Question : Block Administrator account from logging into RDP externally, but allow internally

Just noticed that our administrator domain account has ability to login through RDP externally.  We have a Windows 2003 terminal server.  I can set the deny permission on the administrator account for login to terminal servers, however, that blocks me from logging into servers while at the office.  So that doesn't work.  Should I create a GP or is there another way around this issue?

Answer : Block Administrator account from logging into RDP externally, but allow internally

SecureRDP permits filtering permission on user, too.

Though I suggest you to filter the users that have access to your LAN (on the firewall).