I have a user accessing a server and they have to RDP using mstsc /admin.
How do I remove /admin from my user, and just use the RDP with mstsc, but not mstsc /admin.
Thanks.
1 Answer
Convert user from mstsc /admin to just mstsc for RDP
How to remove admin from my user, and just take the RDP by just using mstsc, but not mstsc /admin.
Right-click on the shortcut icon they click on to RDP into the server with the /admin switch, select Properties, and go to the shortcut tab. In the target field simply remove the /admin characters and press OK.
Once the change is made to that shortcut, when it's used without it, it'll not RDP into the console session of that machine any longer.
Before Removal
After Removal
Update
Logon: "Your interactive logon privilege has been disabled"
Follow these steps if you see a dialog box with the message Your interactive logon privilege has been disabled when trying to logon to your PC.
This message usually means your domain user account has the Terminal Services logon privilege disabled in Active Directory. Please contact your system administrator to re-enable this privilege for your domain account.
For Administrators: The Deny this user permissions to log on to any Terminal Server setting for the user should be unchecked as seen in the Windows Server 2003 screen shot below:
Deny RDP Permission with Group Policy
RESOLUTION
To deny a user or a group logon via RDP, explicitly set the "Deny logon through Remote Desktop Services" privilege. To do this access a group policy editor (either local to the server or from a OU) and set this privilege:
Start | Run | Gpedit.msc if editing the local policy or chose the appropriate policy and edit it.
Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment.
Find and double click "Deny logon through Remote Desktop Services"
Add the user and / or the group that you would like to dny access.
Click ok.
Either run gpupdate /force /target:computer or wait for the next policy refresh for this setting to take effect.
Update2
5Terminal Service access by default allows only two connections for remote administration. It was designed solely for remote administration and not for users to access.
If you need more than two users, such as to allow your users to connect remotely wtih their own desktop, do work, etc, then you must upgrade to what used to be called Terminal Server Application Mode or now called, Remote Desktop Services. However, this requires purchasing CALs (client access licenses) and , then once purchased, then you would:
- Install the Remote Desktop Services Role.
- Install the TS Licensing role service.
- Open TS Licensing Manager and connect to the Terminal Services license server.
- Activate the license server.
- Install required TS CALs on the license server.
- You then have to reinstall your apps in "Install Mode" so they will be available for your users.
