For a user to log on to a Terminal Server, the following permissions and rights must be granted:
- Allow log on through Terminal Services
This user right is by default granted to Administrators and members of the local Remote Desktop Users group on the server.
- Permission to use the rdp-tcp connection
The local Remote Desktop Users group has by default "User access" permission on the rdp-tcp connection.
- Allow logon to Terminal Server checkbox, in the properties of the user account in AD.
By default, this checkbox is checked for all users.
- add the users to the built-in domain local Remote Desktop Users group in AD
- enable the following setting in the Default Domain Controller Policy:
Computer Configuration - Windows Settings - Security Settings - Local Policies - User rights Assignment "Allow log on through Terminal Services"and add the Remote Desktop Users group to the list of allowed users
- add the Remote Desktop Users group to the permission list of the rdp-tcp connection
- 290720 - How to Add a User to Terminal Services RDP Permissions by Using WMI (2003)
- 259129 - How to modify or query the RDP connection permissions for Terminal Services (W2K)
Error messages - permission problems
- "The local policy of this system does not permit you to logon interactively"
2003: The user account is not a member of the local Remote Desktop Users group. See 289289
SBS2003: The Remote Desktop Users group does not have the "Allow log on through Terminal Services" right - see 886620
W2K: The user does not have the "Log On Locally" right in the servers security policy.
- "You do not have access to logon to this session"
2003: The user account is not a member of the local Remote Desktop Users group.
W2K: The user doesn't have the necessary permissions on the rdp-tcp connection. This happens when you remove the User group from the properties of RDP-tcp
- "The requested session access is denied."
Vista: The user account is not a member of the local Remote Desktop Users group
- "Your interactive logon privilege has been disabled"
The user does not have the "Allow Logon to terminal server" check box selected on the Terminal Services Profile tab of their account.
2003: The user account is denied Read permissions to the Active Directory directory service. This right is by default denied to the Guest account. See 815266
- "The desktop you are trying to open is currently available only to administrators", followed by
"You do not have access to logon to this session"
2003 + Citrix PS3.0 only: Installing Citrix PS 3.0 on a Windows 2003 creates a new RDP-TCP listener. The default properties of this listener allow only the launching of published applications. See 931353 and CTX104106
- "To log on to this remote computer, you must have Terminal Server User Access permissions...."
2003 + Citrix PS4.0 only: Installing Citrix PS 4.0 on a Windows 2003 creates a new RDP-TCP listener. The default properties of this listener allow only the launching of published applications. See CTX109925
Error messages - misc. problems
- "An error occurred in the licensing protocol"
Vista: not enough permissions on the local registry to store the client license
- "The remote computer disconnected the session because of an error in licensing protocol"
XP: Terminal Services service is not started; invalid stored license
- "Because of a security error, the client could not connect to the remote computer"
W2K + 2003: corrupted certificate on the Terminal Server
- "Because of a security error, the client could not connect to the terminal server"
W2K: invalid certificate on the Terminal Server
XP: invalid stored license
- "The terminal server has ended the connection"
W2K with SRP1: invalid certificate on the Terminal Server
- "The remote computer has ended the connection"
XP with SP2: DFS client is disabled
- "No authority could be contacted for authentication"
Vista client to Vista host in 2003 domain: Kerberos service account problem
- "The system could not log you on"
RDP 6.0 client to XP SP2 host: smart card login problem
- "The remote session was disconnected because another user has connected to the session"
2008: autologon enabled
- "Your system administrator does not allow the use of default credentials..."
Vista RDP client with Single Sign-On enabled
See Problems using default credentials with Vista RDP clients with Single Sign-on Enabled
- "The logon attempt failed"
Vista RDP client with saved credentials
See 954397 and Problems using saved credentials with Vista RDP clients and above
- "Winlogon has encountered a problem and needs to close"
2003: when many users connect at the same time
- "Server is not found in the network"
2008: when many users connect at the same time
- "Autoreconnect failed to reconnect user to session because authentication failed. (0x0)"
All OS: autoreconnect enabled and a time-out limit on disconnected sessions can cause this error message.
A temporary network interruption can cause the remote session on the server to be put into the "disconnected" state, and the time-out limit causes it to end after the limit is exceeded.
When the user tries to start working again in the session, the rdp client tries to reconnect and fails, producing the above error message as well as EventID 1042 in the EventLog.
- "... Remote Desktop cannot verify the identity of the computer..."
Vista and Windows 7 client to 2003 / 2000 TS: downlevel RD Session Hosts cannot provide their identity
Misc. logon problems
- 2258492 - You notice that the check box "Deny this user permissions to logon to a Remote Desktop Session Host Server" behaves differently in Windows 2003 and Windows 2008
- 982010 - You may be unable to log on a terminal server that has the DisableWindowsUpdateAccess user policy set
- 922044 - A Windows Server 2003 Service Pack 1-based terminal server cannot accept new incoming Terminal Service connections
- 828664 - An access violation error occurs if your Terminal Services information is corrupted
- 914048 - Event IDs 1000 and 1004 may be logged in the Application event log, and Windows Server 2003 Terminal Server client connections and logon tries may sometimes fail, when you try to connect to a remote computer
- 931353 - Error message when you use RDP to connect to a Windows Server 2003-based computer that is running Terminal Server and Citrix MetaFrame Presentation Server 3.0: "The desktop you are trying to open is currently available only to administrators"
- 939820 - Error message when you try to use Remote Desktop Connection to connect to another Windows Vista-based computer in Windows Vista: "No authority could be contacted for authentication"
- 947714 - You cannot create a remote desktop session as an administrator when Autologon is enabled in Windows Server 2008
- 951028 - You are prompted two times for credentials when you use the Remote Desktop Client to connect to a Windows 2000 Terminal Server from Window Vista or from Windows Server 2008
- 954393 - Local credentials are used to log on to a Windows Server 2008-based computer instead of credentials that you entered on a Terminal Services client
- 938449 - Event ID 5719 is logged when you start a computer on a domain, and the computer is running Windows Server 2003, Windows XP, or Windows 2000
# Start Registry Editor (Regedt32.exe).
# Locate the following registry key:
# Locate the following entry:
Value name: RestrictAnonymous
Data type: REG_DWORD
# Change the value to 0.