Disable administrators group?

[spud]

I have a bunch of machines that are not part of a domain and only use local security.

Is there any way to only use the MS Logon I groups that I specify, but not allow the Administrators group to have access?

[bevtech]

you should be able to limit uvnc by username using the mslogon authenication..

But for uvnc to function as a service you need to have admin rights.


You could try application mode just not sure how the mslogon will like that..

[spud]

The problem is not what rights it takes to run the VNC server service, the problem is the fact that any user who has a local account on these machines can also remote to those machines. This is because all the users who have accounts on these machines are in the "administrator" group. I am trying to limit who can use VNC to remote control to these machines, but the default install seems to always allow the "administrator" group full access. Changing the groups in the "configure MS Logon Groups" screen doesn't change the default "administrator" group's rights to do remote control to a machine.

[bevtech]

hmm how about this??

ou can limit ips with Authost this may be an option


[post=17374][/post]

Limit by subnet..Just an idea but mslogon should be able to use any account for authenication. Cant you just create an account with restricted access??


I personally only use classical authenication with complex 8 char passwords along with the dsm plugins.. that way you could always have different passwords for UVNC on different servers..

[spud]

Limiting by IP address won't work because we use DHCP. There are a number of techs who would need to use UVNC to support our users and these techs all would have DHCP addresses.

The problem is I need to be sure that no other people in our environment can remote to these machines. I was really hoping there was a way to only allow a specific "remote-access" group in the MS Login I screen and not have to worry about all the "administrators" group having access.

[bevtech]

Try Mslogon II should let you specify user groups or if nothing else a user account