0

On ubuntu I can set up a server to only allow a group of users to log in and allow that group to su and control e.g. a webserver user. Is there a way for me to replicate that flow with Windows, LDAP and remote desktop?

My goal is to have my group of users use their own username and password when RDP-ing instead of knowing that machine's username and password. But allowing them to see and manage one desktop. I guess a VNC like solution with LDAP authentication would work. Though I'm wondering if Windows has support out of the box in Windows8 or 2012.

To clarify - I don't want the users logging in to have their own desktop on that machine. And I don't want a shared user that everyone knows its password. I.e. the shared user would be preferably password-less, or at least the shared user password wouldn't be needed to impersonate it.

6
  • RDP doesn't work like that. It's not just a screen capture of the console (or a session), like VNC would do. Why would multiple users need to see the same desktop anyway? What advantage do you feel that gives you? Aug 26, 2014 at 17:48
  • "see and manage one desktop" at the same time? Or are you basically wanting to set up aliases for a user?
    – Jason
    Aug 26, 2014 at 17:54
  • The advantage is the shared user could have a long running UI process that many people can interact with from time to time (i.e. not at the same time). Aug 26, 2014 at 18:05
  • @ubershmekel as long as they don't have to be on at the same time, create a new user for that long-running UI process, log in as the new user, and launch the process. From there, anyone with the new user's password can log in and view the status as long as it's only one person at a time. Aug 26, 2014 at 19:07
  • @DarthAndroid - knowledge of a password is what I'm trying to avoid. E.g. would you change passwords for every shared user every time a person leaves the team? The idea is to revoke the not-shared user's privileges instead. Aug 26, 2014 at 23:13

1 Answer 1

0

i think you could get something like what you want by using remote desktop to a server. what is possible is to use the terminal servers built in remote control functionality. possibly reconfiguring it so the user being controlled never gets a question if it is ok to remote control.

it might not be exactly what you want but i think it is the closest you can get.

when you are an administrator of a terminal server you are allowed to remote control other connected users. the default setting pops up a question on the user being controlled screen asking if the user want the administrator to be allowed to remote control his session. if the user says yes both can see the same screen.

you can turn off this question, it is configuration option both in the rdp client and also on the rdp connection on the server.

the problem is that you can only remote control connected users, if the session is disconnected your only option is to use the "connect" option instead to take over the session but this requires you to know the password of the user.

i also assume you dont want to give the group of "semi admin" user local admin permission on the server, so most likely you have to modify the security settings on the rdp connection and add another group as full control in addition to the default local admin group.

for the part of setting rdp permissions you might want to take a look at Configure Permissions for Remote Desktop Services Connections

2
  • This is very close to a solution. I actually wouldn't mind the "semi admins" being full on admins of some sort. The ability to potentially revoke admins without changing passwords seems still missing though. Sep 7, 2014 at 20:42
  • to remove the ability of a "semi admin" to access the shared session you would need to revoke the permissions granted that controls their ability of remote controlling other sessions. but this whole "solution" is a bit of a hack and not something i would recomend
    – T J
    Sep 8, 2014 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .