terminal services administrative template / GPO

seeking terminal services administrative templates ...

in particular: need to set permissions (for non-
administrator "administrators") under terminal services
configuration for TS running on domain controllers

Thanks in advance ...

Dear Eric,

Thank you for your posting.

To add/set permissions for user accounts, please follow the instructions
below:

Verify that the user has permission to initiate Remote Control.
Administrators, by default, can use Remote Control with other users'
sessions. Users do not have this right. To give specific rights for groups
other than Administrators:

1. Start the Terminal Services Configuration tool.
2. Double-click the connection you want to modify.
3. Click the Permissions tab.
4. Click Advanced, and then click Add.
5. Specify the user or group you want to add so the user or group can use
Remote Control.
6. After adding the user or group, the Permission Entry dialog box appears.
Click to select the Allow column for Remote Control.
7. Click OK.
8. Click OK, and then click OK.

For information about how to use Terminal Services for remote
administration of the Windows 2000 Server family, view the following
Microsoft Web site:

http://www.microsoft.com/windows200...terminal/tsremo
te.asp

To allow older programs to run correctly under Terminal Services in Windows
2000, additional permissions are granted to Terminal Services users.

You can remove the additional permissions by using the Notssid.inf security
template in the %SystemRoot%\Security\Templates folder. After you apply the
Notssid.inf security template, the system has the same default permissions
as a standard Windows 2000-based server, but with Terminal Services
enabled. To apply this security template:

1. At a command prompt, type "cd /d %systemroot%\security\templates folder"
(without the quotation marks), and then press ENTER.

2. Type "secedit /configure /db notssid.sdb /cfg notssid.inf [/log
notssid.log]/verbose" (without the quotation marks), and then press ENTER.

For the detailed information, please refer to the following articles:

238965 Removing Additional Permissions Granted to Terminal Services Users
http://support.microsoft.com/?id=238965

232792 HOW TO: Use the Terminal Services Remote Control Feature
http://support.microsoft.com/?id=232792

Hope it helps.

Thanks and have a good day!

Regards,
Benny Fu
Product Support Services
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
>Content-Class: urn:content-classes:message
>From: "ericggordon" <ericggordon@hotmail.com>
>Sender: "ericggordon" <ericggordon@hotmail.com>
>Subject: terminal services administrative template / GPO
>Date: Tue, 8 Jul 2003 19:58:36 -0700
>Lines: 7
>Message-ID: <919601c345c5$fddbcc20$a401280a@phx.gbl>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Thread-Index: AcNFxf3bG7pQjoRaQ5KuMYlf1SfFYw==
>X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
>Newsgroups: microsoft.public.win2000.termserv.apps
>Path: cpmsftngxa09.phx.gbl
>Xref: cpmsftngxa09.phx.gbl microsoft.public.win2000.termserv.apps:4069
>NNTP-Posting-Host: TK2MSFTNGXA12 10.40.1.164
>X-Tomcat-NG: microsoft.public.win2000.termserv.apps
>
>seeking terminal services administrative templates ...
>
>in particular: need to set permissions (for non-
>administrator "administrators") under terminal services
>configuration for TS running on domain controllers
>
>Thanks in advance ...
>