Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have some domain admins on the Windows domain. We want to restrict some of them from accessing certain servers via RDP (mstsc.exe). But we still want them to be domain admins.

So in the end, some domain admins can access all servers, some only certain servers, while still being domain admins. Is there a way?

share|improve this question
Are these certain servers in the same OU in AD? –  Volodymyr Jan 10 '13 at 9:11
Any user. Sorry, managed to find it and it works OK: 1. Logon to the server you want to deny someone RDP access 2. Admin tools > Local Security Policy 3. Local Policies 4. User Rights Assignment 5. Deny log on through Remote Desktop Services or Deny log on through Terminal Services (if 2003) 6. Takes effect immediately –  Anon Jan 10 '13 at 9:11
Make sure you do NOT have any other site\domain\OU GPOs which override this setting. Restarting server, will apply settings in GPO, and local changes will be lost. –  Volodymyr Jan 10 '13 at 9:18
Keep in mind that, being domain admins, they will be able to override any such restriction if they choose to do so. –  Harry Johnston Jan 10 '13 at 21:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.