I want to disable all users other than Domain Admins from being able to shutdown or restart a server if they are logged into it using a terminal services connection. I just want the logoff and / or disconnect option available.
There are 2 group policies you'll want to apply to the group your terminal services users are in:
User Configuration>Administrative Templates>Start Menu & Taskbar
Add Logoff to Start Menu
Disable & Remove Shut Down Command
There are many ways to do this, this is how I do it:
You need to create an MMC to control Group Policies. Go to Start>Run>MMC. This opens Console1. Click Actions>Add/Remove Snap-In. You’ll see a list of Snap-Ins. Click Add, Group Policy, Add. Now you’ll have to define what Group Policy you want to Administer. Click Browse, and right click in the white box that has the default Group Policies, and click New. Type a name for it, then click Finish, then Close, then OK. You’ll have added your Group Policy Snap-In to your MMC Console1. Right Click on the name of the Group Policy, and click Properties. Choose the Security tab. Click Add, and add the group that your Terminal Services users belong to. Give them the Read & Apply Group Policy rights under the Allow column. Also add the Domain Administrators group, but give them the right Apply Group Policy under the Deny column. This is very important, it ensures that this policy does not affect your administrators. Save Console1 before you exit (probably to your desktop), and give it a friendly name.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.