Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a requirement of disabling the end users who remote desktop to a Server 2008 R2 machine to capture images digitally through say Print Screen key. Is there a reliable way to do it? I should mention that the remote desktop session runs in full screen mode so the user cannot use Snipping Tool from the client machine to capture the desktop screen. Snipping tool is also disabled on the Server.

share|improve this question

1 Answer 1

The client can use snipping tool, even in full-screen. Even if you find a way to disable the print screen key on clients (You can if you have control of their registry, but that requires completely disabling the key and rebooting the client system. If people are remoting in with their own systems, that isn't going to happen), there are hundreds of screen-capturing utilities that can screenshot and record the RDP window as it is visible on their machine.

And, they can always take a picture with their smartphone. It sounds like you're trying to find a technical solution to a social problem - these almost never work out well.

Unless you're talking about a kiosk system where you have 100% full control of the client, and you have the resources to write a utility that prevents RDP from losing focus, then an RDP client can screenshot and record anything on the RDP session that they want.

Your requirement is not technically feasible. As a client user, I'm either authorized to view the data, or I'm not. If you can't trust what someone will do with the data, don't authorize them to view it at all.


If you have full physical security, then

  • Remove the snipping tool from the client machines
  • Disable the local clipboard in Remote Desktop
  • Use SharpKeys or something similar to set up a custom keymap that disables PrintScrn (remap it to keycode 00)
  • Firewall the machines so that the ONLY server they can see on the network is the RDP server (and possibly the domain controller). The client machines should not be able to access the Internet in any way, shape, or form at any time.
  • Make sure no I/O ports (DVD burner, eSata, USB, etc.) can be physically accessed on the client machines. Keep the machine in a locked cabinet at all times, or I've even heard of companies putting glue into the USB ports.

The idea here is that:

  1. They should have no way to download or install any 3rd party screen capture tools
  2. If they manage to capture the screen, there is no way for them to get the image off of the machine.

This all breaks apart if the user can connect the machine to a different network or if they can physically touch the client machine itself (other than the mouse/keyboard).

share|improve this answer
    
Scenarios like taking pictures with camera/phone is taken care of by other means. That is not an issue here. It is also ensured that RDP session is always in full screen mode and cannot lose focus during the session. Let me put the question in another way. We can apply DRM on emails and documents such that it prevents users from capturing the screen using Print Screen/Snipping Tool. Is it possible to apply DRM on any generic application that has an UI (say like is it possible to apply DRM on notepad.exe such that the client will not be able to capture it's window content using Snipping Tool)? –  Mouzer Jun 7 '13 at 17:00
    
Do you have full, security-restricted control to the client machine (like a kiosk), or are these something more like employee laptops? –  Darth Android Jun 7 '13 at 18:01
    
Yes there are security restrictions implemented. –  Mouzer Jun 8 '13 at 13:58
    
Check the second half of my answer now. –  Darth Android Jun 10 '13 at 16:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.