Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We need to disallow the domain Administrator account to access a server directly via RDP. Our policy is to log on as regular user and then use Run As Admin functionallity. How can we set this up?

The server in question is running Windows Server 2012 R2 with Remote Desktop Session Host and Session Based RD Collection. Allowed User groups do not contain the domain Administrator user but somehow he is still able to log on.

Thank you.

share|improve this question

migrated from May 24 '14 at 9:09

This question came from our site for computer enthusiasts and power users.

You don’t. (filler) – kinokijuf Mar 26 '14 at 10:05
I have never heard of someone settings permissions for the Domain Admin... haha – pulsarjune Mar 26 '14 at 10:06
Which policies exactly did you modify, list them, in your question. – Ramhound Mar 26 '14 at 11:20
@Ramhound I didn't think of using GPO, I thought this was only matter of setting up the Remote Desktop Services tab somehow. – r0b0 Mar 26 '14 at 12:14
@pulsarjune I come from unix background where it is quite common to disable root login via ssh and only use su/sudo. This is not tha case in Windows I suppose? – r0b0 Mar 26 '14 at 12:16
up vote 11 down vote accepted

This seems to be what you are looking for:

To deny a user or a group logon via RDP, explicitly set the "Deny logon through Remote Desktop Services" privilege. To do this access a group policy editor (either local to the server or from a OU) and set this privilege:

  1. Start | Run | Gpedit.msc if editing the local policy or chose the appropriate policy and edit it.

  2. Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment.

  3. Find and double click "Deny logon through Remote Desktop Services"

  4. Add the user and / or the group that you would like to dny access.

  5. Click ok.

  6. Either run gpupdate /force /target:computer or wait for the next policy refresh for this setting to take effect.

share|improve this answer
Anyone tested this to be working? – Pacerier Mar 13 '15 at 17:34
I think it's better to remove Administrators from "Allow logon" and add individual admins to "Remote desktop users" group – basin yesterday

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.