Remote Desktop to 80% of my servers do no longer work (“User account restriction”) from just one of my PCsRemote desktop connection drops before login can appeardeploying AV via GPO only to workstationsRemote Desktop won't launch program upon user loginRemote Desktop Username Logon Failure - Remote Desktop only Passes local Account Domain - Win 7 ProUSB Barcode scanners Redirect order RDP on windows 2008r2Windows 7 Current Active Session - No user logged inUnable to RDP to a remote server — my user just stopped workingHow to lock down local server account while permitting Remote Desktop in Windows 2008 SP2 and run scheduled task?Remote Desktop Jump Using Different Licence ServersHow do I change encryption from RC4 to AES in order to allow RDP to my remote servers?
Row vectors and column vectors (Mathematica vs Matlab)
A Latin text with dependency tree
how to find out if there's files in a folder and exit accordingly (in KSH)
Can I bring back Planetary Romance as a genre?
Is every story set in the future "science fiction"?
Was the Highlands Ranch shooting the 115th mass shooting in the US in 2019
Is it a good idea to copy a trader when investing?
How can it be that ssh somename works, while nslookup somename does not?
How can I test a shell script in a "safe environment" to avoid harm to my computer?
Is there an application which does HTTP PUT?
if i accidentally leaked my schools ip address and someone d doses my school am i at fault
Pre-1993 comic in which Wolverine's claws were turned to rubber?
Is there any evidence to support the claim that the United States was "suckered into WW1" by Zionists, made by Benjamin Freedman in his 1961 speech
Are double contractions formal? Eg: "couldn't've" for "could not have"
Best species to breed to intelligence
Can you turn a recording upside-down?
How can Sam Wilson fulfill his future role?
What does the "DS" in "DS-..." US visa application forms stand for?
Is there a need for better software for writers?
Are wands in any sort of book going to be too much like Harry Potter?
Is there an idiom that means "revealing a secret unintentionally"?
How long can fsck take on a 30 TB volume?
Why use steam instead of just hot air?
resoldering copper waste pipe
Remote Desktop to 80% of my servers do no longer work (“User account restriction”) from just one of my PCs
Remote desktop connection drops before login can appeardeploying AV via GPO only to workstationsRemote Desktop won't launch program upon user loginRemote Desktop Username Logon Failure - Remote Desktop only Passes local Account Domain - Win 7 ProUSB Barcode scanners Redirect order RDP on windows 2008r2Windows 7 Current Active Session - No user logged inUnable to RDP to a remote server — my user just stopped workingHow to lock down local server account while permitting Remote Desktop in Windows 2008 SP2 and run scheduled task?Remote Desktop Jump Using Different Licence ServersHow do I change encryption from RC4 to AES in order to allow RDP to my remote servers?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I came into work last week, checked my first ticket (easy to fix one), RDP'd into the server needed for this and the login did not work. After clicking 'connect' I got the "Unable to Log You on Because of an Account Restriction" message. Checked another server (all machines are 2008R2/2012R2), the same message. No, I do not habe an empty password, not using network auth, my clint is Windows 10 (1607).
Here is what I did:
- Used another client (Win10.1607), same ou, same setup. Can perfectly login from anywhere to anywhere (so I am asuming it's no my user account or a GPO)
- Checked servers: I can RDP into all my DC's and a few other machines (2008R2/2012R2), looks random to me (all server in the same OU, no special software installed)
- Deleted the mstsc cache (%appdata%..localMicrosoftTerminal Server Client* )
- Cleaned up HCUSOFTWAREMicrosoftTerminal Server Client
- Watched the eventlogs: nothing. Absolutely nothing. So I assume it's my client, not the servers. But I can RDP into all my servers at home and in another (customers) network ...
- Checked date/time on client/server (0.0002ms apart)
- Checked account restrictions on ma account (neither time nor machine restrictions are present)
- Checked if logon at the console works (vm/ilo): works perfectly fine with my credentials
- Checked if Share-Access would work (\servershare): Does not work, I am seeing the same error message. Works from clientB, but not from alientA.
- When doing the same thing from one of the 'working' machines (sever or client), everything is fine.
Any Ideas where to look for this? It is haunting me into my sleep :-(
Updates: Surely I checked the local policies on the server(s). any changes would have surprised me - there are a lot of servers. Also checked the clients GPO, nothing.
windows active-directory remote-desktop rdp
asked Sep 27 '16 at 11:39
bjosterbjoster
1,9711919
|
show 11 more comments
I came into work last week, checked my first ticket (easy to fix one), RDP'd into the server needed for this and the login did not work. After clicking 'connect' I got the "Unable to Log You on Because of an Account Restriction" message. Checked another server (all machines are 2008R2/2012R2), the same message. No, I do not habe an empty password, not using network auth, my clint is Windows 10 (1607).
Here is what I did:
- Used another client (Win10.1607), same ou, same setup. Can perfectly login from anywhere to anywhere (so I am asuming it's no my user account or a GPO)
- Checked servers: I can RDP into all my DC's and a few other machines (2008R2/2012R2), looks random to me (all server in the same OU, no special software installed)
- Deleted the mstsc cache (%appdata%..localMicrosoftTerminal Server Client* )
- Cleaned up HCUSOFTWAREMicrosoftTerminal Server Client
- Watched the eventlogs: nothing. Absolutely nothing. So I assume it's my client, not the servers. But I can RDP into all my servers at home and in another (customers) network ...
- Checked date/time on client/server (0.0002ms apart)
- Checked account restrictions on ma account (neither time nor machine restrictions are present)
- Checked if logon at the console works (vm/ilo): works perfectly fine with my credentials
- Checked if Share-Access would work (\servershare): Does not work, I am seeing the same error message. Works from clientB, but not from alientA.
- When doing the same thing from one of the 'working' machines (sever or client), everything is fine.
Any Ideas where to look for this? It is haunting me into my sleep :-(
Updates: Surely I checked the local policies on the server(s). any changes would have surprised me - there are a lot of servers. Also checked the clients GPO, nothing.
windows active-directory remote-desktop rdp
asked Sep 27 '16 at 11:39
bjosterbjoster
1,9711919
Try logging on with a different account.
– Greg Askew
Sep 27 '16 at 11:45
First, a good sleep is required for solving stuff... Anyway, maybe there's a local GPO that blocks it (allowdeny remotenetwork access under security settings). Can you post results of 'gpresult /h gpresoprt.html'?
– EliadTech
Sep 27 '16 at 11:47
@GregAskew: does not work either (eg 'administrator', the default and first domain admin). Not from this client. Works from other clients/servers.
– bjoster
Sep 27 '16 at 12:27
@EliadTech: my client is not member of the domain, so my report is rather short. The gpresult of the server(s) are somewhat larger, but due to the intimate details I am not allowed to post it completely. I checked the resultset before (using rsop.msc) and found nothing (no User/Group restrictions). Do you have any special places I should have look at?
– bjoster
Sep 27 '16 at 12:31
You can RDP to and from servers and desktops that belong to the domain. You cannot RDP from this PC1 that is in workgroup mode. Is there a different PC2 that is also in workgroup that you can try to RDP from?
– Clayton
Sep 27 '16 at 13:16
|
show 11 more comments
I came into work last week, checked my first ticket (easy to fix one), RDP'd into the server needed for this and the login did not work. After clicking 'connect' I got the "Unable to Log You on Because of an Account Restriction" message. Checked another server (all machines are 2008R2/2012R2), the same message. No, I do not habe an empty password, not using network auth, my clint is Windows 10 (1607).
Here is what I did:
- Used another client (Win10.1607), same ou, same setup. Can perfectly login from anywhere to anywhere (so I am asuming it's no my user account or a GPO)
- Checked servers: I can RDP into all my DC's and a few other machines (2008R2/2012R2), looks random to me (all server in the same OU, no special software installed)
- Deleted the mstsc cache (%appdata%..localMicrosoftTerminal Server Client* )
- Cleaned up HCUSOFTWAREMicrosoftTerminal Server Client
- Watched the eventlogs: nothing. Absolutely nothing. So I assume it's my client, not the servers. But I can RDP into all my servers at home and in another (customers) network ...
- Checked date/time on client/server (0.0002ms apart)
- Checked account restrictions on ma account (neither time nor machine restrictions are present)
- Checked if logon at the console works (vm/ilo): works perfectly fine with my credentials
- Checked if Share-Access would work (\servershare): Does not work, I am seeing the same error message. Works from clientB, but not from alientA.
- When doing the same thing from one of the 'working' machines (sever or client), everything is fine.
Any Ideas where to look for this? It is haunting me into my sleep :-(
Updates: Surely I checked the local policies on the server(s). any changes would have surprised me - there are a lot of servers. Also checked the clients GPO, nothing.
windows active-directory remote-desktop rdp
asked Sep 27 '16 at 11:39
bjosterbjoster
1,9711919
I came into work last week, checked my first ticket (easy to fix one), RDP'd into the server needed for this and the login did not work. After clicking 'connect' I got the "Unable to Log You on Because of an Account Restriction" message. Checked another server (all machines are 2008R2/2012R2), the same message. No, I do not habe an empty password, not using network auth, my clint is Windows 10 (1607).
Here is what I did:
- Used another client (Win10.1607), same ou, same setup. Can perfectly login from anywhere to anywhere (so I am asuming it's no my user account or a GPO)
- Checked servers: I can RDP into all my DC's and a few other machines (2008R2/2012R2), looks random to me (all server in the same OU, no special software installed)
- Deleted the mstsc cache (%appdata%..localMicrosoftTerminal Server Client* )
- Cleaned up HCUSOFTWAREMicrosoftTerminal Server Client
- Watched the eventlogs: nothing. Absolutely nothing. So I assume it's my client, not the servers. But I can RDP into all my servers at home and in another (customers) network ...
- Checked date/time on client/server (0.0002ms apart)
- Checked account restrictions on ma account (neither time nor machine restrictions are present)
- Checked if logon at the console works (vm/ilo): works perfectly fine with my credentials
- Checked if Share-Access would work (\servershare): Does not work, I am seeing the same error message. Works from clientB, but not from alientA.
- When doing the same thing from one of the 'working' machines (sever or client), everything is fine.
Any Ideas where to look for this? It is haunting me into my sleep :-(
Updates: Surely I checked the local policies on the server(s). any changes would have surprised me - there are a lot of servers. Also checked the clients GPO, nothing.
windows active-directory remote-desktop rdp
windows active-directory remote-desktop rdp
asked Sep 27 '16 at 11:39
bjosterbjoster
1,9711919
asked Sep 27 '16 at 11:39
bjosterbjoster
1,9711919
edited Sep 27 '16 at 13:53
bjoster
asked Sep 27 '16 at 11:39
bjosterbjoster
1,9711919
asked Sep 27 '16 at 11:39
bjosterbjoster
1,9711919
asked Sep 27 '16 at 11:39
bjosterbjoster
1,9711919
1,9711919
Try logging on with a different account.
– Greg Askew
Sep 27 '16 at 11:45
First, a good sleep is required for solving stuff... Anyway, maybe there's a local GPO that blocks it (allowdeny remotenetwork access under security settings). Can you post results of 'gpresult /h gpresoprt.html'?
– EliadTech
Sep 27 '16 at 11:47
@GregAskew: does not work either (eg 'administrator', the default and first domain admin). Not from this client. Works from other clients/servers.
– bjoster
Sep 27 '16 at 12:27
@EliadTech: my client is not member of the domain, so my report is rather short. The gpresult of the server(s) are somewhat larger, but due to the intimate details I am not allowed to post it completely. I checked the resultset before (using rsop.msc) and found nothing (no User/Group restrictions). Do you have any special places I should have look at?
– bjoster
Sep 27 '16 at 12:31
You can RDP to and from servers and desktops that belong to the domain. You cannot RDP from this PC1 that is in workgroup mode. Is there a different PC2 that is also in workgroup that you can try to RDP from?
– Clayton
Sep 27 '16 at 13:16
|
show 11 more comments
Try logging on with a different account.
– Greg Askew
Sep 27 '16 at 11:45
First, a good sleep is required for solving stuff... Anyway, maybe there's a local GPO that blocks it (allowdeny remotenetwork access under security settings). Can you post results of 'gpresult /h gpresoprt.html'?
– EliadTech
Sep 27 '16 at 11:47
@GregAskew: does not work either (eg 'administrator', the default and first domain admin). Not from this client. Works from other clients/servers.
– bjoster
Sep 27 '16 at 12:27
@EliadTech: my client is not member of the domain, so my report is rather short. The gpresult of the server(s) are somewhat larger, but due to the intimate details I am not allowed to post it completely. I checked the resultset before (using rsop.msc) and found nothing (no User/Group restrictions). Do you have any special places I should have look at?
– bjoster
Sep 27 '16 at 12:31
You can RDP to and from servers and desktops that belong to the domain. You cannot RDP from this PC1 that is in workgroup mode. Is there a different PC2 that is also in workgroup that you can try to RDP from?
– Clayton
Sep 27 '16 at 13:16
Try logging on with a different account.
– Greg Askew
Sep 27 '16 at 11:45
Try logging on with a different account.
– Greg Askew
Sep 27 '16 at 11:45
First, a good sleep is required for solving stuff... Anyway, maybe there's a local GPO that blocks it (allowdeny remotenetwork access under security settings). Can you post results of 'gpresult /h gpresoprt.html'?
– EliadTech
Sep 27 '16 at 11:47
First, a good sleep is required for solving stuff... Anyway, maybe there's a local GPO that blocks it (allowdeny remotenetwork access under security settings). Can you post results of 'gpresult /h gpresoprt.html'?
– EliadTech
Sep 27 '16 at 11:47
@GregAskew: does not work either (eg 'administrator', the default and first domain admin). Not from this client. Works from other clients/servers.
– bjoster
Sep 27 '16 at 12:27
@GregAskew: does not work either (eg 'administrator', the default and first domain admin). Not from this client. Works from other clients/servers.
– bjoster
Sep 27 '16 at 12:27
@EliadTech: my client is not member of the domain, so my report is rather short. The gpresult of the server(s) are somewhat larger, but due to the intimate details I am not allowed to post it completely. I checked the resultset before (using rsop.msc) and found nothing (no User/Group restrictions). Do you have any special places I should have look at?
– bjoster
Sep 27 '16 at 12:31
@EliadTech: my client is not member of the domain, so my report is rather short. The gpresult of the server(s) are somewhat larger, but due to the intimate details I am not allowed to post it completely. I checked the resultset before (using rsop.msc) and found nothing (no User/Group restrictions). Do you have any special places I should have look at?
– bjoster
Sep 27 '16 at 12:31
You can RDP to and from servers and desktops that belong to the domain. You cannot RDP from this PC1 that is in workgroup mode. Is there a different PC2 that is also in workgroup that you can try to RDP from?
– Clayton
Sep 27 '16 at 13:16
You can RDP to and from servers and desktops that belong to the domain. You cannot RDP from this PC1 that is in workgroup mode. Is there a different PC2 that is also in workgroup that you can try to RDP from?
– Clayton
Sep 27 '16 at 13:16
|
show 11 more comments
1 Answer
1
active
oldest
votes
The solution in my case was the option "Restrict delegation of Credentials to remote Servers".
Basically, there is a new Group policy settings that can prevent a system to pass credentials to a remote server. This was exactly the issue. you can find this setting in your lokal oder domain group policy under:
Computer Configuration > Administrative Templates > System > Credential Delegation
answered Oct 11 '16 at 12:30
bjosterbjoster
1,9711919
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f805573%2fremote-desktop-to-80-of-my-servers-do-no-longer-work-user-account-restriction%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The solution in my case was the option "Restrict delegation of Credentials to remote Servers".
Basically, there is a new Group policy settings that can prevent a system to pass credentials to a remote server. This was exactly the issue. you can find this setting in your lokal oder domain group policy under:
Computer Configuration > Administrative Templates > System > Credential Delegation
answered Oct 11 '16 at 12:30
bjosterbjoster
1,9711919
add a comment |
The solution in my case was the option "Restrict delegation of Credentials to remote Servers".
Basically, there is a new Group policy settings that can prevent a system to pass credentials to a remote server. This was exactly the issue. you can find this setting in your lokal oder domain group policy under:
Computer Configuration > Administrative Templates > System > Credential Delegation
answered Oct 11 '16 at 12:30
bjosterbjoster
1,9711919
add a comment |
The solution in my case was the option "Restrict delegation of Credentials to remote Servers".
Basically, there is a new Group policy settings that can prevent a system to pass credentials to a remote server. This was exactly the issue. you can find this setting in your lokal oder domain group policy under:
Computer Configuration > Administrative Templates > System > Credential Delegation
answered Oct 11 '16 at 12:30
bjosterbjoster
1,9711919
The solution in my case was the option "Restrict delegation of Credentials to remote Servers".
Basically, there is a new Group policy settings that can prevent a system to pass credentials to a remote server. This was exactly the issue. you can find this setting in your lokal oder domain group policy under:
Computer Configuration > Administrative Templates > System > Credential Delegation
answered Oct 11 '16 at 12:30
bjosterbjoster
1,9711919
answered Oct 11 '16 at 12:30
bjosterbjoster
1,9711919
answered Oct 11 '16 at 12:30
bjosterbjoster
1,9711919
answered Oct 11 '16 at 12:30
bjosterbjoster
1,9711919
1,9711919
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f805573%2fremote-desktop-to-80-of-my-servers-do-no-longer-work-user-account-restriction%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Try logging on with a different account.
– Greg Askew
Sep 27 '16 at 11:45
First, a good sleep is required for solving stuff... Anyway, maybe there's a local GPO that blocks it (allowdeny remotenetwork access under security settings). Can you post results of 'gpresult /h gpresoprt.html'?
– EliadTech
Sep 27 '16 at 11:47
@GregAskew: does not work either (eg 'administrator', the default and first domain admin). Not from this client. Works from other clients/servers.
– bjoster
Sep 27 '16 at 12:27
@EliadTech: my client is not member of the domain, so my report is rather short. The gpresult of the server(s) are somewhat larger, but due to the intimate details I am not allowed to post it completely. I checked the resultset before (using rsop.msc) and found nothing (no User/Group restrictions). Do you have any special places I should have look at?
– bjoster
Sep 27 '16 at 12:31
You can RDP to and from servers and desktops that belong to the domain. You cannot RDP from this PC1 that is in workgroup mode. Is there a different PC2 that is also in workgroup that you can try to RDP from?
– Clayton
Sep 27 '16 at 13:16