Patent ID: 8370510

Claim:
A method comprising: receiving at a first server a request over a public network from a user computer, the request including a user identification; querying, by the first server, a directory service for an identity of a virtual machine on a second server that is assigned to the user identification; in response to the query, receiving by the first server, a remote desktop protocol file from the directory service, the remote desktop protocol file corresponding to the virtual machine; sending, by the first server, the remote desktop protocol file and the user identification to the second server; identifying, by the second server, the virtual machine based on the remote desktop protocol file; determining, by the second server, that the virtual machine is configured to execute a first application and a second application, the second server being configured to enumerate to the first server each application that the virtual machine is configured to execute in response to receiving a remote desktop protocol file; sending, by the second server and to the first server, an indication that the virtual machine is configured to execute the first application and the second application; determining, by the first server, that the user identification is authorized to access the first application, and not authorized to access the second application based on the indication that the virtual machine is configured to execute a first application and a second application; and in response to determining that that the user identification is authorized to access the first application, and not authorized to access the second application, returning to the user computer an indicator for the first application but not the second application.