P Hurdle
asked on
Disable shutdown on Remote Desktop Server that is also a Local Server
I have a server that is acting as my RDP server as well as my local Database and Domain Controller. Some of my RDP users have shut down my server without realizing it. How can I disable shutdown (along with some other items) without disabling those same things on the local windows 7 machines that are not using RDP.
Thanks.
Thanks.
LockDown32
Here is a tutorial on setting it up via a GPO. If you don't want to mess with a GPO the same settings would apply using the local securiey settings in gpedit.msc: http://www.ohoque.com/tutorial/disable-shutdown-option-from-start-menu-using-group-policy/
You would set a policy as above and apply it to the Active Directory OU that contains the server.
Also I suggest checking that the RDP users are just that, users. Normally users don't have the rights to shut down a DC.
Unless this is MS Small Business/fundamentals Server, there are additional complications in users logging on the remote desktop to a domain controller. So you'll have to be careful of setting local rights versus domain rights.
Also I suggest checking that the RDP users are just that, users. Normally users don't have the rights to shut down a DC.
Unless this is MS Small Business/fundamentals Server, there are additional complications in users logging on the remote desktop to a domain controller. So you'll have to be careful of setting local rights versus domain rights.
Are your users administrators? Non-admins don't have the right to shutdown the machine.
Users may shutdown servers by default, just not domain controllers. See https://technet.microsoft.com/en-us/library/cc960201.aspx for the settings.
Your problem is common. I had the same issue on a 2003 Terminal Server. Users were shutting it down. The fix is above and it does work.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
On my 2012 R2 RDS server if I go to the Power option all I'm presented with is a disconnect.
The option shouldn't be there, but if they know what they are doing and INTENTIONALLY do it, they can shutdown. (for example, running the Shutdown command from the command prompt).
The option shouldn't be there, but if they know what they are doing and INTENTIONALLY do it, they can shutdown. (for example, running the Shutdown command from the command prompt).
On my 2012ers, too, sorry, I stand corrected: the quoted setting is not valid any more.
Win2k member servers: users may do it.
2003 member servers: power users may do it
2008 and higher member servers: only admins and backup operators may shut those down.
Win2k member servers: users may do it.
2003 member servers: power users may do it
2008 and higher member servers: only admins and backup operators may shut those down.