0

We have recently deployed and tested a working RemoteApps configuration based on MS Windows Server 2012R2's Remote Desktop Session Host and Remote Desktop Gateway services, that is intended to allow certain users to run certain applications on the server farm, to store their data either locally or on the server farm in a shared (farm-wise) network resource as a roaming profile, but have stumbled on a problem: If a user only has rights to run Microsoft Word, for example, it can pretty easily run command prompt (as himself, of course) by navigating the file system tree in File-Open menu, afterwards he is able to launch an application that hasn't been published for him with RDS as a whole (no rights via RDS Web Access). We want users to not be able to do that, while allowing to browse to at least their own (roaming) profile and connected remote drives. What should we do to ensure that the user can only run what he's entitled to, and not run anything else unless published via Remote Desktop Web Access?

Improve this question
4
  • AppLocker and Software Restrictions come to mind. Both are configured via Group Policy.
    – joeqwerty
    Feb 14, 2017 at 12:27
  • @joeqwerty Will surely check these, already researching. Probably there are other restriction methods that could be applied to RDSH servers.
    – Vesper
    Feb 14, 2017 at 13:47
  • Hmm, neither SCP nor AppLocker care for group membership. I want to make it so that if a certain app is published for a group that current user doesn't belong to, it won't start on RDSH even if browsed to app executable with file-open dialogue. Setting AppLocker is still a valid approach as it will secure the server from users starting malicious code or really foreign apps, like launching an exe from \\tsclient\c drive, for example. Build many GPOs for each group?
    – Vesper
    Feb 14, 2017 at 14:13
  • Yes, the answer is use AppLocker to limit users' abilities to start programs. And AppLocker DOES care for group membership, while SRP does not. Okay, implementing.
    – Vesper
    Feb 21, 2017 at 9:24

1 Answer 1

Reset to default
0

The solution I chose was to implement a granulated AppLocker policy targetting the RDSH servers, that allowed enough programs for RemoteApp users to initialize RDS environment, then selectively allow software from Program Files based on whatever app is published on RD Gateway to the same group entities that have access via RD Gateway. No out-of-box solution exists so far.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .