Can I have a windows group with all the administrator privileges without the Remote Desktop privilege?

Question

Currently, I am using an account in the administrators group on a machine to kill the processes and stop/start windows services remotely using a tool written in c# (wmi) but this is causing issues because being in the administrator group also allows users to log on to the target machine via Remote Desktop and I don't want that.

What are my options here?

Answer 1

If the user doesn't need to log in at all, you can add it to the Deny log on locally security policy setting (or Deny Log on through Terminal Services, if you want to allow console login).

This can be done either through group policy on a domain or local security policy (secpol.msc); the setting is in Security Policies -> Local Policies -> User Rights Assignment.