Sounds like UAC Virtualization.
Any writes to a system folder (or Registry) as a standard user were redirected to a location in the AppData folder so those apps that incorrectly assumed that all users run with full admin privileges would continue to work when migrating from Windows XP to Vista.
You are probably referring to the sandboxing done on processes with "low/medium integrity" flag. From Wikipedia:
Windows Vista and later editions include a "low" mode process running,
known as "User Account Control" (UAC), which only allows writing in a
specific directory and registry keys
Again, from another Wikipedia page:
Windows Vista defines ...
From filesystem standpoint, entering a directory is akin to executing, or activating, it.
It clearly is a convention (directory are not really "executed"), probably rooted to the shortage of classical filesytem flags/permissions on Unix (where the "x" flag stand both for "directory enter" and file execution).
New users are not allowed to RDP even though they have the same
permissions as existing users.
What do you mean by that? What permissions are you referring to?
User rights and permissions are two different things. User rights determine what a user can do (Shutdown the system or log on through Remote Desktop Services). Permissions determine what a user ...