Domain DeltaV Security Group permissions not applying

Hi All,

We have a DeltaV version 14.3.1 Server 2016 system with 2 independent domain controllers.  The system seems to be working fine, and the domain and DNS are all healthy.  Replication is happening as expected.

I created a few new users, some are engineers, some are system administrators as well.  In DeltaV User Manager, I put them in those respective groups.  I then also granted the permissions to Windows Desktop, DeltaV Administrator, Event Chronicle Administrator, Allow Terminal Server Logon...all the Windows permissions basically in User Manager.

The problem we're seeing is, that the Windows permissions are not applying to the users.  Despite having Windows Desktop Access permissions and being members of the Domain DeltaV Ax s group, the users receive an error when they try to access the Windows Desktop.  Also we're seeing that even when granted Terminal Server Access rights and are in the security group, the user is unable to remote desktop onto the terminal server.  That is just an example...we're finding that ALL the Windows level permissions granted in User Manager are not applying to the users.

We have verified the users are members of all the appropriate AD security groups.  Also there are no conflicting groups or custom groups created.  The group policy doesn't have anything special or unique other than what comes standard.  There aren't any GPOs applying that would deny users these permissions.

We've rebooted all the servers.  We've replicated the domain controllers and verified the domain is healthy.  Right now the only way to grant a user access to the Windows Desktop or to RDP is to put them in the built-in Administrators group.  Obviously we do not want to do this for all users that need RDP access!

Has anyone seen this before or have ideas on what I could look at?

Christiana Spencer

  • Hi Christiana, if not done yet I highly encourage you to open a call to get our GSC to provide you assistance with this issue. There is a thread open which seems related to the issue you are experiencing and I want to ensure you get the appropriate support from Emerson directly. I'll also make sure I get involved on your troubleshooting discussion with GSC so that we can provide a good answer for you and for anyone else with a similar issue. If you have a call already open, great! I'll find the best way to follow up with you directly.
    Regards,
    Alexandre.Peixoto@emerson.com
  • “Authenticated Users” were not applying the “Default Domain Controller Policy” GPO, specifically the required setting for Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Network access: Restrict clients allowed to make remote calls to SAM. The reason for this is the “Default Domain Policy” GPO was set to “Enforced: Yes” which is not the required setting.

    Solution: Change the “Default Domain Policy” to be “Enforced: No”.

    This was updated in the Group Policy Management and a GP Update sent to all workstations. Testing of user accounts on machines verified this has solved the problem.

    Christiana Spencer