Winlogon error 1219 (Access Denied) when logging on Terminal Server


Anton Panyushkin

I've got Windows 2003 Forest running in native Windows 2003 Mode.
And there are two domains in this forest, tied via trunsitive trusts,
let me call them the first domain and the second one. All the servers
belonging to the first domain have Windows Terminal Server enabled and
are running in Remote Administration Mode.
A few users of the second domain have administrative privileges in the
first domain and are able to log on server of the first domain via
Terninal Service.
Sometimes (approximately during one logon from ten) these users unable
to log on Terminal Servers. The following message appears on the
user's screen during unsuccessfull user logon:
Unable to obtain Terminal Server User Configuration. Error: Access is
After several attemps to log on server users finally are able to log
on successfully.
I've examined System Log of Terminal Server and found the following

Event ID: 1219
Source: Winlogon
Logon rejected for SECONDDOMAINNAME\Username. Unable to obtain
Terminal Server User Configuration. Error: Access is denied.

Also there are following events in system log

Event ID: 1054
Source: Userenv
Windows cannot obtain the domain controller name for your computer
network. (An unexpected network error occurred. ). Group Policy
processing aborted.

Event ID: 1000
Source: Userinit
Could not execute the following script Proxy.bat. The system cannot
find the file specified.

(You see there's a script we use to configure proxy server
configuration on workstations during userlogon and it's called

The last two events appear in System Log during every Terminal Service
user logon regardless if this logon complited successfully or not.

I also have to remark that not all domain controllers of the second
domain are reachable from servers of the first domain, it's a routing

I examined MS KB and and didn't get the real cause of this
What should I do to get rid of this error and let users to logon
without any obstacles.

Vera Noest [MVP]

You have already said it yourself: it's a routing (or more
general: a network) problem.
Have you checked your DNS records?

Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
--- please respond in newsgroup, NOT by private email ---

(e-mail address removed) (Anton Panyushkin) wrote on 16 nov 2004 in

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question