WinXP Pro in Win2K SBS domain.

I log onto a workstation via RDP as Admin, then log off. Any user that does
not have Terminal Server access in Active Directory now gets the message
"Your interactiver logon privilege has been disabled."

Any non-TS-enabled user cannot log on locally to the workstation now until
another TS-enabled user logs on & off locally once.

How do I fix this? I really do not want everyone to have TS access.