When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected.
By default, these disconnected sessions are maintained for an unlimited time on the server.
If you enable this policy setting, users are prevented from using Windows Installer to install patches.
Patches are updates or upgrades that replace only those program files that have changed.
In Security Filtering delete Authenticated Users, add RDS Server Computer Account, and the security group created in previous step. As a result, users cannot use the Hardware tab to view or change the device list or device properties, or use the Troubleshoot button to resolve problems with the device.
Some group policies might not be available in your group policy manager. Enable – Remove Security tab Removes the Security tab from File Explorer.
In the Show Contents dialog box in the Value column, enter the Control Panel item’s canonical name. [Computer Configuration\Administrative Templates\Windows Components\Windows Update] Enable: Do not display ‘Install Updates and Shut Down’ option This policy setting prevents users from using Windows Installer to install patches. If you enable this policy setting, select a drive or combination of drives in the drop-down list. Also, the drive letters representing the selected drives do not appear in the standard Open dialog box.30 minutes): Set time limit for disconnected sessions You can use this policy setting to specify the maximum amount of time that a disconnected session remains active on the server.By default, Remote Desktop Services allows users to disconnect from a Remote Desktop Services session without logging off and ending the session.