I need to allow a user to RDP to a Win 2003 server (not currently a TS) and lock that user down to just have access to one folder and to run the app in that one folder. I feel like there is a few different ways of going about this but would like to get some guidance on the "best". The app doesn't work via a network share so it seems the only option is for the user to RDP to the server.
Use software restriction policies to restrict this user's rights to execute software. The user should be able to run only the single app that you want to authorize.
Configure NTFS permissions so that the user is permitted access only to files in the intended folder.