RemoteApp : how to deny full desktop access ?

[Vincent Schmid]

Hello,

I would like to deploy some application using the new RemoteApp feature
of Windows Server 2008. Can I authorize a user to run the application
through RemoteApp, but deny him the right to connect to his full desktop
on the server ?

Regards,
Vincent

 

[Vera Noest [MVP]]

Re: RemoteApp : how to deny full desktop access ?

This isn't possible. If you give users access to RemoteApps, they
also have access to the full desktop of the server.
And even from within a RemoteApp, it's nearly always possible to
get to a full desktop, so you shouldn't regard a "published"
application (through RemoteApp) as a safety feature. You will still
have to lockdown the server with restrictive policies and NTFS
permissions on the file system.

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
*----------- Please reply in newsgroup -------------*

Vincent Schmid <vincent.schmid@fvls.vd.ch> wrote on 15 jul 2008:

> Hello,
>
> I would like to deploy some application using the new RemoteApp
> feature of Windows Server 2008. Can I authorize a user to run
> the application through RemoteApp, but deny him the right to
> connect to his full desktop on the server ?
>
> Regards,
> Vincent

 

[Vincent Schmid]

Re: RemoteApp : how to deny full desktop access ?

Many thanks you for your help and clear answer,

Best regards,
Vincent


Vera Noest [MVP] a écrit :
> This isn't possible. If you give users access to RemoteApps, they
> also have access to the full desktop of the server.
> And even from within a RemoteApp, it's nearly always possible to
> get to a full desktop, so you shouldn't regard a "published"
> application (through RemoteApp) as a safety feature. You will still
> have to lockdown the server with restrictive policies and NTFS
> permissions on the file system.
>
> _________________________________________________________
> Vera Noest
> MCSE, CCEA, Microsoft MVP - Terminal Server
> TS troubleshooting: http://ts.veranoest.net
> *----------- Please reply in newsgroup -------------*
>
> Vincent Schmid <vincent.schmid@fvls.vd.ch> wrote on 15 jul 2008:
>
>> Hello,
>>
>> I would like to deploy some application using the new RemoteApp
>> feature of Windows Server 2008. Can I authorize a user to run
>> the application through RemoteApp, but deny him the right to
>> connect to his full desktop on the server ?
>>
>> Regards,
>> Vincent