Prevent Power Users from rebooting terminal server

  • Thread starter Thread starter Brian
  • Start date Start date
B

Brian

Guest
Windows 2003 TS.
Has QuickBooks on it, which requires Power Users membership in order to
function correctly (well, maybe not, but that is what Intuit claims, and it
is likely easier to get an answer to my question here than get any info the
actual rights required from Intuit - it's much easier for them just to say
the user must be a member of Power Users in order to run QB).

So...I need to prevent Power Users from rebooting the server.

How?
 
Re: Prevent Power Users from rebooting terminal server

Brian <Brian@discussions.microsoft.com> wrote:
> Windows 2003 TS.
> Has QuickBooks on it, which requires Power Users membership in order
> to function correctly (well, maybe not, but that is what Intuit
> claims,

Yes, sigh.

> and it is likely easier to get an answer to my question here
> than get any info the actual rights required from Intuit

Have you tried?

> - it's much
> easier for them just to say the user must be a member of Power Users
> in order to run QB).

Correct, but

a) you should still holler at them - it's sloppy code
and
b) you may be able to work around it anyway.

http://msmvps.com/blogs/bradley/archive/2005/04/23/how-to-run-quickbooks-under-user-mode.aspx

....and a lot of Google hits. Much depends on your version of Quickbooks,
which you haven't mentioned....

http://www.google.com/search?hl=en&...er"+permissions+"terminal+server"&btnG=Search



>
> So...I need to prevent Power Users from rebooting the server.
>
> How?

Group policy or local policy - but honestly, this is only one of *myriad*
Bad Things a power user could inadvertently (or advertently) do, and you'll
always be chasing your tail here. A power user is pretty nearly a
full-fledged administrator. Since this is a TS box and not someone's
individual workstation, you're running with scissors if you give them more
rights than they should have.

Another tool that may help you - Process Monitor from Sysinternals (now MS)
http://www.microsoft.com/technet/sysinternals/utilities/processmonitor.mspx
 
Re: Prevent Power Users from rebooting terminal server

Hi,

Please take a look at the instructions Vera has on her site. If
you are unable to get it working with those, let me know.

You do *not* need to make normal users a member of the
Power Users group in order to run QuickBooks.

http://ts.veranoest.net/ts_apps_qb.htm

I use a different technique that is more complicated which uses
per-user class registration entries.

-TP

Brian wrote:
> Windows 2003 TS.
> Has QuickBooks on it, which requires Power Users membership in order
> to function correctly (well, maybe not, but that is what Intuit
> claims, and it is likely easier to get an answer to my question here
> than get any info the actual rights required from Intuit - it's much
> easier for them just to say the user must be a member of Power Users
> in order to run QB).
>
> So...I need to prevent Power Users from rebooting the server.
>
> How?
 
Re: Prevent Power Users from rebooting terminal server

Hi,

I didn't know that Vera is a woman :-) , I was thinking she was a guy, that's cool, there are not too much woman high tech like her
(in public forums or on the web) .

Have a nice weekend all

Thomas
"TP" <tperson.knowspamn@mailandnews.com> wrote in message news:OzAnf$F$HHA.3780@TK2MSFTNGP06.phx.gbl...
Hi,

Please take a look at the instructions Vera has on her site. If
you are unable to get it working with those, let me know.

You do *not* need to make normal users a member of the
Power Users group in order to run QuickBooks.

http://ts.veranoest.net/ts_apps_qb.htm

I use a different technique that is more complicated which uses
per-user class registration entries.

-TP

Brian wrote:
> Windows 2003 TS.
> Has QuickBooks on it, which requires Power Users membership in order
> to function correctly (well, maybe not, but that is what Intuit
> claims, and it is likely easier to get an answer to my question here
> than get any info the actual rights required from Intuit - it's much
> easier for them just to say the user must be a member of Power Users
> in order to run QB).
>
> So...I need to prevent Power Users from rebooting the server.
>
> How?
 
RE: Prevent Power Users from rebooting terminal server

If you put the TS in its own OU then create a GPO linked to this OU. Then on
the GPO go to Computer Settings / Windows Settings / Local Policies / User
Rights Assignment and then under "Shut down the System" Enter the account for
Domain\Administrator or any other Admin user that you would like to have
these rights. This will prevent users accidentially shutting the Server down.

I do this as part of a standard TS lockdown strategy.


"Brian" wrote:

> Windows 2003 TS.
> Has QuickBooks on it, which requires Power Users membership in order to
> function correctly (well, maybe not, but that is what Intuit claims, and it
> is likely easier to get an answer to my question here than get any info the
> actual rights required from Intuit - it's much easier for them just to say
> the user must be a member of Power Users in order to run QB).
>
> So...I need to prevent Power Users from rebooting the server.
>
> How?
 
Re: Prevent Power Users from rebooting terminal server

LOL!
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"ThomasT." <ThomasT@nospam.nospam> wrote on 21 sep 2007 in
microsoft.public.windows.terminal_services:

> Hi,
>
> I didn't know that Vera is a woman :-) , I was thinking she was
> a guy, that's cool, there are not too much woman high tech like
> her (in public forums or on the web) .
>
> Have a nice weekend all
>
> Thomas
> "TP" <tperson.knowspamn@mailandnews.com> wrote in message
> news:OzAnf$F$HHA.3780@TK2MSFTNGP06.phx.gbl... Hi,
>
> Please take a look at the instructions Vera has on her site.
> If you are unable to get it working with those, let me know.
>
> You do *not* need to make normal users a member of the
> Power Users group in order to run QuickBooks.
>
> http://ts.veranoest.net/ts_apps_qb.htm
>
> I use a different technique that is more complicated which
> uses per-user class registration entries.
>
> -TP
>
> Brian wrote:
> > Windows 2003 TS.
> > Has QuickBooks on it, which requires Power Users membership
> > in order to function correctly (well, maybe not, but that is
> > what Intuit claims, and it is likely easier to get an answer
> > to my question here than get any info the actual rights
> > required from Intuit - it's much easier for them just to say
> > the user must be a member of Power Users in order to run QB).
> >
> > So...I need to prevent Power Users from rebooting the server.
> >
> > How?
 
RE: Prevent Power Users from rebooting terminal server

What we usually do is remove Domain Admins from the local administrators
group, and add a different group that is responsible for maintaining the
Terminal Servers. Users should NEVER be members of the Power Users or
Administrators groups, as there is always a way to tweak certain registry or
file system permissions to accomodate a specific application.

--
Patrick C. Rouse
Microsoft MVP - Terminal Server
Provision Networks VIP
Citrix Technology Professional
President - Session Computing Solutions, LLC
http://www.sessioncomputing.com



"Johan Strange" wrote:

> If you put the TS in its own OU then create a GPO linked to this OU. Then on
> the GPO go to Computer Settings / Windows Settings / Local Policies / User
> Rights Assignment and then under "Shut down the System" Enter the account for
> Domain\Administrator or any other Admin user that you would like to have
> these rights. This will prevent users accidentially shutting the Server down.
>
> I do this as part of a standard TS lockdown strategy.
>
>
> "Brian" wrote:
>
> > Windows 2003 TS.
> > Has QuickBooks on it, which requires Power Users membership in order to
> > function correctly (well, maybe not, but that is what Intuit claims, and it
> > is likely easier to get an answer to my question here than get any info the
> > actual rights required from Intuit - it's much easier for them just to say
> > the user must be a member of Power Users in order to run QB).
> >
> > So...I need to prevent Power Users from rebooting the server.
> >
> > How?
 
Back
Top