Why can't the "domain user" login to the terminal server?

Question

RDP

Machine in a domain based on Windows Server 2016, remote desktop roles added. No licenses used 120 days trial period. Logging in via mstsc as a normal domain user - error: Requested session access denied.
NLA disabled
in local group policies checked: "Allow logon through remote desktop service" in it by default "% MYDOMAIN% / Domain Users" and "Remote Desktop Users". Moreover, the add button is not active in this policy, you will not be able to add others

Answer 1

In short, despite the presence of a user in the "Remote Desktop Users" group, nothing changes.
It is solved in a completely idiotic way, in my opinion, revealed by touch. Despite disabling NLA, you still need to add "%DOMAIN% / Domain Users" in the same place, then it allows you to enter why it works like that, I don't know.

Answer 2

You should not add users to the policy, but to the group. The user that is added to group "Users of a remote desktop"?

Answer 3

1) Check again that the user is a member of the local group "Remote Desktop Users" on the terminal server.
2) Set the licensing mode for the RD Session Host server and specify the licensing server in the group policies of the terminal server. Read more here: tavalik.ru/ustanovka_servera_terminalov_windows_se...