Log on Locally rights question.

[rayzze]

I have a Metaframe XP FR2 server farm with 4 servers. Each server hosts different published apps and I want to limit who has rights to log on to these boxes. I have used the local security policy to limit who can log on locally and this works with one exception.

If a user requests a list of published apps he has access to via logging on to the farm or via NFUSE, contacts a server (via TCP/IP + HTTP resolving ICA) that he doesn't have the right to log on locally to, that server will not give him a list of published apps on the other farm servers he does have access to.... In turn if I give that user access to log on locally to the server he doen't need, it will provide a list of apps on the servers he needs.

I get the feeling in order to have pubilshed apps browsing work correctly all users must have some basic right on all of the servers in the farm, but I do not want them to be able to log on anywhere they want... Any Ideas?

 

[JeffHicks]

Here is how I handle it. I create a global Citrix Users group that any and every Citrix user is a member of. I grant that group the logon local right. I then create groups per application and add the users to the respective group. The final step is to disable RDP (or restrict it to just admins if you wish) and check the Run only Published Applications option for the ICA Connection. Thus, rather than trying to restrict log on local rights by user, I control their access to the servers by restricting their access to published applications. The only way around that security setup would be to get physical access to the servers (which opens up a whole other can of worms).

 

[JeffHicks]

No edit on this forum. hmmmm....

I should have stated that I grant the global group the logon local right to every Citrix server. Not sure if that was clear or not.

 

[rayzze]

I have been reluctant to do this because I have a few people who directly connect to a server to get a desktop with a specific app. But if I just published those individual desktops and gave those special users rights...

Thanks, that would definitely work.