Re: Updating status - REMOTE INTERACTIVE LOGON vs. INTERACTIVE

There is no built-in way to have XP automatically update the user's security token because of a session state change.
I imagine you could program something yourself but it would be non-trivial.

What specific resources/objects are you attempting to secure based on console versus RDP? Perhaps I can think of another way to accomplish your goal.

-TP

oldemusicke@xxxxxxxxx wrote:
XP sp2 assigns you to the special groups REMOTE INTERACTIVE LOGON or
INTERACTIVE (etc.) only at logon. Is there any way to get Remote
Desktop or a session unlock to update this group assignment?

Situation 1: You log in at the console. As expected, you're now part
of the special INTERACTIVE group. You lock the session (ctrl-alt-del,
Lock Workstation). Later, you connect via Remote Desktop. This gives
you the existing session. Even though you're now in a remote session,
you're still part of INTERACTIVE, and not part of REMOTE INTERACTIVE
LOGON (confirmed by whoami /groups).

Situation 2: The console isn't logged in. You start a Remote Desktop
session. As expected, you're now part of the special REMOTE
INTERACTIVE LOGON. Next, you disconnect (as opposed to logging out).
Later, you visit the console and unlock the session. Even though
you're now logged in at the console, you're still in REMOTE
INTERACTIVE LOGON, but not INTERACTIVE (confirmed by whoami /groups).

If Remote Desktop Connection or the session unlock would re-assess
membership in these special groups, it would move you between
INTERACTIVE and REMOTE INTERACTIVE LOGON as appropriate, but
apparently this assessment happens only once at logon.

Goal: Allow non-admin users to use Remote Desktop Connection, but make
certain resources accessible only at the console, not over a remote
connection. An ACL entry denying all access to REMOTE INTERACTIVE
LOGON seemed like the way to go, until we discovered that it reflected
conditions of the initial logon, not conditions at the moment.

Session timeouts don't really solve the problem, by the way. One,
they'd shrink the window of opportunity but otherwise wouldn't solve
the problem. Two, any arbitrary ending of sessions affects the people
who are working normally too (in INTERACTIVE when they're really
interactive, and in REMOTE INTERACTIVE LOGON when they're really a
remote interactive logon).

Thanks.
.

Relevant Pages

  • Console Logon Issues with WSS 2003 R2
    ... After a while I will be unable to logon remotely -- the ... logging on at the physical console and logging off the session there. ... Consider using a shadow copy storage volume that does not have ...
    (microsoft.public.windows.server.general)
  • Re: TS / RDP / Citrix Events
    ... and remote connections to the console session (EventID 628 in stead ... Logon at physical console: ... Logon with normal TS session: ...
    (microsoft.public.windows.terminal_services)
  • Re: Updating status - REMOTE INTERACTIVE LOGON vs. INTERACTIVE
    ... ACL for the root folder of that volume with a Deny for REMOTE ... the user's security token because of a session state change. ... INTERACTIVE only at logon. ... you visit the console and unlock the session. ...
    (microsoft.public.windows.terminal_services)
  • Re: Viewing a remote session
    ... > He mentions connecting to the server via RDP sessions. ... > software for remote control or remote support. ... When I logon to the server using RDP and their ... >>> find their session, right-click the session, and select 'remote ...
    (microsoft.public.windows.server.sbs)
  • RE: emote console, WlxQueryConsoleSwitchCredentials, and WlxGetConsole
    ... logout from TS Session, you have to do same on workstation. ... Remote console logon. ... The weird thing is that the local consol goes in "log off" state - ...
    (microsoft.public.platformsdk.security)