users can't use remote desktop

[Guest]

While I as an administrator can log in remotely to XP Pro SP2 workstation,
users, even though in remote users group and with allow remote connections
checked, can't log in getting the "the local policies of this computer do not
permit you to log in remotely..." message. In gpedit\Windows
Settings\Security Settings\Local Policies\User Rights Assignment, the Allow
logon through Terminal Services is gray and when accessed says..."This
setting is not compatible with computers running Windows 2000 Service Pack 1
or earlier." Of about 50 PC's I've now found 3 affected the same way,
different manufacturers, different ages, all running XP Pro SP 2. All are
current with Windows Updates.
How can I change this so my users can log in?

 

[Shenan Stanley]

While I as an administrator can log in remotely to XP Pro SP2
workstation, users, even though in remote users group and with
allow remote connections checked, can't log in getting the "the
local policies of this computer do not permit you to log in
remotely..." message. In gpedit\Windows Settings\Security
Settings\Local Policies\User Rights Assignment, the Allow logon
through Terminal Services is gray and when accessed says..."This
setting is not compatible with computers running Windows 2000
Service Pack 1 or earlier." Of about 50 PC's I've now found 3
affected the same way, different manufacturers, different ages, all
running XP Pro SP 2. All are current with Windows Updates.
How can I change this so my users can log in?

Are the "users" members of the local group "Remote Desktop Users"?

 

[Shenan Stanley]

While I as an administrator can log in remotely to XP Pro SP2
workstation, users, even though in remote users group and with
allow remote connections checked, can't log in getting the "the
local policies of this computer do not permit you to log in
remotely..." message. In gpedit\Windows Settings\Security
Settings\Local Policies\User Rights Assignment, the Allow logon
through Terminal Services is gray and when accessed says..."This
setting is not compatible with computers running Windows 2000
Service Pack 1 or earlier." Of about 50 PC's I've now found 3
affected the same way, different manufacturers, different ages, all
running XP Pro SP 2. All are current with Windows Updates.
How can I change this so my users can log in?

Are the "users" members of the local group "Remote Desktop Users"?

Whoops.. *missed* "... even though in remote users group ..."

My Apologies..

Are these machines getting the proper domain policies (gpresult)..?

 

[Guest]

We'll see pretty soon.... gpresult showed a policy I didn't know about,
which I was able to edit that may solve this problem; I'll let you know, and
thanks for the quick response.

 

[Guest]

And that didn't do it. I'll dig a little deeper, but maybe this is the right
track.

 

[Guest]

Well, yes this was the right track, thanks. Although it still doesn't
explain why some machines have this setting and others don't (but I have some
ideas on that) it provided me with the clue I needed to make it work. By
modifying that domain policy and putting users in the domain Remote Desktop
Users group, the local policy is overridden, so problem solved. Thanks again.