This message was deleted.
# _generals
Slackbot
03/13/2023, 3:21 PMThis message was deleted.
k
Kasper Johansen
03/13/2023, 3:23 PMHow about adding the same group to the Remote Desktop users group? It should produce the same result
j
James Rankin
03/13/2023, 3:28 PMThe GPO for "allow logon" and actually adding the groups to the RDP Users group need to be configured separately, don't they?
k
Kasper Johansen
03/13/2023, 3:30 PMThey do, but I don't think you need to configure "allow logon" if the user is a member of the Rmote Desktop users group
j
James Rankin
03/13/2023, 3:30 PMOh, I thought you did - unless of course the "Remote Desktop Users" is allowed that user right by default. Maybe my usual environments are higher security
c
Chai
03/13/2023, 3:32 PM@Kasper Johansen Domain users group is already added to local RDP group.
k
Kasper Johansen
03/13/2023, 3:33 PMUnless you configre something "non default" on the allow logon through remote desktop services setting, nothing else should be configured to allow RDP access
c
Chai
03/13/2023, 3:33 PMWe're adding remote desktop users group to that allow logon through remote desktop services policy so that all users who are part of that local RDP group are allowed through Citrix.
Chai
03/13/2023, 3:34 PMBy default only admins are allowed on that RDP group.
Chai
03/13/2023, 3:34 PMlocal RDP group I mean.
k
Kasper Johansen
03/13/2023, 3:34 PMYes, but you can add users or groups to that group using GPO
c
Chai
03/13/2023, 3:36 PM@James Rankin My bad, Thats what we did.. updated above message.
👍 1
j
James Rankin
03/13/2023, 3:37 PMSo can't you just use Restricted Groups GPO or Local Users and Groups GPP to fill the local RDP Users group with the users you need?
James Rankin
03/13/2023, 3:37 PMAnd then only "Admins" and "RDP Users" local groups need to have the security right defined?
c
Chai
03/13/2023, 3:39 PMDomain users AD group is added to local Remote desktop users group (this is OK).
Local Remote desktop group is added to "allow logon through remote desktop services" policy. This is added through a GPO. It is failing for some reason.
j
James Rankin
03/13/2023, 3:40 PMAre you doing it via domain GPO or local GP?
James Rankin
03/13/2023, 3:41 PMBut I'm still a bit confused as to why you need to change it because I'm sure Remote Desktop Users gets that user right by default......
c
Chai
03/13/2023, 3:45 PMWe are doing it with a domain GPO.
Chai
03/13/2023, 3:45 PMcan you run rsop in that same machine?
j
James Rankin
03/13/2023, 3:46 PMOK, then does gpresult /r show the domain GPO being applied?
c
Chai
03/13/2023, 3:46 PMI wonder if that RDP group is added through a domain or local GPO
j
James Rankin
03/13/2023, 3:46 PMIf it does, then are there any errors in the event logs during the application of the GPO?
c
Chai
03/13/2023, 3:47 PMFor now, I am only working on verifying on whether we have that remote desktop users group in allow logon through remote desktop services policy in secpol.
Why that GPO is not being applied - i m going to involve our windows team for that.
m
Mike Streetz (O_P)
03/13/2023, 6:14 PMIf you want users to be able to RDP you need to add them to the Direct Access group too.
https://support.citrix.com/article/CTX477298/1912cu6-how-to-enable-users-rdp-after-vda-installation
💯 4
c
Christian Jöns
03/13/2023, 6:46 PMAs Mike says
j
James Rankin
03/14/2023, 10:33 AMYep, Direct Access group is always the one people forget
2 Views