Please advise me on how I can ensure that remote desktop users cannot install software onto the Active Directory Server they are logging into remotely.

Some Background:

I have a client whose Server Security is very screwed up. I'm typically more of a programmer than an Admin, so I need some help.

They are using their Active Directory Server to allow remote sales people to Remote Desktop into their network, essentially allowing that Active Directory Server to double as a desktop for 4 remote employees. This alone seems like a bad idea to me. I'd prefer setting up a separate server for these remote users.

However, what's worse, is I just logged in using the credentials of one of the sales people, and I was able to install firefox, using their credentials! So, essentially, each outside sales person has administrative privileges for installing applications onto the Active Directory Server!

Last week I removed a virus from the server that essentially took the business down. Today, there is another virus sending out mass emails (getting their company blacklisted).

I do intend to reinstall this server and try to lock it down, but until the weekend, I'm trying to at least figure out how to make it to where these remote sales people cannot install software onto the server.

The truth is, I don't have much experience with Active Directory. I've mostly locked down Windows Servers that do not have Active Directory (through the 'Computer Management > Users' console).

When I go into "Active Directory User's and Computers". I do not see that the sales person is a member of an administrator's group. And when I look at each group (that they are a member of), I'm not able to locate any permission setting that reveals why they are able to install software on the server.

Could you please direct me a bit. I must be over-looking something essential. Please advice.


Here are the groups, the user is a memember of:

Name:           ActiveDirectoryFolder
Custom Sales All        domain.com/Users
Domain Users        domain.com/Users
Remote Desktop Users    domain.com/Builtin
Remote Users        domain.com/Builtin
  • 1
    If the users are not in any groups that are obviously administrative users, then someone has been playing, and has possibly assigned extended rights to one of those groups via group policy/user rights assignment, or something else equally clever/obscure/stupid. Given how difficult it is likely to be to "unpick" that kind of knot without knowing what was done, and given how the server appears to be a roach motel for viruses, I'd strongly recommend either getting in a consultant who does understand AD properly, or doing a rebuild of the server. – Rob Moir Jul 24 '12 at 18:56

They are likely either a member of BUILT-IN\Administrators, DOMAIN\Domain Admins, or DOMAIN\Enterprise Admins.

Remove them from these groups and don't let anyone ever log into a DC that isn't a systems administrator.

  • The sales people are indeed members of two Builtin accounts: (1) Remote Desktop Users: domain.com/Builtin and (2) Remote Users: domain.com/Builtin. – LonnieBest Jul 24 '12 at 17:58
  • 2
    Right. To add to that, the only [local] group they should need to be a member of is Remote Desktop Users. And in case it wasn't made clear enough, never ever, ever, ever let people remote into your Domain Controller. If they absolutely must remote into something, any other server is a better choice. (If this is a Domain Controller, there are no local users, and you'll need to use AD tools to determine what privileges they're getting, and where those come from.) – HopelessN00b Jul 24 '12 at 17:58
  • 1
    @LonnieBest Have you confirmed that neither Remote Users / Remote Desktop Users groups are nested into a group that would have had permissions to install software? – DKNUCKLES Jul 24 '12 at 18:35

The first thing I would suggest Lonnie is to convince them to shed out some money for a separate remove server. Remote Servers should be locked down in a way where the employee's have just enough access to do their work (known as The Rule of Least Privilege)

As far as viewing the permissions, Active Directory has a group of utilities, however the most useful in your situation will likely be the dsget <user> -memberof -expand command. This will display that particular users group memberships and allow you to figure out why they're able to install software.

More information on DSGET : http://technet.microsoft.com/en-us/library/cc732535%28v=ws.10%29

  • Is there a way to check these things through the "Active Directory Users and Computers" GUI console? – LonnieBest Jul 24 '12 at 19:08
  • 1
    The best thing I would suggest is that you go to each of the groups that @MDMarra mentions, double-click on them and click the "Members" tab to see who belongs to those groups. If any of the groups you listed above are members of the administrators groups then you know why they can install software. I would also check the Built In\Server Operators group as well. – DKNUCKLES Jul 24 '12 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.