Solved

Policy to Disable RDP for users on a specific server

Posted on 2013-05-23
16
511 Views
Last Modified: 2013-05-29
I have 2 servers one is a 2003 server the other a 2008 server (they are both terminal servers).  I need a way to prevent users - not admins from using  (Accessing) MSTSC.exe or RDP to connect to their machines.  How can this be done?
0
Comment
Question by:WellingtonIS
  • 7
  • 5
  • 3
  • +1
16 Comments
 
LVL 22

Accepted Solution

by:
Haresh Nikumbh earned 500 total points
ID: 39190962
1- With a Software Restriction policy (Computer Configuration - Windows Settings - Security Settings - Software restriction policies)
Either a Path or Hash rule for mstsc.exe located in (C:\Windows\System32)
2- Configuring Deny logon through Terminal services user right in (Computer Configuration - Windows Settings - Security Settings - Local Policies - User rights assignements)


http://www.petri.co.il/forums/showthread.php?t=43016
0
 
LVL 11

Expert Comment

by:Pradeep Dubey
ID: 39190992
0
 

Author Comment

by:WellingtonIS
ID: 39191041
If you deny login via local policies won't that stop the users from connecting to the machine too?  Also I have yet to get the Software restriction policy to work regardless of what I do.   Not sure why because it's that complicated...  Maybe because it's 2003 and not 2008.
0
 
LVL 22

Expert Comment

by:Haresh Nikumbh
ID: 39191062
yes you can configure this policy on local machine too
0
 

Author Comment

by:WellingtonIS
ID: 39191105
I also created a hash registry setting to block MSTSC.exe I checked the policy and it's there too. But I can open RDP and connect to my computer...
0
 
LVL 22

Expert Comment

by:Haresh Nikumbh
ID: 39191156
I have tested on my pc and its working

have a look
mstsc.jpg
5-23-2013-8-31-41-PM.jpg
0
 

Author Comment

by:WellingtonIS
ID: 39191219
I have the EXACT same thing except I did it for users instead of computers.  Maybe it's just time.  I'm updating the machine now with about 30 updates I'll reboot it and try again.  Thanks.  I also did the application blocker - see attached too.. It works on a windows 7 machine but no on 2003 server???
hash.png
app.png
0
 
LVL 22

Expert Comment

by:Haresh Nikumbh
ID: 39191234
looks good,
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:WellingtonIS
ID: 39191243
Tried it on 2008 terminal server and it's not working there either???  Maybe you can't block it on a server?
0
 
LVL 14

Expert Comment

by:Justin Yeung
ID: 39191260
change the permission of mstsc.exe file itself.........
0
 
LVL 22

Expert Comment

by:Haresh Nikumbh
ID: 39191261
I have applied policy on the local machine,  RDP screenshot which i have attached for my local machine.. which can not take RDP connection for any machine.
0
 
LVL 14

Expert Comment

by:Justin Yeung
ID: 39191323
as i said before just edit the permission of the local mstsc.exe file.

no other users that you want can use the RDP.
0
 

Author Comment

by:WellingtonIS
ID: 39191496
If I do that then no one will be able to use RDP not even admins?
0
 
LVL 14

Expert Comment

by:Justin Yeung
ID: 39195290
no.......... you can edit the permission to who or what group(s) can access mstsc.exe the file itself.

for example full control for Domain Admins and deny access to a group of users.

remember deny access will override granted access, so becareful with that.
0
 

Author Comment

by:WellingtonIS
ID: 39204870
I finally got this to work with the registry setting.
0
 

Author Closing Comment

by:WellingtonIS
ID: 39204882
I wasn't sucessful blocking with a hash rule in the app blocker, however when I did it in the registry setting it worked.
0

Featured Post

Are end users causing IT problems again?

You’ve taken the time to design and update all your end user’s email signatures, only to find out they’re messing up the HTML, changing the font and ruining the imagery. What can you do to prevent this? Find out how you can save your signatures from end users today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you migrate a Terminal Server licenses server inside the 2008 server family, you can takte advantage of the build-in migration tool. If you like to migrate an older 2003 Server (and the installed client CALs) to a 2008 R2 server for example, you …
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now