the local policy does not permit you to login interactively
in [Terminal Services]
|
From: Vera Noest [MVP] on 26 Jul 2006 15:51 Mmm, strange. Can you verify that the user is *not* trying to use a console connection? I.e. connecting with "mstsc /console", or by using the Remote Desktops snap-in from the AdminPak, and selecting the "Connect to console" option? _________________________________________________________ Vera Noest MCSE, CCEA, Microsoft MVP - Terminal Server TS troubleshooting: http://ts.veranoest.net ___ please respond in newsgroup, NOT by private email ___ =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul 2006 in microsoft.public.windows.terminal_services: > Hi Vera > > Membership of Remote Desktop Users on each TS server is: > > NT Authority\Authenticated Users > > and I also added this morning: > > domain users > > but this didn't solve my problem. There is also no "deny" > defined on the TS... > > KInd regards > Nicolas > > "Vera Noest [MVP]" schrieb: > >> Have you checked membership in the local Remote Desktop Users >> group on the TS? >> >> _________________________________________________________ >> Vera Noest >> MCSE, CCEA, Microsoft MVP - Terminal Server >> TS troubleshooting: http://ts.veranoest.net >> *----------- Please reply in newsgroup -------------* >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul 2006: >> >> > Windows 2003 >> > >> > "Vera Noest [MVP]" schrieb: >> > >> >> Which OS is you TS running, W2K or 2003? >> >> >> >> _________________________________________________________ >> >> Vera Noest >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> TS troubleshooting: http://ts.veranoest.net >> >> *----------- Please reply in newsgroup -------------* >> >> >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= >> >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul >> >> 2006: >> >> >> >> > Hello >> >> > >> >> > I have ONE user having this problem. I have checked the >> >> > user rights and even added the "Domain Users" group to the >> >> > "Allow >> log >> >> > on to terminal services" right on all the Windows Terminal >> >> > Servers... but one account cannot connect having the error >> >> > message: "the local policy does not permit you to login >> >> > interactively". For information: there are about 70 people >> >> > working daily on these Terminal servers without nay >> >> > problem... >> >> > >> >> > I have already tried following: >> >> > >> >> > - delete / recreate the Windows account from this user >> >> > - delete his TS profile >> >> > - tried on another PC, thinking it could be a domain >> >> > relationship problem >> >> > >> >> > I have also checked the "Deny..." rights. This user is not >> >> > listed there: there is only one "support..." account >> >> > probably created by the installation. >> >> > >> >> > Has someone an idea ? >> >> > >> >> > Kind regards >> >> > Nicolas
From: Nicolas Heyer on 27 Jul 2006 01:23 No... In fact, he uses the Citrix Metaframe Client to connect... and I also tried on my computer with his credentials: it doesn't work... "Vera Noest [MVP]" schrieb: > Mmm, strange. > Can you verify that the user is *not* trying to use a console > connection? > I.e. connecting with "mstsc /console", or by using the Remote > Desktops snap-in from the AdminPak, and selecting the "Connect to > console" option? > _________________________________________________________ > Vera Noest > MCSE, CCEA, Microsoft MVP - Terminal Server > TS troubleshooting: http://ts.veranoest.net > ___ please respond in newsgroup, NOT by private email ___ > > =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= > <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul 2006 in > microsoft.public.windows.terminal_services: > > > Hi Vera > > > > Membership of Remote Desktop Users on each TS server is: > > > > NT Authority\Authenticated Users > > > > and I also added this morning: > > > > domain users > > > > but this didn't solve my problem. There is also no "deny" > > defined on the TS... > > > > KInd regards > > Nicolas > > > > "Vera Noest [MVP]" schrieb: > > > >> Have you checked membership in the local Remote Desktop Users > >> group on the TS? > >> > >> _________________________________________________________ > >> Vera Noest > >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> TS troubleshooting: http://ts.veranoest.net > >> *----------- Please reply in newsgroup -------------* > >> > >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= > >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul 2006: > >> > >> > Windows 2003 > >> > > >> > "Vera Noest [MVP]" schrieb: > >> > > >> >> Which OS is you TS running, W2K or 2003? > >> >> > >> >> _________________________________________________________ > >> >> Vera Noest > >> >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> >> TS troubleshooting: http://ts.veranoest.net > >> >> *----------- Please reply in newsgroup -------------* > >> >> > >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= > >> >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul > >> >> 2006: > >> >> > >> >> > Hello > >> >> > > >> >> > I have ONE user having this problem. I have checked the > >> >> > user rights and even added the "Domain Users" group to the > >> >> > "Allow > >> log > >> >> > on to terminal services" right on all the Windows Terminal > >> >> > Servers... but one account cannot connect having the error > >> >> > message: "the local policy does not permit you to login > >> >> > interactively". For information: there are about 70 people > >> >> > working daily on these Terminal servers without nay > >> >> > problem... > >> >> > > >> >> > I have already tried following: > >> >> > > >> >> > - delete / recreate the Windows account from this user > >> >> > - delete his TS profile > >> >> > - tried on another PC, thinking it could be a domain > >> >> > relationship problem > >> >> > > >> >> > I have also checked the "Deny..." rights. This user is not > >> >> > listed there: there is only one "support..." account > >> >> > probably created by the installation. > >> >> > > >> >> > Has someone an idea ? > >> >> > > >> >> > Kind regards > >> >> > Nicolas >
From: Vera Noest [MVP] on 27 Jul 2006 05:22 He's using ICA?! So we've been troubleshooting the wrong problem all the time......! _________________________________________________________ Vera Noest MCSE, CCEA, Microsoft MVP - Terminal Server TS troubleshooting: http://ts.veranoest.net *----------- Please reply in newsgroup -------------* =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= <NicolasHeyer(a)discussions.microsoft.com> wrote on 27 jul 2006: > No... > > In fact, he uses the Citrix Metaframe Client to connect... and I > also tried on my computer with his credentials: it doesn't > work... > > "Vera Noest [MVP]" schrieb: > >> Mmm, strange. >> Can you verify that the user is *not* trying to use a console >> connection? >> I.e. connecting with "mstsc /console", or by using the Remote >> Desktops snap-in from the AdminPak, and selecting the "Connect >> to console" option? >> _________________________________________________________ >> Vera Noest >> MCSE, CCEA, Microsoft MVP - Terminal Server >> TS troubleshooting: http://ts.veranoest.net >> ___ please respond in newsgroup, NOT by private email ___ >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul 2006 >> in microsoft.public.windows.terminal_services: >> >> > Hi Vera >> > >> > Membership of Remote Desktop Users on each TS server is: >> > >> > NT Authority\Authenticated Users >> > >> > and I also added this morning: >> > >> > domain users >> > >> > but this didn't solve my problem. There is also no "deny" >> > defined on the TS... >> > >> > KInd regards >> > Nicolas >> > >> > "Vera Noest [MVP]" schrieb: >> > >> >> Have you checked membership in the local Remote Desktop >> >> Users group on the TS? >> >> >> >> _________________________________________________________ >> >> Vera Noest >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> TS troubleshooting: http://ts.veranoest.net >> >> *----------- Please reply in newsgroup -------------* >> >> >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= >> >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul >> >> 2006: >> >> >> >> > Windows 2003 >> >> > >> >> > "Vera Noest [MVP]" schrieb: >> >> > >> >> >> Which OS is you TS running, W2K or 2003? >> >> >> >> >> >> _________________________________________________________ >> >> >> Vera Noest >> >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> >> TS troubleshooting: http://ts.veranoest.net >> >> >> *----------- Please reply in newsgroup -------------* >> >> >> >> >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= >> >> >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul >> >> >> 2006: >> >> >> >> >> >> > Hello >> >> >> > >> >> >> > I have ONE user having this problem. I have checked the >> >> >> > user rights and even added the "Domain Users" group to >> >> >> > the "Allow >> >> log >> >> >> > on to terminal services" right on all the Windows >> >> >> > Terminal Servers... but one account cannot connect >> >> >> > having the error message: "the local policy does not >> >> >> > permit you to login interactively". For information: >> >> >> > there are about 70 people working daily on these >> >> >> > Terminal servers without nay problem... >> >> >> > >> >> >> > I have already tried following: >> >> >> > >> >> >> > - delete / recreate the Windows account from this user >> >> >> > - delete his TS profile >> >> >> > - tried on another PC, thinking it could be a domain >> >> >> > relationship problem >> >> >> > >> >> >> > I have also checked the "Deny..." rights. This user is >> >> >> > not listed there: there is only one "support..." >> >> >> > account probably created by the installation. >> >> >> > >> >> >> > Has someone an idea ? >> >> >> > >> >> >> > Kind regards >> >> >> > Nicolas
From: Nicolas Heyer on 27 Jul 2006 11:14 Perhaps I should have talked about it before but there are 2 things that make me think that Metaframe and ICA have nothing to do with it: 1- the Knowledge Base from Citrix refers to Microsoft Windows Server 2003 when having this problem 2- If, for test purposes, I use another "simple" user and try to connect using this time "Remote Console" (mstsc.exe), the error message that is displayed, explains that I'm not an administrator and cannot therefore use this option. If I use my "corrupted" user with the Remote Console, the "local policy..." error is displayed, and in a much faster way then the other error message... So I really do not think, the problem relies on Citrix... but everything is possible... but I do really not know what to do next... I created a test user this morning and this one works fine... perhaps I will use it and rename it in order to replace the "corrupted one"... Thanks anyway for your help Regards Nicolas "Vera Noest [MVP]" schrieb: > He's using ICA?! So we've been troubleshooting the wrong problem > all the time......! > > _________________________________________________________ > Vera Noest > MCSE, CCEA, Microsoft MVP - Terminal Server > TS troubleshooting: http://ts.veranoest.net > *----------- Please reply in newsgroup -------------* > > =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= > <NicolasHeyer(a)discussions.microsoft.com> wrote on 27 jul 2006: > > > No... > > > > In fact, he uses the Citrix Metaframe Client to connect... and I > > also tried on my computer with his credentials: it doesn't > > work... > > > > "Vera Noest [MVP]" schrieb: > > > >> Mmm, strange. > >> Can you verify that the user is *not* trying to use a console > >> connection? > >> I.e. connecting with "mstsc /console", or by using the Remote > >> Desktops snap-in from the AdminPak, and selecting the "Connect > >> to console" option? > >> _________________________________________________________ > >> Vera Noest > >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> TS troubleshooting: http://ts.veranoest.net > >> ___ please respond in newsgroup, NOT by private email ___ > >> > >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= > >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul 2006 > >> in microsoft.public.windows.terminal_services: > >> > >> > Hi Vera > >> > > >> > Membership of Remote Desktop Users on each TS server is: > >> > > >> > NT Authority\Authenticated Users > >> > > >> > and I also added this morning: > >> > > >> > domain users > >> > > >> > but this didn't solve my problem. There is also no "deny" > >> > defined on the TS... > >> > > >> > KInd regards > >> > Nicolas > >> > > >> > "Vera Noest [MVP]" schrieb: > >> > > >> >> Have you checked membership in the local Remote Desktop > >> >> Users group on the TS? > >> >> > >> >> _________________________________________________________ > >> >> Vera Noest > >> >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> >> TS troubleshooting: http://ts.veranoest.net > >> >> *----------- Please reply in newsgroup -------------* > >> >> > >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= > >> >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul > >> >> 2006: > >> >> > >> >> > Windows 2003 > >> >> > > >> >> > "Vera Noest [MVP]" schrieb: > >> >> > > >> >> >> Which OS is you TS running, W2K or 2003? > >> >> >> > >> >> >> _________________________________________________________ > >> >> >> Vera Noest > >> >> >> MCSE, CCEA, Microsoft MVP - Terminal Server > >> >> >> TS troubleshooting: http://ts.veranoest.net > >> >> >> *----------- Please reply in newsgroup -------------* > >> >> >> > >> >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= > >> >> >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul > >> >> >> 2006: > >> >> >> > >> >> >> > Hello > >> >> >> > > >> >> >> > I have ONE user having this problem. I have checked the > >> >> >> > user rights and even added the "Domain Users" group to > >> >> >> > the "Allow > >> >> log > >> >> >> > on to terminal services" right on all the Windows > >> >> >> > Terminal Servers... but one account cannot connect > >> >> >> > having the error message: "the local policy does not > >> >> >> > permit you to login interactively". For information: > >> >> >> > there are about 70 people working daily on these > >> >> >> > Terminal servers without nay problem... > >> >> >> > > >> >> >> > I have already tried following: > >> >> >> > > >> >> >> > - delete / recreate the Windows account from this user > >> >> >> > - delete his TS profile > >> >> >> > - tried on another PC, thinking it could be a domain > >> >> >> > relationship problem > >> >> >> > > >> >> >> > I have also checked the "Deny..." rights. This user is > >> >> >> > not listed there: there is only one "support..." > >> >> >> > account probably created by the installation. > >> >> >> > > >> >> >> > Has someone an idea ? > >> >> >> > > >> >> >> > Kind regards > >> >> >> > Nicolas >
From: Vera Noest [MVP] on 27 Jul 2006 16:15
Which KB article from Citrix? Which version of Citrix? MetaFrame XP? or Presentation Server? 3.0 or 4.0? Since installing Citrix Presentation Server 3.0 and higher actually creates a completely new RDP listener, the fact that you are running Citrix on the server *is* relevant to the problem. What *exactly* is the text of the error message when the user tries to connect with the rdp client? If it is this message: "The desktop you are trying to open is currently available only to administrators" then you should uncheck "Allow published applications only" on the rdp-tcp connection properties. CTX104106 - Connection Error : The desktop you are trying to open is currently available only to administrators http://knowledgebase.citrix.com/kb/entry.jspa?externalID=CTX104106 But that won't solve your original problem. Have you checked the ica-tcp connection properties, especially the permissions? _________________________________________________________ Vera Noest MCSE, CCEA, Microsoft MVP - Terminal Server TS troubleshooting: http://ts.veranoest.net ___ please respond in newsgroup, NOT by private email ___ =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= <NicolasHeyer(a)discussions.microsoft.com> wrote on 27 jul 2006 in microsoft.public.windows.terminal_services: > Perhaps I should have talked about it before but there are 2 > things that make me think that Metaframe and ICA have nothing to > do with it: > > 1- the Knowledge Base from Citrix refers to Microsoft Windows > Server 2003 when having this problem > > 2- If, for test purposes, I use another "simple" user and try to > connect using this time "Remote Console" (mstsc.exe), the error > message that is displayed, explains that I'm not an > administrator and cannot therefore use this option. If I use my > "corrupted" user with the Remote Console, the "local policy..." > error is displayed, and in a much faster way then the other > error message... > > So I really do not think, the problem relies on Citrix... but > everything is possible... but I do really not know what to do > next... I created a test user this morning and this one works > fine... perhaps I will use it and rename it in order to replace > the "corrupted one"... > > Thanks anyway for your help > > Regards > Nicolas > > > > "Vera Noest [MVP]" schrieb: > >> He's using ICA?! So we've been troubleshooting the wrong >> problem all the time......! >> >> _________________________________________________________ >> Vera Noest >> MCSE, CCEA, Microsoft MVP - Terminal Server >> TS troubleshooting: http://ts.veranoest.net >> *----------- Please reply in newsgroup -------------* >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 27 jul 2006: >> >> > No... >> > >> > In fact, he uses the Citrix Metaframe Client to connect... >> > and I also tried on my computer with his credentials: it >> > doesn't work... >> > >> > "Vera Noest [MVP]" schrieb: >> > >> >> Mmm, strange. >> >> Can you verify that the user is *not* trying to use a >> >> console connection? >> >> I.e. connecting with "mstsc /console", or by using the >> >> Remote Desktops snap-in from the AdminPak, and selecting the >> >> "Connect to console" option? >> >> _________________________________________________________ >> >> Vera Noest >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> TS troubleshooting: http://ts.veranoest.net >> >> ___ please respond in newsgroup, NOT by private email ___ >> >> >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= >> >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul >> >> 2006 in microsoft.public.windows.terminal_services: >> >> >> >> > Hi Vera >> >> > >> >> > Membership of Remote Desktop Users on each TS server is: >> >> > >> >> > NT Authority\Authenticated Users >> >> > >> >> > and I also added this morning: >> >> > >> >> > domain users >> >> > >> >> > but this didn't solve my problem. There is also no "deny" >> >> > defined on the TS... >> >> > >> >> > KInd regards >> >> > Nicolas >> >> > >> >> > "Vera Noest [MVP]" schrieb: >> >> > >> >> >> Have you checked membership in the local Remote Desktop >> >> >> Users group on the TS? >> >> >> >> >> >> _________________________________________________________ >> >> >> Vera Noest >> >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> >> TS troubleshooting: http://ts.veranoest.net >> >> >> *----------- Please reply in newsgroup -------------* >> >> >> >> >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= >> >> >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 jul >> >> >> 2006: >> >> >> >> >> >> > Windows 2003 >> >> >> > >> >> >> > "Vera Noest [MVP]" schrieb: >> >> >> > >> >> >> >> Which OS is you TS running, W2K or 2003? >> >> >> >> >> >> >> >> _______________________________________________________ >> >> >> >> __ Vera Noest >> >> >> >> MCSE, CCEA, Microsoft MVP - Terminal Server >> >> >> >> TS troubleshooting: http://ts.veranoest.net >> >> >> >> *----------- Please reply in newsgroup -------------* >> >> >> >> >> >> >> >> =?Utf-8?B?Tmljb2xhcyBIZXllcg==?= >> >> >> >> <NicolasHeyer(a)discussions.microsoft.com> wrote on 26 >> >> >> >> jul 2006: >> >> >> >> >> >> >> >> > Hello >> >> >> >> > >> >> >> >> > I have ONE user having this problem. I have checked >> >> >> >> > the user rights and even added the "Domain Users" >> >> >> >> > group to the "Allow >> >> >> log >> >> >> >> > on to terminal services" right on all the Windows >> >> >> >> > Terminal Servers... but one account cannot connect >> >> >> >> > having the error message: "the local policy does not >> >> >> >> > permit you to login interactively". For information: >> >> >> >> > there are about 70 people working daily on these >> >> >> >> > Terminal servers without nay problem... >> >> >> >> > >> >> >> >> > I have already tried following: >> >> >> >> > >> >> >> >> > - delete / recreate the Windows account from this >> >> >> >> > user - delete his TS profile >> >> >> >> > - tried on another PC, thinking it could be a domain >> >> >> >> > relationship problem >> >> >> >> > >> >> >> >> > I have also checked the "Deny..." rights. This user >> >> >> >> > is not listed there: there is only one "support..." >> >> >> >> > account probably created by the installation. >> >> >> >> > >> >> >> >> > Has someone an idea ? >> >> >> >> > >> >> >> |