We have an RDS server set up on Server 2012 R2. It has Quickbooks Desktop Enterprise Solutions: Accountant 17.0, Quickbooks Premier Accountant Edition 2016, and Quickbooks Premier Accountant Edition 2017 installed. There are fewer than 10 users.
The RDS users all have local accounts, though the RDS server is part of a domain. (We figured that by sticking with local accounts, that would ensure that the users had absolutely no access to any other network resources.) All of the RDS users are members of the Remote Desktop Users and Users groups.
The standard user is locked down and does not have access to browse the C: drive. When setting up each user, we left administrator access enabled, then opened the database files in Quickbooks so they would show up in the list of recently opened files, and then removed administrator access. This gave them the ability to open the database files through Quickbooks while restricting their ability to browse the C: drive.
The folder structure is a folder called Quickbooks located on the root of the C: drive, with subfolders for each user's company files. Each user is the owner of its respective folder, and Creator Owner has full control. Also, the local administrator, domain administrator, and system accounts have full control to the Quickbooks folder and all of its subfolders. The users cannot browse to any folders (through the Quickbooks file-open prompt) aside from their own folder.
The users who are using QB AE 2016 and 2017 do not have any problems. When the user who uses QB Enterprise 17.0 attempts to open a company file, the following error appears:
"This action requires Windows adminsitrator permissions." The choices are Continue or Cancel. Cancel, unsurprisingly, cancels the attempt to open the company file, and clicking Continue returns the following error:
"We're sorry. Quickbooks encountered a problem. Error codes: (-12, 0)."
If I make the problematic user a member of the administrators group, they are able to open their company files with no issues. After removing administrator permissions, the above errors return.
I have made the following changes (found during Google searches) with no effect:
--Made the QuickBooks DB27 user a member of the administrators group
--Changed the QuickBooks DB27 service to run as Local System and gave it the ability to interact with the desktop.
--Changed QBCFMonitorService, QBIDPService, and QuickBooksDB27 service to all log in as the domain administrator account.
--Disabled UAC in the registry.
--Server has been rebooted as needed throughout the process.
I'm about out of ideas at this point.