When setting up a terminal server for Intouch Thin Clients, the RDP client connection should be configured to auto launch the application named "D:\Program Files (x86)\Wonderware\InTouch\view.exe".
Note: for newer versions of the RDP client it is necessary to add the below to the connection file manually in order to specify the application to launch. Microsoft in their infinite wisdom decided to hide the “Program” tab.
alternate shell:s:"D:\Program Files (x86)\Wonderware\InTouch\view.exe"
When you establish a RDP session with a program specified, it will run just that program.
Therefore the user has zero access to the desktop. Therefore there is less chance of them doing anything malicious. It’s not the only method, they should be users on the machine for starters, but its another.
Additionally, all those programs that run in the background normally consume resources. As the amount of sessions increase this can add up.
Also also, if view.exe crashes, the RDP session will drop out. This normally works well with a client which auto reconnects because it will reconnect and start the Intouch application up again.