Symptoms

Windows security events of Login Failure type are generated for NLAUser account on Active Directory Server when AD credentials validation is performed from:

RAS Console > Farm Enrollment Servers > AD Integration > Validate AD Integration Settings

The following warning from RAS Console is observed:

Cause

Deny log on though Remote Desktop Services is applied not only to RD Session Hosts but to Active Directory server itself.

Resolution

Reconfigure policies as described in the following article