13

Is there any impact on the server performance in case I don't log off after having used Remote Desktop Connection?

5 Answers 5

21

Yes there is an impact. Yes it is recommended that you log off. If you don't log off, all of the resources (such as RAM) that it took to sustain your interactive user session stay in use. You keep one of two administrative connections in use so that others can't connect.

What's actually recommended is to not RDP to your servers at all. This is what the Remote Server Administration Tools and Powershell Remoting are for.

I also wish to say that there is a much larger security risk involved when you log in via RDP versus a network logon, e.g. through RSAT/MMC.

5
  • 4
    Who recommends not RDP'ing to your servers?
    – DKNUCKLES
    Aug 21, 2013 at 18:52
  • 6
    @DKNUCKLES Microsoft has made every effort to make it so that you rarely ever have to log in to a server. RSAT, Server Manager 2012, PS Remoting, Server Core edition, etc.
    – MDMarra
    Aug 21, 2013 at 18:56
  • 4
    They've also released TSGateway as well. Just because they've released methods so that you don't have to use RDC, doesn't mean that it's recommended by MS or best practices that you don't use RDC. I have a bank card that allows me to bank without going into the bank, but does that mean it's best practices to not go into a branch and see a teller?
    – DKNUCKLES
    Aug 22, 2013 at 12:41
  • @DKNUCKLES I don't know about wherever you are located, but here, bank branches definitely want to make bank customers feel that way! In my town, only one bank (not branch or office, but bank!) will let you walk into the building, see a teller and do something as trivial as deposit some cash with them into your own account with them.
    – user
    Aug 22, 2013 at 21:24
  • 1
    @DKNUCKLES - I recommend not RDPing to your servers, because it uses more resources, takes longer, and uses interactive logons which open you up to a larger array of security vulnerabilities than network logons do.
    – Ryan Ries
    Aug 26, 2013 at 19:23
9

This might be slightly off-topic, but anyway:

It's considered a good practice by all the administrators I know to logoff when your done. Although the performance gain probably is neglible, there are other things to consider:

  1. A logged-on session tells other administrators that you're working on that server.
  2. By logging off when done, you work in a structured way (disregarding any "administration servers" from this rule, of course).
  3. The more processes running on a server, the larger the chance of memory leaks.
  4. Especially for virtual servers and graphic-intensive consoles, there is actually a measurable RAM penalty in large environments with a lot of lingering RDP sessions.

In short, do your fellow administrators a favor and log off. Everybody wins.

5

Besides the resource impact that Ryan Ries described, the other problem with long-running RDP sessions is if your password changes then any sessions currently open on a server will cause a huge number of authentication errors on your Domain Controllers.

4

Sorry to disagree with some of the above, and I know questions like this always bring out references to "best practices", personal preferences, Etc., but apart from the memory footprint on the remote server and the potential for one of the administrators' desktop processes producing unexpected CPU load, the biggest risk is one of security.

And, whether you're using RDP or RS/AT, it's the same issue. If you have an administrative token in-play, and the token lifetime is protracted, the risk of token stealing is higher than if you don't remain logged in with an administrative token.

Long story short, use low-privilege accounts for as much as possible, and only logon/escalate to a administrative token when absolutely necessary.

It's all too easy to use tools such as incognito to steal a token, and replay it against another system.

1
  • I agree with you that the biggest risk really is one of security, but I disagree with you that your amount of exposure is more or less the same using either RDP or RSAT (which uses network logons as opposed to interactive logons.) I don't really want to talk too deeply about it here because it gets 'exploity' very quickly but I promise a full-on RDP seesion exposes you to more risk than a remote administration connection over RSAT/MMC/PSRemoting for at at least a couple of reasons.
    – Ryan Ries
    Aug 22, 2013 at 0:52
0

My guess is that it is almost none (provided that you don't leave some applications running).

The only thing is that you use up the remote session. There is a limited number of them (if I remember correctly, on Windows Server 2008, it is four remote sessions at maximum). So the hanging session can at some point prevent somebody from connecting.

Actually, as an administrator, you are allowed to terminate established sessions, freeing them for yourself. I don't know how it is if you connect as an ordinary user, though.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .