unable to login normally on Windows10 Client in a domain environment.

Question

Hi

Please I need help in this matter, it took a lot of my time, and still could not solve it in the normal way.

I created a test environment on Hyper-V where every server has a different subnet except Fileserver, as follows:

• Router
• DC01 (Domain Controller)
• DC02
• Fileserver
• RODC
• Windows10 (Client)

File server & windows10 are on the same subnet of DC01

I created accounts and used them to log in to the windows 10 client, unfortunately, it did not succeed as I got an error message saying:

To sign in remotely, you need the right to sign in through Remote Desktop Services. By default, members of the Remote Desktop Users group have this right. If the group you're in doesn't have this right, or if the right has been removed from the Remote Desktop Users group, you need to be granted this right manually.

I did search over the internet and I found 3 (workaround) solutions for it as follows:

• add the users to the group policy and apply it Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow logon locally Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Allow log on through Remote Desktop Services
• On Windows 10 client adds users to the remote desktop group.
• On Windows 10 client adds everyone or Domain\users to the remote desktop group.

My questions:

in Real-world organization work scenarios, shouldn't the users be able to log in normally without facing the error(mentioned above), the Windows 10/11 clients are all joined to the domain.

• Does this issue happen in a Real- work scenario?
• Why would it happen?
• How do IT pros set up an environment in a Real-Work scenario, where the users are able to log in without this issue?
• How to solve it in the correct manner without referring to the solutions I mentioned above, unless it is the only one?

Answer 1

Do you mean on Active Directory or on windows client.

Neither one actually. The target VM needs to have the user account as a member of Remote Desktop user's group.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

These ones could help.

https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-allow-access

https://theitbros.com/add-user-to-remote-desktop-group/

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Thank you Dave

I started to believe that the issue is caused by Hyper-V, because I checked with my friends who are working on VMware and they are not facing this issue.

in other words, if I try to login in Hyper-V Enhanced session the login will fail and error message will show, but if I use Basic session the login will work.

Why it is happening in Hyper-V and how to solve it from Hyper-V, rather than doing workaround solutions like GPOs and adding users to groups.

Enhanced session:

The windows client takes full resolution: the yellow highlight is (Enhanced/Basic session).

After writing credentials the error message pops out

Basic session:

The windows client takes small/different resolution.

And the credentials work fine(Login successfully) with no error

is there a solution for this issue that is caused by Hyper-V

Kind regards,

Answer 4

By default, administrators are part of the Remote Desktop user's group. If the account used is not a member, then you'll need to add the account.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 5

Do you mean on Active Directory or on windows client.

I checked the AD and I did not find the administrators part of the Remote Desktop users, also, on windows client the administrator is not member of Remote Desktop users.

which group should I add the user to it, is it the one in AD or in Windows client

The error message that showed in my previous comment is for the normal user(John), but I don't face any issue for administrator (local account or domain account).

in real work scenario, should I add Domain\users to group Remote Desktop users, to over come this issue, because this would fix all users in the domain, and if this is the case, is there any downsides or risks by adding Domain\users to that group

because I still believe that the issue from Hyper-V not like VMware