group-policyvbscriptwindowswindows-command-promptwindows-server-2008
I'm looking for a way to disable Remote Desktop login for Windows 2008 for a specific user (a local administrator account), either using the command line or a script (such as VBS) in Windows 2008.
I understand I need to modify the local security policy, however, I have not found a way to perform this via either cmd or a script-based solution.
Anyone have any recommendations to how to solve this?
Best Regards
Anders L.
Seconding/mirroring FoxInSocks' answer, you can change this in the Local Security Policy (secpol.msc).
From the left-hand "Security Settings > Local Policies > Security Options" tree option, change the setting named "Interactive logon: Do not display last username" to Enabled.
If you want to apply this to all servers in your domain, login to your DC and open the Group Policy Editor, either by opening Active Directory Users and Computers, right-clicking the domain node, choosing Properties, then the Group Policy tab and clicking the Edit button; or opening Group Policy Management, right-clicking the Default Domain Security Policy entry and choosing Edit.
With the Group Policy Editor open, navigate to the left-hand "Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options" tree option and change the setting named "Interactive logon: Do not display last username" to Enabled.
HTH
J.
Best Answer
To disable remote desktop from windows command line run the below command as administrator:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
To enable remote desktop from windows command line run the following command as administrator:
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f