只允许RemoteApp，而不允许远程桌面

没有一个“官方认可”的方式来实现这一点，因为从根本上讲，TS RemoteAppfunction只是利用现有的远程桌面代码。 你可以像使用组策略那样做一些傻事，把用户的shell设置为“logoff.exe”，这样如果他们试图访问机器的桌面，他们会立即注销。 但是，使用通用的“文件/打开”对话框的任何应用程序都可以用来在服务器桌面上打开命令提示符或其他程序。

您最好确保遵循最小权限的原则，并为您的TS RemoteApp用户提供运行预期软件所需的权限。 如果他们最终在服务器计算机的桌面上，他们的受限权利应该防止他们做任何损害服务器的计算机。

在安全设置中使用“应用程序控制策略”更好，只有在使用Windows 7或Windows 2008 R2时才允许使用必要的应用程序或脚本

这就是我所做的将桌面locking为只能由服务器pipe理员和命名的AD组访问。 不是给定AD组成员的用户将收到一条消息，告诉他们使用RDWeb，而不是桌面/标准mstsc。

1. 创build一个vbscript并把它放在服务器上的所有用户都可以读取+执行的文件夹中

2. %windir%\system32\USRLOGON.CMD添加到%windir%\system32\USRLOGON.CMD

    cscript <sourcefolder>\DesktopUserCheck.vbs 

vbscript代码（请在下面的<>条目中添加您的个人信息）

 'Script created by Tord Bergset, Jan 2014 'This script is called from the file called C:\Windows\System32\USRLOGON.CMD 'The script check if a user logging on to the server desktop is a allowed to do this. 'The string called StrGroupName controls the access group to check for. 'AD group used for this script = "G WTS Grant Desktop Access" '--------------------------------------------------------------------------------------- Const strComputer = "." Const EWX_LOGOFF = 0 Dim objShell, objWMIService, colProcessList, objNetwork, StrGroupName, strUsername, strUserIsMember, strUserFullName Set objShell = WScript.CreateObject ("WScript.Shell") Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colProcessList = objWMIService.ExecQuery("SELECT * FROM Win32_Process WHERE Name = 'userinit.exe'") Set objNetwork = CreateObject("Wscript.Network") strUsername = EnvString("username") ' Mention any AD Group Name Here. Also works for Domain Admins, Enterprise Admins etc. ' ------------------------------------------------------------------------------------- StrGroupName = "G WTS Grant Desktop Access" ' ------------------------------------------------------------------------------------- If IsAdmin = 0 Then wscript.Quit CheckADGroupMembership() If strUserIsMember = "YES" Then ' Do something here if user is a member of the group 'MsgBox "Is member" Wscript.Quit Else ' Do something here if user is NOT a member of the group 'MsgBox "Is not member" For Each objProcess in colProcessList MsgBox "You (" & strUsername & " ) are not allowed to log in to the server desktop." & VBLF & "Please connect through the Remote Desktop Web Page (RDWeb):" & VBLF & VBLF & "<rdweb server address>", vbExclamation + vbSystemModal, strUsername & " - Access Denied !" objShell.run "logoff" WScript.Quit Next End If Wscript.Quit ' ***************************************************** 'This function checks to see if the logged on user has local admin rights Function IsAdmin() With CreateObject("Wscript.Shell") IsAdmin = .Run("%comspec% /c OPENFILES > nul", 0, True) End With End Function ' ***************************************************** 'This function checks to see if the passed group name contains the current user as a member. Returns True or False Function IsMember(groupName) If IsEmpty(groupListD) then Set groupListD = CreateObject("Scripting.Dictionary") groupListD.CompareMode = TextCompare ADSPath = EnvString("userdomain") & "/" & EnvString("username") Set userPath = GetObject("WinNT://" & ADSPath & ",user") For Each listGroup in userPath.Groups groupListD.Add listGroup.Name, "-" Next End if IsMember = CBool(groupListD.Exists(groupName)) End Function ' ***************************************************** 'This function returns a particular environment variable's value. ' for example, if you use EnvString("username"), it would return the value of %username%. Function EnvString(variable) variable = "%" & variable & "%" EnvString = objShell.ExpandEnvironmentStrings(variable) End Function ' ***************************************************** Sub CheckADGroupMembership() ' ============================================================= ' List All Members of a Group; Including Nested Members ' ============================================================= Dim ObjRootDSE, ObjConn, ObjRS, ObjCustom Dim StrDomainName, StrGroupName, StrSQL Dim StrGroupDN, StrEmptySpace strUserIsMember = "" Set ObjRootDSE = GetObject("LDAP://RootDSE") StrDomainName = Trim(ObjRootDSE.Get("DefaultNamingContext")) Set ObjRootDSE = Nothing StrSQL = "Select ADsPath From 'LDAP://" & StrDomainName & "' Where ObjectCategory = 'Group' AND Name = '" & StrGroupName & "'" Set ObjConn = CreateObject("ADODB.Connection") ObjConn.Provider = "ADsDSOObject": ObjConn.Open "Active Directory Provider" Set ObjRS = CreateObject("ADODB.Recordset") ObjRS.Open StrSQL, ObjConn If ObjRS.EOF Then 'WScript.Echo VbCrLf & "This Group: " & StrGroupName & " does not exist in Active Directory" End If If Not ObjRS.EOF Then WScript.Echo vbNullString ObjRS.MoveLast: ObjRS.MoveFirst 'WScript.Echo "Total No of Groups Found: " & ObjRS.RecordCount 'WScript.Echo "List of Members In " & StrGroupName & " are: " & VbCrLf While Not ObjRS.EOF StrGroupDN = Trim(ObjRS.Fields("ADsPath").Value) Set ObjCustom = CreateObject("Scripting.Dictionary") StrEmptySpace = " " GetAllNestedMembers StrGroupDN, StrEmptySpace, ObjCustom Set ObjCustom = Nothing ObjRS.MoveNext Wend End If ObjRS.Close: Set ObjRS = Nothing ObjConn.Close: Set ObjConn = Nothing End Sub Private Function GetAllNestedMembers (StrGroupADsPath, StrEmptySpace, ObjCustom) Dim ObjGroup, ObjMember Set ObjGroup = GetObject(StrGroupADsPath) For Each ObjMember In ObjGroup.Members 'WScript.Echo Trim(ObjMember.CN) & " --- " & Trim(ObjMember.DisplayName) & " (" & Trim(ObjMember.Class) & ")" & " (" & Trim(ObjMember.sAMAccountName) & ")" strThisUser = Trim(ObjMember.sAMAccountName) If lCase(strUsername) = lCase(strThisUser) Then strUserIsMember = "YES" strUserFullName = Trim(ObjMember.DisplayName) Exit Function End If If Strcomp(Trim(ObjMember.Class), "Group", vbTextCompare) = 0 Then If ObjCustom.Exists(ObjMember.ADsPath) Then 'WScript.Echo StrEmptySpace & " -- Already Checked Group-Member " & "(Stopping Here To Escape Loop)" Else ObjCustom.Add ObjMember.ADsPath, 1 GetFromHere ObjMember.ADsPath, StrEmptySpace & " ", ObjCustom End If End If Next End Function Private Sub GetFromHere(StrGroupADsPath, StrEmptySpace, ObjCustom) Dim ObjThisGroup, ObjThisMember Set ObjThisGroup = GetObject(StrGroupADsPath) 'WScript.Echo vbNullString 'WScript.Echo " ** Members of this Group are:" For Each ObjThisMember In ObjThisGroup.Members 'WScript.Echo " >> " & Trim(ObjThisMember.CN) & " --- " & Trim(ObjThisMember.DisplayName) & " (" & Trim(ObjThisMember.Class) & ")" & " (" & Trim(ObjThisMember.sAMAccountName) & ")" strThisUser = Trim(ObjThisMember.sAMAccountName) If lCase(strUsername) = lCase(strThisUser) Then strUserIsMember = "YES" strUserFullName = Trim(ObjThisMember.DisplayName) Exit Sub End If Next 'WScript.Echo vbNullString End Sub 

运行remoteapps WS2008 TS服务端mac客户端http://www.thinomenon.com/downloads/thinrdc-0.2.8.rar

工作正常

您可以充分利用以下事实：完整的用户会话启动userinit.exe进程，而RemoteApp会话启动rdpshell.exe进程。 可以使用AppLocker来禁止标准用户执行userinit.exe 。