.png?width=100&auto=webp&quality=80&disable=upscale "Picture of John Savill")
.png?width=400&auto=webp&quality=80&disable=upscale "John Savill")
Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
How do I remove the additional privileges granted to Terminal services users?
John Savill
July 1, 2000
1 Min Read
A. To allow older programs to work with Terminal servicesadditional privileges are granted however its possible to remove theseadditional permissions.
Windows 2000 provides two additional security templates, notssid.inf anddefltsv.inf are supplied, the first removes the additional permissions and thesecond sets back to the default.
To disable:
Start the command prompt session (cmd.exe)
Move to %systemroot%securitytemplates folder
C:> cd /d %systemroot%securitytemplatesImplement the notssid.inf information file
C:> secedit /configure /db notssid.sb /cfg notssid.inf /verbose
To set back to the default:
Start the command prompt session (cmd.exe)
Move to %systemroot%inf folder
C:> cd /d %systemroot%infImplement the defltsv.inf information file
C:> secedit /configure /cfg defltsv.inf /db defltsv.sb /log defltsv.log /verbose
You can also directly edit the registry to stop users being a member of adynamic, group TERMINAL SERVER USER when connecting via Terminal services tostop them getting the extra permissions:
Start the registry editor (Regedit.exe)
Move to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server
Double click TSUserEnabled
Set to 1 so that all users logging on via Terminal Services are made members of the 'TERMINAL SERVER USER' group or set to 0 so they are not
Click OK
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
