Terminal Services – Giving users rights to log off other users

A customer today asked me whether it was possible to give a (who was not an Administrator) permission to send messages and log other users off a Terminal Services Server, without giving them full administrative rights.

To achieve this within an Active Directory environment (and in this case with a Windows 2003 Terminal Server, although it should work on earlier versions too) first create a new Security Group (imaginatively called "TerminalServicesAdmins" in this case) within the Active Directory Users and Computers Snap-In. Then add the user or users who you want to have the enhanced privileges to this group.

Next, open Terminal Services Configuration MMC. Select your RDP connection and right click it – then select Properties. Move to the Permissions tab and select your new Security Group.

Click Advanced to show more detailed Permissions. Select your new Security Group again and click Edit.

Finally give your group the additional "Logoff", "Message" and "Disconnect" rights as shown in the screenshot here.

Be aware that these new permissions only take hold once the currently logged on users log off and back on – that includes users not being given any new rights, but who are trying to be logged off by the new demi-Administrators!

There’s a good overview of RDP Permissions at Microsoft’s Help and Support Site here.


0 Responses to “Terminal Services – Giving users rights to log off other users”

  1. Leave a Comment

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


Tubblog on Twitter

Error: Twitter did not respond. Please wait a few minutes and refresh this page.


Enter your email address to subscribe to Tubblog and receive notifications of new posts by email.

Join 48 other followers

Microsoft Small Business Specialist Logo
Computer Weekly Blog Awards 2010 Logo
MSP Mentor 250 Logo
SMB 150 List Logo
International Association of Microsoft Channel Partners Logo
MyFreeCopyright.com Registered & Protected

%d bloggers like this: