Prevent member of administrator group loging in via Remote Desktop
- by Chris J
In order to support some build processes on our Server 2003 development servers, we require a common user account that has administrative privs.
Unfortuantly, this also means that anyone that knows the password can also gain admin privs on a server. Assume that trying to keep the password secret is a failed exercise. Developers that need admin privs already have admin privs so should be able to log in as themselves.
So the question is a simple one: is there anything I can configure to prevent people (ab)using the account to gain administrator on servers they shouldn't have administrator on? I'm aware that devs could disable anything that is put in place, but that's then down to process and auditing to track and manage.
I don't mind where or how: it can be via the local security policy, group policy, a batch file executed in the user's profile, or something else.
