Prevent Terminal Server users from establishing VPN connections

Disable the "Remote Access Connection Manager" service and make sure none of your users have the ability to enable it.