hello
Environment
- Parallels RAS 21.2, RD Session Hosts on Windows Server 2025, users connect with Parallels Client (Windows 11) to published applications only (no published desktop)
- FSLogix profile containers managed by RAS
- Group policy per Parallels KB 129058: "Allow remote start of unlisted programs" = Enabled
What happened
1. A user started a published application (nomacs image viewer, published as RemoteApp).
2. When opening an image, Windows showed the "How do you want to open this file?" / default app prompt, because no file association existed for that file type on the host.
3. After the user clicked OK, Windows launched the Settings app (ms-settings, ImmersiveControlPanel) inside the RemoteApp session.
4. The user now had full access to the Settings UI of the session host (System, Bluetooth, Network, etc.), even though Settings is not a published resource.
Expected behaviour
A user who is only entitled to specific published applications should not be able to start other, unpublished programs on the session host, including system tools such
as Settings, Control Panel, cmd or PowerShell.
Questions
1. Is it by design that RAS publishing only controls entry points and does not restrict child processes started by a published application?
2. Does Parallels RAS offer any built-in mechanism to restrict which processes a RemoteApp session may start, or is Windows AppLocker / App Control (WDAC) the
recommended approach?
3. Are there known side effects of AppLocker (Exe + Packaged App rules for non-admins) on RAS components (RAS Session Agent, Memshell, 2XDevRedir, Universal Printing, FSLogix)?
Mitigation we applied
- Fixed the missing file associations (DefaultAssociationsConfiguration)
- Disabled Control Panel and Settings for session users (NoControlPanel)
- AppLocker for all non-administrators: only applications from our software catalogue are allowed; system tools and anything outside Windows/Program Files are blocked; Settings is blocked via Packaged App rules
Environment
- Parallels RAS 21.2, RD Session Hosts on Windows Server 2025, users connect with Parallels Client (Windows 11) to published applications only (no published desktop)
- FSLogix profile containers managed by RAS
- Group policy per Parallels KB 129058: "Allow remote start of unlisted programs" = Enabled
What happened
1. A user started a published application (nomacs image viewer, published as RemoteApp).
2. When opening an image, Windows showed the "How do you want to open this file?" / default app prompt, because no file association existed for that file type on the host.
3. After the user clicked OK, Windows launched the Settings app (ms-settings, ImmersiveControlPanel) inside the RemoteApp session.
4. The user now had full access to the Settings UI of the session host (System, Bluetooth, Network, etc.), even though Settings is not a published resource.
Expected behaviour
A user who is only entitled to specific published applications should not be able to start other, unpublished programs on the session host, including system tools such
as Settings, Control Panel, cmd or PowerShell.
Questions
1. Is it by design that RAS publishing only controls entry points and does not restrict child processes started by a published application?
2. Does Parallels RAS offer any built-in mechanism to restrict which processes a RemoteApp session may start, or is Windows AppLocker / App Control (WDAC) the
recommended approach?
3. Are there known side effects of AppLocker (Exe + Packaged App rules for non-admins) on RAS components (RAS Session Agent, Memshell, 2XDevRedir, Universal Printing, FSLogix)?
Mitigation we applied
- Fixed the missing file associations (DefaultAssociationsConfiguration)
- Disabled Control Panel and Settings for session users (NoControlPanel)
- AppLocker for all non-administrators: only applications from our software catalogue are allowed; system tools and anything outside Windows/Program Files are blocked; Settings is blocked via Packaged App rules