Sometimes you might not want your users to connect to WAC Server and have total access to all programs and resources on the server machine. You can use access control provided by Windows system to do that but it's very difficult to setup correct access for thousands of files on the server.
As a much more convenient and efficient alternative, WAC Server provides a "Protected Shell" program. System administrator can force all or some users to use this program instead of the standard command shell program provided by Windows system.
The protected shell program takes a definition file as input. The protected shell will reject the user to access any commands or programs not defined in this file. For different users, administrator can assign different definition files.
Administrator can also choose to log everything the user has done within the protected shell, including the commands and programs executed, as well as detailed input/output data.
By forcing users to use protected shell, you can be sure that everything is under your control.