Last week, Microsoft introduced KnowledgeBase article 2878821, discussing some strange behavior on a domain-joined Windows Server 2012-based Remote Desktop Virtualization host. When such a host is added to a domain and the default domain policy is applied, the option to select a physical GPU used for RemoteFX (within Hyper-V settings) appears to be unavailable.

The issue

You install a Windows Server 2012 box, and join it to the domain. You then configure it as a Remote Desktop Virtualization host. When you want to select the option to use a physical GPU for RemoteFX (within Hyper-V settings), it appears to be unavailable. Or, if the option to select a physical GPU in the Hyper-V settings is available, you are unable to add the RemoteFX 3D Adapter to the Virtual Machines provisioned on the host server.

The cause

The issue can occur if the Default Domain policy (or any other policy) has removed the Users group from the Allow log on locally policy.

The RemoteFX feature availability in a Remote Desktop Virtualization host is provided by a system account named RDV Graphics Service. This account is part of the local Users group on the Remote Desktop Virtualization Host. If the Users group is denied the permission to logon on to the system, the account in turn is also denied permission to log on to the server.

The solution

To resolve this problem, follow these steps:

Add the Users group to Allow log on locally policy.

1. Click Start, type gpedit.msc, and then press Enter.
2. In the left pane, expand Computer Configuration, Policies, Windows Settings, Security Settings, and Local Policies, and then click User Rights Assignment.
3. In the main pane, double-click Allow Logon Locally.
4. Verify the users added here and click Add User or Group.
5. Add the RDV Graphics Service account or the Users group.
6. After you have the account name entered, click OK in the Add User or Group window, and then click OK in the Allow log on locally Properties window.

Check the Deny Logon Locally policy for any explicit inclusions

• Click Start, type gpedit.msc, and then press Enter.
• In the left pane, expand Computer Configuration, Policies, Windows Settings, Security Settings, and Local Policies, and then click User Rights Assignment.
• In the main pane, double-click Deny Logon Locally.
• Verify the users added here and Make sure the Users group or RDV Graphics Service account are not listed.

Concluding

While Active Directory helps you manage settings centrally on domain-joined servers and devices, sometimes, it might present you with specific challenges. Like the one above.

This issue is fixed in Windows Server 2012 R2.

Related KnowledgeBase articles

2878821 Physical GPU in Windows Server 2012 Hyper-V settings is unavailable post domain join
2505030 A RemoteFX VM does not start, and you receive the error "Microsoft Synthetic 3D Display Controller: Failed to Power on" when you try to add the RemoteFX 3D Video adapter from Hyper-V settings
2505694 Error message when you try to start a RemoteFX-enabled virtual machine: "Microsoft Synthetic 3D Display Controller : Failed to Power on with Error 'Insufficient system resources exist to complete the requested service'"
2590851 RemoteFX Licensing Incompatible with standard Remote Desktop Protocol (RDP) Security

Further reading

Microsoft RemoteFX
Explaining Microsoft RemoteFX
Hardware Considerations for RemoteFX
Configure RemoteFX in Hyper-V running Windows Server 2012 with low end GPU
Configure a RemoteFX 3D Video Adapter
Microsoft RemoteFX requirements in Windows Server 2012
Implementing RemoteFX in Windows 2012 Hyper-V