I'm piloting Windows Server 2025 Remote Desktop Session Host servers as a replacement for non-persistent Windows 10 VDI desktops. Performance has been excellent, and the user environment is fairly lightweight: Office, browsers, PuTTY, 7-Zip, and potentially Power BI. Most applications are delivered through App Volumes.
I want to prevent standard users—some of whom are technically knowledgeable—from changing server configuration, network settings, disks, or installing software. Server Manager is one of the tools I would like to restrict.
I tried using AppLocker to block it, but the policy caused major side effects: the Start menu stopped working, Outlook became unstable, Teams would not launch, and several App Volumes applications failed as well. I have also configured the policy that prevents Server Manager from opening automatically at logon, but users can still find and launch it manually.
Is AppLocker the wrong tool for this? What is the recommended way to lock down Server Manager and other server-management tools on an RDSH host without breaking the normal desktop experience?
4 Answers
Start with permissions rather than application blocking. Standard users should not be members of Administrators and should not have rights that let them alter server configuration. Server Manager can still open for a non-administrator, but the user should not be able to make privileged changes through it. Also disable the scheduled task that launches Server Manager automatically at logon if that is part of the issue.
AppLocker is probably being applied too broadly. Blocking system components or inherited executable rules can also block shell components, Office integrations, Teams, and application-delivery agents. If you use AppLocker, test a very narrow rule targeting only the specific Server Manager executable and validate it in audit mode first. Do not use a blanket deny policy across system directories unless you have mapped all of the dependencies.
The main control should be a properly designed RDSH security baseline and GPO set: least-privilege user accounts, removal of unnecessary local rights, restrictions on Control Panel and administrative consoles, and prevention of software installation. Hiding a shortcut only affects visibility, while denying one executable may not prevent access through other management tools. Focus on preventing privileged actions rather than trying to make every administrative binary impossible to start.
There is a Group Policy setting under Computer Configuration → Policies → Administrative Templates → System → Server Manager that prevents Server Manager from opening automatically at logon. That is useful for removing the nuisance, but it does not stop someone from launching the executable manually, so it is not an access-control solution by itself.
That setting is already enabled, but Server Manager remains available from the menu and can still be started directly.
The goal is to stop technically capable users from changing settings that could affect the host, such as network configuration, disks, or software installation, while keeping the session usable for Horizon users.