Remote Desktop permissions
Backstory
Up until Windows Server 2008 R2 the "Remote Desktop Session Host Configuration" was shipped with the O.S, this has been removed in later versions.
With this application you could delegate certain Remote Desktop permissions on a user or group base.
This was possible by opening the application, right click and select Properties on a connection, then going to the Security-tab, Advanced, selecting a permission, and Edit.
The following permissions are available:
| Permission | Description |
|---|---|
| Query Information | Get information on any session |
| Set Information | ? |
| Remote Control | Shadow any session (behaviour depends on shadow settings) |
| Logon | Logon your session |
| Logoff | Logoff any session |
| Message | Send a message to any session |
| Connect | Take over any session (password still required) |
| Disconnect | Disconnect any session |
| Virtual Channels | Use outside-session features (e.g. clipbord or printer) |
- The Query and Virtual Channels permissions are allowed by default when unchecked.
- Logon also requires the user/group to be added to the Remote Desktop's User Rights Assignment (via Group Policy).
Doing this is still possible, whoever only with WMI commands via scripting.
An easy to use PowerShell menu script will be provided here, but individial commands will also be provided as an example.
You can download the PowerShell menu script at: https://pastebin.com/0w9Vq8aJ
This script must be run as an administrator, open PowerShell as an administrator and execute the script from there.
In this menu you get a clear overview of all the permissions, you can add a new user/group, edit or remove them, or reset all permissions back to default.
Note that deny permissions always overrule allow permissions, and when deleting a user/group it will remove both the allow and deny permissions entries.
Commands
Messaging
You might be interested in giving certain users the right to send messages to other users or the entire farm.
For more information on this please see the article "Remote Desktop messaging".
