0

I'm managing a Windows 2008 R2 Server box. For maintenance, I need for some hours to deny access to all users in the Remote Desktop Users and allow Administrators only.

I've tried in gpedit.msc under User Rights to deny Users group, but still Administrators can't log in because it returns a rights error.

Why can't Administrators log in if I deny the Users group to use Remote Desktop Connection?

2 Answers 2

1

Denies always win over Allows, and Administrators are also (usually) members of the Users group.

Perhaps instead of adding the Users group to the "Deny log on through Remote Desktop Services" policy, you could remove all the users/groups except the Administrators group from the "Allow log on through Remote Desktop Services" policy?

2
  • That did the trick! What stuped of me! I didnt think about that. Now i can connect with Administrators and Remote Desktop Users stay out during maintenance. Really Thank you!
    – frost
    Nov 3, 2011 at 13:13
  • NP, you can always upvote/accept answers to thank us. ;)
    – techie007
    Nov 3, 2011 at 13:37
0

Is this a domain joined server? If so, domain level group policy will be your saviour. Make an OU in active directory for remote desktop administrators and a GPO for the same, link them in group policy management and tweak it to suite your needs.

If this is not a domain joined server, try making a GPO for only the remote administrators and break its inheritance.

Also, remote desktop has to be enabled on the server itself.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .