Interactive Login

[DJones]

I've got term services set up on my Win2k server, and am
currently testing it for deployment to our remote sites.
This is really my first dabble with term services, so I'm
a complete newbie.

Anyhoo...Myself and the other IT person here are able to
log into the term server using the client with no problem.
We are both Administrators. However, when trying to log
into the term server using one of my user's logons, I
get "The local policy of this system does not allow you to
log in interactively".

I've looked at my local policy on the server, and nothing
stands out. To be certain, I added "Terminal Server Users"
to the "Log onto this machine locally" policy on the
server. I have also verified that the user(s) in question
have "Allow Terminal Server login" checked in their user
profile in AD.

This is a sticky one.

Any thoughts? "

Update: I found I had not activated my license server
within the 90 grace period before slipping back into
Remote Admin mode. So, I activated my server with a 10 cal
license pack for Term Services. I did have the term
services licensing component installed on my main term
server, however I removed it upon activation of my license
server. I added a DefaultLicenseServer key to the registry
of the term server that points to my login server, and
reinstalled Term Services to force it back into
Application Server mode. The licensing server piece is
installed on a domain controller (not the FSMO).

This is still not working...giving the same error as
before "The local security policy of this system does not
allow you to login interactively".

Something else of note: My test users do not have a term
services profile set up, or a home directory (don't know
if that makes a difference or not).

In term services config, the users in question have been
granted User/Guest level access to RDP5.

At this point, I'm stumped.

Any info would be greatly appreciated.

Dennis Jones

 

[Matthew Harris [MVP]]

You might want to check your domain policy as well, since
this might be overriding your local policy.

Also, make sure the user has the ability to log in through
terminal services by checking the permissions on the rdp-
tcp connection in your terminal services configuration.

-M

 

[Vera Noest [MVP]]

This is definitively a problem with the user right "Log on
Locally". The question is: which security policy do you need to
modify?
You might have a domain-wide security policy that is overriding
your local security policy on the TS.
If this TS is also a DC (not recommended!), then you have to
change the Domain Controller Security Policy.

 

[Guest]

Hello.

Unfortunately, we're a small outfit and can't afford any
more servers, so yes, we're using Term Services on a DC.
We can't move it anywhere else for the time being.

You were correct, I changed the Policy setting for the
Domain Controller, and it's all set now. Thank you for the
info.

 

[Dennis Jones]

Thanks for the info.

Because of our circumstances, we had to put term services
on one of our DCs, so I went into the DC Policy and made
the needed changes.

Thanks again.

Dennis Jones