[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 91
  • Last Modified:

Remove the ability to reboot servers from helpdesk user's.

What is your recommendations or the best way to remove the ability to reboot servers from helpdesk technicians, analysts etc?

Even if it is on a per server basis I would like to know your thoughts.
0
Dustin Poole
Asked:
Dustin Poole
  • 4
  • 4
  • 3
  • +2
4 Solutions
 
Rob LeaverSr. Network & Server EngineerCommented:
I would deploy a GPO to remove and prevent access to the shutdown, restart, sleep, and hibernate commands
0
 
Dustin PooleNetwork AdministratorAuthor Commented:
On a user basis or a computer basis?

And how do I allow power user's to reboot with such in place?
0
 
Adam BrownSr Solutions ArchitectCommented:
Remove the Local administrators group from the User Rights Assignment settings "Shut Down the System" and "Force Shutdown from a Remote System". Then add just the users/groups you want to have that ability to the rights list. (This is in Group Policy: Computer Settings > Windows Settings > Security Settings > Local Policies > User Rights Assignment)

If you want to control this with a GPO, deploy a GPO that only includes the users that need those rights listed in the User Rights Assignment node in the GPO, link the GPO, then either set it to be enforced or move it to the top of the list on the OUs that have your servers in them.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Rob LeaverSr. Network & Server EngineerCommented:
You would do it through the per computer configuration, however when you add the GPO you would apply the security settings to a group so you could apply the permissions to a particular set of users, leaving your power users the capability to reboot ect as required
0
 
Adam BrownSr Solutions ArchitectCommented:
To allow power users to reboot their workstations, make sure your Computers and Servers are in different OUs and link the GPO I mentioned to the Servers OU.
0
 
jmac44Commented:
What I would do is create GPO for the for the helpdesk techs and under administrative templates remove the ability to shutdown or restart. See below.GPO.JPG
0
 
Dustin PooleNetwork AdministratorAuthor Commented:
Jmac you're enabling the hightlighted option and applying to the helpdesk technicians OU?
0
 
Adam BrownSr Solutions ArchitectCommented:
Just so you know, that particular policy doesn't prevent them from being able to shut down the computer. It just removes the GUI controls to do so. Users with only that policy set can still use the shutdown command in CMD to turn off or reboot the computer. To block that, you have to ensure that they are not a member of a group that has the user rights I mentioned earlier.
0
 
jmac44Commented:
Yes you would enable that option.
0
 
jmac44Commented:
Adam, your right but you can also remove the run command in that group as well. Or you can edit the security properties of the shutdown.exe and deny it for any user you want.
0
 
Adam BrownSr Solutions ArchitectCommented:
Neither of which also removes the ability to perform a remote reboot on a server or workstation from a computer that doesn't have those options removed. All of those methods are cosmetic changes that don't actually remove the permission to shutdown systems. In essence, they are providing security through obscurity. The proper way to set the permission is to limit the User Rights assigned to the technicians. It takes more thought and consideration to configure systems that way, but it is significantly more secure because it completely removes the ability to shut down a computer without physical access.
0
 
jmac44Commented:
Hey Adam, just so you know... I agree with you and had I saw your post before I posted, I wouldn't have posted my solution but geeze you don't have to be so snarky dude.
0
 
David Johnson, CD, MVPOwnerCommented:
A helpdesk user doesn't need for a lot of tasks to logon to the server, they can do all of the management through RSAT tools.
0
 
Dustin PooleNetwork AdministratorAuthor Commented:
I was able to utilize Adam Brown's solution to resolve my problem.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 4
  • 4
  • 3
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now