Networks

Ask something
Question Locked

Terminal Services Folder Lockout?

0 helpful
4 replies

by daring

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a Terminal Server (Windows 2003) which has many customers connecting to it. We changed their shell program to our application, so they do not get a desktop or Start menu, which works great. The issue is that any time the user gets an Open/Save dialog box, they have the ability to browse any folder in the system. Granted, they can not do any major harm as non-admins, but I do not want them to see ANY other folder or drive which is not their own.

Any suggestions? Thanks in advance.

4 replies

by jck

if you set up their profile to access specifically a directory, then it should restrict them to that.

if they belong to a group with parent access, it might override that individual granting.

i'd check all user rights including group profiles.

by daring

Thanks for the response. I can set up a specific folder as their Profile, but this does not keep them from seeing folders on the C: or D: drives, as well as Network Places.

I realized that I could just simply set the other folders to "hidden" but I would still need to lock them out of the C: drive and Network Places.

by daring

I believe I found one way of locking out other users. Using a Local Group Policy (User Configuration\Administrative Templates\Windows Components\Windows Explorer\ and +Common Open File Dialog) I was able to lock out drives, Network Places, etc. from being accessed by the user. There were also options to disable the right-click context menu, and disable Recent Items.

Since this is a local Group Policy, I also had to deny read permissions for the Administrators group to C:\Windows\System32\GroupPolicy\ or else the policy would be applied to the Administrator as well.

This discussion is closed to new replies.