1

i'm managing a W2008 Server box. As for maintenance i need for some hours to deny access to all users in the Remote Desktop Users and Allow Administrators only. I've tried in gpedit.msc under user rights to deny Users group but still Administrators can't log in because it returns rights error. Please i'm so desperated any help? Why if i deny Users group to remote desktop connection Administrators can't log in also? Thank you!

1 Answer 1

4

Why if i deny Users group to remote desktop connection Administrators can't log in also?

This is the normal ACL behavior on Windows. DENY takes precedence over allows. If you deny all users, then all users will be denied. If you don't want some users to have access to something you need to remove the ACE that permits that group of users access.

As for maintenance i need for some hours to deny access to all users in the Remote Desktop Users and Allow Administrators only.

Instead of messing around with permissions, why not disable new connections by putting the terminal server into drain mode?

Adjust the drain-mode registry value with one of these options. Administrators will still be able to connect when using the /admin switch.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\TSServerDrainMode
0 = Allow all connections
1 = Allow reconnections, but prevent new logon until reboot
2 = Allow reconnections, but prevent new logon

You can also enable drain-mode through the GUI.

rdp drain mode

3
  • Yes that's cool but it requires a reboot, and i cannot reboot, i need to wait all users to logoff..i suppose..
    – frost
    Nov 3, 2011 at 7:17
  • I am 100% certain, that modifying that doesn't require a reboot. I have used that setting every month for the 4 years to drain our TS servers for maintenance. Changing that setting immediately changes the ability for new connections to be made. Why do you believe that needs a reboot? Were you expecting it to disconnect existing connections?
    – Zoredache
    Nov 3, 2011 at 7:22
  • Hmm ok...i aint certain to understood what this drain function does..if you put "Allow reconnections, but prevent new logons" when there are already users connected you got to kick all of em out? I talked about reboot explaing that when it's rebooted im the first to log in and with this policy Users Group wont login? Please explain it in details, sry about that :D
    – frost
    Nov 3, 2011 at 13:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .