Access to Remote Desktop in Windows Server without RDS CAL’s

Why are you singling out Remote Desktop? Why not include VNC, GoToMyPC and so on?

There is no fool-proof way to do this really. If you make the effort to block as much as possible you are going to have to do a lot of work.

You can setup your firewall to block everything except what you explicatively permit and then allow only the things you control. Give your administrators some way to temporarily open holes or vpn around the firewall. You cannot simply block the common port for your users since users could simply setup a VPN/Tunnel of some sort.

Or you can use a tool to build a whitelist of all the allowed application on your machines and block everything else.

Verify that it actually rebooted - if you can do a "net use" against the remote server, then connect to Event Viewer to see if it actually did reboot. I've seen plenty of Win2k3 servers that, when rebooted from an RDP session, don't actually reboot but stop responding to RDP. If that's the case, you can do a shutdown /i against the server or use some other out-of-band method of actually executing the reboot.

And if this is the case, in the future, don't reboot from a regular RDP session. Reboot only from the /console or /admin connection, or use shutdown /i, or other remote methods.