This topic describes how to fix a permission error when you connect to a Windows instance by using Remote Desktop.
Problem description
When you connect to a Windows instance from an on-premises client by using Remote Desktop, you receive an error that your account is not authorized for remote logon.
Causes
This issue can occur for the following reasons:
The local security policy of the ECS instance is configured incorrectly. To resolve this issue, see Solution 1: Modify the local security policy.
A general user account lacks remote logon permissions. To resolve this issue, see Solution 2: Grant remote logon permissions to a general user.
Solutions
Select a solution based on your scenario. The procedures in this topic use Windows Server 2012 as an example.
Solution 1: Modify the local security policy
Connect to the Windows instance by using VNC.
For more information, see Connect to an instance by using VNC.
Right-click Start, and then click Run. In the Run dialog box, enter
gpedit.mscand click OK to open the Local Group Policy Editor.In the Local Group Policy Editor window, navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
In the User Rights Assignment pane, double-click Deny log on through Remote Desktop Services. The Deny log on through Remote Desktop Services Properties window opens.
In the Deny log on through Remote Desktop Services Properties window, check if the Remote Desktop Users group or the domain user account you want to use is in the list. If either is present, remove it.
In the User Rights Assignment pane, double-click Allow log on through Remote Desktop Services. The Allow log on through Remote Desktop Services Properties window opens.
In the Allow log on through Remote Desktop Services Properties window, check for Remote Desktop Users and the required domain user accounts. If they are not listed, add them.
From another host, use the new user account to log on to the Windows instance remotely and verify the connection.
Solution 2: Grant remote logon permissions to a general user
Connect to the Windows instance by using VNC.
For more information, see Connect to an instance by using VNC.
Open the Computer Management console.
Click Start, and then click Server Manager.
In the Server Manager dashboard, click All Servers. In the SERVERS pane, right-click the target server and select Computer Management.
In the Computer Management console, navigate to System Tools > Local Users and Groups > Users. Right-click the Users folder and select New User. In the New User dialog box, create a user. This topic uses a user named test as an example.
After the user is created, right-click the test username, select Properties (R) > Member Of, and click Add to add the user to the Remote Desktop Users group. The general user can then perform a remote logon.
NoteRemote Desktop Users is the group authorized for remote logon. Any user added to this group gains permission to log on remotely.