Configuration of a secure RDS Gateway + RemoteApp (Signal, Threema) with Hardening (Zero Footprint)

Experience with GPO, FSRM, and configuring Electron applications (Signal) in a RemoteApp environment is required.

I am looking for an experienced system administrator (Windows Server) to set up an isolated workspace based on RDS.

The main goal: to ensure the operation of messengers (Signal, Threema) and a browser through a secure gateway without storing any data on the user's device (Zero Footprint / Secure Enclave concept).

What needs to be done (Briefly):

Deploy RDS: RD Gateway + RD Web + Session Host on Windows Server 2019/2022 (Single Server). Access strictly via HTTPS (443).

Publish RemoteApps:

Signal Desktop & Threema (Electron applications, require proper installation in the RDS environment).

Microsoft Edge (with strict security policies and uBlock).

Notepad++ and Explorer (isolated).

Security (Hardening) — The most important stage:

DLP / Zero Footprint: Complete blocking of the clipboard (client<->server), disabling drive and printer redirection, protection against screenshots.

Isolation: Configure FSRM (quotas, blocking .exe), AppLocker, hiding system drives. The user should only see their network drive M:.

Login protection: Configure IPBan (protection against brute force), SSL certificate (Let's Encrypt/Commercial).

Scripting: Implement "Logoff" scripts upon disconnection (1 minute) and a forced session reset button.

Requirements for the performer:

Experience with Group Policy (GPO) at an advanced level.

Understanding the specifics of Electron applications (Signal/Threema) in a terminal environment (memory optimization, updates).

Experience configuring FSRM and AppLocker.

Location: Considering candidates from Ukraine, the EU, and other countries (except RF/RB).

Initial data:

There is a VPS (Windows Server 2022, 8GB RAM), domain, SSL.

A complete detailed technical specification (10 sections) is already prepared and attached to the project. Read it before bidding!

Project delivery:

Demonstration of work according to the checklist, transfer of all accesses (Admin), removal of temporary accounts of the performer. Further paid support (software updates) is possible.