RDP access to a DC

Hello. I need to allow a group of users (an AD group) RDP access to my DCs. I have gone into system properties, clicked remote settings and add users. They still can't log in, it says they must be granted the allow log on through terminal services right. How do I do this? There are no local groups on the DC.