Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a software development machine that will be accessed remotely via RDP, it is a virtual machine running as a guest in Hyper-V.

A hardware firewall is in place to prevent internet access or files to be transferred off the subnet.

Is it possible to restrict the file transfer and other mechanisms of copying data?

I'm running Windows 2008 R2 enterprise and open to all ideas including 3rd party software.

share|improve this question
2  
If the machine can be "accessed" then data can be copied off. It may require an obtuse method (taking screenshots, for example) but it can be transferred. –  Evan Anderson Jul 18 '12 at 20:26
    
To add to what Evan's said, that applies to the type of access and type of data transfer as well. If it can be accessed remotely, the data can be transferred to a remote location, remotely. It may mean doing screen captures of one sort or another on the remote terminal window, but there's no way around that. Because ultimately, "accessing" data is the same as transferring it. It's being transferred from your server into the brain of the person accessing it. And once it's out of your control (such as by being in someone's brain), it's out of your control. –  HopelessN00b Jul 18 '12 at 20:35
    
Agree, can't prevent people taking pictures with their phone or unable to erase their memory MIB style, might have found a solution along the lines of my reply to chopper3's answer which meets my needs without interfering too much with usability –  g18c Jul 19 '12 at 22:01

1 Answer 1

up vote 2 down vote accepted

You can block port 3389 and/or go into group policy editor choose computer configuration then administrative templates, windows components, terminal services, then client-server data redirection and set 'do not allow drive redirection' to enabled.

share|improve this answer
    
Don't forget the clipboard too... –  HopelessN00b Jul 18 '12 at 20:29
    
Can you cut'n'paste files that way? if so then I've learnt something new today? –  Chopper3 Jul 18 '12 at 20:37
    
No, no cut'n'paste of files. But there's nothing stopping someone from opening a file in a text editor, for example, and cut/pasting the content. Unless you disable clipboard redirection, that is. Preventing data leakage is really a losing fight once you give someone access to the data, but there is some value in making unauthorized data transfers non-trivial. I guess. –  HopelessN00b Jul 18 '12 at 20:43
    
Phew - thanks for the confirmation. –  Chopper3 Jul 18 '12 at 20:51
1  
I used remote desktop gateway and disabled all redirection there. Gateway sits inside a restricted subnet along with the workstation and servers whose attempts to route data off are blocked by the hardware firewall. RDS GW controls all traffic, yes not 100% secure but good/secure enough for my requirements –  g18c Jul 19 '12 at 21:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.