Is there a way to allow a non admin user access to kill rogue rdp sessions on a Windows Server 2008 R2 Terminal Server?

If not possible for a regular user, is there a way to allow an admin minimal rights to only be able to kill rdp sessions/reboot the server if needed?

  • 2
    Is there a way to allow a non admin user access to kill rogue rdp sessions on a Win 2K8 R2 Terminal Server? - I'm fairly certain that I've done this in the past. You'll need to grant the user the appropriate permissions to RDP-TCP. - technet.microsoft.com/en-us/library/cc753032(v=ws.11).aspx – joeqwerty Feb 6 '17 at 17:22
  • I think this is what I'm looking for. I'm gonna play around with it and test. Thanks Joe! – Gal_K Feb 6 '17 at 17:43

According this technet post you can set "Logoff" or/and "Disconnect" permission in Remote Desktop Session Host Configuration.

To configure permissions for a connection:

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.
  2. Under Connections, right-click the name of the connection, and then сlick Properties.
  3. In the Properties dialog box for the connection, on the Security tab, configure the permissions as appropriate for your environment, and then click OK.
| improve this answer | |
  • Yeah, this is exactly what I'm looking for... My only issue is when I created a test user on our DC sans admin rights and had it remote and perform logoffs, send messages etc all was great. When I created a new user I kept getting access denied when I tried to log off, send messages etc. Not sure what went wrong as I literally copied my test user and all settings when creating the actual one. – Gal_K Feb 7 '17 at 18:01
  • So after playing around with AD and deleting/recreating the user I was finally able to logoff and send messages to other users without having to give admin access. Thank you Slipeer! – Gal_K Feb 8 '17 at 14:42

It's not possible as far as I can tell. While you can likely assign rights to kill a process (it would be complicated but possible I think), listing the processes would require admin rights. However, if you are giving another user the ability to control processes, and reboot, you are effectively giving admin rights to that user anyway.

A better question might be how to prevent "rogue" rdp sessions in the first place.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.