Is there a way to allow a non admin user access to kill rogue RDP sessions on Windows Server 2016 using Group Policy? Our network consists of hundreds of 2016 and 2012r2 servers so we're trying to do this with GP instead of individually on each server.

This post is related, only our servers do not have the RDSH role applied, and it seems this would need to be configured on each server individually.

enter image description here

  • What do you mean kill rogue sessions? – RobbieCrash Mar 20 '19 at 22:09
  • Sign off other users, by going to Task Manager > Users > right-click their session and Sign off. We serve an application through RemoteApp and occasionally encounter users who get stuck in a Disconnected state, requiring an Administrator to sign them off. We're trying to find a way to grant this right to non-admins. I've added a screenshot to clarify. – Nathan Mar 20 '19 at 23:58
  • Killing other sessions is an administrative action, it will require additional rights on the server. Is there a reason you want to sign them off rather than allow the session to sit idle? IE: is this to combat resource exhaustion, or is this because you're running a TS without licensing? Either way, what about killing idle sessions via GPO rather than allowing users to kill the sessions? – RobbieCrash Mar 21 '19 at 22:17
  • For some reason we occasionally see user sessions in a stuck state: they are disconnected and cannot reconnect until we have killed their session. While using GP to kill idle sessions rather quickly would theoretically be a solution, we have other users that expect to be able to reconnect to idle (or even disconnected) sessions after several hours, so there would be ramifications to that solution. – Nathan Mar 28 '19 at 18:06

Not granularly, but you can update the Security registry value for specified servers/groups of servers to replace the entire security descriptor with your custom value:

Key: HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
Value: Security
Value Type: REG_BINARY

Set the permissions on a server, then use Group Policy Preferences to import the registry value:

RDP Security Descriptor

If you need a method to change the Security registry valued to add/modify permissions, you can use this tool:


| improve this answer | |
  • We ended up running the following command on all servers wmic /namespace:\\root\CIMV2\TerminalServices PATH Win32_TSPermissionsSetting WHERE (TerminalName ="RDP-Tcp") CALL AddAccount "domain\<OU>",2. I'm unsure, but this command might be setting the same registry value? I haven't used Group Policy to enforce a registry value before and am a little reluctant to do so, but this does seem like exactly what I was looking for. – Nathan Mar 28 '19 at 18:15

You can configure End a disconnected Session and Idle Session Limit using Group Policy or By Setting each Users Properties in Active Directory.

| improve this answer | |
  • While related, we're looking for slightly different functionality than ending disconnected sessions or limiting the number of idle sessions. – Nathan Mar 28 '19 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.