Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got this annoying problem in setting up a WIN2008R2-server as a TS-Server.
Basically, I've got everything up and working and have tested the connectivity of the RDC clients I've added through gpedit.
Here's the issue;
I only want the RDC client to have access to his Desktop on the server in order to run an application and edit files, placed on that desktop.
However, he can browse all of the server, have network access and can start programs that don't require Administrator rights!
I use the server for other purposes as well, hence uninstalling features are not an option...

Can anyone help me to prevent the RDC client to only have access to his Remote Deskop and the applications / files placed there?


The server is not a AD DS Server, but merely a Stand-alone.

I don't plan to implement either a TS Web Access or TS Gateway; just use the VPN solution to let clients (read customers) gain access to their own remote desktop.

Can I reach the objective by using NTFS permission on the Remote Desktop Users Group?

I've tried to go through Group Policy Management to edit the Remote Users Group, but get the message, that I need to log-in with a Domain user account? Haven't set it up as a DC, haven't installed AD.
How can I edit the Remote Users group to restricts them from browsing the computer?

Strikes me as odd that there isn't some easier way to restrict user rights for RDC clients in Win Serv 2008...

share|improve this question

There are a number of things you can do via GPO:

Restrict access to the local drives on the server

Hide the local drives on the server

Implement a Software Restriction policy and rules

An easier solution might be to use RemoteApps to publish only the application you want the user to run and to publish Windows Explorer restricted to the desktop folder or another folder that you create specifically for this user.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.