After several YEARS of operation, i got a Ticket of an user error: user is complaining tjhat he can see the RDweb icons, but when try to access any published App, the error message:
"To log on to this computer, you must be granted the Allow log on through the Terminal (or Remote Desktop) Services right...."
IN the EV logs:
Failure Information:Failure Reason:The user has not been granted the requested logon type at this machine.
Status: 0xc000015b
Sub Status: 0x0
The TSWeb is up and running for several years, Win2008R2, installed and barely touched since 2012!
So:
1) There are several published applications, among them, a "Chrome Browser" associated to a global group GG-TS-Chrome, and the GG-TS-Chrome is inside the local "Remote Desktop Users" as usual. Te user can see all icons on TSWeb, so, it proves that the user is being considered as inside the group and the whoami /groups is expecting as expected, showing the user´s groups
2) There is NO Deny Logon via TS local or domain policy in place
3) The checkbox denying logon via TS in user´s AD properties (RDS profile) is NOT checked
4) The AD group GG-TS-Chrome is isnde the "Remote Desktop Users" of the local TS/RDweb server
5) RDP properties are OK, permissions for Guest/users are in palce, as expected
what else should I check?