I would like to know how the issue described by Ruslan Nalivaika in the article was resolved.

Question

We reviewed an issue in which users from the account forest, who are added to a domain local security group in the resource forest within Active Directory, are able to see all Remote Desktop Services (RDS) applications instead of only the applications explicitly assigned to them.

This is a newly configured setup, and the cx expected behavior has never functioned as intended for users from the resource forest. However, the same configuration works as expected for users from the local domain forest.

Reference: https://learn.microsoft.com/en-us/answers/questions/187004/remoteapp-user-assignment-not-filtering-for-member

Answer 1

Hello,

This issue is not related to Windows for Business or Windows 365 Enterprise. It is specifically tied to Active Directory multi-forest configurations and Remote Desktop Services (RDS) application assignment filtering.

What you are seeing is a limitation in how RDS RemoteApp user assignment works when domain local groups in a resource forest contain members from an external account forest. The filtering logic in RDS relies on token evaluation at logon, and when the user is from a different forest, the group membership is not being correctly enumerated for RemoteApp assignment filtering. As a result, those users see all published applications instead of only the ones explicitly assigned.

This behavior is documented in several cases, including the Microsoft Q&A thread you referenced. The key point is that RemoteApp assignment filtering is not fully supported across forest boundaries when using domain local groups in the resource forest. It works correctly for users in the same forest because the SID resolution and group membership evaluation are handled natively. For cross-forest users, the filtering logic fails to apply as expected.

The current best practice is to use universal security groups that are replicated across both forests, or to assign RemoteApp permissions directly to the user accounts or global groups from the account forest. Domain local groups in the resource forest should not be used for RemoteApp filtering when cross-forest membership is involved. If you must maintain the current design, you will need to adjust group scope or restructure the assignment model to ensure proper filtering.

At this time, there is no hotfix or cumulative update that changes this behavior. It is a design limitation rather than a bug. If this functionality is critical, I recommend opening a support case with Microsoft to confirm whether there are any roadmap changes planned for RDS in multi-forest deployments, but the most reliable solution is to redesign the group assignment strategy using universal groups.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.