We have some users connecting to a Windows Server 2008 box on our network, is there an easy way that I can prevent these users from accessing other computers on the LAN, such that they can only access files on the server. I'm not very familiar with server administration.


My suggestion is to use network level isolation by firewall policy. Namely the design you should use is DMZ.

For instance, if you have a terminal server/remote desktop server that VPN users connect into, it would be best to isolate that terminal server to a subnet off an interface of a firewall where more restrictive policies can take place.

See this diagram, and read about the concept of a DMZ.

Put the dedicated firewall to the task it handles best, being a firewall; and leave your Windows to the task it does best, being a network operating system.

To do this correctly and securely, you have to educate yourself a little more. :)


While there are any number of ways to do this the most fundamental way is to simply ensure those users have appropriate permissions. i.e. Don't give them permissions which would allow them to access anything you don't want to access.


You can use Windows Firewall with Advanced Security to block all outbound traffic to your LAN. If you set this in a Group Policy or Local Policy, non-admin users shouldn't be able to change it.

Note that you'll have to allow, at a minimum, outbound traffic for your RDP sessions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.