Windows 10: I need to force workstations on my Domain to use Domain CA generated Remote Desktop...

Good day!! I have a question that I have been researching the answer to but have come up empty. Here is my situation:I have a small Domain I manage and I utilize RDP to manage all systems both workstations and servers from my own desk, I have an issue where my Tenable Security scanner log a vulnerability "SSL Self-Signed Certificate 57582" one of the solutions is to use a CA signed certificate instead of the self signed certificate. I have a Domain CA deployed, I have created the certificate template for Remote Desktop services, the CA is naturally in the Trusted Root Certificate Authority s

:)

 

CredSSP error on domain joined workstations

Unable to understand this situation. All workstations without domain are able to take remote sessions without difficulty, While all domain joined workstation throwing error of CredSSP oracle server remediation.

 

Win10 domain workstation, "currently no power options available", tied to group security policy and remote desktop connection

Hello Windows community.

I know there are many threads about the issue of the dreaded "There are currently no power options available." But I haven't found one that fixes my problem.

Initial issue: Windows 10 Pro PC's, connected to a work domain (Windows Server 2012), get the "There are currently no power options available" message when trying to shutdown or restart the PC.

Action taken: Group Policy Editor > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > 'Shut down the system' ... The only way to add the user to the list of users for this policy, is
to log on to the server itself, go into Group Policy Management Editor, delve into the domain controller, find the policy, and add the user there.

Result: After restarting the Win10 Pro workstation, the power options are now available from the start menu. Yay... HOWEVER...

New issue: If I use "remote desktop connection" on the workstation, and connect to the server, the user now has the permission to access restart and shutdown options from the start menu for the server itself... Which is not acceptable. We
can't have people accidentally turning off the server through their remote desktop connection (which is used frequently, in order to access MYOB on the server).

EDIT Question: How can I add "users" to this policy for only the workstations, and not when they are connected to the server through Remote Desktop Connection?

Additional information:

• EDIT: I noticed on
  Technet, that the defaults for the policy is different depending on whether it is for "workstations and servers" or for "Domain Controllers". The "Workstations and servers" policy includes the group "users", whilst the "domain controllers" policy does not.
• Windows 7 Pro PC's, connected to the domain in the exact same way, do not have the issue. All users on Windows 7 PC's are not added to the security policy, they CAN access shut down options for their local PC, but CANNOT access shutdown options for the
  server during a remote desktop connection. This means it is working as intended for Windows 7 Pro PC's.
• The current list of users and groups that are listed in the security policy is as follows:
  • Administrators
  • Backup Operators

Thank you in advance for any help.

Sincerely,

Jeremy

 

Remote Connection to desktop in domain only

Hello,

I am looking for a Windows 10 solution for an admin remoting to a domain user's desktop only from their domain profile on a domain computer.

For context: The use case is I am wanting to give an admin the ability to remote into a user's computer whenever they require immediate assistance (such as admin prompts to install software.) Remote Desktop Connection is not working for this use case, because it signs the end user out. I also looked at the Windows 10 app Quick Assist, but it could potentially allow the admin to access the computer from outside of the scope of the domain (such as on their home computer).

Is there anything that works like Quick Assist or other remote software but can be stripped down to only work between users on the domain?

Thanks!