server 2012 Standard. When i leave my session idle for more than 20 min it disconnects and post more 20 minutes my session is logged off.
I know this setting can be changed from Remote desktop session host configuration in Windows server 2008 R2. But this option "Remote desktop session host configuration" is not there in Windows server 2012. Does any one have an idea where do i go
and edit these settings in the Server 2012 o/s ?
Also the Remote session shadowing option is also not available when i right click a user in the task manager. Any idea on an alternate method in Windows server 2012 ?
Gautam.75801

Exactly WHERE are the W2K12 R2 equivalent GPO settings to W2K8 R2 GPO settings of "Set time limit for disconnected sessions" and "set time limit for active but idle Remote Desktop Services
sessions"? Microsoft changed the remote desktop/terminal services around.
Appreciate it.
Matt
Policy Path
Scope
Policy Setting Name
Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits
User
End session when time limits are reached
Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits
Machine
End session when time limits are reached
Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits
User
Set time limit for disconnected sessions
Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits
Machine
Set time limit for disconnected sessions
Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits
User
Set time limit for active but idle Remote Desktop Services sessions
Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits
Machine
Set time limit for active but idle Remote Desktop Services sessions
Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits
User
Set time limit for active Remote Desktop Services sessions
Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits
Machine
Set time limit for active Remote Desktop Services sessions
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

NULL SID Security Log Event ID 4625 when attempting logon to 2008 R2 Remote Desktop Session Host

This is a new deployment of Server 2008 R2 in a newly created 08 R2 active directory on a newlyt installed 08 R2 RDSH server.
A new generic user is created in AD. That user can log on to the terminal server on the console just fine. But that user cannot logon via RDP. Furthermore, the domain admin credentials also cannot logon via RDP.
When either set of credentials is used, the logon attempt registered in the Windows Security Even Log as a denied attempt with Event ID 4625 reporting a NULL SID.
Troubleshooting: The RDSH has already been disjoined and rejoined to the domain. Also, curious note, there are three ways to save the user account on the RDSH server as a valid user account which has permissions to logon. The one Microsoft recommends is to open computer management and edit the remote desktop users group. When I the accounts here and click apply, they immediately dissapear. Secondly, I can open the computer properties and go to the remote tab. There I find the user accounts added using the previous method are enumerated but not displaying correctly. They show up with the RDSH server name and a question mark. The last way, is to open the Remote Desktop Session Configuration tool and edit the properties of the rdp connection and go to the security tab. This was the only place I could get a user to ‘stick’ but the logon attempts still show a NULL SID and access is denied.
I have scoured every bit of RDS documenation I can find with no luck.
Thanks,
Chris

I am also experiencing this issue.
2008 servers, 2007 exchange on server 2008.
These are fresh servers, fresh AD. Users can log onto domain normally, RDP not working for admin accounts, generating same errors as posted above.
The bigger issue, is that we have a cisco messaging service account that is generating this error on the DC's and the Exchange server as well. The service basically emails users voicemails to their inbox. The user we've created for the cisco service is unable
to authenticate to the exchange server, in turn generating the same errors posted above as well. We can log on to the domain with this account just fine.
Any ideas on this? We have not tried re-adding the servers to the domain.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 5/5/2010 9:01:13 AM
Event ID: 4625
Task Category: Logon
Level: Information
Keywords: Audit Failure
User: N/A
Computer: xx.corp
Description:
An account failed to log on.
Subject:
Security ID: NULL SID
   Account Name: -
   Account Domain: -
   Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
   Security ID: NULL SID
   Account Name:
xxxx
   Account Domain:
xxxx
Failure Information:
   Failure Reason: Domain sid inconsistent.
   Status: 0xc000006d
   Sub Status: 0xc000019b
Process Information:
   Caller Process ID: 0x0
   Caller Process Name: -
Network Information:
   Workstation Name: laptop
   Source Network Address: -
   Source Port: -
Detailed Authentication Information:
   Logon Process: NtLmSsp
   Authentication Package: NTLM
   Transited Services: -
   Package Name (NTLM only): -
   Key Length: 0

Can I use Remote Desktop Connection (windows server 2008) even if no user is logged in?

I'm configuring a Server, running Windows Server 2008, to be accessed remotely. Suppose no user is logged in in the server (if it was just turned
on, for instance). Can I use the "Remote Desktop Connection" feature to log in remotely in this case? Or is it always necessary to have a user locally logged in, to remotely log in to one of the users available?

If its a fresh installation, RDM might not work at first.
1. You need to check firewall and allow Remote Desktop. To be specific, communication to port 3389 TCP
2. Right click My Computer --> Properties --> Remote tab
Enable Remote Desktop
Allow connections to this computer
Click users and grant the permissions for the users. By default, Administrators do have the permission. An also, the users who are members of the 'Remote Desktop Users' security group also have the permission

How to allow more than two users on remote desktop on windows server 2012 foundation?

i have a dell server power edge T300 with windows server 2012 foundation. I am unable to connect more than two remote desktop at once.

Hi,
Add to Brain, you cannot have more than 15 user accounts in Windows Server 2012 Foundation.
In order to access a hosted application, such as Microsoft® Office, a license for Windows Server 2012 Remote Desktop Services is required for each user account (not to exceed 15 user
accounts) that directly or indirectly uses RD Gateway to host a graphical user interface, including using Remote Desktop Connection (RDC) client. When using Remote Desktop Services, you may not install or use Remote Desktop Connection Broker or Remote
Desktop Virtualization Host role services. For more information about Remote Desktop CALs , see http://go.microsoft.com/fwlink/?LinkId=140238.
http://technet.microsoft.com/en-us/library/jj679892.aspx
Hope this helps.
Jeremy Wu
TechNet Community Support

Create a 1-click setup for a Remote Desktop session for non-tech users

Hi everyone,
I know how to configure a VPN or use port forwarding for VNC, ARD, etc. and know about iChat's Screen Sharing feature and sites like LogMeIn. But I'm looking for something special here. This is the situation:
• A user calls me for help and I would prefer a Remote Desktop session
• He's usually behind a NAT router which hasn't been set up to allow remote access
• He's absolutely NOT tech savy
So I'd like to have an easy way to allow me to initiate a Remote Desktop session (ARD/VNC) with as little user interaction needed as possible. I don't want to walk him through reconfiguring his router on the phone!
I was thinking of using iChat's Screen Sharing first. But I'd need to create a jabber account, save iChat's preference file, maybe pack it into a little "Installer" and mail it to him. So all he needs to do is double-click it and run iChat afterwards and accept me.
But this is a little too much for my taste and I'm wondering if there isn't already a "best practice" or something like that. Any ideas or suggestions?
Thanks a lot!
Björn

I've recently started using TeamViewer. If you can walk a person through going to http://www.teamviewer.com and clicking on "Start Full Version" and getting them to download it and run it, then you're good to go. It's cross-platform both ways so you can control a Mac from a PC and a PC from a Mac in addition to M-M and P-P. If they're on a PC, the download is an executable which when they double-click it, asks them if they'd like to run it or install it. Just have them run it and in a few seconds they will have an ID number and random password generated that they can tell you over the phone. Then you type it into your TeamViewer app and you're controlling their screen. If they're on a Mac, the download is a disk image so you have them mount it and then just run the app directly from the disk image. Once you're connected you can fully install the app for future use or just help them out. It's pretty much the simplest cross-platform control system I've found to deal with situations where it's not already setup for me to support. On top of all that, it's free for personal use!
Jeff

How to specify RD USER cal for particular session host server on a licensing server.

Hello,
I have 25 user cal license which I want to deploy to my 5 session host servers (5 user cal for each host)
I got 1 licensing server, where I have installed these licenses and pointed all other servers to it.
but I dont see any option to reserve 5 for each host. (4 win 2008R2, 1 win 2003 separate to each other no session host)
Thanks

I would always have two licence servers for resilience.
Regards,
Denis Cooper
MCITP EA - MCT
Help keep the forums tidy, if this has helped please mark it as an answer
Blog: http://www.windows-support.co.uk
Twitter: LinkedIn:

How to allow the user to upload a file from their desktop to MII Server?

Hi,
Is there a way for the user to specify a file on their local computer to upload to the MII server for processing? We have a method that works for uploading from a shared network drive, but now the need/desire is to allow the user to upload a file from their desktop.
Ideally, this would be a file browser that the user would click on to browse their local desktop and select the file and click "Upload" but not sure what's possible?
This is using 12.1 SP4.
Thanks for the help.
Kerby

[Uploading Documents|Uploading Documents]

How to enable users to access windows 2012 through remote desktop client on windows XP SP3

Hi I have just installed Windows Server 2012 and trying to give access to the users. The users are on windows XP Pro SP3 remote desktop client (Shell and control version 6.1.7600 with Remote Desktop Protocol 7.0 support).
I have enabled the windows server 2012 remote desktop users through "control panel -> systems and security -> Remote access" for the users. When I try to connect to the windows server as administrator, it is getting connected.
But when I try to connect as other users I get the following message.
"To sign in remotely, you need the right to sign in through Remote Desktop Services. By default members of the Administrators group have this right. If the group you're in does not have the right, or if the right has been removed from the Administrators
group, you need to be granted the right manually."
Is there any other setting to be done to eanble the Remote Desktop for the users.

Hi I have just installed Windows Server 2012 and trying to give access to the users. The users are on windows XP Pro SP3 remote desktop client (Shell and control version 6.1.7600 with Remote Desktop Protocol 7.0 support).
I have enabled the windows server 2012 remote desktop users through "control panel -> systems and security -> Remote access" for the users. When I try to connect to the windows server as administrator, it is getting connected.
But when I try to connect as other users I get the following message.
"To sign in remotely, you need the right to sign in through Remote Desktop Services. By default members of the Administrators group have this right. If the group you're in does not have the right, or if the right has been removed from the Administrators
group, you need to be granted the right manually."
Is there any other setting to be done to eanble the Remote Desktop for the users.
Have you tried adding those users to the "Remote Desktop Users" group? It's in Active Directory Users and Computers and it's a Built-In group. Might want to give that a try ...
- JJ

Options for deployment via Remote Desktop Services / Terminal Server

Currently we have volume licenses for CS which is deployed via remote desktop services in a multi-server load balanced farm.
When reaching out to support, they informed me that CC cannot be deployed via RDS/terminal services.
Seeing that CS is discontinued, how does Adobe suggest deployment of their apps via RDS/Terminal services?
The support rep really didn't have an answer for me.
I find it hard to believe that Adobe's going to abandon deployment of their apps in the enterprise as things are moving towards thin clients rather than traditional desktops.
We'd like to avoid needing to go VDI instead of RDS if possible.
I'd imagine VDI would have the same licensing issues assuming you don't want to have a dedicated VM for each user rather than having a shared pool of VMs.
Thank You.

The only link I have is http://forums.adobe.com/community/download_install_setup/creative_suite_enterprise_deploym ent
Otherwise, Adobe contact information - http://helpx.adobe.com/contact.html since this forum is about the "regular" Cloud

Remote Desktop Session - users presented with Other User only?

Hi,
I am running a 2008 R2 server patched up to date. It has the remote desktop services role installed. Whenever I RDP or if a user launches a terminal services session they are presented with OTHER USER only.
This involves clicking the Other User before entering their credentials which is becoming a pain.
Non of the other servers are behaving this way. I've compared the settings with the other and all is identical. I've checked the local security policy and disabled all Group Policies but the behaviour still persists. Any ideas?
Thanks, Matt.

Hi Matt,
Can you clarify more for this line, “Whenever I RDP or if a user launches a terminal services session they are presented with OTHER USER only.” what you mean by this? If I understand, when you taking RDP, you need to enter the credential for user manually
and that you don’t want, yes? If misunderstood, please correct.
For that, for a try you can enable the Group policy under credential manager and enable SSO for remote desktop connection. You can find the setting under beneath path.
Computer Configuration\Administrative Templates\System\Credentials Delegation
Allow Delegating Default Credentials: Enable
Add "TERMSRV/<Your server name>" to the server list.
There are other setting which you can check with following link.
How to enable Single Sign-On for my Terminal Server connections
http://blogs.msdn.com/b/rds/archive/2007/04/19/how-to-enable-single-sign-on-for-my-terminal-server-connections.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Users need to run an Unknown Publisher .exe during Remote Desktop session

I believe this still holds true (closer to the bottom, adding to trusted sites).
http://blogs.msdn.com/b/askie/archive/2009/06/19/how-to-bypass-the-security-warning-unknown-publishe...

Let me flesh this out best I can...
In a domain network I have a Remote Desktop Services running on MS Server 2008 R2. One of its jobs is to serve up applications that do not need to be installed on every users machine.While installing a new application, logged on as the administrator, I noticed this particular application has an unknown publisher. The application did install fine and will run under the admin account without warning or prompting for permission.The application does get stopped when opened with a domain user account and demands admin credentials. The UAC (user account control) steps in - due to the unknown publisher and 'making changes to this computer' safety concerns.
Hopefully this has been asked before and I missed finding the post.If not, any suggestions to allow users access to the application?Thank you for your...
This topic first appeared in the Spiceworks Community

Specific User receiving Application crash when using Remote Desktop Application

I have a client running a server with their line of business software configured as a remote application. I have one user that when he attempts to run the line of business software as a remote application he receives a APPCRASH error.However if another user
launches the remote application and then signs in as the problem user there is no APPCRASH.
The following information is reported with the error:
Faulting application name: impress.exe, version: 5.1.102.0, time stamp: 0x522f820a
Faulting module name: impress.exe, version: 5.1.102.0, time stamp: 0x522f820a
Exception code: 0xc0000005
Fault offset: 0x003fe41f
Faulting process id: 0x268
Faulting application start time: 0x01cf11ffa8811e46
Faulting application path: C:\data\Impress\impress.exe
Faulting module path: C:\data\Impress\impress.exe
Report Id: 238e8dfc-7df6-11e3-b1b6-001e678ee8f8
After the app crash the is a warning in the event log, but its about 43 seconds later; Event 1530, user Profile Service
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-2105745629-1987324649-1874639966-1224:
Process 328 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-2105745629-1987324649-1874639966-1224\Printers\DevModePerUser
just trying to find some sort of hint as to way the remote application would crash for just one user. it is my luck that the one user is the owner.

It looks like the issue was resolved by deleting the problem users profile off of the terminal server. The user can now access the RD application without suffering an APPCRASH error.

Option "Deny this user permissions to logon to a Remote Desktop Session Host Server" tuned on

Similar Messages

Maybe you are looking for