Control Who Can Use RDP Drive Redirection on Windows 2008 R2

Before we can proceed, you need to refer to this post to create 2 RDP listeners. Once you have multiple RDP listeners, the first step we need to do is to open Remote Desktop Session Host Configuration. You can do it by typing tsconfig.msc from run. As you can see in the screen captures below, there are actually 2 connections.

Assuming RDP-Tcp allow drive redirection and only Administrator can use it while RDP-Tcp-normalUser does not allow drive redirection and user1 can use it. So click on RDP-Tcp-normalUser and change the following:

Add in user1

Configure drive redirect, for this example, i disable all Redirection features.

Click on RDP-Tcp and make sure no user1 in this profile.

From client, you can do drive redirection by go to Local Resources tab and click More

A new Window let you select which drive to redirect

So if you login using Administrator with the default connection (default port 3389), you should see the mapped drive under Others.

If you login using user1 with the new connection (port 3390), you should not see any mapped drive.

Create 2 RDP Listners in Windows 2008 R2

Remote Desktop Protocol (RDP) allow user to remotely control a remote PC. By default, there is only one RDP listener and so why i want to create more that that? My reason is because i want to create 2 RDP profiles where only one profile allow drive redirection. I will discuss more on how to achieve that in the other post and for this post, i will show you how to create 2 RDP listeners.

Open your Registry Editor by typing regedit on the run prompt. Once you in the Registry Editor, go to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp and right click and select Export.

Go to the path where you save the exported registry key and right click and select Edit

Change the highlighted part with a new name. Save the file.

Double click the registry file will add the new registry key.

Yo can now change the port number, in this case, i change it to 3390 

After change, you need to restart Remote Desktop Service

You can check using netstat -an to confirm new port (3390) is indeed listening.

You can now login using this new port