All users, except Admin, only would be able to run a specific application in Windows Server.

I am new in Windows Server. What I did is: for each user, I changed the environment configuration and in "Start the following program at logon", under "Local Users and Groups \ Users".

It works great, when the user logs on, the application is automatically executed. They do not see the desktop. When they close the application, the session is automatically log off also. However there are 2 problems:

1-From the application, using Open or Save File option, they can see all folders in unit C:. I have tried to deny permissions for the entire C: but a bunch of errors arises.

2-If they do Ctrl+Alt+Del, they can access to Task Manager and from there, they can execute any other program. I have tried to deny the access to TASKMGR.EX from security sheet, but the "Add" button for adding a group or user is disabled.

How can I solve these two problems?

Thank you

  • In your title you say WS2012, the tags you use are for 2008 / 2008R2. Which one is it? – MichelZ Jun 28 '14 at 14:27

You might want to have a look at Microsoft's AppLocker technology.

AppLocker is a new feature in Windows Server 2008 R2 and Windows 7 that advances the features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny applications from running based on unique identities of files and to specify which users or groups can run those applications.

Using AppLocker, you can:

• Control the following types of applications: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.msi and .msp), and DLL files (.dll and .ocx).

• Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file.

• Assign a rule to a security group or an individual user.

• Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe).

• Use audit-only mode to deploy the policy and understand its impact before enforcing it.

• Import and export rules. The import and export affects the entire policy. For example, if you export a policy, all of the rules from all of the rule collections are exported, including the enforcement settings for the rule collections. If you import a policy, all criteria in the existing policy are overwritten.

• Streamline creating and managing AppLocker rules by using Windows PowerShell cmdlets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.