Home / server / Questions / 515410
Accepted
James Cadd
Asked: 2013-06-13 15:16:42 +0800 CST

Windows Server Essentials 2012 & RDP: How to disable all read/write access to disks and USB devices except user profile?

  • 772

I'd like to allow an RDP user to access their profile folder but nothing else on the server. Ideally I'd like to disable read/list files/write on all disks except for the user profile location. Is this possible?

permissions

1 Answers

  1. Best Answer

    No. This isn't possible. The operating system's stock permissions do a very good job of preventing users from writing to locations outside their profile. At least one location (the "Public\AppData" folder, for example) that is left world-writable to allow legacy application software to run (there may be others-- that's the first and only one that's coming to mind).

    Blocking the ability for users to read (including "List Folder Contents") on the operating system volume is going to be problematic at best. The user needs a lot of read access in order for the OS to function. For non-OS volumes it'll be up to what the needs of your application software are.

    While I understand that you want to limit access to prevent disclosure having read access to the operating system is unlikely to be severely problematic. A user could download an evaluation version of Windows Server 2012 if they wanted to poke around reading OS files, so reading the OS files on your server isn't going to tell them anything they can't already learn from public sources.

    (Just to play devil's advocate, you might also want to think about permissions the user has to the registry, and to objects in the kernel object manager. Users have a lot of access to read and list contents in those areas too, by default, and there's very little you can do about it w/o "breaking" the OS.)

    • 6