Recently I found a weird thing that if I remove the gpo about restricted administrators group which includes domain admins, then I can no longer remote into any workstations or servers saying access denied. I thought domain admins should be able to remote into any workstations or servers. It seems that domain admins have to be added to the local admininstrators group to be able to remote into workstations and servers. I tried to create gpo with remote desktop users with domain admins in it but still no luck.
Does remote access have to be the member of local administrator group? I am lost.
Please advise.