GPO tool

Group Policy made searchable

A free ADMX browser or comparison tool for IT administrators. Search policies, find registry keys, and see exactly what each setting writes to the Windows Registry. Or compare two GPO backups to see exactly what has changed between them.

Select a product
  • Select a category.

Do not allow local administrators to customize permissions

This policy setting specifies whether to disable the administrator rights to customize security permissions for the Remote Desktop Session Host server.

You can use this setting to prevent administrators from making changes to the user groups allowed to connect remotely to the RD Session Host server. By default, administrators are able to make such changes.

If you enable this policy setting the default security descriptors for existing groups on the RD Session Host server cannot be changed. All the security descriptors are read-only.

If you disable or do not configure this policy setting, server administrators have full read/write permissions to the user security descriptors by using the Remote Desktop Session WMI Provider.

Note: The preferred method of managing user access is by adding a user to the Remote Desktop Users group.

Registry Information

VendorMicrosoft
ProductTerminal Server
CategoryRemote Desktop Services › Remote Desktop Session Host › Security
Applies toComputer Configuration
Supported onWindows NET
Registry Key[HKLM]SOFTWAREPoliciesMicrosoftWindows NTTerminal Services
Value NamefWritableTSCCPermTab
TypeREG_DWORD
Enabled value0
Disabled value1

Registry File (.reg)

Windows Registry Editor Version 5.00

; Enable the policy
[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows NTTerminal Services]
"fWritableTSCCPermTab"=dword:00000000

; Disable the policy
[HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindows NTTerminal Services]
"fWritableTSCCPermTab"=dword:00000001

PowerShell

# Enable the policy
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesMicrosoftWindows NTTerminal Services" -Name "fWritableTSCCPermTab" -Value 0 -Type DWord

# Disable the policy
Set-ItemProperty -Path "HKLM:SOFTWAREPoliciesMicrosoftWindows NTTerminal Services" -Name "fWritableTSCCPermTab" -Value 1 -Type DWord