We just moved servers offsite to a hosted service after a near disaster with onsite equipment. We have a VPN connection to the hosting service that allow printing directly to our IP printers across our sites and direct access from desktops to shared files
and our DB2 server.
This has resulted in unacceptable latency with some applications, so we have migrated almost everyone to a 2016 RD server also at the hosting service. This has greatly improved performance as well as removed the task of deploying several applications
to 50+ computers. These are full desktops, not remote apps, since we have too many apps to deploy them all as remote apps.
However, we have a site license for a particular accounting package that we do not want everyone to be able to use. Sometimes users just get too curious. We used to limit access to it by installing it only it on accountants' workstations. But in the RD environment,
I need to install it on the server in a way that only specific users can run it.
My inclination is to create an AD group, then limit security for the program's EXE in its Program Files folder to include only the usual system admin accounts and the one AD group that needs the app.
Is this a good approach? The only approach? What about setting rights at the Program Files\ThisProgramFolder level instead of just the EXE?
Other/better ideas are welcome as are any pitfalls to avoid. After 20+ years of managing systems and 17 for this particular client, this is a first for me/us.