Okta Advanced Server Access and Okta Privileged Access Fails With an "Other user" Message During Remote Desktop Protocol Connection

When users attempt a Remote Desktop Protocol (RDP) connection through Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA), the connection fails and displays an Other user message.

This occurs because a Windows Group Policy denies the user group remote login access. Resolve this issue by updating the User Rights Assignment policies.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)
• Windows Servers

Okta ASA and Okta OPA use local accounts for RDP. A Group Policy denies the user group remote login access through the Allow log on through Remote Desktop Services or Deny log on through Remote Desktop Services policies under the User Rights Assignment settings.

How is the Remote Desktop Protocol connection error resolved?

Update the Windows Group Policy settings to allow the Remote Desktop Users group access and force a policy update via the command line.

1. Open Group Policy Management on the affected Windows server.
2. Navigate to Computer Configuration > Policies > Windows Settings > Security settings > Local policies > User Rights Assignment.
3. Verify the configuration of the two Remote Desktop Services policies to allow users through Okta ASA or Okta OPA:
   • Ensure the Deny log on through Remote Desktop Services policy does not include the Remote Desktop Users group.
   • Ensure the Allow log on through Remote Desktop Services policy includes the Remote Desktop Users group.
4. Apply the changes.
5. Open the command line as an administrator.
6. Enter the following command to update the group policy:

   gpupdate /force