Remote Desktop permissions - Revision history

Dan at 18:05, 18 June 2020

2020-06-18T18:05:03Z

Dan at 12:02, 17 June 2020

2020-06-17T12:02:58Z

Dan at 11:33, 17 June 2020

2020-06-17T11:33:36Z

Dan: Created page with " ===Backstory=== Remote Desktop Session Host Configuration's security settings example Up until Windows Server 2008 R2 the "Remote Des..."

2020-06-17T11:29:09Z

Created page with " ===Backstory=== thumb|right|Remote Desktop Session Host Configuration's security settings example Up until Windows Server 2008 R2 the "Remote Des..."

New page

===Backstory===
[[File:RDPermissions-1.png|thumb|right|Remote Desktop Session Host Configuration's security settings example]]
Up until Windows Server 2008 R2 the "Remote Desktop Session Host Configuration" was shipped with the O.S, this has been removed in later versions. 
With this application you could delegate certain Remote Desktop permissions on a user or group base. 
This was possible by opening the application, right click and select Properties on a connection, then going to the Security-tab, Advanced, selecting a permission, and Edit. 

The following permissions are available:
{| class="wikitable"
|-
! Permission !! Description
|-
| Query Information || Get information on any session
|-
| Set Information || ?
|-
| Remote Control || Shadow any session (behaviour depends on shadow settings)
|-
| Logon || Logon your session
|-
| Logoff || Logoff any session
|-
| Message || Send a message to any session
|-
| Connect || Take over any session (password still required)
|-
| Disconnect || Disconnect any session
|-
| Virtual Channels || Use outside-session features (e.g. clipbord or printer)
|}

* The Query and Virtual Channels permissions are allowed by default when unchecked.
* Logon also requires the user/group to be added to the Remote Desktop's User Rights Assignment (via Group Policy).

Doing this is still possible with WMI commands via scripting. 
An easy to use PowerShell menu script will be provided here, but individial commands will also be provided as an example.

@@ Line 9: / Line 9: @@
 {| class="wikitable"
 |-
-! Permission !! Description
+! ID !! Permission !! Description
 |-
-| Query Information || Get information on any session
+| 0 || Query Information || Get information on any session
 |-
-| Set Information || ?
+| 1 || Set Information || ?
 |-
-| Remote Control || Shadow any session (behaviour depends on shadow settings)
+| 4 || Remote Control || Shadow any session (behaviour depends on shadow settings)
 |-
-| Logon	|| Logon your session
+| 5 || Logon || Logon your session
 |-
-| Logoff || Logoff any session
+| 2 || Logoff || Logoff any session
 |-
-| Message || Send a message to any session
+| 7 || Message || Send a message to any session
 |-
-| Connect || Take over any session (password still required)
+| 8 || Connect || Take over any session (password still required)
 |-
-| Disconnect || Disconnect any session
+| 9 || Disconnect || Disconnect any session
 |-
-| Virtual Channels || Use outside-session features (e.g. clipbord or printer)
+| 3 || Virtual Channels || Use outside-session features (e.g. clipbord or printer)
 |}
@@ Line 46: / Line 46: @@
 =Commands=
 =Messaging=
 You might be interested in giving certain users the right to send messages to other users or the entire farm.<br>
 For more information on this please see the article "[[Remote Desktop messaging]]".<br>

@@ Line 34: / Line 34: @@
-Doing this is still possible with WMI commands via scripting.<br>
+Doing this is still possible, whoever only with WMI commands via scripting.<br>
 An easy to use PowerShell menu script will be provided here, but individial commands will also be provided as an example.<br>
 =PowerShell menu=
 =Commands=

@@ Line 1: / Line 1: @@
-===Backstory===
+=Backstory=
 [[File:RDPermissions-1.png|thumb|right|Remote Desktop Session Host Configuration's security settings example]]
 Up until Windows Server 2008 R2 the "Remote Desktop Session Host Configuration" was shipped with the O.S, this has been removed in later versions.<br>
@@ Line 36: / Line 36: @@
 Doing this is still possible with WMI commands via scripting.<br>
 An easy to use PowerShell menu script will be provided here, but individial commands will also be provided as an example.<br>