VPN Problem for Specific User

I have a Win2003 box running RRAS. Our router is forwarding all PPTP
traffic to this server. Other users can log into and use the VPN
successfully. My remote access policy states that users must be members of
the VPN Users group and be using the PPTP tunnel type. Nancy IS a member of
the VPN Users group, and I've tried setting her Active Directory user
account for Dial In access to either 'grant' or 'control through remote
access policy'.

When she tries to connect to the VPN (internal or external to our LAN), she
gets "Error #649: This account does not have permission to dial in."

Does anybody have any suggestions?

Thanks,
Rob

Nevermind.

Somehow one of the servers had her listed as 'denied' whereas the other had
her 'control by remote access policy'. Shouldn't they be synchronized?!?

-Rob



"Rob" <(E-Mail Removed)> wrote in message
news:eoP%(E-Mail Removed)...

>I have a Win2003 box running RRAS. Our router is forwarding all PPTP
>traffic to this server. Other users can log into and use the VPN
>successfully. My remote access policy states that users must be members of
>the VPN Users group and be using the PPTP tunnel type. Nancy IS a member
>of the VPN Users group, and I've tried setting her Active Directory user
>account for Dial In access to either 'grant' or 'control through remote
>access policy'.
>
> When she tries to connect to the VPN (internal or external to our LAN),
> she gets "Error #649: This account does not have permission to dial in."
>
> Does anybody have any suggestions?
>
> Thanks,
> Rob
>

Hi Rob,

I hate to assume anything, so it's hard to know for sure without more info
about your environment. It does look like you're probably running in a
domain environment, and because you're encountering user settings that are
different on two different servers I would also want to assume that you're
in AD. But I guess you could be in a workgroup environment and are manually
sync'ing lusrmgr.... nah.

So assuming you are in a domain, then yes, they probably should be
synchronized. Assuming you've given them enough time to synchronize.
Perhaps you've just been handed a fairly innocuous warning of problems to
come. I'd check your logs (particularly DNS, FRS and System) on your
servers for Red and Yellow flags....

HTH,
=d=


Dana Brash
MCSE, MCDBA, MCSA

(E-Mail Removed)

"Rob" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> Nevermind.
>
> Somehow one of the servers had her listed as 'denied' whereas the other
> had her 'control by remote access policy'. Shouldn't they be
> synchronized?!?
>
> -Rob
>
>
>
> "Rob" <(E-Mail Removed)> wrote in message
> news:eoP%(E-Mail Removed)...
>
>>I have a Win2003 box running RRAS. Our router is forwarding all PPTP
>>traffic to this server. Other users can log into and use the VPN
>>successfully. My remote access policy states that users must be members
>>of the VPN Users group and be using the PPTP tunnel type. Nancy IS a
>>member of the VPN Users group, and I've tried setting her Active Directory
>>user account for Dial In access to either 'grant' or 'control through
>>remote access policy'.
>>
>> When she tries to connect to the VPN (internal or external to our LAN),
>> she gets "Error #649: This account does not have permission to dial in."
>>
>> Does anybody have any suggestions?
>>
>> Thanks,
>> Rob
>>
>
>

Check your synchronization settings. I had a similar problem running LCS.
Found out domain.com was not replication properly with child.domain.com...

"Rob" wrote:

> Nevermind.
>
> Somehow one of the servers had her listed as 'denied' whereas the other had
> her 'control by remote access policy'. Shouldn't they be synchronized?!?
>
> -Rob
>
>
>
> "Rob" <(E-Mail Removed)> wrote in message
> news:eoP%(E-Mail Removed)...
>
> >I have a Win2003 box running RRAS. Our router is forwarding all PPTP
> >traffic to this server. Other users can log into and use the VPN
> >successfully. My remote access policy states that users must be members of
> >the VPN Users group and be using the PPTP tunnel type. Nancy IS a member
> >of the VPN Users group, and I've tried setting her Active Directory user
> >account for Dial In access to either 'grant' or 'control through remote
> >access policy'.
> >
> > When she tries to connect to the VPN (internal or external to our LAN),
> > she gets "Error #649: This account does not have permission to dial in."
> >
> > Does anybody have any suggestions?
> >
> > Thanks,
> > Rob
> >
>
>
>