Microsoft KB Archive/317853

= Modifying the Terminal Server Profile Properties Sets Dial-in Access to &quot;Denied&quot; =

Article ID: 317853

Article Last Modified on 2/21/2007

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2

-



This article was previously published under Q317853



SYMPTOMS
If you modify any items in a user's settings on the Terminal Server Profile tab of the user object, that user may lose the ability to dial in to a remote access server. When you modify a user's settings on the Terminal Server Profile tab for the first time in a Native-mode domain, the user's dial-in settings are changed from Control Access via RAS Policy to Deny.



CAUSE
When you first set the UserParameters Active Directory attribute that stores both remote access and Terminal Server Profile details for a user, the default setting for remote access is assumed. This is not a problem in a Mixed-mode domain because the default setting is to deny access.

In Native-mode domains, however, the mSNPAllowDialIn attribute is used to control dial-in access. The mSNPAllowDialIn attribute has three possible states for dial-in access: Allow, Deny, and Control Access via RAS Policy. In its uninitialized state, mSNPAllowDialIn uses the Control Access via RAS Policy setting. In Native mode, when you first set the userParameters attribute, a loopback mechanism also sets the mSNPAllowDialin attribute. In this case, it sets the Deny setting, which may prevent users from dialing in.

For additional information about a similar issue, click the article number below to view the article in the Microsoft Knowledge Base:

277631 BUG: WTSSetUserConfig May Modify a User's Remote Access Permission



RESOLUTION
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

The English version of this fix should have the following file attributes or later:   Date         Time   Version        Size    File name -  17-Mar-2002  11:32  5.0.2195.5093  36,112  Regapi.dll



WORKAROUND
To work around this problem, explicitly set the dial-in permissions before you modify the Terminal Server Profile settings.



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.



MORE INFORMATION
For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 The Datacenter Program and Windows 2000 Datacenter Server Product

For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:

296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot

Additional query words: kbTermServ

Keywords: kbbug kbfix kbwin2000presp3fix kbqfe kbwin2000sp3fix kbtermserv kbhotfixserver KB317853

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.