Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

is there a way to let terminal services make some kind of 'abstraction' over the physical network interfaces of the server so they can be managed via gpo to grant or prohibit access for different users?

the basic idea is to have 2 network interfaces (user and server/management) and not letting users within terminal sessions access the server/management network.

or is this just impossible ? what would be a better way to do this ?

share|improve this question

What you are looking for is not as much of an abstraction but rather a user token based firewall solution which would allow you to sandbox / filter traffic from processes run by particular users. This is at least not done by the Windows Firewall, there might be working 3rd party solutions, though.

Probably a better approach to security would be not to mix up user and administrative infrastructure and give the administrators an own terminal server not open to users instead.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.