Terminal Services giving logon error.

[AV1611]

Why would I be getting an error when a regular user tries to logon that says, "The local policy of this system does not permit you to logon interactively"??

I installed TS in Application mode. I also added the regular users that will be logging in to the permissions tab on the RDP client in Configuration. I didn't setup a License Server yet though. Could that be it??

Thanks,, AV

 

[jpederson]

First, you definitely need to set up a license server for App Mode terminal services. Win2K and higher clients can connect for free, but you still need the licensing server.

Second, TS users need to have the "logon locally" permission and "access this computer from the network" permission to successfully connect. Look in the security policy under User Rights Assignments.

Good luck!

 

[AV1611]

I did all that. When you go to User Rights Assignments it has just USERS selected. I also added the group that all local users are in. Still won't let me in. I can't figure it out. I loaded the license server and all.

AV

 

[karmic]

Is this a domain controller? Check your policies, the local policy for sure. Under "local policies" and "user rights assignments" you should find the "log on locally". Are these users in this policy?

~ K.I.S.S - Don't make it any more complex than it has to be ~

 

[AV1611]

Yes, they are all there. Still no dice. Any other thoughts.

Thanks, AV

 

[mlichstein]

2003? Try the "Allow Logon through Terminal services" user right.

Also realize that if the TS is 2003, you will NOT be able to use Windows 2000 and Windows XP built in CALs to connect.

Licensing does not have anything to do with the error you are getting at this point, since there is a grace period that you have before you must install and activate a licensing server. In 2000, the grace is 90 days, and in 2003 it's 120. After installing the license service, you get another grace period of 90 or 120 days before you must install license packs.

During the grace periods, the TS will give out temporary CALs.

 

[AV1611]

No, its 2000. I will check all my policies again but I am pretty sure they are ok.

Thanks, AV

 

[mlichstein]

Is the server a member of a domain? What policy or polices are you editing? Are you running 'secedit /refreshpolicy machine_policy /enforce' after changing the user rights?

We need more info.

 

[AV1611]

Its a member of a domain. I tried local security policy and domain security policy under local policy / user rights assignment and changed the log on locally policy.

I didn't run 'secedit /refreshpolicy machine_policy /enforce' after changing the user rights.

Could this be the problem?? What all rights should a person need to run Terminal Services. I had each user as just a Domain User Member and a Domain Computer member. Should they need more other than to be put in the above policy??

Thanks, AV

 

[mlichstein]

If you change user rights, you either need to run the secedit command or reboot the box to make the new settings apply.

 

[AV1611]

Ok, I ran the secedit but it still doesn't work. I get the same error, "The local policy of this system does not permit you to logon interactively"

I have about 5 users that I put in a group I created called billing. This group has Domain User & Domain Computer rights assigned to it.

Anything I am missing that you can see?

Thanks again, AV

 

[AV1611]

I'm in major trouble now. I messed around with the policies and now none of the users can even log on localy while sitting at their computers on the domain.

HELP!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

AV