Disallowing connection to TS by group name

[Harry Devine]

We are in the process of restructuring our username and group assignment
structure in our AD. What we want is to have certain groups not have access
to Terminal Server into our development boxes.

I know that I can go into each user and uncheck the "Allow logon to Terminal
Server" box, which will work, but can I override this somehow and disallow
connection if a user belongs to a certain group?

Thanks for any help,
Harry

 

[Guest]

1. Add your development boxes to a separate OU and control the connections
settings via GPO

or

2. Do not add these users to the RDP-Tcp connection ACL in each server's
Terminal Server Configuration MMC.

How tos:
http://www.workthin.com/tshta.htm

Patrick Rouse
Microsoft MVP - Terminal Server
http://www.workthin.com

 

[Harry Devine]

Thanks for the reply. In the MMC, would I add the group(s) that I want in
the permissions tab and check Deny for Full Control, User Access, and Guest
Access?

Thanks again,
Harry

 

[Guest]

You can either add groups to which you grant access and give them User &
Guest Permissions and don't add the group that doesn't need access to these
machines, or you can add everyone, and implicitly deny the other group.