How do I restrict a remote dektop user to a single application

On Windows Server with Remote Desktop Services, you can restrict a user so that when they connect through Remote Desktop, they launch only a specific application instead of receiving the normal Windows desktop. This is commonly called a RemoteApp-style restriction or an RDS per-user program restriction.

For a standard RDP connection, you can configure the user's RDS properties in Active Directory. Open Active Directory Users and Computers, find the user, open Properties, and go to the Environment tab. Select "Start the following program at logon" and enter the executable path for the application, such as C:\Program Files\App\App.exe. When that user connects through RDP, Windows starts the specified application instead of Explorer/the desktop. When the application exits, the RDP session can be disconnected or logged off depending on the configuration.

You can also configure this through Group Policy if you want to apply the restriction to multiple users. In Group Policy Management, configure the Remote Desktop Services user environment policy under User Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Remote Session Environment. The relevant setting is "Start a program on connection." Specify the executable and, if necessary, its working directory.

If you need the user to be able to run only that application and not launch other programs, simply starting the application at logon is not always sufficient. A more restrictive RDS deployment uses RemoteApp, where the application is published through Remote Desktop Services and the user is granted access only to that published application. This prevents the user from receiving a normal Windows desktop and is generally the better approach for a true single-application RDS environment.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin