Home
Join

Server 2012 R2, remove desktop rightclick menu Properties option

Posted by Elbeso
Solved
Windows Server Active Directory & GPO Windows 8

Hi, we have a Win Server 2012 R2, part of a domain. Users can access the server with terminal server (remote desktop) and use the program shortcut icons on the desktop to start the programs there. When rightclicking a program shortcut icon on the desktop, the rightclick menu opens, and one has the Properties option at the bottom of the menu. (When going into Properties there is the option to Open File Location, and suddenly the user has access to files on the hard drive, and we do not want that.) Is there a way to 1) remove the Properties option in the desktop icon rightclick menu? or 2) remove the desktop icon rightclick menu altogether?

Spice (5) Reply (7)
Elbeso

Strategy for the Age of Ransomware and Recession

2022-08-24 17:00:00 UTC Webinar Webinar : Strategy for the Age of Ransomware and Recession Event Details View all events
check

  • Elbeso wrote:

    Gary: they only need to access one program. What happens if one of your users rightclicks one of the shortcuts? Does the usual rightclick menu open? Does the menu have the Properties option?

    My users don't get the shortcuts as they don't reach a desktop. They open the RDP shortcut and the program opens automatically. When they close the program, their terminal session logs out. There are a few ways to accomplish this. One is by group policy and two is by editing the RDP shortcut with a text editor, the easiest way is by opening up an rdp shortcut on your 2012 server by going to run and typing mstsc. When you click options, it will maximize the window an show the tabs. Look at the program tab in particular. Add your program there and then save the terminal server shortcut. Place that shortcut on their machines and they won't have full desktop access any longer. 


    Spice (2) flagReport
    Was this post helpful? thumb_up thumb_down
    • View Best Answer in replies below

    7 Replies

    • I think you best bet would be to simply adjust the permissions on the folders you don't want users to access.  Other wise if you simply remove the properties without adjusting the file permissions users would still have access to said folders via, cmd PS or file explorer.

      Was this post helpful? thumb_up thumb_down

    • File explorer, cmd, powershell, run, and other possibilities are already locked down with GPO etc. Maybe file permissions is a way to go, I will check it out next time I have access to the server. If anybody has suggestions to the original question or other suggestions, please comment.

      Was this post helpful? thumb_up thumb_down
    • How many programs do they need to access? Our users only need 2 programs on the terminal server, so I have 2 terminal server shortcuts on their desktop, each one opens one of the 2 programs when launching. It does not present them with the server desktop at all. It works pretty slick and has saved me lots of headaches. 

      Gary
      Was this post helpful? thumb_up thumb_down

    • Not fuilly tested on every scenario, but there is a way to deny the permission to "List Folder Contents" while still allowing 'read' on the executable (read is needed to load the program and run it).

      Was this post helpful? thumb_up thumb_down

    • This applies to Windows 7, but would probably work on Server 2012. 

      https://www.sevenforums.com/tutorials/236988-open-file-location-add-remove-context-menu.html

      Was this post helpful? thumb_up thumb_down

    • Gary: they only need to access one program. What happens if one of your users rightclicks one of the shortcuts? Does the usual rightclick menu open? Does the menu have the Properties option?

      1 found this helpful thumb_up thumb_down

    • Elbeso wrote:

      Gary: they only need to access one program. What happens if one of your users rightclicks one of the shortcuts? Does the usual rightclick menu open? Does the menu have the Properties option?

      My users don't get the shortcuts as they don't reach a desktop. They open the RDP shortcut and the program opens automatically. When they close the program, their terminal session logs out. There are a few ways to accomplish this. One is by group policy and two is by editing the RDP shortcut with a text editor, the easiest way is by opening up an rdp shortcut on your 2012 server by going to run and typing mstsc. When you click options, it will maximize the window an show the tabs. Look at the program tab in particular. Add your program there and then save the terminal server shortcut. Place that shortcut on their machines and they won't have full desktop access any longer. 


      Spice (2) flagReport
      Was this post helpful? thumb_up thumb_down
    lock

    This topic has been locked by an administrator and is no longer open for commenting.

    To continue this discussion, please ask a new question.

    Read these next...