Limit specific user from using RDP from WAN, but allow from LAN?

[Joem]

Hi,

I have a working Remote Desktop connection to Windows Server 2003. It is only in WORKGROUP networking not domain.

Users can use RDP from the office LAN ( due to performance consideration for a specific application) and from the home (WAN).

Now, there is one specific user that I want to allow RDP only from inside the office LAN, but not be able to do RDP from the WAN. (Please try to help me with this restriction and not tell me he can destroy the server when in the office, I know)

Is there a way to achieve this? IE, like only permit this user if his IP is local 192.168.1.* ? or some other way?

Thanks.

JM

[+BudMan MVC]

there was just a thread on this -- no you can not restict access to RDP by user based and IP. You can limit access by IP, you can limit access by user.. But you can not say user A can access only if coming from IP B, etc.

On a side note -- why would anyone that has 2k3 server run it workgroup mode for???? You clearly have users that access the server, an I would assume you have to maintain the network, etc.. For what reason would not be be using AD???

But no -- even if you were running AD, you could not do what you ask.

But what you could do is limit when the user can logon by time.. So you could allow them to to login during working hours, but not after.

[neufuse Veteran]

why dont you just add the users you want to let use RDP on the server to the Remote Desktop Users group on that server? thats what it's there for... to limit who can connect... it works in AD and Workgroup mode... That is what we do at work and it works great.. we have it set up so only admins can log into any of the servers through RDP... then have it set up so only terminal server users can only log into the terminal servers... all controlled by placing users into that group on the system you want to allow or disallow users to... btw why in the world are you using workgroup mode if you have a server?

as for lan / wan... get ISA server and you can do stuff like that by setting up filters based on server and user rights... we've done that also at work

[Joem]

I thought that originating IP address is a good way to find out from where a user is logging on via RDP. Any other way to achieve this is OK with me.

I also thought about implementing a small login batch-file or program to check this situation and disconnect the specific user. Any idea where is the best place to start such batch file?

Limiting access by time is not a good idea as the user might be leaving the office at 3PM one day and staying till 10PM the next day.

The issue is of office politics only, as the user has the same privileges regardless where they are. Fortunately, the user does not know how to set RDP by himself, at least so far.

For the remarks on domain/workgroup: this is a very small office that worked without a server on workgroup where parts of the common stuff were shared among couple PCs. Now they want to grow and centralize office resources on the new server for better control and maintenance. There are 6 PCs, and unfortunately only 3 of which can logon to domain. :(