RD Web Access Isn't Showing Your RemoteApp? Here's Why (Windows Server)

Table of Contents

Can’t See Your RemoteApps? Let’s Fix That!¶

Having trouble accessing your RemoteApp programs through RD Web Access? You’re not alone. This frustrating issue pops up sometimes, especially when using a domain user account to log in. Let’s dive into why this happens and how to get those RemoteApps back in action.

image just illustration

The Problem: Vanishing RemoteApps¶

Picture this: you log into RD Web Access, expecting to see your handy RemoteApp programs, but they’re nowhere to be found. Local accounts can see them just fine, but your domain account is left out in the cold. To make matters worse, RD Web Access throws an error message like this:

[Error] App Filtering:Error starting filtering: Could not initialize context from SID. SID: S-1-5-21-1997477047-1508330638-219632125-223304, Error: 0x80070005

Not very helpful, right? Don’t worry, we’ll decipher it.

The Culprit: Domain Permissions¶

This vanishing act usually happens in domains created with the “Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems” option. This setting messes with the built-in Everyone group, preventing it from becoming a member of the “Pre-Windows 2000 Compatible Access” group. It can also occur if someone, as part of a security lockdown, removes the Everyone group from the “Pre-Windows 2000 Compatible Access” group. It’s a bit of a technical mouthful, but the gist is that your domain account lacks the necessary permissions to see the RemoteApps.

image just illustration

The Solution: Granting Access¶

The fix is thankfully straightforward. You need to add the RD Web Access machine account to the Windows Authorization Access Group on your domain controller. This gives the RD Web Access server the right to look up group information, including your domain account’s access rights.

Think of it like giving the server a key to unlock the door to your RemoteApps. Once it has the key, it can see which apps you’re allowed to use and display them on the RD Web Access portal.

image just illustration

Behind the Scenes: Understanding the Technical Details¶

For those curious about the nitty-gritty technical details, here’s a deeper dive. The issue revolves around a function called AuthzInitializeContextFromSid. This function checks your user account’s group memberships by reading the tokenGroupsGlobalAndUniversal attribute.

To do this, it needs read access to this attribute, which is controlled by the “Pre-Windows 2000 Server Compatible Access” group. As mentioned earlier, this group is often empty in newer domains or has the Everyone group removed, leading to the ACCESS_DENIED error.

By adding the RD Web Access machine account to the Windows Authorization Access Group, you essentially bypass this issue and grant the necessary permissions to look up the required group information.

More on “Pre-Windows 2000 Server Compatible Access” Group¶

This group is a relic from older Windows versions and deals with backward compatibility. It ensures that older applications and services can still function correctly in newer domain environments. In this specific case, it plays a vital role in allowing RD Web Access to determine which users have access to which RemoteApps.

Taking Action: Getting Your RemoteApps Back¶

If you’re experiencing this issue, follow these steps:

1. Identify the RD Web Access machine account: This is the computer account for the server hosting RD Web Access.
2. Access your domain controller: You’ll need administrative access to modify group memberships.
3. Locate the Windows Authorization Access Group: This group controls access to user authorization information.
4. Add the RD Web Access machine account to the group: This grants the necessary permissions.

Once you’ve completed these steps, your domain account should be able to view and access RemoteApp programs through RD Web Access.

Still Having Trouble?¶

If the issue persists, double-check that the correct machine account has been added to the correct group. It’s easy to make a typo or select the wrong server in a complex domain environment. Review the steps carefully, and if necessary, consult your IT administrator for further assistance.

We hope this comprehensive guide has helped you resolve the “vanishing RemoteApps” issue. We encourage you to share your experiences and any other solutions you’ve found in the comments below! Did this work for you? Let us know! We’re always looking for more ways to help. Come back and visit if you encounter other RD Web Access challenges. We’re here to help you navigate the sometimes-complex world of remote desktop solutions.