Hello, my name is Pankaj Pande and I would like to discuss a method that an administrator can use to keep users from storing files in public folders and scattering files randomly throughout a virtual machine pool or Remote Desktop Session Host (RD Session Host) server farm, while using Remote Desktop Services and RemoteApp programs. (Note: an “RD Session Host server” was formerly called a “terminal server” in Windows Server 2008.)
Currently, when a user creates an RDP session or a RemoteApp program, they can see, and in some cases transverse, drives C and D of the RD Session Host server. They can also save anything on the desktop, which might look like their personal desktop, but it's actually the desktop of the RD Session Host server.
Restrictions will disable Libraries and Favorites and will hide or restrict users or a group of users from accessing and viewing any drives on the RD Session Host server. Users will be provided with an error message even if they use the UNC path to access the drives.
The primary reason to remove Favorites and Libraries and access to drives is because they contain mostly accessed locations on a system, so in the case of the RD Session Host server, this includes the desktop, downloads, recent places, etc. It is recommended that a user not save any documents to these locations.
You must perform these modifications on the RD Session Host server. You can use the Registry to make these changes.
Using the Registry (applies to all users including the administrators)Note: Back up the key first and take ownership of the ShellFolder before changing the value of Attributes.
1. For Favorites , the key is:
[HKEY_CLASSES_ROOTCLSID{323CA680-C24D-4099-B94D-446DD2D7249E}ShellFolder]
"Attributes"=dword:a0900100
Changing
a0900100
to
a9400100
will hide
Favorites
from the navigation pane.
2. For Libraries , the key is:
[HKEY_CLASSES_ROOTCLSID{031E4825-7B94-4dc3-B131-E946B44C8DD5}ShellFolder]
"Attributes"=dword:b080010d
Changing
b080010d
to
b090010d
will hide
Libraries
from the navigation pane.
You can use Group Policy settings to hide and restrict access to drives on the RD Session Host server. By enabling these settings you can ensure that users do not inadvertently access data stored on other drives, or delete or damage programs or other critical system files on drive C.
The following settings are located in the Group Policy Management Console under User ConfigurationPoliciesAdministrative TemplatesWindows ComponentsWindows Explorer :
Applies to :
You can also enable the following Group Policy settings at User ConfigurationAdministrative TemplatesWindows ComponentsWindows Explorer :
Applies to :
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.