Block nested RDP sessions in a Remote RDP Jump

Hello,

We are looking for a way to block nested RDP sessions inside a remote RDP jump.

We tried adding mstsc.exe under Application Sharing Restrictions on the relevant Session Policy, but does not seem to work.

For reference, in a similar solution by Fortinet (FortiPAM), there is the option of applying a Windows App Profile where you can block specific executables (see below).

Do you know if this is supported in general or I’ve missed something in our configuration?

Thanks in advance.