Information
This policy setting specifies whether Remote Desktop Services retains a user's per-session temporary folders at logoff.
The recommended state for this setting is: Disabled.
Rationale:
Sensitive information could be contained inside the temporary folders and visible to other administrators that log into the system.
Impact:
None - this is the default behavior.
Solution
To establish the recommended configuration via GP, set the following UI path to Disabled:
Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Temporary Folders\Do not delete temp folders upon exit
Note: This Group Policy path is provided by the Group Policy template TerminalServer.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.
Note #2: In older Microsoft Windows Administrative Templates, this setting was named Do not delete temp folder upon exit, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative Templates.
Default Value:
Disabled. (Temporary folders are deleted when a user logs off.)
Item Details
Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION
References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|9.2
Control ID: 4fe8996dcedfa20b2a1ff5c68c116e700a077a90aa1548aa4661eaf0be75771e