Lock employees to RDM

Hi

Do each of them use their own credentials or they use a shared one? If they use a shared credential then you could be the only one that knows it and you would configure an embedded session that they would have to use in order to connect.

I would need to check for another solution if they each use their own...

There's also the possibility of disabling running MSTSC.EXE using a policy. That would force using only embedded sessions.

Hi Maurice,

Thanks for the great information! I've been testing how I could lock down RDP to a specific user via policies. Seems pretty straightforward actually.

1) I created a domain user account that has no administrative permissions what so ever.
2) Added the newly created account into the Local Security Policy to allow access through Remote Desktop (or Remote Desktop Users group).
*By removing the default group "Domain Users" from the user account in AD and specifying a new empty security group as the default group this removes all default "Domain Users" permissions therefore locking down the user entirely and only allowing an RDP session.
3) Setup the technician in the administrators group. This will allow them to elevate into Admin to allow them to do their job.

Seems this combination would not allow the technicians account to RDP into the server but once they are RDP'd into the server they can elevate as admin. I actually see quite a bit of benefit in this although I can also see this being tedious.

I'll need to play with this some more to see how it really works out. There's just such a nice benefit to having the RDP logging.

I'm curious about locking down MSTSC via a policy but then they could simply use a separate computer. We have our RDM configured to use an SSL certificate for the connection. If the SSL cert is not installed on the client computer, then they are unable to connect to the RDM database.

This combination will help keep RDP sessions isolated to certain computers.

Ryan
edited by ryaninco on 4/8/2014

thanks for sharing

For the RDPing from other computers, you could allow port 3389 only from specific computers, we often do that for web environments.