Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here comes a real softball for your sysadmins from a lowly programmer:

We have a machine with Terminal Services enabled so our clients can preview the next version of our product. I want to turn off Terminal Services for our users while I remote into the machine and perform an upgrade.

How do I turn off Terminal Services access for all users except Administrator? (I'm using Windows Server 2003.)

Bonus: Is there a way I can leave a polite rejection message if they try to connect while I'm performing the upgrade?

Thanks!

share|improve this question
add comment

5 Answers 5

up vote 1 down vote accepted

This is setup by default. You would need to make sure those users that should be allowed in are in the administrators or "remote desktop users" group to allow access. If they must be admins you can take out that group and specify only certain users.

Right click my computer, manage, click "remote" tab, click "enable remote desktop on this computer", click "select remote users"

I don't know a way to change the "you don't have access to term in" message.

share|improve this answer
add comment

Hmm there is no date on this post, but all the answers here are very primitive in my opionion.

If you open "terminal services configuration" there is a tab called "permissions" Remove the remote desktop users from here, apply the settings and voila.

As for leaving a note at login. This can be done before the login screen even appears using the local group policy. (found in administrative tools)

The option you would look for is called: "interactive logon: Message text for users attempting to log on"

Hope this helps.

Ben

www.prime-networks.co.uk

share|improve this answer
add comment

If you would like to disable sessions from the command line, you can use the CHANGE LOGON command:

CHANGE LOGON {/QUERY | /ENABLE | /DISABLE}

/QUERY Query current session login mode. /ENABLE Enable user login from sessions. /DISABLE Disable user login from sessions.

This won't disconnect current sessions, but it will prevent clients from starting new sessions.

Using this method, a new client attempting to connect will receive a message which states that remote logins are currently disabled.

share|improve this answer
    
which works because you will already be connected and you can log the others off. Here is the rub though, if your upgrade requires a restart you are in real trouble. –  Matt Jul 2 '09 at 17:25
    
That's true if you forget to enable remote logins again and don't have physical access to the server/networked kvm. –  Jeremy Viet Jul 2 '09 at 17:30
    
which I am assuming must be the case or he would not say "How do I turn off Terminal Services access for all users except Administrator?" otherwise he should sit down at the machine and unplug the netowrk cable. (said in jest of course :) –  Matt Jul 2 '09 at 18:21
add comment

Option 1: check the option "deny this user permissions to log on any terminal server" on user account's terminal services profile tab.

Option 2: remote them from local remote desktop user account.

The reject message will show the reason why people can't log in.

Hope it helps.

share|improve this answer
add comment

Right click on my computer, select manage, click on local users and groups and change the users in the terminal services group.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.