1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

remote desktop builtin group

Discussion in 'Windows Server 2003 / 2008 / 2012 Exams' started by dales, Mar 25, 2008.

  1. dales

    dales Gigabyte Poster

    1,997
    46
    97
    Hi all,

    this may seem a little basic but im trying to find out exactly what adding users to the builtin remote desktop user group does. In my little environment 1 dc, 1 ts server, 1 member server and 1 xp pro, it doesnt seem to do very much. I cant log any user added to that group to any of the above without adding them to the local rdug.

    Sorry for being a spazz but I cant see the point of it at the moment?!:oops:
     
    Certifications: vExpert 2014+2015+2016,VCP-DT,CCE-V, CCE-AD, CCP-AD, CCEE, CCAA XenApp, CCA Netscaler, XenApp 6.5, XenDesktop 5 & Xenserver 6,VCP3+5,VTSP,MCSA MCDST MCP A+ ITIL F
    WIP: Nothing
  2. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    Are you adding the domain account to the local remote desktop users group on the member server? (just an example)
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  3. dales

    dales Gigabyte Poster

    1,997
    46
    97
    Yes but I would have thought that adding the user to the remote desktop builtin group would have been enough. just to confuse me even more if I add the user only to the domain members local rdug and not put the user in the builtin group then you can still logon quite happily to it?
     
    Certifications: vExpert 2014+2015+2016,VCP-DT,CCE-V, CCE-AD, CCP-AD, CCEE, CCAA XenApp, CCA Netscaler, XenApp 6.5, XenDesktop 5 & Xenserver 6,VCP3+5,VTSP,MCSA MCDST MCP A+ ITIL F
    WIP: Nothing
  4. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    Hmm, I thought that would work as well.

    When you enable remote desktop I think there is a button called 'select users', if you put the domain user account or the local remote desktop users group in there it should work.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  5. Fergal1982

    Fergal1982 Petabyte Poster

    4,196
    171
    211
    As I understand it, you need to be a member of the local RDU group on any machine you wish to log into via terminal services (or remote desktop as I believe its called these days - pretty sure they are the same thing). If you arent a member, you cant use terminal services to log in.

    Not necessarily so vital if you are using VNC or something similar on your network really.
     
    Certifications: ITIL Foundation; MCTS: Visual Studio Team Foundation Server 2010, Administration
    WIP: None at present
  6. Fergal1982

    Fergal1982 Petabyte Poster

    4,196
    171
    211
    never mind. realised the error of my ways - you were asking about the domain builtin remote desktop group. oops
     
    Certifications: ITIL Foundation; MCTS: Visual Studio Team Foundation Server 2010, Administration
    WIP: None at present
  7. dales

    dales Gigabyte Poster

    1,997
    46
    97
    No thats true, but then what is the point of the remote desktop builtin group in ADUC, is it just a hangover from something as i really cant get it to do anything in my set up without adding users into the local machines remote desktop group (the one I want to logon too!:blink
     
    Certifications: vExpert 2014+2015+2016,VCP-DT,CCE-V, CCE-AD, CCP-AD, CCEE, CCAA XenApp, CCA Netscaler, XenApp 6.5, XenDesktop 5 & Xenserver 6,VCP3+5,VTSP,MCSA MCDST MCP A+ ITIL F
    WIP: Nothing
  8. Fergal1982

    Fergal1982 Petabyte Poster

    4,196
    171
    211
    It looks like its not attached to anything by default. This is, I assume, to allow you to manually decide which of your servers people are allowed to remote desktop onto. So what you need to do is set up TS, and add the domain RDU group to the permissions for each server you want it to work with.

    Alternatively (in a complex environment), you could set up groups for specific servers/groups of servers and give each of them RD access to the target servers.
     
    Certifications: ITIL Foundation; MCTS: Visual Studio Team Foundation Server 2010, Administration
    WIP: None at present
  9. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    This link helps mate. Basically it looks like the default domain controller policy uses the remote desktop group in ADUC. Therefore a user in this group can log into a DC but would not have any admin rights on that server. You would then add the user to additional security groups (e.g DHCP admins) as needed.

    http://www.windowsdevcenter.com/pub/a/windows/2004/10/05/Remote_Desktop.html
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  10. Fergal1982

    Fergal1982 Petabyte Poster

    4,196
    171
    211
    Certifications: ITIL Foundation; MCTS: Visual Studio Team Foundation Server 2010, Administration
    WIP: None at present
  11. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  12. dales

    dales Gigabyte Poster

    1,997
    46
    97
    thanks for the linky guys, its still not working how it says in the link if I add a user to the builtin remote desktop users group and try to logon to my DC I just get the you must have terminal services right/remote desktop error message, and not the "you cant logon interactively".

    Oh well I think I'll take my books into work in the morning and see what they all have to say about it.:rolleyes:
     
    Certifications: vExpert 2014+2015+2016,VCP-DT,CCE-V, CCE-AD, CCP-AD, CCEE, CCAA XenApp, CCA Netscaler, XenApp 6.5, XenDesktop 5 & Xenserver 6,VCP3+5,VTSP,MCSA MCDST MCP A+ ITIL F
    WIP: Nothing
  13. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,189
    296
    319
    Yup, I believe that part of the GPO is disabled. If you enable it and add the domain admins and remote desktop users group you should be fine.

    Note you have to add the domain admins group else you wont be able to log on as a domain admin to the DC, arrgh! :biggrin
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010

Share This Page

Loading...