Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 5 down vote favorite

I found the following question, with a similar premise, however the answer to the question, was the question rephrased as a statement!

http://serverfault.com/questions/111770/remoteapp-prevent-user-from-running-remote-desktop

How do I allow RemoteApp but disallow Remote Desktop? In order to allow remote app, I'm seemingly having to add the users to the "Remote Desktop Users" group. This allows Remote Desktop.

I tried using the "TS Web Access Computers" group, however this does not give them the authority to run RemoteApp.

Where is the configuration to disable Remote Desktop, while leaving RemoteApp capabilities intact?

share|improve this question
RemoteApp is still TS/RDS; you still have to secure the server just the same. – Chris S♦ Jun 23 '10 at 18:32
Agreed, though the premise of our service, is they are only allowed to use the Application. They are not given a full login to desktop to reduce overhead on the system. If they work around it like Evan mentions, then we can deal with that case by case. This is a resources issue, not a security issue tough. – Aequitarum Custos Jun 23 '10 at 19:10

4 Answers

up vote 8 down vote accepted

There isn't an "officially sanctioned" way to do this because, fundamentally, TS RemoteApp functionality is just leveraging existing Remote Desktop code. You could do something silly like use Group Policy to set the user's shell to be "logoff.exe" such that if they attempted to access the machine's desktop they'd be immediately logged-off. Any application that uses a common "File / Open" dialog, though, can be used to get a command prompt or other programs open on the server's desktop.

You're better off making sure that you follow the principle of least privilege and give your TS RemoteApp users as few rights as they need to run the intended software. If they do end up on the server computer's desktop their restricted rights should prevent them from doing anything damaging to the server computer.

share|improve this answer
Good to know, the software is our own, and we are providing customers a way to run it without having their own server. However we are attempting to restrict them down to simply using the application. Will attempt that idea and see how it goes. – Aequitarum Custos Jun 23 '10 at 19:06
Where is the policy for this located at? Can I do this in the Local Security Policy for the server hosting these applications? If I need to do this at a domain level, need to bring in the owner of the company and walk him through it. – Aequitarum Custos Jun 23 '10 at 19:09
2  
@Aequitarum Custos, I believe he was talking about User Configuration/Policies/Administrative Templates/System/Custom User Interface – Zoredache Jun 23 '10 at 19:27
Thanks that looks like it works Zoredache! – Aequitarum Custos Jun 23 '10 at 19:54
1  
Don't forget to set software restriction policies that allow them to run only what you are expecting them to run. (+1 for setting the shell to logoff.exe: I've done the same & recommend it) – Miles Erickson Jun 24 '10 at 0:05
show 2 more comments
up vote 1 down vote

It is better to use "Application control policy" in the security settings just to allow only necessary applications or scripts if you use Windows 7 or Windows 2008 R2

share|improve this answer
up vote 0 down vote

run remoteapps WS2008 TS service en mac whit this client http://www.thinomenon.com/downloads/thinrdc-0.2.8.rar

work fine

share|improve this answer
up vote 0 down vote

You can take advantage of the fact that full user sessions launch the userinit.exe process while RemoteApp sessions launch the rdpshell.exe process. AppLocker can be used to prohibit userinit.exe from being executed by standard users.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.