xeserver

This is the note I got from Microsoft. After implementing their recommendations I still get the error. I will post their response. From MSFT: According to Problem Description and the specified forum, I understand that the issue you are experiencing is: The TS users cannot RDP to the Windows 2008 Remote Desktop (RD) Session Host Server which is a domain controller by using MSTSC.EXE and received the following error message. “Access is denied.” (Please refer to the following screenshot.) Note: In Windows Server 2008 R2, Terminal Service has been renamed as Remote Desktop Service and the Terminal Server has been renamed as Remote Desktop (RD) Session Host Server. If I have misunderstood your concern, please don’t hesitate to let me know. Based on my experience, could you please check the policy “Allow users to connect remotely using Remote Desktop Services” on the affected RD Session Host Server? ====================================================================================================== 1. On the affected RD Session Host server, please open local policy. If the affected server is a domain controller, please open Default Domain Controllers policy. Please refer to the following screenshot. 2. Please navigate to the following path and enable “Allow users to connect remotely using Remote Desktop Services” policy. Computer configuration/Policy/Administrator Templates/Windows Components/ Remote Desktop Services/ Remote Desktop Session Hosts/Connections If this issue still persists, could you help take time to collect the following information to clarify the situation? ================================================================== 1. Could you please let me know if the RD Session Host Server has been installed on a domain controller? 2. Since you mentioned “Modified all group policies to allow the RD to function” in Problem Description, could you please collect the gpresult log and upload to me? To do this, ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- On the affected RD Session Host Server, please use the command "gpresult \v >c:\ gpresult.txt" (without quotation marks) in the command shell. After that, please upload the gpresult.txt file to me. Please refer to the following screenshot. Note: Please run this command under administrator privilege 3. Since you mentioned “Added the Remote Desktop Users group to the domain controller Remote Desktop users group” in Problem Description, could you please check the TS Users account has been added in the Remote desktop users group on the affected RD Session Host Server? Please refer to the following screenshot. 4. Could you please let me know if the RD Licensing Server has been installed on the same server as the RD Session Host Server? And please capture some screenshots of the TS Licensing Manager? ----------------- a. On the RD Licensing Server, click Start > Run, type licmgr.exe b. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue. c. Maximize the Terminal Service Licensing window, click + before the server entity to expand it, adjust the split bar so that the string names of installed CALs are completely shown in the Terminal Server Licensing window. d. Capture a screenshot of the Terminal Service Licensing window and upload it to me. Note: Please refer to the below screenshot, we can check the specific licenses information on the TS License Server from the screenshot. 5. On the affected server, please help collect the Microsoft Platform Support (MPS) Report. --------------------------------------------------------------------------------------------------------- To allow us to better support you please run the Microsoft Platform Support(MPS) Report for Windows 2008 Server R2 using the steps below. The tool gathers diagnostic information useful in resolving your issue. From a computer that is connected to the internet: a. Please download and run the MPS report tool, http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=cebf3c7c-7ca5-408f-88b7-f9c79b7306c0 b. Please click This Computer, then, please select General, Internet and Networking, Server Components, click Next. Please refer to the following screenshot. c. After the process complete, please save the result in the specified path and upload the CAB file to me.

I can only surmise that the issue is somewhere in the "Log on Access Rights" settings. The issue is not that the Remote Desktop services don't work because the server gives the user a RD CAL when they login, but for some reason it doesn't let them past the blue screen. I think I will file a report with MSFT and pay the money to have one of their guys help me out.

Tried the hack ...... "Access is denied" You are probably starting to get as frustrated as I am. What drives me nuts is that I have successfully deployed Remote Desktop on other servers and computers with no issue and this one is such a hassle.

The "Deny" policy is empty by default and has nothing in it. There are no error messages being generated when a remote user attempts to connect. I tried connecting today and then ran a report of the domain RDS CAL usage and this was the result: RDS CAL Usage Report RD License Server: xxx Report Date: Tuesday, January 05, 2010 12:27:14 PM Report Scope: Domain Issued to User RDS CAL Version Expires On CORP\Administrator Windows Server 2008 or Windows Server 2008 R2 Saturday March 06 2010 12:12:57 AM CORP\xxx Windows Server 2008 or Windows Server 2008 R2 Friday March 05 2010 11:50:49 PM RDS CAL Version RDS CAL Type Installed RDS CALs RDS CALs in Use RDS CAL Availability Windows Server 2008 or Windows Server 2008 R2 Per User 1 2 None So you can see that the OS is assigning RDS CALs to the user attempting to login, but then giving a "Access is Denied" screen. Thanks again

By the way, I am no longer getting the previous error in the event log but instead am get flat out getting denied. jrw

OK .... I have done everything in the link you sent me and I am still getting denied. You have no idea how grateful I am for your help. Here are some screen shots:

Thanks for your help. I really appreciate it. here is a listing of my group policies: Policy Setting Access this computer from the network Everyone, BUILTIN\Administrators, NT AUTHORITY\Authenticated Users, NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS, BUILTIN\Pre-Windows 2000 Compatible Access Add workstations to domain NT AUTHORITY\Authenticated Users Adjust memory quotas for a process NT AUTHORITY\LOCAL SERVICE, NT AUTHORITY\NETWORK SERVICE, BUILTIN\Administrators, Classic .NET AppPool, DefaultAppPool, S-1-5-82-604604840-3341247844-1790606609-4006251754-2470522317 Allow log on locally BUILTIN\Server Operators, BUILTIN\Remote Desktop Users, BUILTIN\Print Operators, BUILTIN\Backup Operators, BUILTIN\Administrators, BUILTIN\Account Operators Allow log on through Terminal Services BUILTIN\Remote Desktop Users Back up files and directories BUILTIN\Administrators, BUILTIN\Backup Operators, BUILTIN\Server Operators Here is the error I get from the event log: Description: The Remote Desktop license server cannot update the license attributes for user "XXXX" in the Active Directory Domain "corp.XXX.com". Ensure that the computer account for the license server is a member of Terminal Server License Servers group in Active Directory domain "corp.XXXX.com". If the license server is installed on a domain controller, the Network Service account also needs to be a member of the Terminal Server License Servers group. If the license server is installed on a domain controller, after you have added the appropriate accounts to the Terminal Server License Servers group, you must restart the Remote Desktop Licensing service to track or report the usage of RDS Per User CALs. Win32 error code: 0x80070005

The server is indeed a domain controller. I went to the Remote Desktop configuration (Terminal Services) and added in the Remoter Desktop users group and still the same error.

Did this get resolved? I have the same issue. I keep getting the screen shown below. I have spent weeks searching forums and no one seems to have the answer. I have all the permissions, user groups, and services set up per the recommendations of everyone and I still get the same error. Thanks for your help! Jordan