Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm managing a Windows 2008 R2 Server box. For maintenance, I need for some hours to deny access to all users in the Remote Desktop Users and allow Administrators only.

I've tried in gpedit.msc under User Rights to deny Users group, but still Administrators can't log in because it returns a rights error.

Why can't Administrators log in if I deny the Users group to use Remote Desktop Connection?

share|improve this question

migrated from superuser.com Nov 3 '11 at 9:23

This question came from our site for computer enthusiasts and power users.

2 Answers 2

Denies always win over Allows, and Administrators are also (usually) members of the Users group.

Perhaps instead of adding the Users group to the "Deny log on through Remote Desktop Services" policy, you could remove all the users/groups except the Administrators group from the "Allow log on through Remote Desktop Services" policy?

share|improve this answer
    
That did the trick! What stuped of me! I didnt think about that. Now i can connect with Administrators and Remote Desktop Users stay out during maintenance. Really Thank you! –  frost Nov 3 '11 at 13:13
    
NP, you can always upvote/accept answers to thank us. ;) –  techie007 Nov 3 '11 at 13:37

Is this a domain joined server? If so, domain level group policy will be your saviour. Make an OU in active directory for remote desktop administrators and a GPO for the same, link them in group policy management and tweak it to suite your needs.

If this is not a domain joined server, try making a GPO for only the remote administrators and break its inheritance.

Also, remote desktop has to be enabled on the server itself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.