Removing Shutdown in Terminal Sessions 1

[Capsella]

Hi,

I am running a Windows 2000 AD domain where a member 2003 advanced server provide terminal services. I want to prevent the terminal users to shutdown the 2003 server from their terminal sessions.

The TS are used on 2000Pro workstations authenticated in the 2000 AD and that includes the users used to log into win2000Pro. The terminal sessions are started on these workstations using the same user which is also part of a TS group I created that allows them to open terminal sessions on the 2003 server.

In order to block these users from shutting down the whole TS environment, I followed the instructions on Microsoft website at:

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/terminal/trmlckd.mspx

In the group policy snap-in, I created another OU called Terminal Sessions into where I moved the users that were normally under USERS underneath the domain.

I then started to modify the policy that I created and that should only apply to that new OU. The problem is that everyone in the domain will get their shutdown button removed, except for the terminal sessions which keep their button!!

I played with inheritance settings thinking that I could block any changes outside of the default domain controller policy, but to no avail!

There is something I am missing and I would dearly appreciate some help.

Thanks a lot

 

[tfg13]

Why not have this group you created in the users group on the terminal services? Only people that can shut down terminal services are the administrators....

 

[Capsella]

Hi,

Thanks for your reply.

I am not sure I understand you. I should have the terminal users made part of the member server user group and apply the policies to that local group?

Isn't there a way to do it in active directory?

Thanks!

 

[tfg13]

This is an easy fix. From my understanding of your posts so far, you have already created an AD group that has all of the users that you need to be able to connect to the server. Are these users in the "allow shutdown from a remote system" in Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment? If they are, remove that entry, and leave administrators (you'll want to keep that in case you want to reboot the server remotely). If there is only the administrators in that group, start looking at the local groups you have set, such as the administrators group. Is the "Terminal Server users (that you assigned in AD)" included as administrators?

 

[Capsella]

Hi again,

Your solution works! Thank you so much! I was not looking at the right place.

In 2003 though, the wording is a little different.

Thanks!