0

We have a number of TS/RDP servers and due to concerns about viruses, we are wondering if there some way we can allow our clients to copy files from the server, to their local workstations, but NOT allow them to copy files to the server.

My preliminary research indicates (out of the box) you cannot do that. Microsoft has an all or nothing setup where clipboard redirection is either on, or off. Given that, is there another way, or other software that might allow us to achieve the same result?

Clinemi
  • 101
  • 4

1 Answers1

1

Make sure that users have access to write only into their home folders. Add a permission to explicitly deny execution permission on their home folder and subfolders (via NTFS permission inheritance). Same for TEMP folders.

Then even if they are able to upload a file, they will not be able to run it.

As alternative, you can use Software Restriction Policies to Protect Against Unauthorized Software

Mircea Vutcovici
  • 16,706
  • 4
  • 52
  • 80
  • Thanks for the response. We need the users to be able to run programs on the server so we cannot restrict them from doing that, but if we can give them a white list of programs that they can only execute, that might help. – Clinemi Nov 12 '19 at 16:14
  • This is what I meant, to whitelist using NTFS permissions or using Software Policies. – Mircea Vutcovici Nov 12 '19 at 17:14
  • My boss now says he wants to turn clipboard redirection (copying) completely off, but still wants some way to transfer files. I am going to post another question from that perspective. Thanks! – Clinemi Nov 12 '19 at 17:43