To log on to this remote computer.... Mandatory Profile

[Dublin73]

Hi All,

Hope someone out there can help. I'm trying to implement mandatory profiles for my Citrix users, but when I do, they cannot log in. The error message they receive reads...

"To log on to this remote computer, you must have Terminal Server User Access permissions on this computer. By default, members of the Remote Desktop Users group have these permissions. If you are not a member of the Remote Desktop Users Group or another group that has these permissions, or if the Remote Desktop Users group does not have these permissions, you must be granted these permissions manually."

When a user does not have a mandatory profile applied, he can log into Citrix without any problems. Here is some more information...

I'm fairly confident that the mandatory profile has been set up correctly. It is sitting on the root partition and for the meantime I've given "Everyone" Full Control access to it. The "ntuser.dat" file in the profile folder has been renamed to "ntuser.man" and AD user & Computers has been edited accordingly, whereby the Terminal Services profile for the user points to \\servername\profilename

OS is Windows Server 2003. Both Citrix licensing and Terminal Services licensing are installed on the Domain Controller in the domain. Citrix MetaFrame Presentation Server 3.0 is installed on a different server. This is the only Citrix Server installed.

I have tried the following in an attempt to resolve....

Made the test user a member of the "Remote Desktop Users" group

Unticked "Only Launch Published Applications" in the "Citrix Connection Configuration" for both ICA and RDP.

Adding "anonymous" to the "Remote Desktop Users" group.

None of the above has resolved the problem for me.

Also to note, when I go into "Terminal Server Licensing" on the licensing server, "Temporary Licenses for Windows Server 2003 - Terminal Server Per Device CAL Token" displays that 5 are "Issued". This is valid as we have 5 users that connect to the server. I understand these to be the "grace" Windows Server 2003 Terminal Server CALs that you get, whereby you have something like 90 days to purchase valid licensing.

Today I've installed 5 valid Windows Server 2003 Terminal Server CALs and they seem to be installed successfully, however, when a user logs in, under "Windows Server 2003 - Terminal Server Per User CAL Token" the number of issued remains at zero. I'm thinking that these may start getting issued once the 5 licenses listed under "Temporary Licenses for Windows Server 2003 - Terminal Server Per Device CAL Token" are expired.

Any ideas as to what I need to look at next? I really want to get the users onto Mandatory profiles.

thanks in advance to any of you Citrix gurus out there who can help me!

Dublin73

 

[Dublin73]

Hi All,

To add to my first posting.... I have a Windows Global Group in the domain called "Citrix Users". When I add this group to the local "Administrators" group on the Citrix server itself, I can log in to Citrix successfully from the client AND the mandatory profile gets applied. Having said that, this is the only way I can log in to Citrix successfully with the mandatory profile.

When I remove the "Citrix Users" group from the local "Administrator" group on the Citrix server ,I'm back to not being able to log in to the Citrix server from the client again. I've tried adding the "Citrix Users" group to both the local "Users" and local "Power Users" groups on the Citrix server, but I still cannot log in successfully.

I've also given the "Citrix Users" group Full Control permissions over the RDP and ICA connections under "Terminal Services Configuration" on the Citrix Server.

Any suggestions would be greatly appreciated!

thanks, Dublin73