0

Applied some new required policies to our GPO and can't figure out why I can't login remotely using RDC to our DC (Server 2008 R2). I am getting this error from my clients.

Logon failure: user account restriction. Possible reasons are blank passwords not allowed, logon hour restrictions, or a policy

I have checked User Rights assignment and I am added to the group it allows. I have checked Security options:

  • Accounts: Limit local account use of blank passwords to console logon only (Disabled and enabled has no effect)
  • Microsoft network server: Disconnect clients when logon hours expire is enabled. (Disabled and enabled has no effect) (I can login at all hours BTW).

Checking event longs shows that when I try to connect I get logon type 10 and it says unknown account/bad password. It doesn't even let me type my password in when I connect. So I am confused as to what is going on. What am I missing in my GPO

Improve this question
7
  • Have you tried to reverse your policy changes?
    – Ramhound
    Aug 31, 2018 at 18:44
  • @Ramhound trying that right now.
    – JukEboX
    Aug 31, 2018 at 19:06
  • @Ramhound old policies allow me in without a problem.
    – JukEboX
    Aug 31, 2018 at 19:10
  • 1
    So apply each policy change, one by one, in order to find the conflicting policy. Provide us with that policy so we can explain the reason you have a conflict.
    – Ramhound
    Aug 31, 2018 at 19:18
  • @Ramhound So far the policy on my DCs are fine. When I apply the policy to my Local computers is what is preventing the connection.
    – JukEboX
    Sep 4, 2018 at 21:33

2 Answers 2

Reset to default
1

Issue was found to be the following Group Policy setting on the local computer clients.

Computer Configuration > Administrative Templates > Systems > Credential Delegation > Restrict delegation of credentials to remote servers.

Originally set to Enabled. Changed it to Disabled. And was able to remote to my servers.

Improve this answer
1

As an added issue, if you use Hyper-V on Windows 10 and you try to RDP into an enhanced session Restrict delegation of credentials to remote servers break Enhanced Session functionl when using the VMConnect client.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .