Share via

Security Principal Discrepancies in RDWeb Published Applications vs. Full Desktop Sessions

LinChaoTTDC 0 Reputation points
2026-04-27T03:32:35.1833333+00:00

Hi all! We are streamlining application security on a Windows Server 2019 cluster by stripping the default "Users" group permissions from specific program directories and replacing them with granular departmental groups. While staff members can execute the binary without issue when logged into a full desktop session via MSTSC, the deployment fails when they attempt to launch the same tool as a published RemoteApp through the RDWeb portal. It appears that the RDS management layer or the connection broker requires a specific service identity or a broader built-in security principal to bridge the gap between the web feed and the file system. Beyond the standard authenticated user, which specific system-level account or group does the RDWeb process utilize to authorize the initial execution of a virtualized application?

Windows for business | Windows Server | Devices and deployment | Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Tracy Le 9,280 Reputation points Independent Advisor
    2026-04-28T14:07:18.1833333+00:00

    Hi LinChaoTTDC,

    Just doing a quick follow-up to see if your RemoteApp publishing issue is fully resolved. Did explicitly granting "Read & Execute" permissions to the NETWORK SERVICE and SYSTEM accounts bridge the gap and allow your staff to launch the apps through the RDWeb portal again?

    If you are still hitting access denied errors or if the connection broker is still failing to spawn the app, just drop a comment. I'm always happy to help!

    Tracy Le.

    Was this answer helpful?

    0 comments
  2. Tracy Le 9,280 Reputation points Independent Advisor
    2026-04-27T03:53:38.3033333+00:00

    Hi LinChaoTTDC,

    You have hit a classic RDS security boundary trap. By stripping the default folder permissions, you inadvertently removed the system identities that the Remote Desktop infrastructure relies on to validate and publish the application.

    Here is the architectural difference: While a full desktop session (MSTSC) executes the app purely under the logged-in user's token via explorer.exe, a RemoteApp is initialized by the Remote Desktop Services (TermService), which runs locally under the NETWORK SERVICE account.

    The Fix: To allow the RDWeb process to authorize and launch the virtualized application, you must explicitly grant Read & Execute permissions to the following two built-in principals on your application's executable and directory:

    NETWORK SERVICE

    SYSTEM

    Without NETWORK SERVICE having read access to the binary, the connection broker cannot bridge the gap to spawn the rdpshell.exe process for the RemoteApp feed. It fails before the user's specific departmental permissions are even evaluated.

    Tracy Le.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.