Windows server 2003 enterpriseIf i don't add user with Domain Admins then they can't log on ....error message ( to log on to theis remote computer , you must be granted the Allow log on through Terminal services right. By default , members of the Remote Desktop Users group have this right. If you are not a member of the Remote Desktop users group or another group that ahs this right, or if the Remote Desktop User group does not have this right, you must be granted this right manually. )ps: If i added user with Domain Admins then user can log on but the user can access Active Directory users and computer. The User can change password Administrator .FINALLY : MY QUESTION IS HOW CANI CONFIGURE USER ABLE LOG ON BUT CAN'T ACCESS ACTIVE DIRECTORY USERS AND COMPUTER ???Windows server 2003 enterpriseAny Help me ?

Users should be members of the group "Domain Users", but not "Domain Admins". As the message indicates, in order to logon remotely with Remote Desktop, the user must be a member of the "Remote Desktop Users" group. This group is in the "Builtin" container of AD. Richard MuellerMVP ADSI

Hi There,I would just add the users to remote desktop user group as richard mentioned and this should work fine in your context

Hello Tommy,In addition to Richard and Sainath's suggestion, If your server is a domain controller, you need to also grant the user "Allow log on locally" permission.Please refer to:http://technet.microsoft.com/en-us/library/cc785165(WS.10).aspxSincerely,Wilson JiaThis posting is provided "AS IS" with no warranties, and confers no rights.

thanks you all