If you have a permission to control the desktop of a terminal server - you can control the desktop of any terminal user, right?
This depends on what you mean by "control". In Remote Utilities you can switch to any actively running terminal session, but you can only view the desktop if it's unlocked. If the terminal user's desktop is locked (by the user) you won't be able to view it.
Active Directory have a user setting for this
Could you please clarify, what specific setting you mean? Thanks.