Windows Forum

Ask something
Discussion Locked

Terminal Services/ rights

0 helpful
8 replies

by rcoolman

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a user that is an administrator because they have to be able to connect to their server remotely to check backups etc. My understanding is that when TS is in Admin mode (in other words free) only administrators can connect. But I really don't want this person to have full rights to the server and or domain. Is there any way to let them access the server through TS while limiting their ability to screw things up?
Thanks.

8 replies

by dc1

In the Terminal Services configuration applet (found in administrative tools) right click on the RDP protocol and select properties. On the permissions tab give either the user or a seperate group rights as either admin, user, etc.

by rcoolman

This is interesting, but isn't giving me the kind of control I want. It doen't give me the option of locking an administrator into a predefined role. What I really want is for this person to not be a Domain Admin, but still be able to logon and manage backup.

by rcoolman

I am playing around with DC1's solution, but so far it doesn't seem to be giving me the control I want. What I'd really like to be able to do is have this user be able to use Terminal services as Backup Operator, but not be an administrator. This server is a DC and this individual should not have authorization to play with the Directory. I will keep looking at the first suggestion though. Thanks!

by cg it

As with some of my other answers to questions regarding user rights assignments on domains, (which most seem to not want try), I direct them to Active Directory Users and Computers for assigning domain Global user rights. [Active Directory User rights do apply to Terminal Services clients and users. Even to whether or not an Admin can watch a users activity or disconnect the user]. Changing this user from an admin security group to a different group, say, backup operators security group would solve your security problem with a user you do not want to have full admin rights to the domain.

As I stated, I found most who pose a security related question regarding user rights assignments don't seem receptive to Active Directory. Maybe because the do not have it installed. It's a wonderful tool in assinging user rights both on a global domain, local domain and even a local computer.

by rcoolman

Yes, changing this person to a Backup Operator is what I want, but it seems as if only administrators may login terminally if TS is in remote administration mode.

by acattr

Your concern is that you don't want the user touching anything while in the Terminal session. You can set the terminal session to only open up the backup program.

Considering that the user has administrative access over the Terminal server. Install the TS client on the users machine. with the connections manager, create a session for the terminal server. Set the session only to run the backup program. create an icon on the users desktop. Your done.

Email me if you have questions.

This discussion is closed to new replies.