Article ID: 317853
Article Last Modified on 2/21/2007
APPLIES TO
- Microsoft Windows 2000 Service Pack 1
- Microsoft Windows 2000 Service Pack 2
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Service Pack 1
- Microsoft Windows 2000 Service Pack 2
This article was previously published under Q317853
SYMPTOMS
If you modify any items in a user's settings on the Terminal Server Profile tab of the user object, that user may lose the ability to dial in to a remote access server. When you modify a user's settings on the Terminal Server Profile tab for the first time in a Native-mode domain, the user's dial-in settings are changed from Control Access via RAS Policy to Deny.
CAUSE
When you first set the UserParameters Active Directory attribute that stores both remote access and Terminal Server Profile details for a user, the default setting for remote access is assumed. This is not a problem in a Mixed-mode domain because the default setting is to deny access.
In Native-mode domains, however, the mSNPAllowDialIn attribute is used to control dial-in access. The mSNPAllowDialIn attribute has three possible states for dial-in access: Allow, Deny, and Control Access via RAS Policy. In its uninitialized state, mSNPAllowDialIn uses the Control Access via RAS Policy setting. In Native mode, when you first set the userParameters attribute, a loopback mechanism also sets the mSNPAllowDialin attribute. In this case, it sets the Deny setting, which may prevent users from dialing in.
For additional information about a similar issue, click the article number below to view the article in the Microsoft Knowledge Base:
277631 BUG: WTSSetUserConfig() May Modify a User's Remote Access Permission
RESOLUTION
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to Obtain the Latest Windows 2000 Service Pack
The English version of this fix should have the following file attributes or later:
Date Time Version Size File name
-----------------------------------------------------
17-Mar-2002 11:32 5.0.2195.5093 36,112 Regapi.dll
WORKAROUND
To work around this problem, explicitly set the dial-in permissions before you modify the Terminal Server Profile settings.
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.
MORE INFORMATION
For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:
265173 The Datacenter Program and Windows 2000 Datacenter Server Product
For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:
296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot
Additional query words: kbTermServ
Keywords: kbbug kbfix kbwin2000presp3fix kbqfe kbwin2000sp3fix kbtermserv kbhotfixserver KB317853
