Setting up a terminal server

[MK-2]

OK I've installed Virtual PC and a copy of 2K3 R2 on it. All it's got is Domain controller with active directory, and terminal services installed as roles.

I created a test basic user, added it to the remote desktop users group and tried logging in and get the message
"to log on to this remote computer you must be granted the allow log on through terminal services.......see if user is member of remote desktop users........"

It is, but it refuses to log in. If, however, I go into TS manager, edit the connection and add the user in the permissions tab with full control (remote desktop users dont have full, only modify i believe) and try logging in, it works. I remove it from the permissions so it picks up permissions from remote desktop users, back to square 1. is there something i'm missing in terms of getting a standard user to log on to a terminal services server.
Cheers

****EDIT****
Not sure if this is the correct solution but basically in:
secpol.msc you have user rights assignment. in that is allow log on via terminal services, and in there it only had administrators, so i added remote desktop users and its fine.

if thats just a bodge fix and there is a correct way I'd like to hear it too, just so i know.

ta

[m25man]

By default DC's will not allow ordinary Domain Users to log in interactively.

If you were preparing a TS for client use this would normally be a member server configured accordingly.

I am assuming from your post you are actually trying to set up a Terminal Services Application Server as would be used by your general users to run applications etc.

[MK-2]

yeah, i just wanted to get experience in setting one up and configuring it correctly on virtual pc rather than set up a pc on our domain.
and yep, was trying to set it up for application server.
so is the option i mentioned the best way to get users to log in?

[Geoff]

You need to add the users/groups you want to log in to the remote desktop users group. Either on the domain, or on the terminal server's local group.
Once that's done, you'll want to create one or more GPOs with the various terminal server settings you need. Finally you need to go to the terminal services tab for the user(s) in question and check the settings are correct there