Re: Remote Desktop Shadowing for Non-Adminsitrators

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Huei Wang [MSFT] (hueiwang_at_online.microsoft.com)
Date: 03/10/04 

Date: Wed, 10 Mar 2004 09:58:06 -0800

Try TS WMI provider, AddAccount in Win32_TSPermissionsSetting,
unfortunately, I am not much of script writer :-(

Other option you have is to use Remote Assistance except it require someone
on the console to accept the invite. 

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
"Rob Lowe" <none@nowhere.com> wrote in message
news:egvC1qYBEHA.2796@TK2MSFTNGP09.phx.gbl...
> Patrick -
>
> FYI -
>
> I have been told by Microsoft that it is a requirement that any user
> attempting to shadow a console session must be a member of the
> Administrators group.  This is by design and TCP-RDP permissions cannot be
> used to grant this access.
>
> Thanks for your post
>
> "Patrick Rouse [MVP]" <anonymous@discussions.microsoft.com> wrote in
message
> news:D6CCB580-ED31-484E-A06B-4FF7A234F113@microsoft.com...
> > To be able to logon to the console session you need the "logon locally"
> right, which can be given in the local security policy or via GPO.  They
can
> probably shadow sessions other than session "0", yes?
> >
> > Patrick Rouse
> > Microsoft MVP - Terminal Server
> > http://www.workthin.com
> >
> >      ----- Rob Lowe wrote: -----
> >
> >      Hi -
> >
> >      Does anyone know a way to grant console shadowing through Remote
> Desktop to
> >      users that are not members of the local Administrators group?
> >
> >      I have setup TCP-RDP permissions to allow members of a domain group
> Full
> >      Control of the Remote Desktop session, but these users cannot
connect
> to the
> >      server via Remote Console using the /console switch.  KB Article
> 278845 -
> >      How to Connect to and Shadow the Console Session with Windows
Server
> 2003
> >      Terminal Services discusses how it can be done, but does not
> elaborate on
> >      security settings required for anyone other than an Administrator
to
> use it.
> >
> >      I have network server admins who are not domain admins who need to
be
> able
> >      to monitor the console directly.  These users are members of the
> built-in
> >      domain Server Operators group (for domain controller access) and
> members of
> >      the local Power Users group on member servers.
> >
> >      Any suggestions would be most appreciated.
> >
> >
> >
>
>

Relevant Pages