PDA

View Full Version : terminal server permissions ????????



baller360
10-11-2002, 09:45 AM
Can anybody help me out? Users here on my network are logging on to the terminal server, but when they go to log off they sometimes hit restart, or shutdown, which does just that to the server. I want to change their permissions so that their only option is to log off. Just so there is no confusion, I'm not talking about their local computer. Just their terminal services connection. Any help will be very appreciated.

Thanks,
baller360

Ghost_Hacker
10-11-2002, 01:30 PM
There are only 2 options for "logging off" for a windows 2000 terminal server client (logoff and disconnect). A shutdown of the server from a TS session isn't possible unless the terminal server is running in remote admin mode. In which case only 2 users can have access to the system.

Judging from your other post I would ask you to post more details about your system. What version of TS are you using? How do your users start a terminal server session?

baller360
10-11-2002, 02:01 PM
The user connect to the terminal server through Internet Explorer. They open the TSWEB defalt connection site and hit connect. Then it appears exactly as if they were on their local computer only they're connected to the TS. If they go start, shutdown, logoff, it will take them back t their local desktop. I know you said it doesn't give them the option to shutdown, but it does, I've confirmed it. They have shutdown, restart, logoff (user), and disconnect. Please let me know what you think.

Thanks,
baller360

Ghost_Hacker
10-11-2002, 02:26 PM
I know you said it doesn't give them the option to shutdown, but it does

It depends on what mode your server is in (As I stated in my last post :) )

So the question is "what mode does your TS run in?"

Or to put it another way "how was it installed?"


EDIT Also I would check the group membership of these users. Only Admins should be able to shutdown a server unless this has been changed in the "user rights" of a group policy. ( you might want check "user rights".)

baller360
10-11-2002, 04:07 PM
I apologize, but I'm a beginner. When you say "mode", what modes are there and how do I find out so that I can tell you. I wasn't here when they installed TS. Also, I want to check the users permisions, but I'm not where I can see that. There not in the local users & groups obviously, and these TS's aren't running Active Directary.

Thanks for your help,
baller360

Ghost_Hacker
10-12-2002, 08:45 AM
, I want to check the users permisions, but I'm not where I can see that.


First check thier group memberships, then check the "shut down computer" option of "user rights assignment". This is found in the local security policy under the security settings. (also in your group policy if you where using active directory.)

Remember that in order to shutdown a server you must be part of either the admin,powerusers or backup ops groups. (by default, but this can be changed) The fact that your users can shutdown the server either means they belong to one of these groups or that a new group has been added to the "shut down computer" option.



I wouldn't worry about the TS mode as you would still need to give users administrative access to the server in order for them to be able to shut it down. Anyway,I would like to test if you can shutdown a server from within "app mode" if you have admin access.



Good Luck :)

Ghost_Hacker
10-12-2002, 09:49 AM
Ok, After doing a fresh install of TS. I noticed that the "users" group was added to the "shutdown the system" option of "User rights assignment". (much like a workstation's defaults)


Removing this group should fix your problem.



Good Luck :)

baller360
10-15-2002, 08:48 AM
Thank you very much. I've learned alot from this experience so far. I went and looked at those settings that you said to check and found that none of the users have that right (they're not in any of the groups that do), but my boss has been complaining about people shutting the server down from their workstations. I went to a user to check their options. If they go START, SHUTDOWN, than they only get the LOG OFF, or DISCONNECT as options, but if they hit CTRL-ALT-DELETE, than they get the SHUTDOWN as an option. Do you know if there is any way to take away that option?

Thanks,
Baller360

baller360
10-15-2002, 02:47 PM
Never mind. I found out that even though you have the option to shutdown when you hit control-alt-delete, its only for your local computer (even though your logged onto the terminal server). But thank you very much Ghost-Hacker for all your help, I learned alot from this experience. I look forward to asking you more questions. haha.

Thanks again,
Baller360