2003 SBS / 2003 terminal server config

[tim55]

We have a 2003 SBS with a separate member 2003 server (no Active Directory) setup solely for terminal server access, with remote users logging onto the domain via it.

In Active Directory on the SBS, we have created a TermServ security group and everyone needing remote access is added to it. On the TS, this group is then added to the Remote Desktop Users group in Computer Management Local Users and Groups.

This works fine, but now it is remote desktop lockdown time, which I assume would be best done via group policies on the SBS.

However, I can't find a 'best practice' for doing this. Can anyone outline the basic steps in setting up the servers for this lockdown?

Many thanks.

 

[Stevehewitt]

How do you mean? As in tighten the security on the TS machine?




Steve.

"They have the internet on computers now!" - Homer Simpson

 

[tim55]

Hi. As it stands, every terminal server user has access to the Start menu and thus Control Panel etc. as well as My Computer and with a little careless messing around, they could shut down the server or worse. I basically need to stop them doing anything except run some programs from desktop links.

Tim

 

[eraH]

Definitely use group policies.
Maybe this Microsoft article can help you?

http://support.microsoft.com/kb/278295

 

[tim55]

I have seen a number of explanations of how to go about this - create new OU, adapt GP as necessary, save it as new GP and apply it to new OU is the general idea - but it seems that any policies will apply to a user whether they log in via terminal services or are sitting at their desk.

I need the policy to ONLY apply to a user when logging in via the terminal server, in addition to which there may be two or three different groups of people who will be able to have greater (or lesser) access to the TS desktop.

If anyone could give me some easy steps to doing this, I would be very grateful.

Thanks.

 

[58sniper]

[google]terminal server loopback processing[/google]

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[robatwork]

If you have a set of different user names that purely use the terminal services machine, you can get away with just putting the users into the OU, and locking down the User configuration bit on its policy (the device config bit will be ignored)

If they are the same users, you need to use the loopback method

 

[58sniper]

But that would require additional CALs. Loopback processing is specifically for stuff like this.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt