how often does the letter s occur in:
q: remoteapp: can one be sure that no unwanted programs are started? back story:
in our company, we bought a client/server process management software from which the client directly communicates with an sql server. this is in my opinion a major security flaw, because it is possible to read the sql server password from the registry on all client computers. this sql user has access to the whole database. the software is user based, which is obviously only placebo and adds no security.
the manufacturer of the software is aware of the problem, but only offers a web access module to prevent the direct communication with the sql server, which would cost additional ~5000$.
so i wondered if it is a good idea to set up another windows server where i install the client software and publish it as remoteapp.
i wondered if this would be sufficient to prevent users to start any non-published programs? i know that if the client software starts any additional software, the user would have access to this software too. this is only the case for pdf readers or other text editors.
considering this information, can i assume that it is not possible to read out the registry keys and/or start any software (network sniffer or so on) that is uploaded by a remoteapp user? 

a: yes.
you can manage this using software restriction policies and/or applocker on the remoteapp server. you definitely do not want the client running on end users workstations due to the security concerns that you mentioned, unless those security concerns are written off by management following a thorough and well-documented discussion of the risks.
if you wish, its possible to take additional steps to lock down the remoteapp server. for example, ive changed remoteapp users default shell from explorer.exe to logoff.exe to prevent non-remoteapp rdp logins.
you are correct in not expecting remoteapp itself to provide a layer of  security. all it does is adjust the users view of the application to make it look like it is running locally. you still need to manage the remoteapp servers security configuration as though the remoteapp users are logging in normally via rdp.

user
The given text has 141 "s"s.
assistant