Enabling the Remote Desktop for Administration mode on all servers on your network is recommended, especially for servers in remote sites that have no local administrators. To enable the Remote Desktop on the server, access Control Panel, and then double-click System to start the System utility. In the Remote tab, select Allow Users To Connect Remotely To This Computer, as shown in Figure 30-1.

Figure 30-1. Enabling Remote Desktop.

When the warning prompt is displayed, click OK, but keep the following details about using Remote Desktop for Administration in mind:

By default, all members of the Administrators group can log on remotely. The Remote Desktop User group has been added to Windows Server 2003 Active Directory to ease managing Terminal Services users. Members of this group are allowed to log on remotely as well once you enable this in Group Policy.

If you want to add a member to this group, access Control Panel, and then double-click System to start the System utility. In the Remote tab, click Select Remote Users. As shown in Figure 30-2, any current members of the Remote Desktop Users group are listed in the Remote Desktop Users dialog box. To add users or groups to the list, click Add. This opens the Select Users Or Groups dialog box.

Figure 30-2. Configuring Remote Desktop users.

In the Select Users Or Groups dialog box, type the name of a user or group account in the selected or default domain, and then click Check Names. If multiple matches are found, select the name(s) you want to use, and then click OK. If no matches are found, you've either entered an incorrect name part or you're working with an incorrect location. Modify the name and try again, or click Locations to select a new location. To add additional users or groups, type a semicolon (;), and then repeat this process. When you click OK, the users and groups are added to the list in the Remote Desktop Users dialog box.

Once you add users to the Remote Desktop Users group, you will need to explicitly allow members of this group to log on. Typically, you will want to do this through local policy on a per-machine basis. You can also do this through site, domain, and organizational policy. Access the appropriate Group Policy object and select Computer Configuration, Windows Settings, Security Settings, Local Policies, and User Rights Assignments. Double-click Allow Log On Through Terminal Services. In the policy Properties dialog box, select Define These Policy Settings, and then click Add User Or Group. In the Add User Or Group dialog box, click Browse. This displays the Select Users, Computers, or Groups dialog box, type Remote Desktop Users, and then click OK. You can add other groups as well if desired.

Inside Out: Restrict remote logon through Group Policy

If you want to restrict users or groups from remotely administering a server, access the appropriate Group Policy object and expand Computer ConfigurationWindows Settings Security SettingsLocal PoliciesUser Rights Assignments. Double-click Deny Log On Through Terminal Services. In the policy Properties dialog box, select Define These Policy Settings, and then click Add User Or Group. In the Add User Or Group dialog box, click Browse. This displays the Select Users, Computers, or Groups dialog box, type the name of the user or group for which you want to deny logon through Terminal Services, and then click OK. You can also change the default permissions for groups in the Terminal Services Configuration tool. For instance, you could remove Administrators from having Full Control of the Terminal Services objects. For more information on the Terminal Services Configuration tool, see the section entitled "Terminal Services Servers".

Remote Desktop for Administration is part of Terminal Services, and you can use Group Policy to configure Terminal Services. Microsoft recommends using Group Policy as the first choice when you are when configuring Terminal Services for use with Remote Desktop for Administration. The precedence hierarchy for Terminal Services configuration is as follows:

You can configure local policy on individual computers or on an organizational unit (OU) in a domain. You can use Group Policy to configure Terminal Services settings per connection, per user, per computer, or for groups of computers in an OU of a domain. The Group Policy settings for Terminal Services are modified using the Group Policy Object Editor and are located in Computer ConfigurationAdministrative TemplatesWindows Components Terminal Services and in User ConfigurationAdministrative TemplatesWindows ComponentsTerminal Services.