Allow Domain Users to Use Remote Desktop

Question

I can't get get working RDP for users in domain...
Users added to "Remote Desktop Users":

>net localgroup "Remote Desktop Users"  
Alias name     Remote Desktop Users  
Comment        Members in this group are granted the right to logon remotely  
  
Members  
  
-------------------------------------------------------------------------------  
rmd1  
rmd2  
rmd3  
rmd4  
rme1  
rme2  
rme3  
rme4  
test  

User group also added here

And i'm still getting this error:

What i'm missing?

Answer 1

Read on here.
https://techcommunity.microsoft.com/t5/ask-the-performance-team/8220-allow-logon-through-terminal-services-8221-group-policy-and/ba-p/374961

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Maybe it's a AD dns issue, all pcs connected to one router which is using google dns 8.8.8.8

Please run;

Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt
ipconfig /all > C:\problemworkstation.txt

then put unzipped text files up on OneDrive and share a link.

Answer 3

• srv3 is multi-homed, do not install the domain controller on hypervisor. Multi-homing a domain controller will always cause no end to grief for active directory DNS
• There may be an IPv6 DHCP server on network. IPv6 if not configured correctly will be problematic so I'd suggest turning off the router IPv6 DHCP server
• Domain controller and all members should have static ip address of DC listed for DNS and no others such as or public DNS (router?)
• I did not look further because these are all show stoppers.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 4

Please put up a new set of files to look at.
Dcdiag /v /c /d /e /s:%computername% >C:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt
ipconfig /all > C:\problemworkstation.txt

then put unzipped text files up on OneDrive and share a link.

Answer 5

Note that "Remote Desktop Users" group in the AD console (since you have the windows-active-directory tag) is only used to give RDP access to the domain controllers.
Just make sure you keep this group empty. You don't want non-admin opening interactive sessions on your domain controllers (it's a no-no-no).

To allow a user to open an RDP session on a member server the user will need the "Allow log on through Remote Desktop Services" privilege on the target system. This is given by default on member server to the users member of the local group "Remote Desktop Users" (the group on the local server, not the AD group). Or you can specify your own through group policy. Everything is explained in the post @Anonymous mentioned. I just tried it on my different labs, it works fine on Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019.

When Network Level Authentication is enabled (which should be the case by default, and stay that way), you will also need the privilege "Access this computer from the network" which is by default is given to the "Users" group (which by default contain the AD group "Domain Users" group, so everyone unless you played with that group in AD).

When you got the following error message, you should see on an event id 4625 on the the target server telling you why it failed (likely lack of the privileges aforementioned).