Prevent Power Users from rebooting terminal server

[Guest Brian]

Windows 2003 TS.

Has QuickBooks on it, which requires Power Users membership in order to

function correctly (well, maybe not, but that is what Intuit claims, and it

is likely easier to get an answer to my question here than get any info the

actual rights required from Intuit - it's much easier for them just to say

the user must be a member of Power Users in order to run QB).

 

So...I need to prevent Power Users from rebooting the server.

 

How?

[Guest Lanwench [MVP - Exchange]]

Re: Prevent Power Users from rebooting terminal server

 

Brian <Brian@discussions.microsoft.com> wrote:

> Windows 2003 TS.

> Has QuickBooks on it, which requires Power Users membership in order

> to function correctly (well, maybe not, but that is what Intuit

> claims,

 

Yes, sigh.

> and it is likely easier to get an answer to my question here

> than get any info the actual rights required from Intuit

 

Have you tried?

> - it's much

> easier for them just to say the user must be a member of Power Users

> in order to run QB).

 

Correct, but

 

a) you should still holler at them - it's sloppy code

and

b) you may be able to work around it anyway.

 

http://msmvps.com/blogs/bradley/archive/2005/04/23/how-to-run-quickbooks-under-user-mode.aspx

 

....and a lot of Google hits. Much depends on your version of Quickbooks,

which you haven't mentioned....

 

http://www.google.com/search?hl=en&rlz=1B3GGGL_enUS212US212&q=Quickbooks+%22limited+user%22+permissions+%22terminal+server%22&btnG=Search

 

 

>

> So...I need to prevent Power Users from rebooting the server.

>

> How?

 

Group policy or local policy - but honestly, this is only one of *myriad*

Bad Things a power user could inadvertently (or advertently) do, and you'll

always be chasing your tail here. A power user is pretty nearly a

full-fledged administrator. Since this is a TS box and not someone's

individual workstation, you're running with scissors if you give them more

rights than they should have.

 

Another tool that may help you - Process Monitor from Sysinternals (now MS)

http://www.microsoft.com/technet/sysinternals/utilities/processmonitor.mspx

[Guest TP]

Re: Prevent Power Users from rebooting terminal server

 

Hi,

 

Please take a look at the instructions Vera has on her site. If

you are unable to get it working with those, let me know.

 

You do *not* need to make normal users a member of the

Power Users group in order to run QuickBooks.

 

http://ts.veranoest.net/ts_apps_qb.htm

 

I use a different technique that is more complicated which uses

per-user class registration entries.

 

-TP

 

Brian wrote:

> Windows 2003 TS.

> Has QuickBooks on it, which requires Power Users membership in order

> to function correctly (well, maybe not, but that is what Intuit

> claims, and it is likely easier to get an answer to my question here

> than get any info the actual rights required from Intuit - it's much

> easier for them just to say the user must be a member of Power Users

> in order to run QB).

>

> So...I need to prevent Power Users from rebooting the server.

>

> How?

[Guest ThomasT.]

Re: Prevent Power Users from rebooting terminal server

 

Hi,

 

I didn't know that Vera is a woman :-) , I was thinking she was a guy, that's cool, there are not too much woman high tech like her

(in public forums or on the web) .

 

Have a nice weekend all

 

Thomas

"TP" <tperson.knowspamn@mailandnews.com> wrote in message news:OzAnf$F$HHA.3780@TK2MSFTNGP06.phx.gbl...

Hi,

 

Please take a look at the instructions Vera has on her site. If

you are unable to get it working with those, let me know.

 

You do *not* need to make normal users a member of the

Power Users group in order to run QuickBooks.

 

http://ts.veranoest.net/ts_apps_qb.htm

 

I use a different technique that is more complicated which uses

per-user class registration entries.

 

-TP

 

Brian wrote:

> Windows 2003 TS.

> Has QuickBooks on it, which requires Power Users membership in order

> to function correctly (well, maybe not, but that is what Intuit

> claims, and it is likely easier to get an answer to my question here

> than get any info the actual rights required from Intuit - it's much

> easier for them just to say the user must be a member of Power Users

> in order to run QB).

>

> So...I need to prevent Power Users from rebooting the server.

>

> How?

[Guest Johan Strange]

RE: Prevent Power Users from rebooting terminal server

 

If you put the TS in its own OU then create a GPO linked to this OU. Then on

the GPO go to Computer Settings / Windows Settings / Local Policies / User

Rights Assignment and then under "Shut down the System" Enter the account for

Domain\Administrator or any other Admin user that you would like to have

these rights. This will prevent users accidentially shutting the Server down.

 

I do this as part of a standard TS lockdown strategy.

 

 

"Brian" wrote:

> Windows 2003 TS.

> Has QuickBooks on it, which requires Power Users membership in order to

> function correctly (well, maybe not, but that is what Intuit claims, and it

> is likely easier to get an answer to my question here than get any info the

> actual rights required from Intuit - it's much easier for them just to say

> the user must be a member of Power Users in order to run QB).

>

> So...I need to prevent Power Users from rebooting the server.

>

> How?

[Guest Vera Noest [MVP]]

Re: Prevent Power Users from rebooting terminal server

 

LOL!

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___

 

"ThomasT." <ThomasT@nospam.nospam> wrote on 21 sep 2007 in

microsoft.public.windows.terminal_services:

> Hi,

>

> I didn't know that Vera is a woman :-) , I was thinking she was

> a guy, that's cool, there are not too much woman high tech like

> her (in public forums or on the web) .

>

> Have a nice weekend all

>

> Thomas

> "TP" <tperson.knowspamn@mailandnews.com> wrote in message

> news:OzAnf$F$HHA.3780@TK2MSFTNGP06.phx.gbl... Hi,

>

> Please take a look at the instructions Vera has on her site.

> If you are unable to get it working with those, let me know.

>

> You do *not* need to make normal users a member of the

> Power Users group in order to run QuickBooks.

>

> http://ts.veranoest.net/ts_apps_qb.htm

>

> I use a different technique that is more complicated which

> uses per-user class registration entries.

>

> -TP

>

> Brian wrote:

> > Windows 2003 TS.

> > Has QuickBooks on it, which requires Power Users membership

> > in order to function correctly (well, maybe not, but that is

> > what Intuit claims, and it is likely easier to get an answer

> > to my question here than get any info the actual rights

> > required from Intuit - it's much easier for them just to say

> > the user must be a member of Power Users in order to run QB).

> >

> > So...I need to prevent Power Users from rebooting the server.

> >

> > How?

[Guest Patrick Rouse]

RE: Prevent Power Users from rebooting terminal server

 

What we usually do is remove Domain Admins from the local administrators

group, and add a different group that is responsible for maintaining the

Terminal Servers. Users should NEVER be members of the Power Users or

Administrators groups, as there is always a way to tweak certain registry or

file system permissions to accomodate a specific application.

 

--

Patrick C. Rouse

Microsoft MVP - Terminal Server

Provision Networks VIP

Citrix Technology Professional

President - Session Computing Solutions, LLC

http://www.sessioncomputing.com

 

 

 

"Johan Strange" wrote:

> If you put the TS in its own OU then create a GPO linked to this OU. Then on

> the GPO go to Computer Settings / Windows Settings / Local Policies / User

> Rights Assignment and then under "Shut down the System" Enter the account for

> Domain\Administrator or any other Admin user that you would like to have

> these rights. This will prevent users accidentially shutting the Server down.

>

> I do this as part of a standard TS lockdown strategy.

>

>

> "Brian" wrote:

>

> > Windows 2003 TS.

> > Has QuickBooks on it, which requires Power Users membership in order to

> > function correctly (well, maybe not, but that is what Intuit claims, and it

> > is likely easier to get an answer to my question here than get any info the

> > actual rights required from Intuit - it's much easier for them just to say

> > the user must be a member of Power Users in order to run QB).

> >

> > So...I need to prevent Power Users from rebooting the server.

> >

> > How?