Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'd like to allow an RDP user to access their profile folder but nothing else on the server. Ideally I'd like to disable read/list files/write on all disks except for the user profile location. Is this possible?

share|improve this question

1 Answer 1

up vote 6 down vote accepted
+100

No. This isn't possible. The operating system's stock permissions do a very good job of preventing users from writing to locations outside their profile. At least one location (the "Public\AppData" folder, for example) that is left world-writable to allow legacy application software to run (there may be others-- that's the first and only one that's coming to mind).

Blocking the ability for users to read (including "List Folder Contents") on the operating system volume is going to be problematic at best. The user needs a lot of read access in order for the OS to function. For non-OS volumes it'll be up to what the needs of your application software are.

While I understand that you want to limit access to prevent disclosure having read access to the operating system is unlikely to be severely problematic. A user could download an evaluation version of Windows Server 2012 if they wanted to poke around reading OS files, so reading the OS files on your server isn't going to tell them anything they can't already learn from public sources.

(Just to play devil's advocate, you might also want to think about permissions the user has to the registry, and to objects in the kernel object manager. Users have a lot of access to read and list contents in those areas too, by default, and there's very little you can do about it w/o "breaking" the OS.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.