RDP server users are default local admins?

Question

so I'm stumbling upon a weird situation. I set up an RDP server so that clients can make their own instances of a desktop. I set up a gateway, web access, licensing, have a session group, etc,... And they are succesful at connecting.

But when they connect, they seem to have rights for local resources like server manager, and everything in windows administrative tools. But when I try to change the pc name, I need to enter an admin user name. I thought things like Windows Adminstrative tools needed admin rights?

What am I doing wrong?

Answer 1

Being able to VIEW Administrative Tools, Server Manager etc doesn't require admin permissions, by default they're visible to any user who's logged into the machine.

It's no different to if you're logged into a regular PC as a non-admin user, there's nothing preventing you accessing those applications. The only difference is that their icons may not be as prominent on a desktop since they're not necessarily part of the default start menu / desktop shortcuts / task bar shortcuts.

Some of those apps don't require admin permissions to run, or limit which functionality you can access without admin permissions. For instance you can launch Computer Management and access the Event Log without admin credentials, but go into Device Manager and it'll (from memory) tell you you're restricted to read-only access as you're not an admin. Other apps will simply deny you access without admin.

You can restrict access to the applications themselves to some degree with things like AppLocker, though it's not always straight forward to find the right combination of rules to lock things down as desired, while maintaining access to the functionality that is needed. I've also seen some discussion of moving / changing the permissions to the various shortcuts so they're no longer visible to non-admin users, though I don't have personal experience of doing that.