Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to provide some users to manage terminal services sessions on Windows Server 2008 RDS farm. However I do not want to provide these users with rights to login to the server or any administrative rights.

Is there any easy way to accomplish this?

share|improve this question

I think that the best you can do is set the rights on teh RDP session to give the users permissions to end sessions, force logout, and/or screen shadow

share|improve this answer

You can do this by creating a group for these users, add the users to the group, add the group to the permissions of the RDP protocol on the RDS server with Allow for all permissions except Logon, set Deny on the Logon permission. This will allow the users to shadow, logoff, message, etc., etc. RDS sessions but won't allow the users to log on to the RDS server and doesn't require that the users be Domain or Local administrators.

share|improve this answer

Create scripts to perform each RDP management function you need them to do using qwinsta.exe and rwinsta.exe. Then delegate the rights to run those scripts on specific servers using System Frontier.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.