Remote Desktop Problem on Windows Server 2008 R2

Question

Revised this question to be more concise, consolidating several revisions.

Symptoms:

From a domain-member Windows 7 Client:

• Domain credentials to a domain controller => success
• Domain credentials to a member server (by hostname or FQDN) => success
• Domain credentials to a member server (by IP) => fail
• Local credentials to a member server (by either) => success

From a non-domain-member Windows 7 Client:

• Domain credentials to a domain controller => success
• Domain credentials to a member server => fail
• Local credentials to a member server => success
• (Identical behavior from a Mac RDC 2.1 client)

Server Configuration Details:

• Windows 2008 R2 Datacenter w/ SP1
• The domain in question is a subdomain of a Windows 2008 domain (forest root).
• Root has DCs in both Site A and Site B, subdomain only has DCs in Site B.
• RDP is operating normally on all root member-servers and DCs.
• No remote desktop settings are defined by GPOs.
• Network level authentication is enabled; all clients are compatible and the certificate exchange/SSL handshake completes successfully.
• Not catching any errors in netlogon log.

Solution

1. If you are seeing SID's in local groups then your DNS or AD access is messed up from that server to either sub or parent domain IMO. RDP access could be a red herring and the real issue is proper connectivity to AD. Do you have event log events talking about unable to resolve account, etc? In a healthy server you should never see SID's IMO (unless accounts are deleted).
2. It's possible a GPO is affecting member servers security policy "allow log on through Remote Desktop Services" or the often forgotten "deny log on through Remote Desktop Services" inside the computer GPO config. You might be left out of the first or added to the second for member servers GPO, then that could be overwritten at the DC container level by the "default domain controllers policy". Run a Group Policy Results on a member server as you and see what shows up for:

computer config > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignments > two settings in quotes above

Comments

[Admin]

A domain is a security boundary, is your user account a domain admin in both the parent and child domain?

[Admin]

The user is a member of the same domain as the target RD Session Host, and is a member of the Domain Admins group.

[Avinash Gupta]

1. Event Viewer and dcdiag indicate that AD is working properly. I can authenticate for UNC, but not RDP. 2. The two settings are not defined in the GPO. I did however discover an interesting twist. I'll update the question with that.

[Avinash Gupta]

Thanks for the response. GPO modeling on the member server matches the policy in the GC. Nothing is defined except that RDP should be enabled. The interesting twist is that it works fine by hostname, but not by IP, even though they resolve to the same address (see Update 2).

[BoxerBucks]

Just to clarify, if you RDP to these machines using either the host name or the fqdn, it will prompt for credentials and log you in to the desktop. If you run "mstsc /v <IP Address>" it will prompt you for credentials but give you the message that the credentials are invalid?

[Avinash Gupta]

Correct, mstsc /v <IP>, enter credentials, and it repeats the prompt with this error: "The credentials that were used to connect to <IP> did not work. Please enter new credentials." : "The logon attempt failed"

[Bret Fisher]

for the failed attempt, what's the event logs say? security got a specific failure? Do you have IPSec policies in place? On the member boxes are you set for NLA auth only? wondering if either NLA or IPSec could be denying connection based on certificate not matching name you use to access. Is your RDP client set to deny connections that don't auth to server (although that results in a diff error then you said in update 2)?

[BoxerBucks]

Enable netlogon debugging and look at the debug file for the error. Also look in the security logs to see the authentication error. I don't know the significance of using an IP address to simply connect mstsc to a machine as opposed to using the FQDN. I didn't think there was a difference - once the connection is made and you pass the credentials, the machine you are authenticating to takes care of the rest. The fact that you use an ip address or an FQDN shouldn't matter.

[Avinash Gupta]

Stangely, I don't see anything in any of the logs (both client and server-side). There aren't any IPSec policies. Both the DCs and member servers require NLA - tried allowing connections without NLA, but the Windows 7 and 2008 R2 clients attempt it by default. The RDP client is configured to warn on a certificate error - I permanently accepted the cert when I first connected.

[BoxerBucks]

I also found this thread that references your problem and says there is a hotfix available. Its at the bottom of the page - social.technet.microsoft.com/Forums/en-US/winserverTS/thread‌​/…