What's the frequency of the letter "a" in:
Q: Stop users logging into Terminal Server via internet Currently we have a SBS Server, and a Terminal Server (both 2008R2) where users locally and remotely login to the Terminal Server, and work.
We need to restrict the ability to login remotely to only a few users.
Is there a way to restrict this? we have previously seen (in another organization) "the requested session access is denied" when a user tries to log on remotely when they do now have the access.
Does anyone know of the way to re-create this?
A TS Gateway and changing the RDP ports unfortunately aren't an option in this instance.
Thanks,

A: Close the RDP ports on your firswall and have those few users that need it connect through a VPN.
With the number of bots hammering at RDP servers these days I get nervous exposing it to the internet in the first place.  Even if all your users have great passwords attackers can still flood logs or trigger lockout policies. So this also removes come security concerns at the same time.  Putting it behind a TS gateway or VPN helps.

A: Due to your budget, make a firewall rule on your router to allow only the 3389 traffic coming from the WAN IP of those worker. SOHO cant do that, you need an business entry router, and that mean static IP for them.

A: Creative solution time: have users log in to a webpage that adds the ip of their device to the list of firewall exceptions temporarily before using RDP. Any users that don't first log in to this won't be able to access RDP from the outside. Maybe even include a pick your own TTL option for users that know how long they'll need the connection. You can include logging to be able to include a method for removing all the exceptions created by X, in case that's ever needed.
You can even require client certificates for authentication to the server, and distribute keys to each user to add to their devices, for added security.

user
There are 104 "a"s.
assistant