2

Is there any way to prevent users from launching and using remote desktop and to restrict it to only local admins or domain admins?

The reason being is that we do not want users to remote desktop home, but at the same time we want it to be available to certain users like administrators or power users.

Ideally there is a group policy that can be set to groups or users who have access to the remote desktop application from their machine.

Clarifications: I need the machine to be able to still have remote desktop work, just only with a specific user or group. The point is that we allow certain users to use remote desktop and others to not have access to it. There are machines where there are multiple users, so we cant just block a whole machine or by IP.

This needs to be done per a user account or login.

Improve this question

7 Answers 7

Reset to default
3

Why are you singling out Remote Desktop? Why not include VNC, GoToMyPC and so on?

There is no fool-proof way to do this really. If you make the effort to block as much as possible you are going to have to do a lot of work.

You can setup your firewall to block everything except what you explicatively permit and then allow only the things you control. Give your administrators some way to temporarily open holes or vpn around the firewall. You cannot simply block the common port for your users since users could simply setup a VPN/Tunnel of some sort.

Or you can use a tool to build a whitelist of all the allowed application on your machines and block everything else.

Improve this answer
0

Remote Desktop uses a specific port or protocol, I believe. You could restrict this port on the firewall or network level -- all it only for specific IP addresses.

Improve this answer
2
  • 1
    And if you aren't blocking SSH, I will simply build a tunnel to get around your firewall.
    – Zoredache
    Dec 17, 2009 at 18:28
  • 3
    And if you are blocking SSH i will run an ssh server on port 443 at home
    – Zypher
    Dec 17, 2009 at 21:49
0

Change the GPO Permissions on MSTSC.exe to have Permissions for only the administrators Group to "execute"

Improve this answer
1
  • 1
    What happens if a user has a copy of mstsc on a flash drive, or if they have an alternate client?
    – Zoredache
    Dec 17, 2009 at 18:27
0

You want the "Software Restrictions" section of group policy. There is a good overview here http://technet.microsoft.com/en-us/library/bb457006.aspx. I haven't worked with it much so I don't know the specifics very well, but you can block applications by a number of different criteria and the "skip administrators" option allows administrators to do whatever they want.

Improve this answer
0

The easiest way to deal with this situation is through group policy, as stated above. This will allow administrators to still use Remote desktop from the local machine. As for VNC/Logmein/Gotomypc, again, use group policy to disallow users from installing software on their machines. It may be a bit of an IT hassle, but if you're looking for lockdown, it is the easiest way.

If you're not using a domain or group policy, just make the users regular users or power users as opposed to administrators.

Improve this answer
1
  • 1
    Many tools these days can be used without any installation whatsoever, including VNC. If is necessary to lock things down hard, then you would have to use a whitelist approach and block everything except the few applications you want to allow your users to use.
    – Zoredache
    Dec 17, 2009 at 22:13
0

Clarifying question: Is this driven by IT security or performance (bandwidth, etc.) concerns, or concerns about employees 'stealing' company time by using home machines?

If the first issue, then as other posters have already mentioned there are a number of workarounds -- GoToMyPC for example uses HTTP protocol. This assumes that your users are educated enough to implement these changes.

If the second, then you should consider some business-level solutions. If you are able to monitor your employees' computers or network activity, your company simply needs to enforce some form of punishment on offenders - threaten fines, pay cuts, or worse.

Improve this answer
0

From http://community.spiceworks.com/topic/104009:

If you need to add Domain users to the Remote Desktop Users group on an XP machine then you need to use restricted groups in GPO...

it is under Computer configuration/Windows settings/Security settings/restricted groups. Right click, add group, click browse to find domain users. Click ok and click add under This group is a member of... Type in Remote Desktop Users.

Worked fine for me (in a Windows Server 2008 R2 domain, of course). Update: Right, this would only give access rights to domain users on local computer

  1. Set "Allow users to connect using Remote Desktop Services" under "Computer Configuration/Policies/Administrative Templates/Windows Components/Remote Desktop Services/Remote Desktop Session Host/Connections" to true.
  2. Add users/group to "Remote Desktop Users" in "Active Directory Users and Computers"

This would work. Sorry for my misinterpretation of the question.

Improve this answer
2
  • That's not quite the information the OP is looking for. That method grants users permission to access machines via RDP. It cannot be used to prevent users from using an RDP client.
    – John Gardeniers
    Oct 17, 2010 at 23:21
  • @John Gardeniers, recheck my answer. Hope it helps.
    – Parsa
    Oct 19, 2010 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .