This topic describes how to resolve the issue that the error message that indicates lack of Terminal Server User Access permissions appears when you connect to a Windows Elastic Compute Service (ECS) instance by using Remote Desktop.
Problem description
When you use Remote Desktop to connect to a Windows instance from a on-premises client, the error message that indicates lack of Terminal Server User Access permissions appears.
Causes
The issue may occur because of the following reasons:
The local security policy of the instance is configured incorrectly. To resolve the issue, perform the operations that are described in the Solution 1: Modify a local security policy section.
General users are not granted the permissions to log on to the instance. To resolve the issue, perform the operations that are described in the Solution 2: Grant the logon permissions to general users section.
Solutions
Use one of the following solutions to resolve the issue based on the actual scenario. In the following examples, an instance that runs Windows Server 2012 is used.
Solution 1: Modify the local security policy
Connect to the Windows instance by using Virtual Network Computing (VNC).
For more information, see Connect to a Windows instance by using a password.
Right-click the Start icon and select Run. In the Run dialog box, enter
gpedit.mscand click OK to start Local Group Policy Editor.In the Local Group Policy Editor window, choose Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
In the Policy directory, double-click Deny log on through Remote Desktop Services to open the Deny log on through Remote Desktop Services Properties window.
In the Deny log on through Remote Desktop Services Properties window, check whether Remote Desktop Users and a domain user account used to connect to the instance exist. If Remote Desktop Users or the domain user account exist, delete them.
In the Policy directory, double-click Allow log on through Remote Desktop Services to open the Allow log on through Remote Desktop Services Properties window.
In the Allow log on through Remote Desktop Services Properties window, check whether Remote Desktop Users and a domain user account used to connect to the instance exist. If no Remote Desktop Users or domain user accounts exist, add a Remote Desktop user and a domain user account.
Use the added user to log on to the Windows instance from another host. Make sure that you can connect to the Windows instance.
Solution 2: Grant the logon permissions to general users
Connect to the Windows instance by using VNC.
For more information, see Connect to a Windows instance by using a password.
Go to the Computer Management window.
Right-click the Start icon and select Server Manager.
In the Server Manager window, click All Servers. In the SERVERS section, right-click the server that you use and click Computer Management.
In the Computer Management window, choose System Tools > Local Users and Groups > Users and select New User. In the New User window, create a user. In this example, a user named test is created.
After you create the user, right-click test. In the test Propertieswindow, click the Member of tab and then click Add to add the user to Remote Desktop Users. Then, general users can log on to the instance.
NoteRemote Desktop Users is the group that is granted the remote logon permissions. All users that are added to this group are granted the remote logon permissions.