You can enable client filesystem for the application in the following steps:

• Turn off 'Disable filesystem mapping' option in the server configuration
• restart the Winflector server
• then the application will see client disks under 'c:\wfmount\.

As per above, I would like to limit users' access to the server's file system and to not elevate users' permissions to the file system on the client. Is the following still the only or best way of achieving this?

The only way to limit Winflector user access to server files is to choose Windows authentication in Winflector and set appropriate files and folders permissions in Windows.

I have setup an instance of Winflector Server on Windows Server 2016 setup as a DC. When I set the authentication method to "Local Windows/Active Directory", I can successfully login to Winflector Client from another machine with either an administrator or a standard user account. However, I can only launch applications successfully if the account used to login to Winflector Client is an administrator account. If I login with a standard domain user account, applications fail to launch with the attached error message. If I add a domain user account (that precipitated this issue) to the administrators group, I am able to successfully launch applications.

Is it a prerequisite for the account that is used to launch an application via Winflector to be an administrator account? If so, it could be that a standard domain user launching an application via Winflector will have elevated permissions on the client machine via the WfMount folder.

I had read that article and applied the group policy changes but it didn't resolve the issue.

If Winflector runs as a domain administrator account, will Winflector provide elevated permissions to the server's file system and the local client's file system (via the WfMount folder) to which the domain user launching the application would otherwise not have access?

Thanks Mirek, Without updating Windows user folder permissions, is there any way of blocking an application launched via Winflector from accessing the server's file system with the exception of the "WfMount" folder?

I revoked write permissions to "C:WfMount" on the server for the user that Winflector runs as but the application on the client was still able to write to that path.

Do permissions revert to those set on the client for the local directories that "C:WfMount" is pointing to?