Solved

Remove the ability to reboot servers from helpdesk user's.

Posted on 2016-08-17
14
56 Views
Last Modified: 2016-09-07
What is your recommendations or the best way to remove the ability to reboot servers from helpdesk technicians, analysts etc?

Even if it is on a per server basis I would like to know your thoughts.
0
Comment
Question by:Dustin Poole
  • 4
  • 4
  • 3
  • +2
14 Comments
 
LVL 6

Expert Comment

by:Rob Leaver
ID: 41760254
I would deploy a GPO to remove and prevent access to the shutdown, restart, sleep, and hibernate commands
0
 
LVL 1

Author Comment

by:Dustin Poole
ID: 41760261
On a user basis or a computer basis?

And how do I allow power user's to reboot with such in place?
0
 
LVL 38

Accepted Solution

by:
Adam Brown earned 250 total points
ID: 41760264
Remove the Local administrators group from the User Rights Assignment settings "Shut Down the System" and "Force Shutdown from a Remote System". Then add just the users/groups you want to have that ability to the rights list. (This is in Group Policy: Computer Settings > Windows Settings > Security Settings > Local Policies > User Rights Assignment)

If you want to control this with a GPO, deploy a GPO that only includes the users that need those rights listed in the User Rights Assignment node in the GPO, link the GPO, then either set it to be enforced or move it to the top of the list on the OUs that have your servers in them.
0
 
LVL 6

Expert Comment

by:Rob Leaver
ID: 41760269
You would do it through the per computer configuration, however when you add the GPO you would apply the security settings to a group so you could apply the permissions to a particular set of users, leaving your power users the capability to reboot ect as required
0
 
LVL 38

Expert Comment

by:Adam Brown
ID: 41760270
To allow power users to reboot their workstations, make sure your Computers and Servers are in different OUs and link the GPO I mentioned to the Servers OU.
0
 
LVL 6

Assisted Solution

by:jmac44
jmac44 earned 250 total points
ID: 41760282
What I would do is create GPO for the for the helpdesk techs and under administrative templates remove the ability to shutdown or restart. See below.GPO.JPG
0
 
LVL 1

Author Comment

by:Dustin Poole
ID: 41760291
Jmac you're enabling the hightlighted option and applying to the helpdesk technicians OU?
0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 
LVL 38

Assisted Solution

by:Adam Brown
Adam Brown earned 250 total points
ID: 41760295
Just so you know, that particular policy doesn't prevent them from being able to shut down the computer. It just removes the GUI controls to do so. Users with only that policy set can still use the shutdown command in CMD to turn off or reboot the computer. To block that, you have to ensure that they are not a member of a group that has the user rights I mentioned earlier.
0
 
LVL 6

Expert Comment

by:jmac44
ID: 41760296
Yes you would enable that option.
0
 
LVL 6

Expert Comment

by:jmac44
ID: 41760297
Adam, your right but you can also remove the run command in that group as well. Or you can edit the security properties of the shutdown.exe and deny it for any user you want.
0
 
LVL 38

Assisted Solution

by:Adam Brown
Adam Brown earned 250 total points
ID: 41760361
Neither of which also removes the ability to perform a remote reboot on a server or workstation from a computer that doesn't have those options removed. All of those methods are cosmetic changes that don't actually remove the permission to shutdown systems. In essence, they are providing security through obscurity. The proper way to set the permission is to limit the User Rights assigned to the technicians. It takes more thought and consideration to configure systems that way, but it is significantly more secure because it completely removes the ability to shut down a computer without physical access.
0
 
LVL 6

Expert Comment

by:jmac44
ID: 41760392
Hey Adam, just so you know... I agree with you and had I saw your post before I posted, I wouldn't have posted my solution but geeze you don't have to be so snarky dude.
0
 
LVL 78

Expert Comment

by:David Johnson, CD, MVP
ID: 41760538
A helpdesk user doesn't need for a lot of tasks to logon to the server, they can do all of the management through RSAT tools.
0
 
LVL 1

Author Closing Comment

by:Dustin Poole
ID: 41788152
I was able to utilize Adam Brown's solution to resolve my problem.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will review the basic installation and configuration for Windows Software Update Services (WSUS) in a Windows 2012 R2 environment.  WSUS is a Microsoft tool that allows administrators to manage and control updates to be approved and ins…
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now