Re: Users can Install on Terminal Servers

Tech-Archive recommends: Fix windows errors by optimizing your registry

http://www.sessioncomputing.com/security.htm

--
Patrick Rouse
Microsoft MVP - Terminal Server
http://www.sessioncomputing.com


"Vera Noest [MVP]" wrote:

You mean that they can still install software after you switch the
compatibility mode to "Full Security?
Yes, I've also noticed that switching compatibility mode after the
initial installation doesn't produce exactly the same results as
choosing it during installation.
I guess that you could go through both the file system and the
registry and try to lock the server down. Maybe you could use
Microsofts Security Configuration Tool and apply the default
security settings. Personally, I'd re-install the server from
scratch, since you have no way of knowing what has been done to it.

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"Steven Hutchinson" <it1@xxxxxxxxxxxxxxxxxx> wrote on 12 jun 2006
in microsoft.public.windows.terminal_services:

Thanks Vera,

That seems to have been the problem. Unfortunately though, users
can still install Firefox although there is a warning message
appears stating that they do not appear to have the appropriate
rights to install. Is there anything else you are aware that I
can do to limit access further? I had initially thought of
trying to disable Windows Installer via group policy but this
doesnt seem to be preventing the installation either.

"Vera Noest [MVP]" <vera.noest@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote
in message
news:Xns97DDDFA13820Averanoesthemutforsse@xxxxxxxxxxxxxxxx
Maybe you chose "Relaxed Security" in stead of "Full Security"
as compatibility mode during installation of Terminal Services?
You can change the compatibility mode on the server, in TS
Configuration - Server properties

Recommended reading:

Understanding Terminal Server's Permissions Compatibility
Options - by Jeff Pitsch
http://www.brianmadden.com/content/content.asp?id=480
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"Steven Hutchinson" <it1@xxxxxxxxxxxxxxxxxx> wrote on 09 jun
2006 in microsoft.public.windows.terminal_services:

I have recently discovered that our users can install software
they have downloaded from the Internet on to our Terminal
Servers. (Firefox appeared one day which kind of took me by
surprise!)

I have checked that they are not members of any group with
rights to do this and are simply members of the Domain Users
group and Remote Desktop Users.

Has anyone seen this before or can anyone suggest why they
would have rights to install software on a Terminal Server?

.

Relevant Pages

  • RE: Terminal Server and Outlook
    ... Normally you install the resource kit tools on a workstation, where you can create transforms or profile settings. ... Run setup /a from the office setup disk to copy the setup files from the CD to an Administrative Installation Point ... Install on the Terminal Server with the MST ...
    (microsoft.public.windows.terminal_services)
  • Re: Networked Office
    ... the idea of a Terminal Server is generally a really good idea. ... / question as to why do you would want to turn them into thin clients. ... you can indeed make an Administrative Installation of Office 2003 ...
    (microsoft.public.windows.server.general)
  • Re: Networked Office
    ... the idea of a Terminal Server is generally a really good idea. ... / question as to why do you would want to turn them into thin clients. ... you can indeed make an Administrative Installation of Office 2003 ...
    (microsoft.public.windows.server.sbs)
  • Re: Networked Office
    ... the idea of a Terminal Server is generally a really good idea. ... / question as to why do you would want to turn them into thin clients. ... you can indeed make an Administrative Installation of Office 2003 ...
    (microsoft.public.office.setup)
  • Re: Users can Install on Terminal Servers
    ... compatibility mode during installation of Terminal Services? ... change the compatibility mode on the server, ... group and Remote Desktop Users. ...
    (microsoft.public.windows.terminal_services)