We help IT Professionals succeed at work.

Remove the ability to reboot servers from helpdesk user's.

123 Views
Last Modified: 2016-09-07
What is your recommendations or the best way to remove the ability to reboot servers from helpdesk technicians, analysts etc?

Even if it is on a per server basis I would like to know your thoughts.
Comment
Watch Question

Rob LeaverSr. Network & Server Engineer
CERTIFIED EXPERT

Commented:
I would deploy a GPO to remove and prevent access to the shutdown, restart, sleep, and hibernate commands
Dustin PooleNetwork Administrator

Author

Commented:
On a user basis or a computer basis?

And how do I allow power user's to reboot with such in place?
Cloud Security Consultant
CERTIFIED EXPERT
Top Expert 2010
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
Rob LeaverSr. Network & Server Engineer
CERTIFIED EXPERT

Commented:
You would do it through the per computer configuration, however when you add the GPO you would apply the security settings to a group so you could apply the permissions to a particular set of users, leaving your power users the capability to reboot ect as required
Adam BrownCloud Security Consultant
CERTIFIED EXPERT
Top Expert 2010

Commented:
To allow power users to reboot their workstations, make sure your Computers and Servers are in different OUs and link the GPO I mentioned to the Servers OU.
CERTIFIED EXPERT
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
Dustin PooleNetwork Administrator

Author

Commented:
Jmac you're enabling the hightlighted option and applying to the helpdesk technicians OU?
Adam BrownCloud Security Consultant
CERTIFIED EXPERT
Top Expert 2010
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
CERTIFIED EXPERT

Commented:
Yes you would enable that option.
CERTIFIED EXPERT

Commented:
Adam, your right but you can also remove the run command in that group as well. Or you can edit the security properties of the shutdown.exe and deny it for any user you want.
Adam BrownCloud Security Consultant
CERTIFIED EXPERT
Top Expert 2010
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
CERTIFIED EXPERT

Commented:
Hey Adam, just so you know... I agree with you and had I saw your post before I posted, I wouldn't have posted my solution but geeze you don't have to be so snarky dude.
David Johnson, CDSimple Geek from the '70s
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
A helpdesk user doesn't need for a lot of tasks to logon to the server, they can do all of the management through RSAT tools.
Dustin PooleNetwork Administrator

Author

Commented:
I was able to utilize Adam Brown's solution to resolve my problem.