You must be granted the allow log on through terminal services

If you wish to allow other users to log on to this PC with TS, you will need to change the security settings in GP after AD has been installed

Symptoms: 1. When you promote A Windows 2000 server to Domain Controller,  you may receive this message: “Terminal Services is installed in this computer. Installing AD on this PC will change security policy on this PC so that only Administrators will be able to log on to the PC... If you wish to allow other users to log on to this PC with TS, you will need to change
the security settings in GP after AD has been installed”

2. When attempting logon a Terminal Services running on a DC, you may receive this message: "To log on this remote computer, you must be granted the Allow log on through Terminal Services right.  By default, members of the Remote Desktop Users group have this right.  If you are not a member of the Remote Desktop Users group or another group that has this right, or if the Remote Desktop User Group does not have this right, you must be granted this right manually."

Resolutions: By default, only Administrators are allowed log on to the DC. If you want to some other users to access the DC using TS, try one or more of the following settings.

1. Assign the user to The Allow log on through Terminal Services right using local policy (gpedit.msc).
2. Assign permission to use TS Configuration. Go to that, select the properties of RDP-Tcp.
3. The Allow logon to terminal server check box under user properties.
4. Assign the user to Access this computer from network.
5. Assign the user to Allow log on locally.

Related Topics

Users can RDC to a DC but administrators - Case Study