Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a windows server 2003 sp1 (maybe will update to sp2 tomorrow, didnt update cause never needed). Currently it has just a user, the admin.

But, I would like to create a user, so it could access it by remote desktop, but he should only be able to run a single program of the company.

So it should be blocked all other programs, explorer, and the menus if its possible. Still he should be able to log in by the remote desktop conection.

I have no clue how to do it, can I have a little help?

share|improve this question
It can be done, but i'm quite sure that you will be going against your licensing agreement with Microsoft. The correct way (yes it is overkill for only one user!) would be to setup a terminal server and configure the group polies as suggested by BoxerBucks and Mircea. – JamesK Mar 21 '11 at 15:01
You're basically asking, "How do I engineer solution X". Try doing a little research into what it is you are trying to do and start asking question based on the individual parts of the solution. – BoxerBucks Mar 21 '11 at 15:36

You can use local or group policy security application and security settings to lock down different aspects of the OS as well as redirect the desktop to a network location that contains only shortcuts to applications you want the users to be able to run.

There isn't really a single list of items to do in order to accomlish what you are talking about. You are going to have to start looking at the policy settings and security settings for Windows 2003 and begin to build a solution based on how you want it to work.

Start looking at the GPMC or the local policy settings editor and go from there.

share|improve this answer
Why the down vote? – BoxerBucks Mar 21 '11 at 14:49
+1 - Voted you back up, due to the idiot down voting. – JamesK Mar 21 '11 at 16:57

This kind of separation can be done via something like Citrix, MS Terminal Server, or desktop virtualization. It depends on your budget and on your application you are trying to expose.

share|improve this answer
Who the hell voted this down? – mfinni Mar 21 '11 at 14:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.