Windows 2000 Dial-in Remote Access Permissions

This article examines the function and significance of the Remote Access Permission setting found on the Dial-in tab of user account properties in Microsoft Windows 2000. It details how this setting governs dial-in and Virtual Private Network (VPN) authorization, interacts with centralized Remote Access Policies, and impacts overall administrative control in both standalone and Active Directory environments.

In Microsoft Windows 2000, the Remote Access Permission setting located on the Dial-in tab defines whether an individual user account is authorized to establish a remote connection—such as dial-up or VPN—to a Routing and Remote Access Service (RRAS) server. Configured via the Active Directory Users and Computers snap-in for domain accounts or the Local Users and Groups console for local accounts, this setting acts as the primary user-level gatekeeper for inbound remote connections.

The setting provides three distinct options:

• Allow access: Explicitly grants the user permission to connect remotely. When selected, the RRAS server permits access without evaluating connection-level permissions within Remote Access Policies, provided the connection still satisfies the policy's environmental conditions (such as allowed times or authentication methods).
• Deny access: Explicitly denies the user permission to connect. If set to deny, the RRAS server immediately rejects the connection attempt, overriding any Remote Access Policy that might otherwise permit it.
• Control access through Remote Access Policy: Defers the authorization decision to the Remote Access Policies configured on the RRAS or Internet Authentication Service (IAS) server. Instead of deciding access on a per-user basis, the system checks whether the user belongs to a group or meets criteria specified in the server's policy rules.

The availability and behavior of these settings depend heavily on the Windows 2000 domain operational mode. In a Windows 2000 mixed-mode domain, the "Control access through Remote Access Policy" option is disabled because Windows NT 4.0 backup domain controllers cannot interpret Active Directory remote access policies; administrators must explicitly choose either "Allow access" or "Deny access." Once the domain is raised to Windows 2000 native mode, "Control access through Remote Access Policy" becomes available and serves as the default configuration.

By using the Remote Access Permission setting, administrators can either enforce strict, individualized access controls directly on user accounts or delegate connection management to scalable, rule-based policies managed centrally across the network infrastructure.