Centrally control Terminal Services logon rights

[Mathias Haas]

Is there any place in the AD where I can centrally control who is allowed to
logon to a server through Terminal Services? I guess there must be, but I
haven't found where. Initially I thought that "Log on locally" and "Access
this computer from the Network" would suffice but it seems to me that I have
to mange the user/group in Terminal Services Configuration as well (see KB:
Q224395) ?

Regards,
Mathias.

 

[Cary Shultz [A.D. MVP]]

Schoenen Guten Morgen, Mathias!

You might want to look at the ADUC as for each user account object there is
a "Terminal Services Profile" tab and at the bottom there is a "Allow logon
to Terminal Server" checkbox that needs to be checked...assuming that you
want this particular user to be able to logon to the Terminal Server. This
might be yet one other place!

In Windows 2003 I believe that there is a 'Remote Desktop Users' group that
pretty much takes care of this. However, please note that I have not done
much with WIN2003 yet so that might not be completely accurate.

 

[Mathias Haas]

Thanks for the reply Cary! (A Schönen guten Morgen to you too!

I think there's a difference in enabling users to use TS and allowing them
to log on using Remote Desktop.

When a user tries to logon to log on using the Terminal Services client they
gety the following error message:

"You do not have access to logon to this session. "

From Q224395
"Terminal Services has a default connection security setting allows only
administrators to log on. If the security attributes on a specified
connection have not been set, the connection inherits these default security
settings. For additional information, please see the following article in
the Microsoft Knowledge Base: "

Is there a way to grant a certain group log on permissions on multiple
servers?

/Mathias