Locking down Terminal Services

[brendaluv]

http://support.microsoft.com/default.aspx?scid=kb;en-us;278295

i did the above and the shutdown button is still available when are connecting to the box.

i have a OU called Terminal Services - inside you'll find terminalservices group and the server object. terminal services group has domain users group under members and all users are part of the domain users group.

logically the policy should apply to users logging on to the terminal server...but the shutdown button is still available and anyone can shutdown the server.

i'm not sure what to do next...

 

[brendaluv]

well...the policy finally kicked in and the users are no longer able to shutdown the system.

unfortunetly this has also locked down the administrator account from being able to access the MMC console or the shutdown button.

i guess you win some and you lose some...

 

[menlopark]

I am sure that you have found that group policy will apply to user and computers but not groups. What you would want to do is apply the policy to the server and then enable loopback processing to apply it to any user that logs onto the system.

If you do not want the policy to apply to an administrator or an administrator group you can set permissions for whom the group policy will apply in the security filtering of the group policy.

 

[brendaluv]

http://groups.google.ca/groups?q=te...=OE6BQ5TDEHA.1228@TK2MSFTNGP11.phx.gbl&rnum=1

above is a good thread that summarizes our situation.

i still cannot get the MMC to run when logging on with an Domain Admins account despite explicitly denying Apply Group Policy setting to the lockdown GPO.

as a work around, on the RAS, i created a local account with admin rights, then connected to a remote session and logged on locally with that account and the MMC works.

 

[menlopark]

You might want to run GP Results from the Group Policy Management Console with your domain admin and the terminal server as the the variables. This will show you what policies are being applied and which are not and why.

If you don't have the Group Policy Management Console, get it. It is free from Microsoft.