poltrone said:
For security reasons i would like to make it impossible to login
via Remote Desktop as an administrator. Unfortunatly admins are
allowed to do so by default.
Is there a way to ban members of the admin group from logging in
via Remote Desktop?
poltrone
The following groups have the right to log on via Remote Desktop:
-Administrators ( Members of the 'Administrators' group );
-Additional users who you grant access via the:
System Properties | 'Remote' tab | 'Select Remote Users' button.
( Members of the 'Remote Desktop Users' group ).
To change this default behaviour, go to:
Start | Run | secpol.msc;
Security Settings | Local Policies | User Rights Assignment
The 5th policy down is 'Allow logon through Terminal Services'.
Double-click it.
As you expect, the groups 'Administrators' and 'Remote Desktop Users' are
listed here. Simply remove 'Administrators', and then only people you have
explicitly chosen using the 'Select Remote Users' button ( the 'Remote
Desktop Users' group )are left.
If you want to look at, or edit, the contents of the 'Remote Desktop Users'
group directly, rather than via the 'Select Remote Users' button, then go to
Start | Run | lusrmgr.msc, and expand up the groups.
