Terminal Services Security Configuration

[ZartiTech]

Hi All,

I have the need to setup a terminal services profile for an outsourced bookkeeping company and I have a few questions about securing it before they log in.

1) How do I prevent a user from being able to shut down or restart the server, but still log on and off terminal services?

2) In order for them to access quickbooks I think I have to give them administrator rights on the server itself, how do I prevent them from being able to access Active Directory & other admin tools?

3) Can I "turn off" internet explorer access so that they can't surf the web while logged into the server?

Any help would be greatly appreciated. Also, if you decide to help, please be specific. My knowledge of security and group policy setup is pretty thin.

Thanks,
Jon.

We're Running:
Microsoft Windows SBS 2003 with exchange & SQL.

 

[Roadki11]

Well by giving them admin rights its going to make this task very difficult to ensure you close all the doors. I would start by creating a new OU and putting this one specific user in the OU. Then i would create a new GPO and link it to that OU. I would start with a desktop and start menu redirection so they can only see the shortcut for quickbooks icon, then i would go through every option in the GPO and tighten the screws until only quickbooks can breath. Not an easy task but you can probably restrict them to point you are comfortable with but you will always have risk with this setup. The question is can you live with that risk?

RoadKi11

 

[ZartiTech]

Ok. I'm a bit confused. OU means? GPO ... Group Policy?

Is there a way to only give them user or power user status and still have them access quickbooks?

 

[Roadki11]

An OU is an organizational unit or AD container, GPO is a group policy object. If you create a new OU and a new GPO for that OU and put the user in that OU then that GPO will only apply to that user. Im struggling to remember but i dont think you can run TS on an SBS server, with that said the only option you have(if you want to use a TS type connection) is to give them admin rights as they need to be a member of the administrators group in order to make a remote management connection.

RoadKi11

 

[Dublin73]

Quickbooks won't require Admin access. see this...

http://support.quickbooks.intuit.com/archive/faqs/qbw2002/premier/129407.html

Try that first. If all else fails you could create a Windows group in the domain for your Quickbooks users, then place this group in the "local" Power Users group on your terminal server