Re: Locking Down Terminal Server in Workgroup environment
- From: Jeff Pitsch <jeff.pitsch.fake@xxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Wed, 06 May 2009 16:32:08 -0400
From Vera's webiste (http://ts.veranoest.net)
: How can I lock down my standalone TS with a local policy without locking down the Administrator account?
Last modified: September 9, 2007
A: If your TS is not part of an Active Directory domain, you are limited to using the local policy on the server in stead of a domain GPO. One of the disadvantages is that you can't use security filtering on a local policy, as you can with AD-based Group Policies.
But here's a way around this limitation:
1. Logged on as Administrator, create a local group named "GP Editors" and a local user named "gpeditor". Make gpeditor a member of the GP Editors group
2. Add the GP Editors group to the Security - Advanced - Permissions tab of the folder C:\WINDOWS\system32\GroupPolicy. Check "Full Control - Allow" and "Replace permission entries on all child objects with entries shown here that apply to child objects"
3. On the Security - Advanced - Owner tab, change ownership to the GP Editors group, checking "Replace owner on subcontainers and objects"
4. On the Security tab of the Machine and User subfolders and the gpt.ini file in C:\WINDOWS\system32\GroupPolicy, change the permissions for Administrators to "Full Control - Deny"
5. Create a shortcut on the desktop with the command:
runas /user:gpeditor "%windir%\system32\mmc gpedit.msc" and name it "Edit Local Policy"
Jeff Pitsch
Microsoft MVP - Terminal Services
Jabooty wrote:
I have a Terminal Server in a Workgroup environment that I would like to lock.
down to limit user access. I would like to configure a Group to drop users in with the restricted rights as you would in an AD environment, because I do
not want administrative accounts to have the restrictions. Is this possible
in a workgroup and if so, how to I go about doing it? Any other
recommendations or best practices are welcome.
- Follow-Ups:
- References:
- Locking Down Terminal Server in Workgroup environment
- From: Jabooty
- Locking Down Terminal Server in Workgroup environment
- Prev by Date: Re: How do I enable certain users from my pdc?
- Next by Date: Problems with IE 8 on 2008 Terminal Server
- Previous by thread: Locking Down Terminal Server in Workgroup environment
- Next by thread: Re: Locking Down Terminal Server in Workgroup environment
- Index(es):
Relevant Pages
|
