Networks

Ask something
Discussion Locked

segragating applications on W2K-TS

0 helpful
7 replies

by therockdoctor 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

How do I install an application on W2K-TS so other users can not see or use it?

Environment:
W2K-IIS5-with TS running

Predicament/Need:
Multiple workgroups connecting to this 1 terminal server where each separate workgroup is NOT allowed to use other workgroup-specific applications.

Troubleshooting:
Have tried several installation methods with several different applications but all have resulted in that each and everyone has access to each and every application installed on the terminal server. Any suggestions for a fix?

7 replies

by joseph moore

Does each separate "workgroup" have its own individual login/password that they use to connect to your TS server?
For example, do the users at WORKGROUP1 use login WORKGROUP1, while the users at WORKGROUP2 use the login WORKGROUP2?
Or do all TS users use the SAME login/password to access your TS server?

If DIFFERENT logins/passwords are used between the different Workgroups, then this is easy.

Just change the NTFS Security permissions on the different applications, giving only the correct user accounts rights to the correct applications.

So, if WORKGROUP1 can only use PROGRAM1, and WORKGROUP2 can only use PROGRAM2, then open up My Computer, go to C:\PROGRAM FILES\PROGRAM1 folder, right-click it, choose Properties, then choose the Security tab.

Change the permissions so that Admistrators, SYSTEM and WORKGROUP1 have Full Control of it. You will probably need to remove the Everyone group from having permissions.

Then do the similar thing to C:\PROGRAM FILES\PROGRAM2, setting WORKGROUP2 to have FC rights.

Sure, this approach does involve a little manual work, but that is ok. It will work.

Then when WORKGROUP2 tries to use PROGRAM1, they will get a big fat Access Denied error!

hope this helps

by therockdoctor

duh, yeah, I should have played around more with this one, it will probably do the trick in a more AD-based way rather than direct NTFS as in #2 above but this would still be confusing for the users...

This discussion is closed to new replies.