User permissions for stores

Hi,
I have for example 2 stores - A and B. Is it possible to define, that user 1 has rights for store A only for viewing and for store B full acces?
I need to define, that some group of users have store A for viewing only and B for full work (transfers, deliveries, invoices) and the others have B for viewing and A for full work.
Thanks for any idea
Petr

Hi Petr,
There are some things you can do.
I don't think it is possible to block a user from having access to a document numbering series and at the same time be able to see them.
It is however possible to assign different default numbering series to different users (departments). It is also possible to give user A access to document numbering series A, and User B to series B. this can be done with the Authorisation under (from the main menu):
Administration -> System Initialisation -> Authorisations -> General Authorisations:
Inj the Authorisations go to:
Administration -> System Initialisation -> Numbering Series -> Here you have different groups that can be assigned to Document Numberings Series. This way you can block one user from adding and seeing a numbering series. Unfortunately it is not possible to have 'Read Only' access here.
The authorisation that is given here relates to the field in:
Administration -> System Initialisation -> Document Numbering -> Open a series: Field - 'Group'.
A part from this there is also the Document Ownership functionality. This will not block users from adding documents in a certain series but it will grant different types of access to documents added by other departments and users.
Below is a link to the PDF with the 'How-to-guide' to set up the Data Ownership structure in Business One.
https://service.sap.com/~form/sapnet?_FRAME=CONTAINER&_HIER_KEY=701100035871000371280&_OBJECT=011000358700004490662004E&_SCENARIO=01100035870000000183&
Please note that the document is for version 2004A, but it is the latest one available and the functionality has changed little since.
I hope this helps.
Jesper

Similar Messages

  • Lite H.264 DVR User Permissions for certian Cameras

    In our building we have a lite H.264 DVR. We have one camera that we need to share with a new user on the DVR.
    I cant for the life of me know how to go about doing this.
    First I thought it would be in the user permissions but within that there wasn't much in the way of setting to restrict what cameras could and couldn't be viewed.
    If someone could give me some feedback on how this could be set up that would be brilliant.
    This topic first appeared in the Spiceworks Community

    Love marriage specialist baba, Vashikaranspecialist baba, black magic specialist baba..+91-9829791419 No1 Indian AstrologerAGHORI Ji +91-9829791419 15 time gold medalist Baba ji...inuk...usa....canada....in india..... love Vashikaran specialist ,voodoo spellget your love back by Vashikaran, blackmagic love Vashikaran specialist, bringyour love back, get back your lost love, win your lost love back, spells andtips to get your love back,Vashikaran WORLD FAMOUS BEST INDIAN molvi baba JIINDIA / AMERICA / CANADA / AUSTRALIA / UK / USA/INTERNATIONAL SERVICE WITHAGHORI ji 50 YRS EXPERIENCE.... love mantra to get back your lost love, Vashikaranspecialist to bring love back, solve love problems, bring your love back bytantra and ilam, powerful Vashikaran mantra to win the the about black magicspecialist molvi baba ji love back, indian hindu...

  • Setting CUIC user permissions for all reports at once

    Hi all,
    We are using CUIC 8.0(4) Standard Edition and trying to set CUIC user permissions, such as Read, Exec and Write, for reports.
    If we need to give access to all reports then we should set permissions for each report separately.
    Is there any way to set those permissions for all reports at once?
    We attempted to set Read, Exec and Write premissions for the Reports, Stock and UCCE folders but no luck.
    Thanks.
    Nikolay

    Hi all,
    We are using CUIC 8.0(4) Standard Edition and trying to set CUIC user permissions, such as Read, Exec and Write, for reports.
    If we need to give access to all reports then we should set permissions for each report separately.
    Is there any way to set those permissions for all reports at once?
    We attempted to set Read, Exec and Write premissions for the Reports, Stock and UCCE folders but no luck.
    Thanks.
    Nikolay

  • User permissions for wiki and calendar changed by themselves?

    I am hoping I can describe this behavior properly. I add a new group using an administrator's account logged into the web interface. I go to that groups settings page and delegate group admins and read/write and read only users. I add a bunch of calendaring appointments into the calendar and all is good. One of the users logs in and adds her own calendaring information as well and modifies the wiki pages. Fast forward a week or so and now she is only read, she cannot edit wiki pages and cannot interact with the calendar.
    Here are the verbose logs from wiki services:
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [QueryProtocol,client]
    [calendarserver.provision.root#debug] Wiki lookup returned user:
    blahblah
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [QueryProtocol,client]
    [calendarserver.provision.root#debug] Wiki user record for user
    blahblah :
    <OpenDirectoryRecord[users@058167af-ace8-519a-ac3d-e166498db024(/Search->/LDAPv3 /127.0.0.1)]
    C1EF4B6C-178A-4937-A8D3-AF535400FC3F(blahblah) 'blahblah'>
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [QueryProtocol,client]
    [calendarserver.provision.root#debug] Wiki-authenticated principal
    C1EF4B6C-178A-4937-A8D3-AF535400FC3F being assigned to authnUser
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [QueryProtocol,client]
    [calendarserver.provision.root#debug] Wiki principal servicedepartment
    being assigned to authzUser
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [QueryProtocol,client]
    [twistedcaldav.directory.wiki.WikiDirectoryService#info] Returning
    existing wiki record with UID wiki-servicedepartment
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [QueryProtocol,client]
    [twistedcaldav.directory.wiki.WikiDirectoryService#info] Returning
    existing wiki record with UID wiki-servicedepartment
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [QueryProtocol,client]
    [twistedcaldav.directory.wiki.WikiDirectoryService#info] Returning
    existing wiki record with UID wiki-servicedepartment
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [QueryProtocol,client]
    [twistedcaldav.extensions#info] REPORT
    /calendars/_uids_/wiki-servicedepartment/calendar/ HTTP/1.1
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [-]
    [calendarserver.provision.root#debug] Wiki principal servicedepartment
    being assigned to authzUser
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [-]
    [twistedcaldav.directory.wiki.WikiDirectoryService#info] Returning
    existing wiki record with UID wiki-servicedepartment
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [-]
    [twistedcaldav.directory.wiki.WikiDirectoryService#info] Returning
    existing wiki record with UID wiki-servicedepartment
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [-]
    [twistedcaldav.directory.wiki.WikiDirectoryService#info] Returning
    existing wiki record with UID wiki-servicedepartment
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [-]
    [twistedcaldav.directory.wiki#debug] Looking up Wiki ACL for: user
    [C1EF4B6C-178A-4937-A8D3-AF535400FC3F], wiki [servicedepartment]
    2011-03-28 14:58:41-0700 [-] [caldav-8011] [QueryProtocol,client]
    [twistedcaldav.directory.wiki#debug] Wiki ACL result: user
    [C1EF4B6C-178A-4937-A8D3-AF535400FC3F], wiki [servicedepartment],
    access [read]
    In this case the group is servicedepartment and the user is blahblah, who I just added using an admin to the group as a read/write user.
    So the question is this- is there a way that I can use the command line to verify and or change permissions for users if this happens in the future? I am really digging the calendaring and wiki features, but I cannot recommend them for use by the company if their accounts stop working all of a sudden…
    Many thanks for any tips!

    Turns out they didn't change themselves, but authentication got out of whack. This post fixed it for me, but I just jogged access on ical and blogs. Not sure which or both is needed, but after I toggled them over and back I was up and running again.
    <SNIP>
    Solution found athttp://michaeljin.wordpress.com/2010/01/05/locked-out-of-mac-os-x-server/
    It’s blog update time! Updates have been a little scarce lately, been super busy with getting trophies on PS3
    Anyway, recently encountered the following with a Mac mini server running Snow Leopard Server:
    Despite being able to ARD / Screenshare the Mac mini, I was unable to get any further than the login window. Authentication credentials are obviously valid. No weird access permissions have been set. However, the weird thing was, I can connect to the server via Server Admin tools (from another Mac) and all other services were running without a hitch.
    After much head scratching it turns out to be a sACL (Service Access Control List) issue.
    This thread solved the mystery!
    http://discussions.apple.com/thread.jspa?threadID=1654864
    To save you the trouble, I’ll lay it out here. I cannot take credit for this, but Randall can!
    Open Server Admin on a computer (any), and connect with the local admin to the machine.
    Select the server and authenticate.
    Select Settings, then go to Access. You’ll want to make sure that Login Window and SSH have the local admin account listed if you select the option to “Allow only these users”. For now, I would suggest making sure all services have “Allow all users and groups” selected.
    If (as in my case) it was set to Allow All in the first place, simply toggle the settings – back and forth.
    Save.
    Try logging in again… should be a good one!
    </SNIP>

  • User Permissions for certain pages only possible?

    I have a client interested in BC but I need to know if they can assign user edit permissions for certain pages to certain users? For example lets say they have pages  A B C D E F and they want Tom to be able to edit A B & C but not D E F and they need Sally to be able to edit D E & F but not A B & C. Is this possible with BC?

    Hi,
    The option is to use and set a workflow for "content approval" to each page.
    Site settings -> manage workflows
    "You can attach a workflow approval process to any web page or template. When an approval is attached to a web page or template, then all changes must be approved by predesignated users of the system before they go live. To attach a workflow to an item, click on the 'More Options' link and choose a workflow."
    Site manager -> pages -> more options
    Hope this helps!
    -Sidney

  • User Permissions for OPM

    Does a user of OPM (10.1) need to be an Administrator on the local machine? After installing the software under an administrator user, we now get an error on launch "Requested Registry access is not allowed". The user is not an admin on the machine, and ideally they won't ever be. Is this a problem?

    MattF wrote:
    Thanks Brad, we're actually running in Windows XP, does the same apply?Yes, the same applies for Windows XP (except there's no "Run As Administrator" option so you would have to log in as an administrator user)
    We're putting in 10.1 as an upgrade from version 9 (9.3 I think), is this a difference between 9 and 10.1?Yes, this is only in Oracle Policy Modeling v10.
    What exactly is 10.1 trying to do to the registry on start up?It's trying to configure a location where plugin extensions can be deployed outside of the product installation. We do this differently in 10.2.

  • DB user permissions for connecting via DI API

    Hello all,
    What database permissions must a user have in order to connect to a B1 database via DI API, and where are they documented? B1's SQL Administration guide doesn't seem to mention DI connections...

    Hi, Johan
    If you mean that your application tries to access the database directly, then you need to adapt it to use the DI API exclusively, and your problem is solved in a much better and securer way.
    A direct SQL connection works faster and is more powerful, but I agree that a DI connection is securer; and the program in question uses the latter.
    If you mean that the customer does not want to give you the sa account credentials, to let the DI API connect to the database, then I repeat: use command line arguments.
    That's exactly how the program works.
    If you mean that the customer does not want to give you the sa account credentials, to let the DI API connect to the database, then I repeat: use command line arguments. The customer can then activate the scheduled task, and provide the credentials themselves. If need be, you can set the whole thing up, and provide the customer with detailed instructions on how to set up the scheduled task. Again easier and much more predictable = safer.
    Agree, but they probably don't trust our program and want to make sure it cannot access the data it does not need.

  • User permissions for shared mailbox

    In a big organization, we've multiple shared mailboxes. Each mailbox is being looked at by different employees. We want to provide folder level restrictions to the employees and have primarily 3 type of access at a folder and root level:
    1) Owner access (Read, Create, Respond and Delete)
    2) Employee access (Read, Create and Respond)
    3) Read and View-only access
    Idea is to have a controlled access environment in the company where we don't want any employee to delete any e-mails and they're held accountable for their work.
    Million dollar question is - How do we achieve this in an Exchange Service 2010 Enterprise SP3 environment? Is it recommended to have such access levels? Can we've profile groups created to add users in future too with similar access restrictions?
    Please provide step by step.
    If this is not possible or advised, please suggest a better alternative with which we can track who deletes the e-mails and then change their behavior. May be some e-mail logs that help us determine this information? What is your suggestion?

    Hi,
    You can try Exfolders tool:
    http://gallery.technet.microsoft.com/office/Exchange-2010-SP1-ExFolders-e6bfd405
    How to use Exfolders:
    http://mouzzamh.wordpress.com/2012/04/01/how-to-use-exfolder-tool-for-exchange-2010/
    Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety,
    or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
    Thanks,
    Simon Wu
    TechNet Community Support

  • How to see all users who are allowed permissions for the specified entity ?

    How to see all users who are allowed permissions for the specified entity ? 
    And change user permissions for the current entity
    from Moscow with money

    Vincent,
    ... and how to change entity permissions for some users?
    from Moscow with money

  • How can I access user permission for specific items in Sharepoint 2013 via REST API?

    I want to access user permissions for specific items like lists, documents, folders etc. via the REST API.
    Currently I am hitting the following endpoint:
    http://win-5a8pp4v402g/sharepoint_test/site_1/_api/web/getUserEffectivePermissions('win-5a8pp4v402g\\Sharepoint User 2')
    However the response looks like this:
       "d":
           "GetUserEffectivePermissions":
               "__metadata":
                   "type": "SP.BasePermissions"
               "High": "0",
               "Low": "0"
    I cant understand why high and low are both 0? I have added the user to a specific group. Also this is the same result for each of the users. Another thing to note is that I havent added the "Guest" user in the sharepoint server. So when I hit the endpoint for the Guest user, it still shows the same response. So I know there is something I am doing wrong.I want to access permission of a user for a specific item, say a document using the REST API. Can someone tell me how? What would be the endpoint?

    Thanks for the reply. Although this works for Lists, I need to get permissions of documents too. Here is what I have tried:
    http://win-5a8pp4v402g/sharepoint_test/site_1/_api/web/GetFileByServerRelativeUrl('/sharepoint_test/site_1/Documents/file1.txt')/GetUserEffectivePermissions(@user)?@user='i%3A0%23%2Ew%7Cwin-5a8pp4v402g%5Csharepoint%20user%201'
    And the response is:
       "error":
           "code": "-1, Microsoft.SharePoint.Client.ResourceNotFoundException",
           "message":
               "lang": "en-US",
               "value": "Cannot find resource for the request GetUserEffectivePermissions."
    Clearly this doesnt work for a file. Whats wrong?

  • Error when trying to give catalog permissions for AD Users

    Hi,
    I have successfully integrated obiee 11.1.1.6.6 with AD. I have two authenticators default authenticator and AD. All the active directory users and weblogic(default authenticator)can successfully login to analytics. I can search them in console too. Problem is when I am trying to assign a report to a user I am getting the below error.
    Error retrieving user/group data from Oracle BI Server's User Population API. Odbc driver returned an error (SQLExecDirectW). State: HY000. Code: 10058. [NQODBC] [SQL_STATE: HY000] [nQSError: 10058] A general error has occurred. [nQSError: 43113] Message returned from OBIS. Error Message From BI Security Service: SecurityService::getUsersWithPropertyListByTenantIdentity store provider error (HY000) SQL Issued: {call NQSSearchIdentities('USERS','NAME_PATTERN=biadmin*')}
    I tried refreshing GUID's but no luck..Please let me know how to proceed.
    Thanks in advance.

    To validate the catalog:
    Stop Presentation Services.
    Refresh the user GUIDs for the catalog.
    Caution:
    Ensure that you regenerate the user GUIDs before validating the catalog. Failure to do so can result in the removal of all accounts, permissions, and privileges from the catalog.
    Back up the catalog by using the 7-Zip utility to create a compressed file for it.
    Create a backup copy of the instanceconfig.xml file.
    Edit the instanceconfig.xml file so that it contains the appropriate elements for performing the validation.
    Due to the nature of the issue encountered, the following elements were included:
    <ServerInstance>
    <Catalog>
    <Validate>OnStartup</Validate>
    <ValidateItems>Clean</ValidateItems>
    <ValidateLinks>None</ValidateLinks>
    <ValidateAccounts>Clean</ValidateAccounts>
    <ValidateHomes>None</ValidateHomes>
    </Catalog>
    </ServerInstance>
    Caution:
    Include only one Catalog element in the instanceconfig.xml file or unexpected results might occur. Unless expressly noted, include most nodes in an XML document only once.
    Note:
    If the Catalog element is already present in the instanceconfig.xml file, add the validate tags to the existing content of the Catalog element.
    Start Presentation Services to run the validation according to the values specified in the instanceconfig.xml file.
    Stop Presentation Services.
    Create a backup copy of the instanceconfig.xml file in which you added the validation elements, renaming the file similar to instanceconfig_validate.xml. In this way, you have a version of the file to use as a starting point for subsequent validations.
    Restore the backup version of the instanceconfig.xml that you created earlier to use as the current version.
    Start Presentation Services.
    Thanks,
    RM

  • Rebuild permissions for mail data store

    I've been running mail services from a copy of our mail database folder on a backup drive while I had a repair done on our server and I'm trying to get the data store back on the main drive. I've got all the data copied and pointed server admin to the folder but I'm getting permission errors with each connect attempt in the logs.
    On the backup drive if I look at the permissions for the individual users, I can see them but on the main drive the "system" user is the only user with read/write. How can I rebuild the permissions without individually doing each folder? Maybe there's a way to copy the data and retain the permissions?

    If you copy it with "sudo cp -Rp /path/to/backup /path/to/live", it'll preserve ownership and permissions. But if you've been running from the existing copy in the meantime, recopying it from the backup will loose any new messages that arrived into the new copy. It's probably best (if annoying) to change ownership on each user's folder with "sudo chown -R username /path/to/user/folder"

  • How do you create default Read/Write Permissions for more than 1 user?

    My wife and I share an iMac, but use separate User accounts for separate mail accounts, etc.
    However, we have a business where we both need to have access to the same files and both have Read/Write permissions on when one of us creates a new file/folder.
    By default new files and folders grant Read/Write to the creator of the new file/folder, and read-only to the Group "Staff" in our own accounts or "Wheel" in the /Users/Public/ folder, and read-only to Everyone.
    We are both administrators on the machine, and I know we can manually override the settings for a particular file/folder by changing the permissions, but I would like to set things up so that the Read/Write persmissions are assigned for both of us in the folder for that holds our business files.
    It is only the 2 of us on the machine, we trust each other and need to have complete access to these many files that we share. I have archiveing programs running so I can get back old versions if we need that, so I'm not worried about us overwriting the file with bad info. I'm more concerned with us having duplicates that are not up to date in our respective user accounts.
    Here is what I have tried so far:
    1. I tried to just set the persmissions of the containing folder with us both having read/write persmissions, and applied that to all containing elements.
    RESULT -> This did nothing for newly created files or folders, they still had the default permissions of Read/Write for the creating User, Read for the default Group, Read for Everyone
    2. I tried using Sandbox ( http://www.mikey-san.net/sandbox/ ) to set the inheritance of the folder using the methods laid out at http://forums.macosxhints.com/showthread.php?t=93742
    RESULT -> Still this did nothing for newly created files or folders, they still had the default permissions of Read/Write for the creating User, Read for the default Group, Read for Everyone
    3. I have set the umask to 002 ( http://support.apple.com/kb/HT2202 ) so that new files and folders have a default permission that gives the default group Read/Write permissions. This unfortunately changes the default for the entire computer, not just a give folder.
    I then had to add wife's user account to the "Staff" group because for some reason her account was not included in that. I think this is due to the fact that her account was ported into the computer when we upgraded, where as mine was created new. I read something about that somewhere, but don't recall where now. I discovered what groups we were each in by using the Terminal and typing in "groups username" where username was the user I was checking on.
    I added my wife to the "Staff" group, and both of us to the "Wheel" group using the procedures I found at
    http://discussions.apple.com/thread.jspa?messageID=8765421&#8765421
    RESULT -> I could create a new file using TextEdit and save it anywhere in my account and it would have the permissions: My Username - Read/Write, "Staff" or "Wheel" (depending on where I saved it) - Read/Write, Everyone - Read Only, as expected from the default umask.
    I could then switch over to my wife's account, open the file, edited it, and save it, but then the permissions changed to: Her Username - Read/Write, (unknown) - Read/Write, Everyone - Read Only.
    And when I switch back to my account, now I can open the file, but I can't save it with my edits.
    I'm at my wits end with this, and I can believe it is impossible to create a common folder that we can both put files in to have Read/Write permissions on like a True Shared Folder. Anyone who has used windows knows what you can do with the Shared folder in that operating system, ie. Anyone with access can do anything with those files.
    So if anyone can provide me some insight on how to accomplish what I really want to do here and help me get my system back to remove the things it seems like I have screwed up, I greatly appreciate it.
    I tried to give as detailed a description of the problem and what I have done as possible, without being to long winded, but if you need to know anything else to help me, please ask, I certainly won't be offended!
    Thanks In Advance!
    Steve

    Thanks again, V.K., for your assistance and especially for the very prompt responses.
    I was unaware that I could create a volume on the HD non-destructively using disk utility. This may then turn out to be the better solution after all, but I will have to free up space on this HD and try that.
    Also, I was obviously unaware of the special treatment of file creation by TextEdit. I have been using this to test my various settings, and so the inheritance of ACLs has probably been working properly, I just have been testing it incorrectly. URGH!
    I created a file from Word in my wife's account, and it properly inherited the permissions of the company folder: barara - Custom, steve - Custom, barara - Read/Write, admin - Read Only, Everyone - Read Only
    I tried doing the chmod commands on $TMPDIR for both of us from each of our accounts, but I still have the same behavior for TextEdit files though.
    I changed the group on your shared folder to admin from wheel as you instructed with chgrp. I had already changed the umask to 002, and I just changed it back to 022 because it didn't seem to help. But now I know my testing was faulty. I will leave it this way though because I don't think it will be necessary to have it set to 002.
    I do apparently still have a problem though, probably as a result of all the things I have tried to get this work while I was testing incorrectly with TextEdit.
    I have just discovered that the "unknown user" only appears when I create the a file from my wife's account. It happens with any file or folder I create in her account, and it exists for very old files and folders that were migrated from the old computer. i.e. new and old files and foders have permissions: barara - Read/Write, unknown user - Read Only, Everyone - Read Only
    Apparently the unknown user gets the default permissions of a group, as the umask is currently set to 022 and unknown user now gets Read Only permissions on new items, but when I had umask set to 002, the unknown user got Read/Write permissions on new items.
    I realize this is now taking this thread in a different direction, but perhaps you know what might be the cause of this and how to correct or at least know where to point me to get the answer.
    Also, do you happen to know how to remove users from groups? I added myself and my wife to the Wheel group because that kept showing up as the default group for folders in /Users/Shared
    Thanks for your help on this, I just don't know how else one can learn these little "gotchas" without assistance from people like you!
    Steve

  • When i open itunes, it gives me a message "the folder itunes is on a locked disk or you do not have write permissions for this folder" i am the only user and it was working a week ago whats wrong with it? it will not open itunes

    when i open itunes, it gives me a message "the folder itunes is on a locked disk or you do not have write permissions for this folder" i am the only user and it was working a week ago whats wrong with it? it will not open itunes

    Hi lvdmerwe!
    I have two articles here for you that should be able to help you troubleshoot this issue further:
    Trouble adding music to iTunes library or importing audio CD
    http://support.apple.com/kb/ts1387
    iTunes: Missing folder or incorrect permissions may prevent authorization
    http://support.apple.com/kb/ts1277
    Take care, and thanks for visiting the Apple Support Communities.
    -Braden

  • Remote Desktop Service Manager - configure permissions for Remote Desktop Users to Send Message, Disconnect, Logoff

    Hello, dear colleagues.
    We are using Windows Server 2012 R2 as Remote Desktop Server. Also use Windows Server 2008 R2 with Remote Desktop Service Manager to control RDS user sessions (Send Message, Disconnect, Logoff, Query Info). 
    Send Message, Disconnect, Logoff options works only for users in Administrators group.
    I can't to configure permissions for Remote Desktop Users, specific user or AD group. 
    To set permissions I'm running RDS Host Configuration on Windows Server 2008 R2 and connect to Windows Server 2012 R2. Then double-click
    RDP-Tcp, Security tab, add specific user account , AD group or configure
    advanced permissions
    for Remote Desktop Users.  
    But, as I sad above, these options works only for users in Administrators group. How to make it work for Remote Desktop Users or specific user, AD group?
    Thanks.
    P.S. If move specific user from Remote Desktop Users group to Administrators group on
    Windows Server 2012 R2 - it works. 

    Hi,
    You can prevent administrators from changing the permissions for a connection by applying the
    Do not allow local administrators to customize permissions Group Policy setting. 
    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security
    Apart there is one command with which you can set the permission for that check the related
    article. Additionally checkthis
    thread for more detail.
    Hope it helps!
    Thanks.
    Dharmesh Solanki
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Maybe you are looking for