Required group policies for Remote Desktop Session hosts

1 users found this article helpful

Applies to:
- Parallels Secure Workspace
Last Review: Mar 29, 2024
Related Articles:
- Application stays open after logging off or disconnecting the session.
- All applications start in the same RDP session
Available Translations:
Get updates Download

Symptoms

If group policies (GPOs) are not correctly configured, this error may occur:

The Client Execute request could not be satisfied because the requested application was blocked by policy from being launched on the server.

Resolution

The Windows Remote Desktop application servers that Parallels Secure Workspace connects to should have the following Group policies applied.

Computer Configuration / Policies / Administrative Templates / Windows Components / Remote Desktop Services / Remote Desktop Session Host / Connections:
- Required:
  - Restrict Remote Desktop Services users to a single Remote Desktop Services session: Disabled
  - Automatic reconnection: Enabled
- Needed when publishing programs in Parallels Secure Workspace as an RDP application :
  - Allow remote start of unlisted programs: Enabled
Computer Configuration / Policies / Administrative Templates / Windows Components / Remote Desktop Services / Remote Desktop Sessions Host / Session Time Limits:
- Required:
  - Set time limit for disconnected sessions: End a disconnected session in 1 minute
  - Set time limit for logoff of RemoteApp sessions: RemoteApp session log off delay Immediately
Computer Configuration / Policies / Administrative Templates / Windows Components / Remote Desktop Services / Remote Desktop Sessions Host / Device and Resource Redirection:
- Recommended:
  - Allow time zone redirection: Enabled

The following user group policies are optional, but can be used to restrict some interactions.
Note that in older Windows versions the term "Windows Explorer" is used instead of "File Explorer".

User Configuration / Policies / Administrative Templates:
- Start Menu and Taskbar: Remove Run menu from Start Menu: Enabled
- System:
  - Prevent access to the command prompt: Enabled (Disable the command prompt script processing also? No)
  - Remove Lock Computer Enabled
  - System: Ctrl+Alt+Delete Options: Remove Task Manager Enabled
- Windows Components
  - Desktop Window Manager
    - Do not allow window animation: Enabled
  - File Explorer
    - Hides the Manage item on the File Explorer context menu: Enabled
    - Hide these specified drives in My Computer: Enabled (Pick one of the following combinations: Restrict all drives.)
    - No Computers Near Me in Network Locations: Enabled
    - No Entire Network in Network Locations: Enabled
    - Prevent access to drives from My Computer: Enabled (Pick one of the following combinations: Restrict all drives)
    - Remove File Explorer's default context menu: Enabled
    - Remove "Map Network Drive" and "Disconnect Network Drive": Enabled
    - Remove Hardware tab: Enabled
    - Remove Search button from File Explorer: Enabled
  - Remote Desktop Services / Remote Desktop Session Host/Session Time Limits:
    - Set time limit for disconnected sessions: Enabled (End a disconnected session: 1 minute)
    - Set time limit for log off of RemoteApp sessions: Enabled (RemoteApp session logoff delay: Immediately)
  - Windows PowerShell
    - Turn on script execution: Enabled with Allow only signed scripts

Was this article helpful?

Tell us how we can improve it.