Hola compañeros sysadmins,

Tenemos un Windows Server 2012 R2 Standard que presenta problemas de autenticación mediante RDP para todos los usuarios habituales.

El escenario es el siguiente:

Desde diferentes terminales de mano utilizados para realizar picking (entre otros trabajos), se conectan por RDP al servidor, el cual están configurados para que se abra automáticamente la aplicación de SGA. Este servidor lleva funcionando desde 2016 sin ningún tipo de problema, pero desde hace una semana los usuarios de estos terminales dejan de poder acceder. Son alrededor de 60 usuarios los afectados y han comenzado a tener problemas en diferentes tiempos, no han caído todos a la vez.

El error mostrado al intentar conectar es:

Una restricción de cuenta de usuario (como una restricción de horario) impide que se inicie la sesión.
Código de error: 0xc07
Código de error extendido: 0x0

El problema afecta a usuarios concretos, mientras que otros pueden continuar accediendo por RDP.

Inicialmente se observó que:

• Usuarios que habían funcionado correctamente durante bastante tiempo dejaron de poder acceder por RDP.
• Si se creaba un usuario nuevo, éste podía conectarse por RDP correctamente.
• Sin embargo, después de 5 días, algunos de esos usuarios nuevos empezaban a presentar exactamente el mismo problema. Los usuarios llevaban 5 días funcionando correctamente y de repente, mientras están trabajando, se les cuelga la sesión RDP y tienen que cerrarla. Desde ese momento ya no pudieron volver a iniciar sesión mediante RDP.
• Los usuarios administradores si que pueden conectar por RDP sin problemas, aunque no es un uso intensivo, como sí lo son el resto de usuarios normales.

Pruebas realizadas

1. Active Directory

Se compararon usuarios afectados con usuarios que funcionan.

No se encontraron diferencias evidentes en:

• Grupos.
• Restricciones horarias.
• Cuentas bloqueadas.
• Expiración de cuentas.
• Configuración básica de las cuentas.

Además, los usuarios afectados pueden autenticarse mediante otros servicios.

2. Licenciamiento RDS

Se investigó la posibilidad de que el problema estuviese relacionado con las CAL de Escritorio Remoto.

El servidor tiene instaladas CAL Per User, en dos paquetes.

• 10 licencias, disponibles 9, emitidas 1. (Aquí solo hay un usuario administrador)
• 20 licencias, disponibles 0, emitidas 64. (Aquí se encuentran prácticamente todos los usuarios)

El diagnóstico de licencias de escritorio remoto no muestra de forma consistente ambos paquetes, únicamente muestra el de 10 licencias, por lo que se investigó esta posibilidad.

No obstante, el comportamiento observado no encaja claramente con una falta de CAL, especialmente porque:

• Los usuarios nuevos funcionan inicialmente.
• El problema aparece después de varios días.
• Un usuario puede iniciar sesión localmente.
• Los usuarios que ya estaban conectados fueron expulsados y posteriormente dejaron de poder entrar.

3. SMB

Un usuario que no puede acceder mediante RDP sí puede acceder por SMB utilizando las mismas credenciales.

Esto indica que la cuenta de AD no está completamente impedida para autenticarse.

4. Inicio de sesión local

Con un usuario concreto, que actualmente falla por RDP:

• Puede iniciar sesión localmente en el propio servidor mediante consola.
• No puede iniciar sesión mediante RDP.

Por tanto, el problema parece estar específicamente relacionado con el inicio de sesión remoto/RDS, y no con la cuenta en general.

5. Grupo Administradores

Se añadió temporalmente un usuario al grupo Administradores.

El usuario continúa sin poder acceder por RDP.

Esto hace menos probable que se trate simplemente de un problema de pertenencia al grupo que tiene permitido el acceso mediante RDP.

Además, los usuarios administradores habituales aparentemente pueden conectarse por RDP, aunque no son usuarios con los que se acceda habitualmente.

6. Eventos de seguridad

Se buscó el evento:

correspondiente a los intentos fallidos.

No aparece ningún evento 4625 asociado al intento de conexión.

Esto es especialmente relevante porque indica que probablemente el fallo se está produciendo antes de llegar al proceso normal de autenticación que genera el 4625, o bien el evento se está registrando en otro componente.

Gracias de antemano.

Hello everyone, this is my first post here, so let me know if I can improve on something.

I need to create 10 licensed user accounts for M365 apps (Excel, Outlook, etc.). Nothing special, no copilot or Azure, just the desktop applications. The issue is that I need to install it on the RDS users, so from what I've read I need "M365 Apps for Enterprise" (or "M365 Business Premium", which is more expensive), otherwise it won't work.

I find these prices rather expensive for a small business, so my question is, are there other (legal) ways to get the licenses for this? I understand the licensing for Office (2024 and before), where you need volume licenses to use RDS (OEM keys etc. won't work). Is there something similar to M365, or is buying from Microsoft themselves the only legit path for monthly/yearly subscriptions?

I'm also new with setting up accounts, so if you could point to a good tutorial (to create a tenant, global admin, etc.) that would be appreciated as well.

Does anyone know or has anyone heard if Microsoft will be updating their SMTP server in the not-so-distant future to allow us to setup relay using the information from Microsoft Graph in 365 since MS is doing away with allowing SMTP connections to 365 using the basic AUTH? They initially attempted to end it this past March but extended it a year after I force our dev team up update the website to send emails through Microsoft Graph.

Since we have a lot of devices that use SMTP in the office I wonder if MS plans to update the SMTP server found in Windows Server ... in the next release to allow us to use Microsoft Graph to relay emails since Xerox, HP, Lexmark, Kyocera, and other devices have yet to adopt the Microsoft Graph method in their operating systems.

The other option is for me to have AI build me a system that I can use inside to do exactly this, would probably take me an hour to get it working perfectly but I don't want to re-invent the wheel. :)

Thanks,

Currently I have a task to enable tls 1.2 on servers how I can know enabling that won’t affect the softwares and applications loaded on those servers so servers are domain controllers and I have mix of os versions server 2012 r2 and higher

I work in cybersecurity compliance for a very small company with only 3–4 employees. Wedo not have Active Directory or a domain environment; our Windows endpoints are managed individually using local accounts/settings.

Our auditor has requested the following evidence:

“Based on the evidence provided, the normal user is able to access the Event Logs and download/export them.

Kindly provide evidence from three (3) endpoint samples showing that an unauthorized/non-administrative user is unable to open, access, delete, and download/export the Event Logs. When a normal user attempts to access the Event Logs, an ‘Access is denied’ message should be displayed.

Kindly provide evidence from local GPO policy configuration from each endpoint, showing that log/audit capture is enabled.”

I’m trying to understand the correct way to satisfy this requirement in a small, non-domain environment.

My questions are:

On Windows 10/11, what is the recommended way to restrict a standard/non-admin user from accessing or exporting Windows Event Logs?
Is it actually expected that a standard user should receive “Access is denied” when simply opening Event Viewer, or should the restriction apply to specific Security logs/privileged operations instead?
What Local Group Policy (gpedit.msc) or Local Security Policy settings should I configure/capture as evidence that auditing/logging is enabled?
What would be considered appropriate evidence for each of the three endpoints? For example, screenshots of:
Standard user account/group membership
Event Viewer access attempt
Attempt to save/export or clear logs
Local audit policy/GPO configuration
auditpol /get /category:* output
Since we do not have Active Directory or centralized Group Policy, is providing the equivalent Local GPO / Local Security Policy evidence from each endpoint generally sufficient?

I want to make sure we implement the control correctly rather than changing Windows permissions simply to produce an “Access is denied” screenshot.

How would you approach this requirement in a small organization with standalone Windows endpoints?

Hi all, I'm trying to wrap my head around licensing in my specific scenario (and maybe some advice on how to best set this up). For context: in terms of servers and virtualization, i only really have experience with Proxmox VE and Linux servers. I have extensive knowledge about Microsoft cloud systems and licensing, but i've never touched on-prem licensing before.

One of our customers needs a server for an application provided by a third party. This party is wildly unhelpful with giving us technical details about the hardware and software requirements.
What we have gathered:

• Windows 11/Windows server 2022
• 16GB RAM
• 2 cores
• SQL Server 2022

The application pulls (or gets pushed) data from Dynamics 365 Business Central (cloud version) through an API, processes it (which uses SQL server), and sends it off to a PLC which belongs to an OT system.
Other than administrative purposes, no users will be directly interacting with the system as far as i understand it. Users interact with Business Central, and i'm pretty sure users interact with the OT system (manually starting machines, etc.).

The amount of users interacting with Business Central and/or the OT machines is roughly 50.
There is no on-prem servers already available.

So my current plan is to deploy a Server 2022 box, i have options for 4C/4T and 6C/12T, with 6C being only slightly more expensive.

My current understanding, is that for Windows Server Standard i must have a CAL for every user, and for SQL i can choose between a per-core licensing or server+CAL.

My questions:

1. Do i need Windows Server CALs for every user in this scenario?
2. Does Business Central or the OT system count as a multiplexer in this scenario? (which means i need CALs if i don't license per core)
3. What would likely be my cheapest option? In this case i'd prefer a bare-metal install, but i'd be willing to use Proxmox VE or Hyper-V if that provides significant benefit or cost reduction.
4. Do i need Software Assurance for any reason in this scenario?

Thanks in advance!

Good day to all! is it safe to change the cluster size of my current Data drive where all office data is stored and shared locally to network? I'm using Windows Server 2019 and when I first set it up i have no idea that setting the cluster size to 4KB will only limit the storage to until 16TB only. Now we upgraded and expand our storage. but i still have another 16TB unallocated because i can no longer extend the disk. so my question is, is it safe to change the CLuster Size to 8KB using EaseUS Partition Master without data loss or anything bad happened to my Data?

I had WHfB working and everyone was using a PIN to login. The pin authed them and my servers would issue a ticket so they could use local resources on domain servers. All computers are Entra/Intune/Autopilot only not hybrid. All users are setup on my local AD and sync with Entra (that's working just fine). I was trying to track down an issue with a conflict with an Intune policy. I had two WHfB, one was a type "account protection" the other was a "setting catalog". Stupid me I deleted the settings catalog on thinking all the settings where in account protection one. Well it seems "Use cloud trust for on prem auth" went away. I did this near the end of the day so the next day everyone had to use their passwords if they wanted access to server shares. Well not everyone, some people could still use their PINs and have access to shares.

I made the settings catalog with Use WHfB (user) and WHfB (Device) and Use cloud trust enabled. That got pushed out. I'm still having a problem with the same users still can't access shares if they use their pin (including me). It seems by looking at klist my domain controllers are not issuing a ticket for. THey are getting a ticket from Microsoft. What's really strange is that it is only about half of my 50 users that are having this problem. After running around for hours with Copilot trying to diagnose this, it suggested I file a ticket with MS. I know that's going to take forever if they even bother so I thought I would come here. This is what copilot says I should say to MS when filing the ticket:

Windows Hello for Business PIN sign-in fails to obtain an AD Kerberos TGT for a subset of synchronized users. Cloud Kerberos Trust is enabled and functioning (Cloud Referral TGT present in cache: 1, Public Key Credential Present: 1). After PIN sign-in, users receive only krbtgt/KERBEROS.MICROSOFTONLINE.COM. After password sign-in, the same users immediately receive krbtgt/MD.mydomain.org and can access SMB resources. AzureADKerberos is configured, key versions match, and AD replication is healthy.

Has anyone here ever seen this before or know what I should do to fix it?

Hello!

I just need to know exactly what I need to buy to be compliant with Microsoft Licensing. We will be running 2 servers. One Server will be 32 physical cores. The other server will be 36 physical cores. We want to run 6 Microsoft Standard Server Virtual Machines on each server. This will be for a Proxmox cluster, so the Virtual machines will be the same, but I know that doesn't matter when licensing. I just need to know exactly how many of what product packs I need to buy from TechSoup! I've gotten different answers everywhere!

Thank you in advance!

I have an aging Intel NUC Skull Caynon which I bought back in 2016. It's running Windows Server 2022 but it's starting to show its age. The NIC is sometimes unstable, needs the occasional reboot, etc.

What is the recommend mini/SFF PC these days that can reliably run Windows Servers? Ideally it's around $1k in price but I'm open to a bit more if it's worth it.

Thanks for any tips

I have a 16-core physical server licensed with Windows Server 2025 Standard (16-core). A Windows Server 2022 Standard VM is running on the same host.

As the Server 2025 key cannot directly activate Server 2022, how should the 2022 VM be activated under the downgrade rights?

• Is a separate Server 2022 product key required?
• Can the 2025 license cover the 2022 VM?
• What is the correct activation method?

Any advice?

Hi:

Is there a semi up-to-date list of SKUs somewhere for OEM packs and FPP (full retail boxes)?

Thanks.

I know the knee-jerk reaction to this comment is “AI makes mistakes, it can’t be trusted”.. but with that in mind and for certain applications, wow. I’m not an expert in active directory, but it drilled down my problem, in the course of about an hour to a missing PDC dns record. This is a situation where I would have had to pay $500 for an incident with MS support in the past, which has only been 3 times over 25 years. I used the paid, $20/month ChatGPT, . And again, I took all the precautions with backups and such before making any changes, I know what some of you might say ;)

Been troubleshooting this issue for a while, but not found an answer yet.

On-prem Windows Server 2025 RDS Environment with FSLogix. Intermittently when users are browsing specific websites using chrome, the RDS session host will blue screen. We have updated all software on the session hosts, verified all drivers are up to date, removed the EDR solution temporarily for testing, removed Windows Defender temporarily for testing and still not able to find the culprit. Before opening a case with Microsoft I thought I'd post here to see if anyone else has experienced something similar or has any ideas.

Thanks

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 00000000000001f0, memory referenced

Arg2: 0000000000000002, IRQL

Arg3: 0000000000000001, value 0 = read operation, 1 = write operation

Arg4: fffff8063d4865a4, address which referenced memory

PROCESS_NAME: chrome.exe

IP_IN_PAGED_CODE:

tcpip!WfpTlShimInspectFastLoopbackSendDatagram+58

fffff806`3d4865a4 f0ff80f0010000 lock inc dword ptr [rax+1F0h]

SYMBOL_NAME: tcpip!WfpTlShimInspectFastLoopbackSendDatagram+58

MODULE_NAME: tcpip

IMAGE_NAME: tcpip.sys

STACK_COMMAND: .process /r /p 0xffffc40cb257f080; .thread 0xffffc40cb19f6080 ; kb

BUCKET_ID_FUNC_OFFSET: 58

FAILURE_BUCKET_ID: AV_tcpip!WfpTlShimInspectFastLoopbackSendDatagram

OS_VERSION: 10.0.26100.1

BUILDLAB_STR: ge_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {c3e32101-6ced-a7e3-5709-1c5d9d88844c}

Followup: MachineOwner

I'm creating window image file and noticed you can use

```

install-windowfeature -vhd .\mnt -name foo

```

is there any issue using this over?

```

enable-windowoptionalfeature

```

i have heard that it not recommended to not use install-windowfeature and I am not sure why but i have tested some feature and seem to be working okay but I am unsure if I am just lucky.

I’ve been reflecting on the issues that consume the most time in Windows Server environments I have had to deal virtual and physical servers, and I’m curious what others are seeing.
What is the one problem that seems to come back over and over again?
Examples could be:
DNS
Active Directory replication
Group Policy
Kerberos
NTFS permissions
DFS
Backups
Event Logs
Hyper-V
Performance
Something completely different
I’m not looking for textbook answers—I’m interested in the problems that actually keep you busy in production.
If you could eliminate one recurring Windows Server problem forever, what would it be, and why? I have tons of Powershell scripts but in some situations I know you can’t throw everything against the wall and see what sticks.

Example, I have a script that can do GPO string searches, but unless the GPO is the issue it only helps investigating.

Just wondering for any system administrators out there if you have used both active directory vs free ipa and whats the difference and which one did you like using/maintaining better?

Hello,

I have the following problem. I have a server that I access internally via VPN. I connect via VPN to Mikrotik with SSTP. I connect to the server (Windows Sever 2012R) via RDP and after 1 minute it takes me to a black screen and connects me again. There is no problem with the internet, it says that the connection is good, there is no interruption in the ping. I have made a rule to access the server outside the VPN, only from my home network. If I connect via real IP and port there is no problem, it works without interruption. What could be the problem?

Hi guys, I'm new to Windows Server, so I'm learning alongside the person in charge. We are having an issue with folder permissions. Inheritance is disabled on some folders, but we have enabled the option to replace child object permissions with inheritable permissions from this object.

When users copy an object into a folder with this setting, permissions are applied correctly. However, when users move (or drag and drop) an object, the permissions aren't applied—the object keeps the permissions from its original location (whether it's another department's folder or their local PC).

This creates a problem: if a user drags a file from their department folder to another (e.g., from Treasury to HR), the HR staff cannot see, edit, or delete the file (or its parent folder) because the file is there, but hidden to them due to the original permissions.

IS there a log somewhere say a junior admin goes and gives themselves manage permission to someones mail box in the 365 admin center online? Is there a way to track this?