Windows Server

Arild Bakken · Guest

Hi,

I work for a company that runs a terminal server environment in a shared
hosting environment. We have many customers and many of these share servers.
For a long time we've been running on Windows 2000 but lately we've been
adding Windows 2003 servers to our environment. This poses a problem for us
as the "Task Manager" in windows 2003 has a "Users" tab that displays a list
of users connected to the server. Since the users connected may be from
different customers we do not want them to "see" each other. For regular
users this is not a problem as they only see one user in the list,
themselves, but certain users at the customers need the ability to do a
"Remote control" / "Shadow" of their own users in order to help them out
with simple stuff. In order to do that they need more rights on the RDP /
ICA protocols in Terminal Services than just the "Logon" privilege.

One thing they need in order to shadow users is to see who is logged on a
server, and so we give them the "Query Information" privilege, and giving
them that enables them to see all logged on users through "Task Manager /
Users" regardless of which customer the user belongs to. Now, since Terminal
Services does not allow for a more finegrained permissionset we only see the
following options:

1. Find a way to remove the "Users" tab from Task Manager.

2. Disable Task Manager using GPO and write our own tool like Task Manager
so that the users can end their tasks when processes hang.

Now, of course we'd like to stick with the built-in Task Manager as it's
hooked up with the windows system keys (Ctrl-Alt-Del and Ctrl-F1 in Citrix)
so option 2 really isn't a good option.

Any tips on option 1, or any other helpful tips are very welcome.

Regards,

Arild Bakken

	Windows Server Forum Index -> Security	All times are GMT
Page 1 of 1