Member Avatar for ero100@live.com 
hi, There is a a physical server (window server 2008 r2) which is running as main server and as domain controller. As administrator it automatically gives remote access to the server from out site of the network. Im using the Remote desktop to log in to the server. The static Ip is for example: 98.23.60.100 from my remote desktop client i use these Static Ip to connect to the server and its prompt for the user name and password and its go okay.
Question 1: there was a domain name linked to this iP which is something like: mail.serverdomainname.com, that when i use it in the remote desktop client it also takes me to the log in screen which is fine to log in to the server as well. I'm just trying to understand how does this web domain name was linked to the server. Is it done when we create the first domain controller (forest) if so, how can i see it within the server management. Because there was already everthing set up for the remote access i'm now trying to understand how the remote access for administrator was created. I need to know how to do it.
In addition, because there is also a need for users to access the server remotely, there was a Virtual machine installed within the server VMWARE which is to be used for remote users, so there is no need to them to log in direct to the server but to the virtual server machine which is also joined to the main server. The vmware also runs a server 2008 r2, and a license  for 10 users was bought in order to allow the users to have remote access. The users access this virtual machine through terminal server. If open VSphere client, there is an ip address which is the range of the local IP Address, and the server name and the vt machine. If im logged in to the main server, i can easily connect to the VM, but what i need is to be able to allow users to access that virtual machine from outside, using Remote Desktop connection.
- Do i have to use the same web server domain name or the server static ip to have direct access to the VM? do i need to do a port forward to redirect the users to the VM ?

Main server static IP: 98.23.60.100
Local server IP: 192.168.30.100

VSPHERE client ip: 192.168.30.53
VM IP:              192.168.30.10

Basically when open the Remote desktop client it takes me to the server, then i change to switch user then use the following details trying to access the Terminal server.

computer:  98.23.60.100 or mail.webservername.com
user:VM\vm

its display an error message like: to log on to this computer you must be granted  Allow log on through terminal server.
well, have changed the local security policy to allow log on through terminal server.
i have ensured that the users has remote access rights policy activated.
I have done all possible change to the policies but no luck at all.
I need to know what are the steps to allow users to access the VM ware remotely.
Thanks
Edited by ero100@live.com
  • 2 Contributors
  • 1 Reply
  • 404 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by CimmerianX

Dani AI

Generated

A concise, practical checklist that builds on ’s topology and ’s direction — focused on getting external users into the VM safely and resolving the “Allow log on through terminal server” error.

Start with the safest connectivity options (preferred): a site VPN or an RD Gateway so clients authenticate and then RDP to the VM without exposing RDP ports to the Internet. If a gateway/VPN is not possible, use a single external port on the public IP and NAT that port to the VM’s RDP port on the LAN; restrict the forwarded port by source IP where possible and enable Network Level Authentication (NLA).

Practical port-forward example (router/NAT entry):

  • External IP: public address
  • External port (TCP): 3390
  • Internal IP: VM (192.168.30.10)
  • Internal port (TCP): 3389

RDP client connect example:

mstsc /v:public.address.or.name:3390

Windows/VM checklist and commands to verify:

  • Confirm the VM has Remote Desktop enabled (Remote Admin vs RD Session Host).
  • Confirm the account is a member of the VM’s Remote Desktop Users (or Administrators) group.
  • Verify the Remote Desktop service is running and the listener is active:
    sc query TermService
netstat -ano | findstr :3389
qwinsta /server:VMName
  • Check local/group policies: Computer Configuration → Windows Settings → Security Settings → Local Policies → User Rights Assignment. Ensure the group appears in “Allow log on through Remote Desktop Services” and is NOT in “Deny log on through Remote Desktop Services”. Use gpresult /h c:\temp\gp.html to find overriding GPOs.

If using Terminal Server (RDS) for more than administration sessions, install/configure RD Session Host and an RD Licensing server and configure the licensing mode (Per User or Per Device) so CALs are recognized; otherwise session host will refuse users.

Security notes: never expose plain 3389 to the Internet; prefer RD Gateway or VPN, enable strong passwords and account lockout, and log/monitor connections. If NAT/port-forwarding is used, make the VM use a static LAN IP (or DHCP reservation) so the NAT rule remains correct.

Member Avatar for CimmerianX

For item #2, every MS server has RDP enabled for admin that allows you to use remote desktop to access ther server with the admin account.

mail.serverdomainname.com is a DNS entry that most likely resolves to 98.23.60.100. Either entry will get you to the same host. If you don't understand how the name is translated to an IP, google "how dns works" to get some info on the subject. Someone had to have created the DNS record that matches the DNS name to IP in a DNS server that is authoritative to that serverdomainname.com zone (read the DNS how-to to understand).

For item 3, a Virtual Host can have different flavors of network connectivity. If you want users to access a virtual host, you would most likely need ' bridge mode' on the virtual server. The virtual server would get an IP from the range and you'd probably want to create a DNS record for it also.

For the rest, I think we may need more specific info on the Virtual product you are using...

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.