Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a problem: users are connecting to our terminal server via remote desktop, and then creating VPN connections from it to another server, which then changes the networking and stops all ability to remote desktop into the server.

We'd like to be able to remove a standard user's ability to create or connect VPN connections from the windows 2008 R2 terminal server, and to this end we created GPOs which are supposed to do just this (User Configuration \ Administrative Templates \ Network \ Network Connections), however it's still possible for users to create connections :( Loopback processing is enabled, and RSoP shows the policies applying to the user on that server, so...

As a temporary workaround I've set the IP Helper Service (which seems to be required to initiate the VPN connection, or at least to do the local routing modifications) to startup type "Disabled". It doesn't seem to be required for anything else we need on that server, though I don't know enough about the service to be sure.

Am I doing something obviously wrong? Has anyone got any good suggestions on how I can achieve this? Or is what I'm trying to do the wrong thing for some reason?

share|improve this question

2 Answers 2

When the user creat VPN connection, do they untick the config Use default gateway in the remote network. If you don't untick it, therefore all traffic on the remote server will pass through the gateway at VPN site, that make the remote desktop failed.

You can change it by

  • Right click VPN connection, properties
  • In Networking tab, select IPv4, properties
  • Click Advanced, untick "Use default gateway in the remote network"
share|improve this answer
    
Yes, but they are not supposed to be creating VPN connections at all on that server, so I'd be surprised if the honour system would work here :) I need something that prevents them creating the VPN in the first place. –  Jon Kloske May 15 '13 at 6:22
    
You can use GPO to make firewall block outbound connection to port 1723. Why don't you do that? –  cuonglm May 15 '13 at 6:27
    
If there's no way for users to specify a different port when setting it up that might at least work. Though it's about the same as disabling the ip helper service, since both just basically gum up the process of actually trying to connect (rather then prevent the connections from being created in the first place). –  Jon Kloske May 15 '13 at 6:42
    
Is seems like you can disable by using GPO like you said. Please make sure checking your user rights, typing gpupdate /force or reboot server. –  cuonglm May 15 '13 at 7:18
    
sadface Yeah, I've done all that and it's not working :( I'm still able to log on as a regular user, create a VPN connection, and start it connecting (which fails, since iphelper service is disabled) but not for lack of trying on its part... –  Jon Kloske May 16 '13 at 7:11

This might seen severe, but, if they don't need access to the control panel, I would suggest disabling user access to the entire control panel. I use this on a 2003 Terminal Server (yes, I know, not the same version). Basically this prevents the users from making any changes to the machine. Odds are, they probably don't need to anyways and are just mucking up the Terminal Server.

User/Policies/Control Panel/ Prohibit access to control panel

Though I am not sure if this will work in your situation or not as it is dictated by how much access the users need when they RDP in.

Also, there is a GP that will override the TCP/IP advanced settings if the user is an administrator. You might want to check and make sure the users didn't make themselves local admins. They might be overriding the policy that way.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.