Non admins unable to login to remote desktop server.

Question

I have a Windows 2016 server with Remote Desktop Services setup. Domain admins are able to login via RDP but non admins are not.

Group policy states that "Allow log on through Remote Desktop Services" should allow "Administrators" and "Remote Desktop Users". I pulled up the local group policy and can see this set on my RDP host correctly.

I created a new user who is only a part of "Domain Users" and "Remote Desktop Users". This user fails to login. Looking at event viewer I see the tmpuser with the following events:

Event 4624 - Account was successfully logged on. I can see my account successfully login with username and password.
Event 4627 - Group Membership Information. This event does NOT show the user is part of "Remote Desktop Users"
Event 4776 - Computer attempted to validate the credentials for an account. Error Code: 0xC0000064

I then ran "net user tmpuser /domain" from the RDP host and can see that the user is part of "Remote Desktop Users"

So the user appears to login, it checks group permissions, then appears to fail. The event for group membership doesn't show "Remote Desktop Users" but wondering if that is a red herring and Local Groups are just not shown in event viewer?

Info on local vs global groups in AD = https://community.spiceworks.com/topic/306028-when-to-use-a-domain-local-group-versus-global-group

AD is stored on another server.

Edit. - Thank you for any assistance!

Answer 1

ok so I think I figured it out (ie found someones answer on serverfault). Turns out that "Remote Desktop Users" group in AD is NOT for handling what users can login to your RDP host. You need to specify that locally on your RDP host.

https://serverfault.com/questions/736703/domain-users-unable-to-logon-to-remote-desktop-server