>Can you please explain what file system permissions should be given or denied to users of a remote app. Also, what should and shouldn't be locked with AppLocker?


Whitelist a filehash of the allowed apps; it's pretty painless. Then, if the user tries to fire up another app that's not approved, AppLocker will block it.