Prevent user from bypassing RemoteApp

windows 2008 terminal server.

i configured , distributed remoteapp rdp file our workstations, on first day, 1 windows xp user, not realizing logon format needed domain\username, instead of calling me clarification, went manually remote desktop connection, entered server name, , gracefully bypassed hard work in configuring remoteapp, ending full deskto on server.

i know can set tthe environment tab in activedirectory users , computers limit users 1 application should again bypass remoteapp. however, seems me there should setting limits users using remoteapp rdp connections on particular server , not generic rdp logon, can find nothing. there such setting.

this particularly important because may use multiple remoteapp connections , occasional user may need regular rdp access (with desktop) 1 of our other servers.

hi,

one technique set custom user interface group policy setting logoff.exe.  have gpo apply normal users, not applied domain admins (or other users need full desktop).

user configuration\administrative templates\system

custom user interface     enabled

interface file name: %systemroot%\system32\logoff.exe

note: critical to have server configured allow programs start on initial connection , explorer.exe must not in list.  otherwise specify start explorer.exe automatically , bypass custom user interface setting above , launch desktop.

this configured in remoteapp manager selecting not allow users start unlisted programs on initial connection.  list applies remoteapps initial programs started via user account properties, rdp-tcp properties, etc.

you may aware of mention that denying ability regular user full desktop nice feature, not of security measure itself.  if part of reason ability limit users have access recommend @ ntfs permissions, applocker, software restriction polices, group policies, etc.

thanks.

-tp

Windows Server  >  Remote Desktop Services (Terminal Services)