With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.
Course Of The Month
Become a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Remove the ability to reboot servers from helpdesk user's.
Posted on 2016-08-17
What is your recommendations or the best way to remove the ability to reboot servers from helpdesk technicians, analysts etc?
Even if it is on a per server basis I would like to know your thoughts.
Even if it is on a per server basis I would like to know your thoughts.
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
4
4-
3
- +2
14 Comments
Active today
I would deploy a GPO to remove and prevent access to the shutdown, restart, sleep, and hibernate commands
Active 1 day ago
Remove the Local administrators group from the User Rights Assignment settings "Shut Down the System" and "Force Shutdown from a Remote System". Then add just the users/groups you want to have that ability to the rights list. (This is in Group Policy: Computer Settings > Windows Settings > Security Settings > Local Policies > User Rights Assignment)
If you want to control this with a GPO, deploy a GPO that only includes the users that need those rights listed in the User Rights Assignment node in the GPO, link the GPO, then either set it to be enforced or move it to the top of the list on the OUs that have your servers in them.
If you want to control this with a GPO, deploy a GPO that only includes the users that need those rights listed in the User Rights Assignment node in the GPO, link the GPO, then either set it to be enforced or move it to the top of the list on the OUs that have your servers in them.
Active today
You would do it through the per computer configuration, however when you add the GPO you would apply the security settings to a group so you could apply the permissions to a particular set of users, leaving your power users the capability to reboot ect as required
Active 1 day ago
To allow power users to reboot their workstations, make sure your Computers and Servers are in different OUs and link the GPO I mentioned to the Servers OU.
Active today
What I would do is create GPO for the for the helpdesk techs and under administrative templates remove the ability to shutdown or restart. See below.
Active 1 day ago
Just so you know, that particular policy doesn't prevent them from being able to shut down the computer. It just removes the GUI controls to do so. Users with only that policy set can still use the shutdown command in CMD to turn off or reboot the computer. To block that, you have to ensure that they are not a member of a group that has the user rights I mentioned earlier.
Active today
Adam, your right but you can also remove the run command in that group as well. Or you can edit the security properties of the shutdown.exe and deny it for any user you want.
Active 1 day ago
Neither of which also removes the ability to perform a remote reboot on a server or workstation from a computer that doesn't have those options removed. All of those methods are cosmetic changes that don't actually remove the permission to shutdown systems. In essence, they are providing security through obscurity. The proper way to set the permission is to limit the User Rights assigned to the technicians. It takes more thought and consideration to configure systems that way, but it is significantly more secure because it completely removes the ability to shut down a computer without physical access.
Active today
Hey Adam, just so you know... I agree with you and had I saw your post before I posted, I wouldn't have posted my solution but geeze you don't have to be so snarky dude.
Active today
A helpdesk user doesn't need for a lot of tasks to logon to the server, they can do all of the management through RSAT tools.
Featured Post
Managing Active Directory can get complicated. Often, the native tools for managing AD are just not up to the task. The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space.
Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites.
Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…
Suggested Courses
Earn Certification
HTML5 Specialist - Certification
Free withPremium
Course of the Month4 days, 7 hours left to enroll
636 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.