Limiting access Windows 2000 Domain

robbo007 · Post by **robbo007** » 2006-05-26 07:38

Hello,

Is there an easy way to limit connections that only the Administrator or Domain Admins Group on a Windows 2000 domain can connect?

I have Ultra VNC installed on my Windows 2000 server and under "Configure MS Logon Groups" I only have the domain adminsitrators group added but when I connect with a normal user it allows access??

I only want the domain administrator account to be able to remotely connect.

The only way at present is to create a group include all the normal domain users and deny access. Is there a better way?

Rob

Marscha · Post by **Marscha** » 2006-05-26 11:33

which version of UltraVNC do you use?
Do you use MS-Logon I or II ("new" mslogon)?

At least with MS-Logon II it should work to just have the group Domain Admins added.
There's no need to explicitly deny access.

robbo007 · Post by **robbo007** » 2006-05-26 13:40

Hey,

I use version 1.0.1 Release. I only have the "mydomain\Administrators" group added. But every domain user can authenticate and connect???

Is there something wrong?

Rob

Marscha · Post by **Marscha** » 2006-05-26 16:40

do you use MS-Logon I or II?

I think there is no "Administrators" group in a domain, they are called "Domain Administrators" or something like that.

robbo007 · Post by **robbo007** » 2006-05-29 06:34

Hiya,

MS Logon II.

I think I have found a security bug.

The default group for MS-Logon II is the local "Administrator" group for the machine where you install.

If you *don't* change this any normal domain user can authenticate and connect.

If you change this to the "domain admin" domain group only the administrator of the domain can connect.

The user normal user I am testing is a normal domain user no admin rights. The local "Administrator" group is on a server and the only user/group with access is the "Domain Admins" group.

Can anyone else confirm this?

Regards,

Rob

bilbus · Post by **bilbus** » 2006-06-18 22:49

There are a few groups in domains

"administrators"
"Domain admins"
"enterprise admins"
"schema admins"

Marscha · Post by **Marscha** » 2006-06-19 07:18

Hmm,

MS-Logon II does not have any pre-configured access group.
If you select MS-Logon II and do no further config, nobody can access this VNC server.

BTW, a normal domain user is not automatically member of the local Administrators group.

Zythan · Post by **Zythan** » 2006-07-13 23:01

Hello,

I have just gone over my setup (W2K domain with AD) and only the admins of the domain can connect.

You might have a problem with the user groups in the domain.

Regards

Zythan

Limiting access Windows 2000 Domain

Limiting access Windows 2000 Domain

Re: Limiting access Windows 2000 Domain