Global control (or Block) of "Local Resources" for ISO 27001 and ENS compliance

Global control (or Block) of "Local Resources" for ISO 27001 and ENS compliance

1 vote

avatar
kcardenas

Dear Support Team,

After analyzing the behavior of the entries with support case (00126025: [Support Case] Devolutions - RDP Entries - Local Devices and Resources), we would like to focus this request on an essential governance and compliance requirement (ISO 27001 and the Spanish National Security Framework - ENS).

Currently, any user with access to an entry can edit the "Local Resources" tab, and this configuration propagates, allowing local drives to be redirected to the servers/virtual machines within our infrastructure. This represents a critical security risk that we must prevent and mitigate.

For this reason, we would like to formally escalate this requirement as a Feature Request:

  1. Global policy enforcement (Vault / Data Source Policy): The ability to centrally disable the "Local Resources" tab (or specifically drive redirection) for all entries in the vault.
  2. Role-based edit restrictions: Restrict modifications to this setting so that it is locked by default for standard users and can only be enabled by roles with elevated administrative privileges.


Note: If granular permission control is not feasible, completely disabling this feature at a global level would be an acceptable alternative for our organization.

The core issue is the current inability to apply a global lockdown or regulatory control within the application.

Account Details:

  • Product: Remote Desktop Manager (Cloud Workspace)
  • Scope: Vault / Data Source Security Policy


This limitation represents a critical compliance blocker for us, as it breaches our internal security policies.

Best regards,

All Comments (1)

avatar
Min Destens

Hello,

I would recommend enforcing this restriction through Group Policy (GPO) rather than through RDM. This allows you to disable drive redirection at the operating system level, ensuring that it is blocked for all users. Even if a user enables drive redirection within an RDP session, it will still be prevented by the policy.

If your goal is to apply this restriction regardless of whether users connect through RDM or another RDP client, you should configure it on Windows using the native Group Policy settings:
https://learn.microsoft.com/en-us/azure/virtual-desktop/redirection-configure-drives-storage?tabs=group-policy&pivots=azure-virtual-desktop#configure-drive-redirection-using-microsoft-intune-or-group-policy

If you only want to enforce this restriction within Remote Desktop Manager, you can use the DisableLocalDriveSharing policy:
https://docs.devolutions.net/rdm/knowledge-base/how-to-articles/apply-policies-gpos#disable-local-drive-sharing-of-rdp-entries

The reason I recommend the Windows policy is that RDM alone cannot fully enforce this restriction. For example, if a user connects using the native Windows Remote Desktop application instead of RDM, they can simply bypass the RDM-specific configuration.

For your use case, I believe the Windows Group Policy approach is the most appropriate solution.

Regards,
Min