1. run secpol.msc
2. Under Local Policies - User Rights Assignment, there is a line that says "Allow logon through Terminal Services.", check whether "Remote Desktop Users" is in the list.
Source:
http://www.mobydisk.com/techres/securing_remote_desktop.html