有问题的服务器正在运行带有远程桌面会话主机和基于会话的RD集合的Windows Server 2012 R2.允许的用户组不包含域管理员用户,但他仍能以某种方式登录.
谢谢.
http://support.microsoft.com/kb/2258492
To deny a user or a group logon via RDP,explicitly set the “Deny
logon through Remote Desktop Services” privilege. To do this access a
group policy editor (either local to the server or from a OU) and set
this privilege:
Start | Run | Gpedit.msc if editing the local policy or chose the appropriate policy and edit it.
Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment.
Find and double click “Deny logon through Remote Desktop Services”
Add the user and / or the group that you would like to dny access.
Click ok.
Either run gpupdate /force /target:computer or wait for the next policy refresh for this setting to take effect.
