2

I'm using Windows Server 2008 R2 with Terminal Server. The users are using a Ms Access database.

I would like to prohibit users to copy the database on their computer, but they must be able to use it.

I thought the easyest way would be to change the file permission of the database directory and to create a shortcut on the users desks to the database, but it doesn't work.

I also tried to find a GPO that hide the address bar in the file explorer, but I did'nt find it.

Improve this question
1
  • 1
    In information security, it is always the case that if someone can read some data, they can also copy it, by some means. You need to rethink this, as any mechanism that is possible will have security holes.
    – Falcon Momot
    Nov 17, 2013 at 20:05

1 Answer 1

Reset to default
4

Disable hard drive device redirection on the Remote Desktop Session Host, so that the users cannot transfer files to and from their own clients and the RD Session Host. Disable clipboard redirection too.

http://technet.microsoft.com/en-us/library/ee791794(v=WS.10).aspx

If you are still having a problem with users doing things like using the internet connection of the RD Session Host to copy the database to their own personal Dropbox, or something heinous like that, then first, fire them, and then second don't let them use a Remote Desktop Server for this purpose. You can expose it as a Remote App.

http://technet.microsoft.com/en-us/library/cc755055.aspx

And finally, there's AD Rights Management Services, which is beast mode:

http://technet.microsoft.com/en-us/library/cc771234%28WS.10%29.aspx

On second thought, AD RMS is neat but it doesn't really fit this case.

Some sort of application virtualization like App-V might help as well.

Improve this answer
6
  • Thank you Ryan. That's a goog idea, but the users still can use Outlook to send the database by email. And I can't use Remote App because the server is hosted the Cloud and it would be too long to access to the document in the server. Oh, and by the way, I can't fire the users ! :D
    – Nde
    Nov 17, 2013 at 15:22
  • Then I'm sorry, I think you've mis-architected. You shouldn't host a sensitive database on the same server that you also give every employee a full desktop on, with internet, with an Outlook client, with access to the file, to do whatever they wish with it.
    – Ryan Ries
    Nov 17, 2013 at 15:30
  • Yes, you're right, the architecture should be changed, but unfortunatly, for multiple reasons, we can't change it.
    – Nde
    Nov 17, 2013 at 15:36
  • And the users could upload the database to DropBox, SkyDrive, Google Drive, etc. so I think you need to rethink how you make this database available to your users.
    – joeqwerty
    Nov 17, 2013 at 16:55
  • 1
    DropBox has a web interface they can use to upload files, so installation of the DropBox client isn't needed.
    – joeqwerty
    Nov 18, 2013 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .