12

I am trying to use Remote Desktop to another PC on our domain. If I use an administrators account this works fine, however when I use a normal user it gives the error:

The connection was denied because the user account is not authorised for remote login.

As per these questions I have:

  • Set "Allow Log on through Remote Desktop Services" (adding the Remote Desktop Users group).
  • Added the user to the remote desktop services group
  • Set "Allow users to connect remotely by using Remote Desktop Services"
  • Done gpupdate /force several times on the RD host machine

If I go in to Remote Settings > Select Users on RD host and add the domain user "walter.white" that user can then login to the machine from the other PC.

RD Users Settings Screen

I don't want to have to do that on every machine. I want to set it by GP object which I thought would be "Allow Log on through Remote Desktop Services" - as you can see above this group doesn't appear in this dialog (and I guess is the cause of the issue).

I know the GP has taken effect as if run "secpol.msc" and look at "Allow logon through Remote Desktop Services", I do see Remote Desktop Services (as well as Walter White which I added to the GP object).

Local Security Policy taking effect

We have Windows Server 2012.

3
  • Did you also apply the Restricted Group changes via GP (as laid out in the last link you provided)? Feb 14, 2017 at 16:07
  • @Ƭᴇcʜιᴇ007 I may be being stupid but I can't see anything about "Restrictive Groups" in any of those links (and I've tried CNTRL+F on the page!)
    – tim.baker
    Feb 15, 2017 at 13:55
  • Reboot after each change to make sure it took effect? :)
    – rogerdpack
    May 19, 2020 at 16:48

5 Answers 5

11

Instead of editing the User Rights Assignment on your workstations, consider using a Group Policy Preference (GPP) setting to modify the membership of the Remote Desktop Users group. By default, anyone that is a member of this group will be granted permission to establish a RDC connection to the machine.

Edit the membership of the Remote Desktop Users group with a Group Policy Preference (GPP) setting as follows:

  1. Create a new Security Group such as My Remote Desktop Users. Members of this group will be granted permission to make Remote Desktop connections.
  2. Edit a Group Policy Object and navigate to Computer Configuration/Preferences/Control Panel Settings
  3. Right-click Local Users and Groups and choose New > Local Group enter image description here

  4. Set Action: to Update

  5. In the Group name: drop-down choose Remote Desktop Users (built-in)
  6. Click Add...
  7. In the Local Group Member dialog box click the ... box and find your group (don't type it in manually)
  8. Confirm Action: is set to Add to this group enter image description here
  9. Click OK two times then close the Group Policy editor.
  10. Apply the Group Policy object to computers to which you want users to be able to access.

The advantage of this method is that you can easily grant/revoke Remote Desktop permissions by modifying a user's membership in the My Remote Desktop Users group, instead of having to edit Group Policy to set a new User Rights Assignment policy then wait for it to propagate to your workstations.

Further, edits to the User Rights Assignment policy are not cumulative. In other words, if you have two Group Policies that modify that policy, only one will have an effect. On the other hand, multiple GPPs can be specified to modify the membership of the Remote Desktop Users group.

1
  • Is there a way to do this with powershell? Feb 26, 2020 at 19:43
2

None of these solutions seemed to work for us.

What we ended up doing is opening control panel > opening user accounts > Manage User Accounts > Click the add button if your user is not there.

We did this on the device we were trying to remote to and added the devices user. Worked like a charm.

1

Oles,

This method works well to deploy user permissions to a local / client machine from a Windows Server. This is especially powerful if you are trying to control the users and / or computers that can have RDP rights across a large organization. You just need to set up an appropriate Organization Unit structure in your Active Directory, and then apply this GPO as desired. The way you have suggested works, but it's difficult to manage many computers and many users this way, particularly if you are not on-site to do so.

Also note, when you are using the Windows Remote Desktop connection to be sure to use the proper login credentials. At first, I was not including the domain name in the username field, which was causing the RDP connection to be rejected with the "The connection was denied because the user account is not authorized" that started this conversation.

When using RDP to connect to a DOMAIN computer...

Username: DOMAINNAME\USERNAME

Password: **********

After I started using the domain name, this method works perfectly on Windows Server 2019 / Windows 10 clients.

0

My fix for this was to make myself an admin on the windows server side. Then I could login.

Failure message from the mac "Microsoft Remote Desktop" app was 'Error code: 0x204' and 'We couldn't connect to the remote PC. Make sure the PC is turned on and connected to the network, and that remote access is enabled'"

0

I am not really sure why no one has pointed this out yet

First run

lusrmgr.msc

Then add the user to a group called Remote Desktop User

You can read how to add username to a group there

https://winaero.com/add-remove-user-group-windows-10/

To me, this solution, not only works, is also the one that makes the most sense.

The problem is the user is not "authorized" to do remote desktop.

However, there is a group called Remote Destop Users. I bet Microsoft must have set that group with correct permission.

So I just add the user to that group.

Kind of obvious.

And yes it works.

So many other solutions are so complicated and do not make sense.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jan 17 at 8:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.