Block file transfers in RDP connections?

[Nick1]

Is the RDP application visibility granular in that we can figure the PAN to allow remote desktop connections but disable the mapping of local drives to prevent file transfer? 

[essnet]

Hello,

There is some encryption (which is on by default I think) on latest versions of RDP, so I would say it's hardly doable , except if "feature" activation is negociated before encryption happens may be ....

Currently PAN doesn't offer this granularity (in which I would be interested too) or I didn't find it.

[Nick1]

Yeah I think I read somewhere that it was 40-bit encryption which by today's standards seems a bit weak.  But our PANs do SSL decryption, and I realize this probably isn't SSL, but I would think it reasonable that the same decryption procedures could be modified to work with the RDP protocol as well.  Oh well maybe in a future release.  Thanks for the response. 

[hiptsg_admin]

Nick,

How about using GPO to disable drive mappings instead?

Tom

[Nick1]

That's an excellent idea.  I'd have to make an exception for IT but that's not a problem.  Our AD gurus have been talking about some new functionality they have around GPO's called GPO Preferences or something like that.  I'll ask them to see if this is an option.  Thanks!

[nmsecteam]

Did not see a response from Palo Alto on the same.

Does anybody know, if this is doable???