☰

终端服务器 2008 登录：RDP 尝试访问被拒绝

tag-icon • tag-icon terminal-server licensing
终端服务器 2008 登录：RDP 尝试访问被拒绝

当我尝试通过 RDP 进入 Server 2008 终端服务器时，我收到一条消息，显示“拒绝访问”和一个确定按钮。我正确设置了许可模式（每个用户），并且还设置为允许所有远程连接。我在安全事件日志中收到以下内容：

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          28/06/2012 12:01:16
Event ID:      4656
Task Category: File System
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      FQDN COMPUTER 
Description:
A handle to an object was requested.

Subject:
    Security ID:        DOMAIN\ACCOUNT
    Account Name:       ACCOUNT
    Account Domain:     DOMAIN
    Logon ID:       0xbbe3f

Object:
    Object Server:      Security
    Object Type:        File
    Object Name:        C:\Windows\System32\ServerManager.msc
    Handle ID:      0x0

Process Information:
    Process ID:     0x60c
    Process Name:       C:\Windows\System32\mmc.exe

Access Request Information:
    Transaction ID:     {00000000-0000-0000-0000-000000000000}
    Accesses:       READ_CONTROL
                SYNCHRONIZE
                WriteData (or AddFile)
                AppendData (or AddSubdirectory or CreatePipeInstance)
                WriteEA
                ReadAttributes
                WriteAttributes

    Access Reasons:     READ_CONTROL:   Granted by  D:(A;;0x1200a9;;;BA)
                SYNCHRONIZE:    Granted by  D:(A;;0x1200a9;;;BA)
                WriteData (or AddFile): Not granted
                AppendData (or AddSubdirectory or CreatePipeInstance):  Not granted
                WriteEA:    Not granted
                ReadAttributes: Granted by ACE on parent folder D:(A;;0x1301bf;;;BA)
                WriteAttributes:    Not granted

    Access Mask:        0x120196
    Privileges Used for Access Check:   -
    Restricted SID Count:   0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4656</EventID>
    <Version>1</Version>
    <Level>0</Level>
    <Task>12800</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2012-06-28T15:01:16.975080700Z" />
    <EventRecordID>1535565</EventRecordID>
    <Correlation />
    <Execution ProcessID="540" ThreadID="556" />
    <Channel>Security</Channel>
    <Computer>FQDN COMPUTER/Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-21-205301047-3902605089-2438454170-21511219</Data>
    <Data Name="SubjectUserName">ACCOUNT</Data>
    <Data Name="SubjectDomainName">DOMAIN</Data>
    <Data Name="SubjectLogonId">0xbbe3f</Data>
    <Data Name="ObjectServer">Security</Data>
    <Data Name="ObjectType">File</Data>
    <Data Name="ObjectName">C:\Windows\System32\ServerManager.msc</Data>
    <Data Name="HandleId">0x0</Data>
    <Data Name="TransactionId">{00000000-0000-0000-0000-000000000000}</Data>
    <Data Name="AccessList">%%1538
                %%1541
                %%4417
                %%4418
                %%4420
                %%4423
                %%4424
                </Data>
    <Data Name="AccessReason">%%1538:   %%1801  D:(A;;0x1200a9;;;BA)
                %%1541: %%1801  D:(A;;0x1200a9;;;BA)
                %%4417: %%1805
                %%4418: %%1805
                %%4420: %%1805
                %%4423: %%1811  D:(A;;0x1301bf;;;BA)
                %%4424: %%1805
                </Data>
    <Data Name="AccessMask">0x120196</Data>
    <Data Name="PrivilegeList">-</Data>
    <Data Name="RestrictedSidCount">0</Data>
    <Data Name="ProcessId">0x60c</Data>
    <Data Name="ProcessName">C:\Windows\System32\mmc.exe</Data>
  </EventData>
</Event>

有任何想法吗？

答案1

看起来它正在尝试在您首次登录时打开服务器管理器，但用户没有权限这样做。

登录的用户是否为服务器上的本地管理员？

在服务器管理器中，在第一个屏幕上单击“登录时不显示此控制台”。

答案2

解决方案如下：

http://blog.danielcosta.pt/?p=371

远程桌面服务正在使用“LocalSystem”帐户运行。如果您将此注册表项与其他正在运行的服务器进行比较，您会发现需要让此服务器使用“NT AuthorityNetworkService”运行。

相关内容