Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server (Windows 2003 ) and different users connect the server via Remote Desktop Connection. All users have admin rights on it. So sometimes it becomes very difficult for me to RDC to the server because of number of session exceeds the limit. The only solution which I am looking now to restrict console RDC session for administrator only. Is it possible?

share|improve this question
    
You can always connect under to session with ID 0 using mstsc /admin or /console switch. Is the server part of the domain or a standalone host? –  Volodymyr Feb 22 '13 at 9:38
    
thanks its standalone server.. i cant connect always with session ID 0. because some time another user is connected with console and if i connect his work might effect. i only want to restrict console session for administrator. –  shikran Feb 22 '13 at 10:40
    
I'd like to point out that unless you've purchased terminal server licensing, RDP can only be used for remote administration of the server. Anything else is a violation of the license agreement. –  MDMarra Feb 22 '13 at 15:17
add comment

1 Answer

Well, this is not a good solution, but, nevertheless it's worth trying:

Method 1.

Go to Start > Run > gpedit.msc.

Then go to Administrative Templates > Windows Components > Terminal Services and enable the setting “Deny Log off of an administrator logged into the console session”. If the status is set to Enabled, logging off the connected administrator is not allowed.

Run “gpupdate.exe /force” from Command Prompt.

So, in other words, what you need to do is to log in session 0, have local computer policy configured like above and NOT to log off from machine. Others won't be able to take over your session.

enter image description here

Hope this helps.

Method 2.

Found a nice article that describes how to change which users or Administrators can connect to the console session:

1. To allow a normal user to connect to the console session, use the following command:

WMIC RDPermissions where "TerminalName='console'" call AddAccount "domain\UserName", 2

2. To deny administrators access to the console session, use the following command:

  WMIC RDAccount where "TerminalName='console' and AccountName like '%administrators%'" call delete

3. To restore the default setting:

   WMIC RDPermissions where "TerminalName='console'" call RestoreDefaults

So, after performing 2nd command and then using 1st command with your account should give you what you wants. Haven't tried myself though.

share|improve this answer
    
thans. first solution does not fulfil my requirement as i need to logoff server some time for other reasons. method 2 is much closer to what i was looking for. i have tried it but the issue which i am facing is, it also restricts administrator a/c as well, and i don not want to restrict administrator a/c using console. i tried to use the other parameter in AccountName like %dba% but it throws an error. so how it is possible i can restrict users not administrator ? –  shikran Mar 13 '13 at 7:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.