Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The closest thing I've found to making this work is to go into

  1. Go into Administrative tools->Terminal Services Configuration
  2. From the tree panel on the left hand side click Terminal Services Configuration->Connections
  3. On the right hand panel double click RDP-Tcp
  4. In the RDP-Tcp Properties window, click the Network Adapter tab
  5. Pick a network adapter, (not sure which one to pick)
  6. Change the Maximum Connections to 1
  7. Click OK

But I'm not completely sure that this is a good way to keep out users during a backup, is this the correct way to do it? I've noticed that the RDP-Tcp also has a Permissions tab as well and I'm not sure if that too could be used to restrict who has access to RDP on the server.

share|improve this question

4 Answers 4

up vote 2 down vote accepted

In order to be allowed to RDP to a Windows 2003 server, a given user must be in the "Remote Desktop Users" group or another group that specifically grants the RDP permission (like Administrators). By default, a regular user cannot RDP to a Windows 2003 server; if you add all your users to the Administrators or Remote Desktop Users group(s) by default, then you need to change your operating practices to achieve what you want.

Note that this does not restrict what times a user can log in, just whether they can RDP or not.

share|improve this answer

One answer that another user of the StackExchange forums came up with is to use Team Viewer. It is a third party application that will only allow authorized partners to access the server.

http://superuser.com/questions/233543/limit-the-computers-that-can-remote-desktop-to-a-server

Other than that you could always use the Remote Desktop built-in security to limit access by user accounts. From the properties of the server.

share|improve this answer

Max Connections will only limit the number of connections. Perms could work, but altering those each time your backup runs will get tedious. My Citrix days are long behind me, but there is such a thing as a server specific logon script, and this might be a good fit for your case. Have it check for username or membership in group, and presence of your backup process, or time of day the backup runs. Force a logoff except for the conditions.

Add you script to this registry key HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon\Appsetup

More details here. http://support.microsoft.com/kb/195461

share|improve this answer

@John is correct, Permissions for RDP access are manageable either by adding users or groups to this local group, or as follows:

Right click on "My Computer", click "Properties":

enter image description here

Then choose the "Remote" tab. On this tab Click "Select Remote Users", here you can add either local or domain users or groups to match your requirements.

enter image description here

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.