Do not allow local administrators to customize permissions
This policy setting specifies whether to disable the administrator rights to customize security permissions for the Remote Desktop Session Host server. You can use this setting to prevent administrators from making changes to the user groups allowed to connect remotely to the RD Session Host server. By default, administrators are able to make such changes. If you enable this policy setting the default security descriptors for existing groups on the RD Session Host server cannot be changed. All the security descriptors are read-only. If you disable or do not configure this policy setting, server administrators have full read/write permissions to the user security descriptors by using the Remote Desktop Session WMI Provider. Note: The preferred method of managing user access is by adding a user to the Remote Desktop Users group.
Policy Details
- Policy Name
- TS_TSCC_PERMISSIONS_POLICY
- Registry Key
- SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
- Value Name
- fWritableTSCCPermTab
- Supported On
- At least Windows Server 2003
- OMA-URI (CSP)
- ADMX_TerminalServer/TS_TSCC_PERMISSIONS_POLICYOS Build Version:10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202CSP Version:10.0Conflict Resolution:LastWriteAllowed Editions:EnterpriseEnterprise NProfessionalProfessional NEnterprise EvaluationEnterprise N EvaluationEducationEducation NEnterprise SEnterprise S NEnterprise S EvaluationEnterprise S N EvaluationHolographic BusinessPro Single LanguagePro ChinaPro WorkstationPro Workstation NPro For EducationPro For Education NEnterprisegEnterprisegnServerrdshIotenterpriseIotenterprisesCloudeditionnCloudeditionIotenterpriseskIotenterpriseseval
- Policy State Values
- Enabled: 0Disabled: 1
- Available Languages
- en-us