SecurityDescriptor is an optional registry value that can be added to a RemoteApp key.

It contains an SDDL string that defines which users/groups can launch this RemoteApp.

Would be great to add support for editing this (with a nice user/group picker).