Return
-
Title
How to adjust permissions to log on to Terminal Server for AD accounts -
Description
New user accounts (Active Directory) are being created with "Deny this user permissions to log on to Terminal Server" enabled.
Note: In Active Directory the default setting for "Deny this user permissions to log on to Terminal Server" is false. Thus accounts created during a synchronization will have "Login to terminal server permitted" set to "True" (checked in Manager).
How can this be prevented or changed so that new users are granted the permission to logon by default? -
Cause
By default the value of 'AllowLogonTerminalServer@ADSAccount' is false when an ADSAccount is created in Manager, which means the Active Directory user account will have "Deny this user permissions to log on to Terminal Server" selected ("Terminal Services Profile" tab).
-
Resolution
One way to change this is to update the process step for "VI_ADS_ADSAccount_INSERT", "Create ADSAccount in ADS", so that for 'AllowLogonTerminalServer' the value is 'True', e.g.:
'Value = True' instead of the default, 'Value = $AllowLogonTerminalServer:Bool$'.
This would require making a copy of the default "VI_ADS_ADSAccount_INSERT" and making the required change.
To change the behaviour for user accounts brought in via a synchronization, the default process "VI_ADS_ADSAccount_UPDATE" can be changed to update 'AllowLogonTerminalServer'.