1

I am looking for a way how to disable remote access to management console of single Windows Server 2008 R2 with least administrative effort.

Server is in domain and there is big amount of other computers and users in domain, hence looking for some local option rather than changing some settings on domain level.

I can disable usage of remote Server Management on server A that works as I would like - I am unable to access its Server Management from server B. However if I will open mmc on server B and add e.g. 'services' or 'computer management' snap-in, I am able to remotely access the server A this way

Need to avoid users to restrict from using mmc and particular snap-ins and preferably trying to find a way without using windows firewall and blocking this type of communication. I somehow deep inside do believe, that there could be some registry key or local policy setting that will simply disable remote access of mmc kind.

Obviously have to avoid any further 3rd party tools...

Anyone know how to achieve this? Or at least some hint would be appreciated.

Thank you

EDIT: to make it bit more clear... I want to disable only remote possibility to e.g. restart services and 'force' administrators to logon to server using RDP

  • Uhm what? If users have admin access to a system, then they have admin access to a system. If you don't want them to have admin access to a system, then fix the permissions so they don't have admin access to a system. Configure your authorization/access correction, and don't worry that people can run admin tools. – Zoredache Mar 18 '14 at 16:55
  • Thanks for your prompt comment, Zoredache. I may have it set a bit misleading way. Only administrators that should be administrators certainly have the access. What I want to achieve is a need for these administrators to by default need to connect to server directly using e.g. RDP and disallow only remote connection to mmc console. – Ricky-Brno Mar 18 '14 at 17:27
  • Curious. Why would you purposefully kill productivity by disabling useful remote administration methods? – Ryan Bolger Mar 18 '14 at 17:30
  • Server serves as NPS and it's configuration has been modified remotely. Microsoft confirm that changes to NPS settings are not being logged at all, hence only option to check were security logs and there are thousands of remote logons due to NPS functionality. We enabled auditing to ias.xml the configuration file of NPS, however if change is being done using mmc console you will see that computer account did the modification. Hence our customer requested to restricted remote access to NPS, so that we can see at least interactive logon types in security logs - therefore this question – Ricky-Brno Mar 18 '14 at 17:37
  • I admit, might look like stupid request though and agree this is certainly on of great features Windows Server is providing, but customer is customer – Ricky-Brno Mar 18 '14 at 17:38

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.