How to set up remote access to a computer for a domain user?

Question

Windows

Good afternoon, I ask you not to kick much for such a question, but I can’t figure out how to properly organize the following connection diagram. There is a CD, there are users in the CD and there are computers in the CD, how to make the settings correctly so that a user at home can connect to his computer at work under his domain account (ip and port are known to the user in advance). When connecting as a normal user who is in the "Remote Desktop Users" and "Domain Users" groups, the connection gives the error "Unable to connect to the computer. Try connecting again. If the problem persists, contact the owner of the computer....", but If you use an administrative account, it enters without problems. Please help me solve the problem. Thank you in advance!

Answer 1

The account must be fully specified in the format [email protected] or DOMAIN\username. Surely home Windows in the Microsoft domain, and therefore is not included.

Answer 2

When connecting under a normal user who is in the "Remote Desktop Users" and "Domain Users" groups

Remote desktop users - what? This domain user must be included in the local group "Remote Desktop Users" on his computer.

Answer 3

IN 1. Raise the VPN to connect to the domain network outside.
IN 2. You have a domain - raise the RD Gateway, configure connection policies in it and connect from the outside through it
On the domain computers themselves, configure the connection settings and permissions through the GPO

Answer 4

If you have a domain - put the gateway and go through it.

Answer 5

Through the security policy, do the following:
1) Special access group - to your computers. Include the user in it.
2) In the department where this workstation: this group, among others (domain administrators, installers, etc.) - allow access to the computer from the network.
3) Add this group to "Remote Desktop Users".
4) Configure (allow) access to the remote desktop.
5) Firewall, if active - set to pass to port 3389.
For security, it is desirable to take away local admin rights, otherwise this user will be able to infect the entire network with a network worm. And it is better also to forbid network access to local administrators.