WSE doesn't block desktop for Standard Users
I was messing with some of the settings and did something that opened up Remote Desktop access for Standard Users. I cannot figure out what did it and with Shell Locker enabled, we cannot even log in and get the WSE Remote access window.
This worked great before. So, I uninstalled and reinstalled the add-in and it still works the same.
Any idea on how to get the actual WSE Remote access window back? We do not want our Standard users to access the desktop.
Thanks…
- jroberts asked 7 years ago
- You must log in to post comments.
All of our RemoteApp-based add-ins (WHS/WSE RemoteApp, etc.) include a feature called “Shell Locker” that blocks standard users from being able to access their full server desktop on the Essentials server (unless they can provide admin sign in credentials in order to continue). The Shell Locker feature is enabled by default seeing as most server admins see having standard users access their full server desktop as a security risk to their server. However, the Shell Locker feature can be disabled for all standard users (or just bypassed for select standard users) if desired by the server admin.
To disable or enable the Shell Locker feature:
1. Open the server Dashboard and go to the add-in’s main page (“WSE RemoteApp“, etc.).
2. Click on the “Server Access Settings” task.
3. Under the “Access Restrictions” section of the Server Access Settings dialog box that opens, check the “Block remote connections to the desktop” checkbox in order to enable the Shell Locker feature (or uncheck it in order to disable the feature).
4. Click the “Select Users” button to allow select standard users to bypass the enabled Shell Locker feature and be able to sign in to their Essentials server desktop.
5. Click on the “Save” button (in both dialog boxes) in order to save any changes you’ve made.
Lastly, please note that WHS/WSE RemoteApp also has a feature that allows the admin to publish the Essentials server’s desktop as a RemoteApp program so that their users can access it (as a nested session) from within the main WHS/WSE RemoteApp Launcher window. When enabling this feature for your users, you also allow them to bypass the Shell Locker feature (which is a requirement in order for them to be able to sign in to their Essentials server desktop).
To publish (or unpublish) the server desktop as a RemoteApp program for your standard users:
1. Open the server Dashboard and go to the add-in’s main page (“WSE RemoteApp“, etc.).
2. Click on the “RemoteApp Programs” sub-tab.
3. Click on the “Publish server desktop” task.
4. Check the boxes next to the standard users who you want to publish the server desktop for (and bypass the Shell Locker feature).
5. Click on the “Save” button in order to save any changes you’ve made.
- Mike answered 7 years ago
- You must log in to post comments.
Mike,
Thank you for your reply. I am not sure what I did, but this morning it works like advertised… and does it very well.
Not to nest issues under the same post, but I notice when you open File Explorer and right click on a folder or try to create a new folder by right clicking or using the Ribbon menus, File Explorer quits. There is no error, it just closes.
I have File Explorer published. Am I missing something?
- jroberts answered 7 years ago
- You must log in to post comments.
Glad to hear that Shell Locker is working for you again.
As for File Explorer crashing… I’m not able to replicate this one here on any of our in-house test servers, and to date, you’re the only one who’s mentioned such a problem that I am aware of.
What version of Windows Server Essentials are you using (2012, 2012 R2, 2016, etc.)?
Are you certain that your Essentials server (and client computers) have all of the latest Windows Updates installed on them (just in case it’s a known problem that Microsoft has already addressed with an update)?
Not that it should matter in this particular instance, but are you running the latest release of WHS/WSE RemoteApp (which, as of this writing, is Version 1.255.1421.0)?
Lastly, are you certain that the standard user has proper permissions to create a new folder within the parent directory (or drive)? I can easily see the crash happening if there is a permissions issue going on there.
Other than that, you can try signing in to the user’s full server desktop (by bypassing Shell Locker via providing admin credentials in order to continue), and then looking in the “Applications” log of the Event Viewer applet (i.e. Control Panel -> Administrative Tools -> Event Viewer -> Windows Logs -> Applications) to see if it gives any indication as to why File Explorer is crashing on the user.
- Mike answered 7 years ago
- You must log in to post comments.
Thanks for the reply. It works now. I don’t know what was happening, but it crashed every time before.
I’ll let you know if it happens again. I just need it all to work before I register it.
- jroberts answered 7 years ago
- You must log in to post comments.
