Terminal server app security

I have installed Win2k3 Standard sp2 with terminal server.

I want to restrict some users to use only a certain application and

not all the installed apps and server resources.

I have achieved this by simple adding the program executable name and

his path on Terminl server

Configuration > Connections > Rdp-Tcp > Environment > "Start this

program at logon"

When I start the rdp session, the user can see only the specified app,

whit no desktop icons, app

bar, right mouse click works only on the started application,

but I have discovered that if I use the application "Open" option, I

can browse the server/network file system and even delete files!

My question is: This is the right procedure ? How can I eliminate this

security problem ?

Thank you.