the connection was denied because the user account is not authorized for remote login

Error message

The connection was denied because the user account is not authorized for remote login.

TL;DR

The account is valid but not permitted to use Remote Desktop on this machine. Add the user to the Remote Desktop Users group on the target machine, or to a group that carries the Allow log on through Remote Desktop Services right, then have them reconnect.

Steps

1. Check whether the user is in the Remote Desktop Users group on the target machine. Expected: You see the membership is missing.

2. Add the user or their AD group to Remote Desktop Users, or grant the right via group policy. Expected: The membership or policy shows the new entry.

3. Confirm no Deny log on through Remote Desktop Services policy overrides the grant. Expected: No deny entry covers the user.

4. Have the user reconnect over RDP. Expected: The session establishes.

When to use

• The exact message appears for a working domain account
• A new hire can sign in at the console but not over RDP
• The failure follows a server rebuild or image change

When not to use

• The message names CredSSP (patch mismatch instead)
• The account password is expired (renew it first)
• Network-level authentication is failing before authorization is evaluated

Why this happens

RDP authorization is a separate gate from authentication: Windows checks the Remote Desktop Users membership and the Allow log on through Remote Desktop Services right after validating credentials. Fresh images and rebuilt servers often ship without the expected group memberships.

Edge cases

• Domain admins bypass this via the Administrators right; do not add regular users to Administrators to fix RDP.
• The RDS licensing mode can produce similar-sounding denials when licenses are exhausted; check the license server too.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__E5PFe4DiQVAst4mcGJb0A