Hi, we have a Win Server 2012 R2, part of a domain. Users can access the server with terminal server (remote desktop) and use the program shortcut icons on the desktop to start the programs there. When rightclicking a program shortcut icon on the desktop, the rightclick menu opens, and one has the Properties option at the bottom of the menu. (When going into Properties there is the option to Open File Location, and suddenly the user has access to files on the hard drive, and we do not want that.) Is there a way to 1) remove the Properties option in the desktop icon rightclick menu? or 2) remove the desktop icon rightclick menu altogether?
Gary: they only need to access one program. What happens if one of your users rightclicks one of the shortcuts? Does the usual rightclick menu open? Does the menu have the Properties option?
My users don't get the shortcuts as they don't reach a desktop. They open the RDP shortcut and the program opens automatically. When they close the program, their terminal session logs out. There are a few ways to accomplish this. One is by group policy and two is by editing the RDP shortcut with a text editor, the easiest way is by opening up an rdp shortcut on your 2012 server by going to run and typing mstsc. When you click options, it will maximize the window an show the tabs. Look at the program tab in particular. Add your program there and then save the terminal server shortcut. Place that shortcut on their machines and they won't have full desktop access any longer.
- ROM
- CPU
- RAM
- GPU
7 Replies
I think you best bet would be to simply adjust the permissions on the folders you don't want users to access. Other wise if you simply remove the properties without adjusting the file permissions users would still have access to said folders via, cmd PS or file explorer.
File explorer, cmd, powershell, run, and other possibilities are already locked down with GPO etc. Maybe file permissions is a way to go, I will check it out next time I have access to the server. If anybody has suggestions to the original question or other suggestions, please comment.
Gary
Not fuilly tested on every scenario, but there is a way to deny the permission to "List Folder Contents" while still allowing 'read' on the executable (read is needed to load the program and run it).
This applies to Windows 7, but would probably work on Server 2012.
https://www.sevenforums.com/tutorials/236988-open-file-location-add-remove-context-menu.html
Gary: they only need to access one program. What happens if one of your users rightclicks one of the shortcuts? Does the usual rightclick menu open? Does the menu have the Properties option?
Gary: they only need to access one program. What happens if one of your users rightclicks one of the shortcuts? Does the usual rightclick menu open? Does the menu have the Properties option?
My users don't get the shortcuts as they don't reach a desktop. They open the RDP shortcut and the program opens automatically. When they close the program, their terminal session logs out. There are a few ways to accomplish this. One is by group policy and two is by editing the RDP shortcut with a text editor, the easiest way is by opening up an rdp shortcut on your 2012 server by going to run and typing mstsc. When you click options, it will maximize the window an show the tabs. Look at the program tab in particular. Add your program there and then save the terminal server shortcut. Place that shortcut on their machines and they won't have full desktop access any longer.