How to Allow RemoteApps but Prevent Full Remote Desktop Logons

This is a question that comes up somewhat frequently. If you want to allow users to use RemoteApp in Windows Server 2008  or 2008 R2, they have to be members of the Remote Desktop Users group on the server. But, sometimes we don’t want our users to have the full desktop UI on a shared server resource. There is actually a very simple way to accomplish exactly what we’re looking at.

On each of the servers with the Remote Desktop Session Host role, open the connection properties by navigating as shown.

RDS2.regsquad.no-ip.org - VMware Workstation_2012-09-28_14-44-22

Open the properties of the connection that you are using. Click on the environment tab, bubble in the Start the following program, and fill it out as shown below. Basically, we’re configuring the server to automatically log out as soon as anyone tries to log in with the full UI. However, this doesn’t prevent users from connecting with RemoteApp. Pretty cool trick I thought!

RDS2.regsquad.no-ip.org - VMware Workstation_2012-09-28_14-44-34

Advertisements
Posted in 2008 R2, Remote Desktop, Windows Server
3 comments on “How to Allow RemoteApps but Prevent Full Remote Desktop Logons
  1. Ron says:

    Doesn’t that also prevent the Administrator from logging in remotely also?

  2. elgwhoppo says:

    I believe you are correct sir. I’d have to double check whether using the mstsc /admin switch makes a difference or not, but I doubt it. If not, looks like you’d need to log in at the console. Otherwise, the next logical workaround would be to instead of directly running the logoff, run a script that runs the logoff command unless a particular username is used during login.

  3. Adam says:

    User with admin rights are also logged off. Using mstsc with /admin switch doesn’t change anything. Any ideas?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Papers
People
Map

Enter your email address to follow this blog and receive notifications of new posts by email.

Join 31 other followers

%d bloggers like this: