Deny users /admin option in RDP

[stm-tech]

Hi

 

We have a couple of RDP servers to allow pupils to connect to the school network. The problem is one or two of them are adding the /admin switch to their command. Now whilst it would be great to just say "Don't do that" it will never work.

 

Has anybody got any idea how I can say "if user is in group "pupils" and session="console" then delete?"

 

I have had a look at - Re: Disable the console RDP session in Server 2003 but they seem to have a problem running it as a batch.

 

How do others stop users logging in with the /admin or /console switch?

 

Paul

[PeterH]

Yep, you need to remove the Allow Logon Locally right from those users using either the local security policy on those servers or through group policy - Computer config | Policies | Windows Settings | Security Settings | Local Policies | User Rights Assignment | Allow log on locally

 

PH

[stm-tech]

Hi Peter

 

Thanks for that, have set that up now.

 

Paul