3

I would like to grant the permission to reset users' sessions on a remote desktop session host (Windows Server 2008 R2) to a group of otherwise unprivileged users. The MSDN documentation on the RDS permission topic contains a promising passage on the "Reset" permission:

Reset: End a session. Be aware that ending a session without warning can result in loss of data at the client.

Windows Server 2003: You cannot set this permission.

This however is not reflected in the Technet Documentation on the same topic nor do I have the respective "Reset" permission listed in the security properties of the Remote Desktop Protocol:

RDP-Tcp permissions

If this is simply a documentation error, how would I then grant the "Reset" permission? I would like to avoid "Full Control" because it includes a number of other rights which should not be granted.

3
  • I agree with BlueCompute on the documentation. However, I wonder if giving them all of the above pics rights except Remote Control and Message would handle what you are after? – TheCleaner Nov 19 '13 at 14:01
  • @TheCleaner I am trying to find out what I can uncheck without breaking the ability to reset. Unfortunately, changes to the security settings of Rdp-Tcp seem to require a reboot to become effective, so testing is tiresome. – the-wabbit Nov 25 '13 at 10:34
  • I gotcha. You can restart Remote Desktop Services service instead I believe, but it will drop all TS connections. To help out, normal "User Access" includes "Query Information, Logon, Message, Connect" only. Only Logon is actually required...the other 3 give the user abilities on other users' connections (see if they are connected, message them, and remote into them (shadow)). However, it seems that the Reset explicit permission went away after Win2k. So Disconnect would be the only logical choice left but it will only do a simple disconnect, not terminate their actual session. – TheCleaner Nov 25 '13 at 14:14
2

I think that the first documentation you refer to is wrong. Everywhere else the reset permission is not listed and under 'Reset a Session' they say:

To reset another user's session, you must have Full Control access permission.

http://technet.microsoft.com/en-us/library/cc730659.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.