Prevent user group from logging onto Terminal Server

[Ambient]

Hi all

 

As title, I’m trying to figure out how to prevent a certain group (or groups) from logging onto a certain terminal server. To cut a long story short, I have a terminal server which I use to log into from home, and I want to make sure that my user account is the only one which can log on to it.

 

We have another terminal server (which is specifically for staff), and the person who did my job before me setup the local security to allow both him and me to literally select which users are granted the ability to logon (its a case of adding the user accounts to the Remote Desktop Users local group), but this procedure doesn’t work for "my" terminal server.

 

Any ideas?

 

It’s probably a simple procedure, but I can't figure it out.

[3s-gtech]

Not sure with a TS - but with a domain workstation it's done on the local machine (so the server itself in this case) with secpol.msc. Security Settings/Local Policies/USer Rights Assignment - Deny Log on Locally, and add the groups. Couldn't say for sure if this will work with your setup though.

[Ambient]

Yeah thats how i prevent students logging onto staff work stations, but that feature doesnt appear to be present in Server 2003. When i go to the local security settings and select that policy, i get a message saying something like the policy isnt compatible with OS's after 2000 SP1...which is a tad strange.

[3s-gtech]

It's not ideal for servers to be honest. Bit dirtier, but how about setting a logon script for all users, that reads the samaccountname attribute %'SAMAccountName'%, if it's not you, it just logs back off again. Should be fairly simple.

[mavhc]

For remote desktop on win2k3 it's just people in the local Remote Desktop Users group, I tend to add an AD group to that and edit the AD group, unless there's some other GPO overriding something, RSOP might help

[Ambient]

Yeah i've looked into that too. It appears that something must be overriding it on "my" server...because i've added only my username to the Remote Desktop Users group, but other members of staff are still able to log on. However, on the staff terminal server, only users who are added to this group are able to logon...which means it works for that server but not mine

[p858snake]

Yeah i've looked into that too. It appears that something must be overriding it on "my" server...because i've added only my username to the Remote Desktop Users group, but other members of staff are still able to log on. However, on the staff terminal server, only users who are added to this group are able to logon...which means it works for that server but not mine

Log in with a account that shouldn't be getting access then run RSOP and see what is being applied.

[sted]

could you just set a deny for staff as that shold take precidence over an allow?

[Ambient]

Done that but, to be honest...i arent quite sure what i'm looking for in all the policy's