Hot answers tagged

45

It turns out that much of the configuration data for RDSH is stored in the Win32_TSGeneralSetting class in WMI in the root\cimv2\TerminalServices namespace. The configured certificate for a given connection is referenced by the Thumbprint value of that certificate on a property called SSLCertificateSHA1Hash. UPDATE: Here's a generalized Powershell ...


23

Generally, I'm opposed to the idea that a Windows server should be rebooted on a regular schedule EXCEPT in relation to TS/RDS servers. We reboot ours every day. It clears up old sessions, releases in use resources (CPU, RAM, file handles, etc.), so my opinion and suggestion would be that you do configure a daily scheduled reboot of your RDS servers. Note ...


17

Users refuse to log off instead of disconnect Setup the appropriate group policies to auto-logoff them. You can separately control an idle timeout and logoff. That should certainly minimize some of the issue during the day. I restart my 3 server TS farm daily at 3:00am. Because, yes crap can build up over time when you have lots of people using a ...


12

Windows by default allows two RDS RDP* connections out of the box, and they are known as "administrative connections" regardless of if the user account is an administrator or not. If you need more remote connections you need to research RDS which requires it's own set of user connection licenses in addition to CALs. RDS can allow for a number of ...


12

If the files are stored at the filesystem level without user-based encryption and with no ACLs then yes, run away. If ALL data was stored within the database then I would feel slightly less hesitant but even still, any vendor that says it's ok (especially when HIPPA is in the mix) to use shared ID's is suspect in my book. If you join the machine to a ...


12

As Chris S mentioned, there are several things that can contribute to poor remote desktop performance. From my experience, these are the main causes, in order of likelihood. Bandwidth The #1 cause of poor performance with remote desktop is lack of bandwidth. Depending on exactly what is being done, a session can use anywhere from a a few Kbps to a few Mbps ...


11

You can type "Query User" into a command prompt on the remote machine to get a very quick look


10


10

Yes, you can use your DC as a RDP Licensing server. I do so myself. However, after a while, I started thinking I should have made it a single purpose VM instead but not because of any problem, just a foreseeable future where it ties in this function into my DC. But I have no problem with this set up particularly. So my recommendation is that while it is ...


9

Run the "qwinsta" command on the server, or with the /server:servername switch. >qwinsta /? Display information about Remote Desktop Sessions. QUERY SESSION [sessionname | username | sessionid] [/SERVER:servername] [/MODE] [/FLOW] [/CONNECT] [/COUNTER] [/VM] sessionname Identifies the session named sessionname. username ...


8

Try Group Policy Preferences. These provide fairly painless support for the mapping of network drives, and can be set to only apply to particular groups, leaving you to create just one GPP for each group. You could then bundle up any other custom settings for each group into the same Group Policy object while you were at it.


7

This is a very common issue when RDP is working with insufficient bandwidth or high latency. I'm not sure if it is a protocol bug or an implementation bug (eg. if packets are arriving out of order and not being reassembled correctly, or if they are being misinterpreted altogether), but the solution is either to increase available bandwidth, or adjust the ...


7

If you have a user that this happens to often in a day, give them a straight client/server VPN into the RDP server over their internet connection instead of the MPLS, bypassing QoS and the bandwidth congestion of the MPLS circuits themselves. If all is well for a few days, then you can set aside bugs/issues within the client or server and focus on the MPLS ...


7

I wouldnt be surprised if its caused by the "++" in the name. Try and rename the app?


7

Mark, I had a lot of fun tracking this down for you. I can totally see where your line of thought is, but you're asking the wrong question. The question should be "Why can't I establish a 'servermanagerworkflows' session on my machine?" If you look in the $enf:systemroot\system32\WindowsPowerShell\v1.0\Modules\RemoteDesktop and open the ...


7

Windows XP mode is now free for all versions of Windows 7 Professional and above, is it not? If you're running a domain, you're at least running Windows 7 Pro - why not just use Win XP mode? http://www.microsoft.com/windows/virtual-pc/download.aspx


7

You should be able to accomplish this pretty easy. Setup the client to auto start, use one of these methods. Drop an RDP file or shortcut in their startup group or the system startup group. Set a group policy that will automatically start the terminal server client at logon GPO: User Configuration \ Admin Templates \ System \ Logon \ Run these programs ...


7

Agreed, with profile sharing comes a whole host of issues - not the least of which is the inability to have good accountability (or even ANY accountability) for exactly who did exactly what and exactly when it happened. Find another vendor - one that adheres to basic security principals. Try to find someone with a SAS 70 type II certification if possible. ...


7

You need to use Loopback Policy processing. Move the RDS server to a new OU. Link your "drive restriction" GPO to this OU. Configure Loopback Policy processing in this GPO to Replace or Merge mode (depending on whether you want to replace the users normal GPO settings with these GPO settings or merge the users normal GPO settings with these settings). I ...


7

HKCU\Software\Microsoft\Terminal Server Client\PublisherBypassList holds the hashes of the issuer certificates which are no longer to raise a prompt according to this blog post and my observations. Finding the "right one" might be troublesome as you don't have the certificates in your store and cannot identify it by just doing a matching. But you could just ...


6

Gateway wins for me every time. If your clients are running a modern OS (read: XP SP3 or above) with NLA, you can expose dozens or hundreds of terminal servers behind a single interface with a single point of entry. This makes applying NAP much easier, along with controlling who can go where and connect to what. A VPN is more universally accepted (I.e. ...


6

Session-based Session-based refers to Microsoft’s implementation of session virtualisation, isolation which is what was previously called Terminal Services. Each user runs on a server operating system (OS) desktop that is semi-isolated from the other user. Each session shares the same OS kernel. A RDS server is normally a locked down secured environment ...


6

The real answer is to use remote control. A couple of your statements are wrong. You do not need to be an administrator. There is a permission you can grant to non-administrators in order to allow them to request remote control. Go to Remote Desktop Session Host Configuration. Edit the properties of the RDP-Tcp connection. Goto the security tab and click ...


6

Your setup is suboptimal -- I'd even go so far as to say that the setup you described is actively hostile to VoIP communications. A few key items: 1. You're sending video and audio both ways over the RDP session. 2. You're going over a wireless network. While this often works fine it's generally not a great idea, especially on common WiFi (not dedicated ...


6

I believe you'd still need the terminal server role installed and you'd have to license CAL's for each connection. You can't get access for free like that.


6

I have found a solution to the tsadmin problem. Copy these files from a 2008 server to the Windows 2012/8 computer under C:\windows\system32: tsadmin.dll tsadmin.msc umcRes.dll wts.dll Then import the following registry settings: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{3FCE72B6-A31B-43ac-ADDA-120E1E56EB0F}] ...


6

As I was setting up an environment in a lab to try this (a simple RDS deployment wihtout a domain), I found the answer to your question, though it's not the one you want to hear. RDS in [Server 2012 and 2012 R2] requires all its servers to be added to a domain. That, according to a program manager at Microsoft on the Remote Desktop Virtualization team, who ...


6

I've found myself in the same scenario as you. Deploying Remote Desktop on a standalone Server 2012 box is quite hard, because the guys at Microsoft don't let you run this on a domain-less network and if you do, you can't manage all the settings. So, you can install a workgroup-based-box and get the Remote Desktop roles working on it. We need also to ...


6

Depending on your cash, time, and the savviness of your users, another idea could be to stand up a second server. You'll still need to reboot occasionally, but you seem to be reaching the limits of a single server. You should be able to use the same client CAL's (licensing's not my strongest area), and depending on your virtualization solution an additional ...


5

Essentially my question boils down to: does a computer joined to the domain automatically trust certificates issued by a CA on the same domain, or would they still need to be manually installed on each client device? Typically, the root certificate for your internal PKI is distributed via GPO to all clients. This makes it "automatic"



Only top voted, non community-wiki answers of a minimum length are eligible