Tag Info

Hot answers tagged

30

It turns out that much of the configuration data for RDSH is stored in the Win32_TSGeneralSetting class in WMI in the root\cimv2\TerminalServices namespace. The configured certificate for a given connection is referenced by the Thumbprint value of that certificate on a property called SSLCertificateSHA1Hash. In order to get the thumbprint value Open the ...


19

Generally, I'm opposed to the idea that a Windows server should be rebooted on a regular schedule EXCEPT in relation to TS/RDS servers. We reboot ours every day. It clears up old sessions, releases in use resources (CPU, RAM, file handles, etc.), so my opinion and suggestion would be that you do configure a daily scheduled reboot of your RDS servers. Note ...


15

Users refuse to log off instead of disconnect Setup the appropriate group policies to auto-logoff them. You can separately control an idle timeout and logoff. That should certainly minimize some of the issue during the day. I restart my 3 server TS farm daily at 3:00am. Because, yes crap can build up over time when you have lots of people using a ...


12

If the files are stored at the filesystem level without user-based encryption and with no ACLs then yes, run away. If ALL data was stored within the database then I would feel slightly less hesitant but even still, any vendor that says it's ok (especially when HIPPA is in the mix) to use shared ID's is suspect in my book. If you join the machine to a ...


10

Yes, you can use your DC as a RDP Licensing server. I do so myself. However, after a while, I started thinking I should have made it a single purpose VM instead but not because of any problem, just a foreseeable future where it ties in this function into my DC. But I have no problem with this set up particularly. So my recommendation is that while it is ...


9

As Chris S mentioned, there are several things that can contribute to poor remote desktop performance. From my experience, these are the main causes, in order of likelihood. Bandwidth The #1 cause of poor performance with remote desktop is lack of bandwidth. Depending on exactly what is being done, a session can use anywhere from a a few Kbps to a few Mbps ...


8

Try Group Policy Preferences. These provide fairly painless support for the mapping of network drives, and can be set to only apply to particular groups, leaving you to create just one GPP for each group. You could then bundle up any other custom settings for each group into the same Group Policy object while you were at it.


7

I wouldnt be surprised if its caused by the "++" in the name. Try and rename the app?


7

This is a very common issue when RDP is working with insufficient bandwidth or high latency. I'm not sure if it is a protocol bug or an implementation bug (eg. if packets are arriving out of order and not being reassembled correctly, or if they are being misinterpreted altogether), but the solution is either to increase available bandwidth, or adjust the ...


7

If you have a user that this happens to often in a day, give them a straight client/server VPN into the RDP server over their internet connection instead of the MPLS, bypassing QoS and the bandwidth congestion of the MPLS circuits themselves. If all is well for a few days, then you can set aside bugs/issues within the client or server and focus on the MPLS ...


7

Windows XP mode is now free for all versions of Windows 7 Professional and above, is it not? If you're running a domain, you're at least running Windows 7 Pro - why not just use Win XP mode? http://www.microsoft.com/windows/virtual-pc/download.aspx


7

You should be able to accomplish this pretty easy. Setup the client to auto start, use one of these methods. Drop an RDP file or shortcut in their startup group or the system startup group. Set a group policy that will automatically start the terminal server client at logon GPO: User Configuration \ Admin Templates \ System \ Logon \ Run these programs ...


7

Agreed, with profile sharing comes a whole host of issues - not the least of which is the inability to have good accountability (or even ANY accountability) for exactly who did exactly what and exactly when it happened. Find another vendor - one that adheres to basic security principals. Try to find someone with a SAS 70 type II certification if possible. ...


7

You need to use Loopback Policy processing. Move the RDS server to a new OU. Link your "drive restriction" GPO to this OU. Configure Loopback Policy processing in this GPO to Replace or Merge mode (depending on whether you want to replace the users normal GPO settings with these GPO settings or merge the users normal GPO settings with these settings). I ...


6

Gateway wins for me every time. If your clients are running a modern OS (read: XP SP3 or above) with NLA, you can expose dozens or hundreds of terminal servers behind a single interface with a single point of entry. This makes applying NAP much easier, along with controlling who can go where and connect to what. A VPN is more universally accepted (I.e. ...


6

Your setup is suboptimal -- I'd even go so far as to say that the setup you described is actively hostile to VoIP communications. A few key items: 1. You're sending video and audio both ways over the RDP session. 2. You're going over a wireless network. While this often works fine it's generally not a great idea, especially on common WiFi (not dedicated ...


6

I believe you'd still need the terminal server role installed and you'd have to license CAL's for each connection. You can't get access for free like that.


6

Windows by default allows two RDS RDP* connections out of the box, and they are known as "administrative connections" regardless of if the user account is an administrator or not. If you need more remote connections you need to research RDS which requires it's own set of user connection licenses in addition to CALs. RDS can allow for a number of ...


5

As I was setting up an environment in a lab to try this (a simple RDS deployment wihtout a domain), I found the answer to your question, though it's not the one you want to hear. RDS in [Server 2012 and 2012 R2] requires all its servers to be added to a domain. That, according to a program manager at Microsoft on the Remote Desktop Virtualization team, who ...


5

Depending on your cash, time, and the savviness of your users, another idea could be to stand up a second server. You'll still need to reboot occasionally, but you seem to be reaching the limits of a single server. You should be able to use the same client CAL's (licensing's not my strongest area), and depending on your virtualization solution an additional ...


5

HKCU\Software\Microsoft\Terminal Server Client\PublisherBypassList holds the hashes of the issuer certificates which are no longer to raise a prompt according to this blog post and my observations. Finding the "right one" might be troublesome as you don't have the certificates in your store and cannot identify it by just doing a matching. But you could just ...


5

You need to enroll for a machine certificate on the workstation. You can setup autoenrollment via group policy or you can navigate to the cert enrollment website on your CA (https://yourCA/certenroll and enroll manually. Autoenrollment is set under Computer Config -> Policies -> Windows Settings -> Security Settings -> Public Key Policies. EDIT After getting ...


5

The real answer is to use remote control. A couple of your statements are wrong. You do not need to be an administrator. There is a permission you can grant to non-administrators in order to allow them to request remote control. Go to Remote Desktop Session Host Configuration. Edit the properties of the RDP-Tcp connection. Goto the security tab and click ...


5

If you are copying the files via a mapping to \\tsclient\c (or whichever drive on your client you are transferring from) then the copy will terminate because the connection to \\tsclient is lost when you close the RDP client. Instead, create a mapping to \\<computer_name>\<share> and transfer from there. In this case the copy should continue. ...


5

You're confusing remote desktop for administration with remote desktop services. Remote desktop for administration is for remotely managing a server via RDP. Remote Desktop Services is for remotely working from a server session as if the remote session were your workstation and running applications within that session via RDP. The conceptual aspects may be ...


5

Session-based Session-based refers to Microsoft’s implementation of session virtualisation, isolation which is what was previously called Terminal Services. Each user runs on a server operating system (OS) desktop that is semi-isolated from the other user. Each session shares the same OS kernel. A RDS server is normally a locked down secured environment ...


4

Don't set them up on the same operating system. You don't want anyone to have access to a domain controller other than trusted systems administrators. Ever. If you really must use a single piece of hardware, what you should do is use some virtualization software to separate the roles into two separate server installs that run simultaneously, but are ...


4

I'm guessing that RDP is open to the world to your server (as it's probably the only way you can get in), and that you are being attacked by bots who have scanned their way to your IP. You're saying that there are no other users than your self logged on.. the only thing that makes sense is that there are bots trying to brute-force their way in with known ...


4

I have found a solution to the tsadmin problem. Copy these files from a 2008 server to the Windows 2012/8 computer under C:\windows\system32: tsadmin.dll tsadmin.msc umcRes.dll wts.dll Then import the following registry settings: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{3FCE72B6-A31B-43ac-ADDA-120E1E56EB0F}] ...


4

This is very similar to what we do. We have a single TS Gateway that all our clients enter through. This has connection and resource policies that control which user groups can log on to which servers. Each company has their own self-contained terminal server. Most companies can only log on to the one TS, but for one particularly large client, they have ...



Only top voted, non community-wiki answers of a minimum length are eligible