Similar Issue with no responses: Nested AD groups working in local computer groups, but certain servers fail to allow RDP?
I am only new to this environment and the person I took this over from also experienced this issue but didn't get very far with it (considered low priority due to it correcting itself eventually).
After building a fresh VM (VMWare) and installing windows 2019 on it, using a task sequence. The task sequence creates local admin global groups for each new server and then adds these to the default local admin groups. The global groups then have our teams admin group added to it with a GPO configured to allow RDP. Some servers have issues with not allowing network admins to RDP to them but domain admin works. I can see no common denominator between them other than this issue has only happened to me on Fridays (which may hint to some process/task that I don't know about being run on Fridays which causes a delay with propagation).
Server 1: Fresh VM, Task sequence deployed OS, connects to the domain without a problem and I can RDP to it without issue.
Server 2: Fresh VM, same task sequence run minutes later/at the same time, connects to the domain, can log in via console but RDP gives "not authorised for rdp".
Every server thereafter has the same issue but the ones before it do not, despite all being created at roughly the same time. The previous day I was able to do the exact same thing (have multiple servers being deployed at the same time using the same task sequence) without any issues, then about half way through Friday they start having this RDP issue. I am able to download updates for them and do other things, so I know its not a network issue.
It's also odd that I am given other permissions that this group allows (ie; admin rights) but not RDP.
I notice that if I remove our teams admin group and add my account directly to the local admin global group, RDP works straight away but as soon as I remove it and add my teams group back, it doesn't work.
This only happens on some and not all servers and I cannot find any connection between them, they all look exactly the same in regards to groups, permissions and GPOs but some will allow RDP and some won't. It's also worth noting that when this happens on Friday, if I wait until the following Monday/Tuesday it's all come good and you wouldn't even know there was an issue in the first place.
I suspect that there is some kind of bug at play, mixed with some process I'm not aware of which results in this issue. However, trying to pin-point it for remediation has proven quite difficult. Any ideas/suggestions?