Avatar of Dustin Poole
Dustin Poole
Flag for United States of America asked on

Remove the ability to reboot servers from helpdesk user's.

What is your recommendations or the best way to remove the ability to reboot servers from helpdesk technicians, analysts etc?

Even if it is on a per server basis I would like to know your thoughts.
Windows Server 2008Windows Server 2003Windows Server 2012

Avatar of undefined
Last Comment
Dustin Poole

8/22/2022 - Mon
Rob Leaver

I would deploy a GPO to remove and prevent access to the shutdown, restart, sleep, and hibernate commands
Dustin Poole

ASKER
On a user basis or a computer basis?

And how do I allow power user's to reboot with such in place?
ASKER CERTIFIED SOLUTION
Adam Brown

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Rob Leaver

You would do it through the per computer configuration, however when you add the GPO you would apply the security settings to a group so you could apply the permissions to a particular set of users, leaving your power users the capability to reboot ect as required
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
Adam Brown

To allow power users to reboot their workstations, make sure your Computers and Servers are in different OUs and link the GPO I mentioned to the Servers OU.
SOLUTION
jmac44

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
Dustin Poole

ASKER
Jmac you're enabling the hightlighted option and applying to the helpdesk technicians OU?
SOLUTION
Adam Brown

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
jmac44

Yes you would enable that option.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
jmac44

Adam, your right but you can also remove the run command in that group as well. Or you can edit the security properties of the shutdown.exe and deny it for any user you want.
SOLUTION
Adam Brown

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
jmac44

Hey Adam, just so you know... I agree with you and had I saw your post before I posted, I wouldn't have posted my solution but geeze you don't have to be so snarky dude.
David Johnson, CD

A helpdesk user doesn't need for a lot of tasks to logon to the server, they can do all of the management through RSAT tools.
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
Dustin Poole

ASKER
I was able to utilize Adam Brown's solution to resolve my problem.