I have a Windows 7 SP1 Ultimate box which is my main machine / "server". I also have an 'accountant' account (of type: standard user) which is for my accountant to RDP into the machine to check up on my QuickBooks from time to time. The actual QuickBooks files are sync'd using DropBox between 1) my user account on main machine 2) accountant account on main machine and 3) my account on my laptop. Since only one person uses QuickBooks at a time (and dropbox has a revert feature) this isn't a problem.
I would like to harden the setup a bit more by the following:
- Prevent access to any drive that is not "C:". Currently I've added NTFS permissions to DENY access to the accountant account but that doesn't work for FAT drives nor for USB drivers whose drive letters change
- Prevent the accountant account from shutting down the machine
- Prevent the accountant account from browsing C:\ 'freely'
My guess is these requirements are not new or exotic so may have been already addressed by some tool in the IT industry. Granted it's not a server OS, but how can I get as close to my needs as possible?