294-Do not allow local administrators to customize permissions

Computer/User Node :

   MACHINE

Policy Path :

   Administrative Templates\Windows Components\Terminal Services

Supported on :

   At least Microsoft Windows XP Terminal Services

Help/Explain Text :

   Specifies whether to disable the administrator rights to customize security permissions in the Terminal Services Configuration tool (tscc.msc). You can use this setting to prevent administrators from making changes to the security descriptors for user groups in the TSCC Permissions tab. By default, administrators are able to make such changes. If the status is set to Enabled, the TSCC Permissions tab cannot be used to customize per-connection security descriptors or to change the default security descriptors for an existing group. All of the security descriptors are Read Only. If the status is set to Disabled or Not Configured, server administrators have full Read/Write privileges to the user security descriptors in the TSCC Permissions tab. Note: The preferred method of managing user access is by adding a user to the Remote Desktop Users group.

Registry Settings :

  HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services!fWritableTSCCPermTab