I have setup Remote Desktop Services on my Windows 2008 Server and having some issues with the permissions. I made a GPO that removes the Administrative Tools from the Start menu but normal users can still gain access to those tools via the normal controlpanel. Users can however only read stuff and not change anything though.
One thing to note is that this server is also running a Domain Controller which is not really recommended, want to remove ability to read stuff from the DC.
What would be the best practise for removing even the ability to read stuff?