Re: Log Off, Disconnect, but no Shutdown
The appropriate way to assign GPO settings to users "only" when they logon to
a Terminal Server is as follows:
1. Create an OU to contain a set of Terminal Servers
2. Block Policy Inheritance on the OU (Properties -> Group Policy). This
prevents settings from higher-up in AD from affecting your Terminal Servers.
3. Move the Terminal Server Computer Objects into the OU. Do NOT place User
Accounts in this OU.
3. Create an Active Directory Security Group called “Terminal Servers” (or
something similar that you’ll recognize) and add the Terminal Servers from
this OU to this group.
5. Create a GPO called “TS Machine Policy” linked to the OU
6. Check “Disable User Configuration settings” on the GPO
7. Enable Loopback Policy Processing in the GPO
8. Edit the Security of the Policy so Apply Policy is set for
“Authenticated Users” and the Security Group containing the Terminal Servers
9. Create additional GPOs linked to this OU for each user population, i.e.
“TS Users”, “TS Administrators”.
10. Check “Disable Computer Configuration settings” on these GPO
11. Edit the Security on these User Configuration GPOs so Apply Policy is
enabled for the target user population, and Deny Apply Policy is enabled for
user to which the policy should not apply.
With GPOs configured this way the Machine Policy applies to everyone that
logs on to the Terminal Server (only the Computer Configuration Settings of
the Machine Policy are processed) in addition to the appropriate User
Configuration GPO (only the User Configuration portion of the GPO is
processed) for the target user population.
--
Patrick C. Rouse
Microsoft MVP - Terminal Server
Systems Consultant
Quest Software, Provision Networks Division
Virtual Client Solutions
http://www.provisionnetworks.com
"Quch_IT" wrote:
> Hi, I'm also looking for removing shutdown option in GPO.
> In my case I would like to have it disabled only if users connection is a
> terminal connection - in interactive logon it must be available to the same
> user.
> Are there any option beside applying it with WMI filter in 2k3/2k8??
>
> --
>
> Quch_IT.
>
> Użytkownik "Patrick Rouse" <PatrickRouse@discussions.microsoft.com> napisał
> w wiadomości news:EDBECA02-F6B2-486E-B90F-7ECC29DFC382@microsoft.com...
> > If you are using 2003 it is located at:
> >
> > User Configuration\Administrative Templates\Start Menu and Taskbar\Remove
> > and prevent access to the Shut Down command
> >
> > This setting removes the Shut Down options from the Start menu and
> > disables
> > the Shut Down button on the Windows Security dialog box, which appears
> > when
> > you press CTRL+ALT+DEL.
> >
> >
> > --
> > Patrick C. Rouse
> > Microsoft MVP - Terminal Server
> > SE, West Coast USA & Canada
> > Quest Software, Provision Networks Division
> > Virtual Client Solutions
> > http://www.provisionnetworks.com
> >
> >
> > "Soo Kuan Teo [MSFT]" wrote:
> >
> >> What is the Windows version of Terminal Services are you running?
> >>
> >>
> >> --
> >> This posting is provided "AS IS" with no warranties, and confers no
> >> rights.
> >>
> >> "JBradshaw" <jbradsha@dphilneas.nnn> wrote in message
> >> news:9aKdnZWQXcpzXTDVnZ2dnUVZ_qfinZ2d@posted.internetamerica...
> >> >A previous admin created a GPO setting that removed the shutdown option
> >> >from the start menu of machines in various OUs.
> >> >
> >> > I am trying to do some testing on a machine using RDP, and for some
> >> > reason, it, also, does not have a shut down option on the start menu.
> >> >
> >> > I need to be able to shutdown via RDP. I have scoured our GPO looking
> >> > for
> >> > where I can add this option. I have move the machine to its own OU and
> >> > verified that User Configuration / Administrative Templates / Start
> >> > Menu
> >> > and Taskbar does NOT have the "Remove and Prevent Shut Down" option
> >> > enabled. I have also used gpedit on the local machine to set this
> >> > option
> >> > to Disabled.
> >> >
> >> > I have rebooted the machine, and I have run gpupdate. But there is
> >> > still
> >> > no shut down option on my start menu.
> >> >
> >> > What am I missing?! Thanks.
> >> >
> >>
> >>
>