Home / server / Questions / 805573
In Process
bjoster
Asked: 2016-09-28 03:39:37 +0800 CST

Remote Desktop to 80% of my servers do no longer work ("User account restriction") from just one of my PCs

  • 772

I came into work last week, checked my first ticket (easy to fix one), RDP'd into the server needed for this and the login did not work. After clicking 'connect' I got the "Unable to Log You on Because of an Account Restriction" message. Checked another server (all machines are 2008R2/2012R2), the same message. No, I do not habe an empty password, not using network auth, my clint is Windows 10 (1607).

Here is what I did:

  • Used another client (Win10.1607), same ou, same setup. Can perfectly login from anywhere to anywhere (so I am asuming it's no my user account or a GPO)
  • Checked servers: I can RDP into all my DC's and a few other machines (2008R2/2012R2), looks random to me (all server in the same OU, no special software installed)
  • Deleted the mstsc cache (%appdata%..\local\Microsoft\Terminal Server Client* )
  • Cleaned up HCU\SOFTWARE\Microsoft\Terminal Server Client
  • Watched the eventlogs: nothing. Absolutely nothing. So I assume it's my client, not the servers. But I can RDP into all my servers at home and in another (customers) network ...
  • Checked date/time on client/server (0.0002ms apart)
  • Checked account restrictions on ma account (neither time nor machine restrictions are present)
  • Checked if logon at the console works (vm/ilo): works perfectly fine with my credentials
  • Checked if Share-Access would work (\\server\share): Does not work, I am seeing the same error message. Works from clientB, but not from alientA.
  • When doing the same thing from one of the 'working' machines (sever or client), everything is fine.

Any Ideas where to look for this? It is haunting me into my sleep :-(

Updates: Surely I checked the local policies on the server(s). any changes would have surprised me - there are a lot of servers. Also checked the clients GPO, nothing.

windows remote-desktop active-directory rdp

1 Answers

  1. The solution in my case was the option "Restrict delegation of Credentials to remote Servers".

    Basically, there is a new Group policy settings that can prevent a system to pass credentials to a remote server. This was exactly the issue. you can find this setting in your lokal oder domain group policy under:

    Computer Configuration > Administrative Templates > System > Credential Delegation
    • 0