I'm managing a Windows 2008 R2 Server box. For maintenance, I need for some hours to deny access to all users in the Remote Desktop Users and allow Administrators only.

I've tried in gpedit.msc under User Rights to deny Users group, but still Administrators can't log in because it returns a rights error.

Why can't Administrators log in if I deny the Users group to use Remote Desktop Connection?


Denies always win over Allows, and Administrators are also (usually) members of the Users group.

Perhaps instead of adding the Users group to the "Deny log on through Remote Desktop Services" policy, you could remove all the users/groups except the Administrators group from the "Allow log on through Remote Desktop Services" policy?

| improve this answer | |
  • That did the trick! What stuped of me! I didnt think about that. Now i can connect with Administrators and Remote Desktop Users stay out during maintenance. Really Thank you! – frost Nov 3 '11 at 13:13
  • NP, you can always upvote/accept answers to thank us. ;) – techie007 Nov 3 '11 at 13:37

Is this a domain joined server? If so, domain level group policy will be your saviour. Make an OU in active directory for remote desktop administrators and a GPO for the same, link them in group policy management and tweak it to suite your needs.

If this is not a domain joined server, try making a GPO for only the remote administrators and break its inheritance.

Also, remote desktop has to be enabled on the server itself.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.