Solved

Remote access restrictions

Posted on 2014-03-10
7
255 Views
Last Modified: 2014-03-12
I have a Group Policy Question.

Here is my situation.

I have a remote desktop server that a few users login remotely to use a quoting custom built SQL database.

We don't have the remote users to be able to shutdown the server by going to start > shutdown or restart

My questions has two parts I guess:  

1) How is this done through a group policy.
2) Can we use the same account for the users so they don't lose the capability of  shutting down THEIR computers at the office OR do I need two separate AD accounts; one for their computer and one for remote access where they can't shut the servers down?

Servers are running Windows 2008 R2. Computers are all windows 7 Pro.
0
Comment
Question by:Anthony H.
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 5

Assisted Solution

by:Joe Jenkins
Joe Jenkins earned 250 total points
ID: 39919612
If I understand your question, you want to make sure the user cannot shutdown the server but CAN shutdown their own machines.

- Create an OU for your RDP Server and put that computer into that OU.
- Create a GPO that contains the following settings and assign it to that OU:

GPO Settings:
- User Configuration/Policies/Admin Templates/Start menu and taskbar/
   Add Logoff to the Start Menu - Set to Enabled

- User Configuration - Administrative Templates - Start Menus and Taskbar
  "Remove and prevent access to the shutdown command" - Set to Enabled.


As for the business logic, we have a security group for RDP users and they login with their normal AD user credentials.   We apply some additional GPOs and other settings to them as well.  That would be how I would do it (and currently do it).

I do not recommend using a shared account for end users under any circumstances.
0
 

Author Comment

by:Anthony H.
ID: 39919630
you mean MOVE that computer (server) to that OU?
0
 
LVL 5

Expert Comment

by:Joe Jenkins
ID: 39919647
Yes, move would be more specific. Make sure to apply any additional GPO to that new OU before moving the server so all other currently applied GPOs to that server stay applied when you move it.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:Anthony H.
ID: 39919653
Thank you. I will try it and get back to you. thanks again, I appreciate your help.
0
 
LVL 5

Expert Comment

by:Joe Jenkins
ID: 39919656
I look forward to hearing from you.
0
 
LVL 11

Accepted Solution

by:
Manjunath Sullad earned 250 total points
ID: 39919955
If its only one server,

You can disable Shutdown from below path

Start --> Run --> Secpol.msc -->

Security Settings --> Local Policies --> User Rights Assignment-->

Shutdown the System --> Remove the user ID's or Security group except Administrators


If you have multiple servers, You can push this through GPO.
0
 
LVL 55

Expert Comment

by:McKnife
ID: 39924257
Users may not shutdown servers by default. If your users were indeed able to do this, the defaults were modified intentionally or your users are nested in the admin group.
0

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

729 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question