Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are hosting some licensed software in our company on a Windows Server 2008 R2. Users access the server using Remote Desktop Services. However, we would like to prevent users from copying the licensed software (e.g. the executable and related program files). That means we want to suppress uploading to web server, copying with RDP etc.

How is this possible with Windows Server 2008 R2?

share|improve this question

One technique that will make it pretty difficult for the end user is to simply not give them a full desktop. Instead of giving them a windows shell where the can manage files and copy them, instead expose your application as a remote app. Also heavily lock down the system with group policies to prevent starting explorer.exe, command shells and other tools from the file open/save dialogs. This wouldn't completely stop a extremely skilled individual, but it should discourage the average computer user.

If you need a full desktop, you could setup a couple terminal servers, one server to provide your full desktop, and a second server to provide your remote apps within the terminal server environment.

If running a remote app isn't an option then you probably will need do a lot of work to lock down the system with group policies. With group policies you can prevent a user from browsing drives in Windows explorer and the standard Windows file dialogs. This would discourage most people, but it might make your system more difficult to use then your users are willing to accept. It depends on your requirements.

Another option might be to deliver your application with something like app-v. It is a technology where the application is not actually installed on the server. You need a special client to run the software. If your infrastructure is fast enough, then you would disable caching of the application files. I am not extremely familiar with the app-v internals to know if a determined person could extract a copy of the program from the cache, I suspect they could, but I don't think App-v is not common enough that it might make it difficult enough.

share|improve this answer
Thanks a lot for your extensive answer. What is the final way for the "skilled" user to download the software any way if I need a solution that works without Remote-App? – Heinrich Sep 7 '11 at 13:31

Simply turn off the ability for local devices and resources to be available in a remote session. Check out this TechNet article for more information about that feature.

If you want more granular control over disallowing only certain files from being copied over an established session that otherwise allows local resources - I am unaware of that being possible.

EDIT: I see clearer now. Sorry for the confusion. In the case of needing to prevent internet copying of files, you may have quite a task ahead of you. If it's a controlled environment that only needs access to certain sites, then you could create a default deny rule in the firewall and only allow those internet connections that are necessary thus disallowing any reasonable possibility of things being copied to a remote host.

If you must have complete access to the internet, then look into a third party tool like Imperva's File Firewall. I'm not 100% sure if that does exactly what you're looking for however. No first-hand experience with it.

You might have to look at a DPI gateway appliance that can inspect file transfers for certain files and block their transmission. Of course, you'll need to block SSL connections except to known good hosts.

share|improve this answer
The machine has internet access enabled for users. Won't they still be able to upload the files to a server? – Heinrich Sep 6 '11 at 17:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.