1

One of the clients I manage runs an RDS environment on Windows Server 2008 R2 servers which users log onto to work. I need to prevent users allowing applications to restart these servers, the kicker is that they are all Local Admins (due to the requirements of the application that they run). What GP(s) would you recommend be applied to solve this? I currently have the following set:

Computer Config > Policy > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Shut down the system.

Only allowing Domain Admins to shut down the system, I believe this is only applying to local shutdowns, not remote.

  • Stopping local shutdowns is not good practice to me, and that dang power button/cord is still there. You should allow someone local to shutdown/restart as a last resort at least...who knows the network card might blow, the switch fries itself – gwillie Aug 19 '15 at 8:21
2

Yes, this policy determines which users who are logged on locally to the computer can shut it down.

See description on the Explain tab:

enter image description here

You may also look at another policy in this location (i.e. under User Rights Assignment:) - Force shutdown from a remote system.

Administrators are members by default.

Removing Administrators from both policies - would disallow them to shutdown the RDS host, either locally or remotely.

enter image description here

| improve this answer | |
  • I had found this GP (the second) but one of the guys above me swore that all we needed was the current GP (the first). Thank you for confirming what I though (not sarcastic, still new to the IT field so wanted some backup before proceeding). – Mickycampbell Aug 19 '15 at 22:51
6

You can't effectively deny rights to local administrators, since regardless of what GPO you apply, they can always override it at least temporarily by editing the registry. They can also remove the computer from the domain.

In general, you shouldn't use or distribute the local administrator accounts in an environment requiring top-down administrative control such as this. The best policy is to keep those passwords within a database (or software designed for this purpose such as Hitachi ID Privileged Access Manager, which I used to work on); the passwords should only be used when necessary to re-establish the domain relationship or similar, and use of them should be auditable.

It's unfortunate that your application requires such access. You could consider determining what access it actually requires, and giving it that instead; most applications do not actually need administrator access.

If your only goal is to prevent inadvertent shutdowns, you can certainly set Local Security Policy/Local Policies/User Rights Assignment/Shut Down the System to exclude them, but be aware that this will not prevent a knowledgeable user from intentionally shutting it down. I believe this policy applies to RDP interactive sessions, but not to the shutdown command (which has an option to target a remote host); that is the domain of the Force shutdown from a remote system GPO option.

| improve this answer | |
  • 'Higher end' stuff like command line and registry edits I am not worried about (it may seem gung-ho but it is because I have to describe how to find a computer name to most of the people there so I can connect with our remote support software). I am mainly attempting to prevent inadvertent shutdowns, such has a prompt from MSE to restart the system. – Mickycampbell Aug 19 '15 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.