Windows Server 2003 R2 - Remote Desktop Administration

JLL

I am currently working on a Remote Desktop for Administration issue for a Windows Server 2003 R2 system. The issue is that the built-in Administrator account does not have rights, at least that is what the error message indicates, to logon to the Terminal Server. I've included part of the message below.

'To logon to this remote computer, you must have Terminal Server user access permissions on this computer. By default, members. . . . .'

I would like some thoughts as to why the built-in Administrator account does not have sufficient rights? My understanding is the the Administrator account automatically has Terminal Server rights. Anyhow, I am able to view the Windows Server logon screen remotely, but I continue to get the message above. Are there any other areas I should look at?

Thanks in advance.

JL

royal

Start > Run > gpedit.msc > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignments. Now scroll down to the Allow Logon Through Terminal Services. Make sure Administrators is in there. By default, Administrators and Remote Desktop Users should be in there. On a DC, only Administrators should be in there.

JLL

OK, any other thoughts?

sprkymrk

How about the same place (User Rights Assignments) but the Access this computer from the network? If the everyone group has been removed that may stop it... but did you check icroyal's suggestion or not? I can't tell by your reply.

When you log on with the built in administrrator account, are you selecting the "computername (this computer)" rather than a domain?

Do the event logs show anything or just the same error you partially posted? I think the remainder of that message goes on to say:

'To logon to this remote computer, you must have Terminal Server user access permissions on this computer. By default, members. . . . of the administrators group have the right blah blah blah. Or something to that effect.

Has the built in administrator account been renamed or disabled?

Finally, also check the "deny access/logon" to terminal services, network logon, etc in the same group policy (local security policy too) as the the other settings to make sure the administrator is not explicitly denied access that way.

blargoe

Does the local administrator have a blank password? If so it probably will not work.

sprkymrk

blargoe wrote:

Does the local administrator have a blank password? If so it probably will not work.

Good suggestion!
I would hope it doesn't though.

JLL

Thank you for the suggestions. Someone must have changed the policy settings recently, because I was able to connect remotely just a few days ago. My mistake was to assume that the policy was not changed.

Thanks again.

JLuna