I've got a work-group of 5 people. All of them have their dedicated machine with Windows 7. They are all connected to a central server running Windows Server 2008 R2, currently mainly offering the file-server role, one shared data directory for all.

Now, what is considered best-practice when these users want to connect to "their desktop" while on the road. Possibly storing everything desktop-related on the server so not all these desktop machines have to be running 24/7?

Some more details:

  • I could port-forward the remote-desktop port 3389 to different machines via different public ports, but if possible, these machines should be allowed to be powered down. Also, I think, security-wise, exposing all these machines to the WAN is tricky, even on non-standard ports. Only having one machine, the server, handling remote connections sounds better, possibly executing a personalised desktop environment on the server. Possible?

  • So far, I've tried to separate user data from the users' machines as good as possible, but had little luck. On *nix having a homedir via NFS is simple, in MS world "Remote profiles" seem to be considered unreliable and get bogged up once these "profiles" get big and have to be pulled over the network on each login. mklink and thus warping a local Win7 Profile dir to a server share seems hackish and does only work on the most up to date Win OSs. Also I so far ran into all sorts of permission and architecture problems, for example when I try to use that same Win 7 Profile dir with a similar set-up user on Win Server locally, ouch.

  • Being on a middle ground right now, I have some data server-side and some-local data. For example people's deskside Outlook pulls files from the server (which is considered unstable by MS, btw, at least as I understood it; having fingers crosses when data eventually gets corrupted).

  • More hackish middleground: I emulate a server-side Desktop by having the same apps on deskside machines and on the server. People log in to the server only, with a same-username,/ same-password Profile (ouch) on the server and find a desktop similar to theirs on the real deskside system (arg!).

  • Is Microsoft Terminal Services a solution? So far I couldn't wrap my head around what it actually does. Or how it could help me.

  • Any comments on what I've done so far? How bad it is, why I wouldn't work, etc?
    – isync
    Nov 28, 2011 at 21:42

2 Answers 2


The Terminal Server is the way to go.

Or the other way is to VPN into the network and then do RDP on the workstation(s).

It's up to you what is the best.

  • 1
    +1 Terminal Services is what you're looking for. To reduce the costs, check to see if you're eligible for an Action Pack Subscription.
    – Nic
    Nov 28, 2011 at 21:51
  • At Joel and mailq: From what I've researched: TS Gateway controls access, Remote Desktop Session host + ActiveDirectory manages a central user db, making my "duplicate accounts" obsolete. BUT: how can I unify a User's Personal Files folder and Desktop environment across 'local on a machine' and 'via RDP'? How can I have true server-stored Profiles and user data dirs? Can I? And: does TS mean the users work "remote" on the server even when sitting in front of their high-powered x64 machines? That's thin-client computing to me. Any MS fat-client solutions, now that I've got these?
    – isync
    Nov 28, 2011 at 22:07
  • TS Gateway not only controls access, it creates a connection to their workstations. The drawback, of course, is that the workstations need to stay on, and that you don't centralize the storage or sessions. If you wanted to centralize storage and sessions in one server, then you'd go with Remote Desktop Session Host. You can also use roaming profiles to keep data in sync across desktops (when working locally) and RD Session Host (when working remotely).
    – Joel
    Nov 28, 2011 at 22:15
  • "roaming profiles" is what I referred to as "Remote profiles" wrongly in my original post. I read about it that it gets corrupt once these profiles get big in some way (cached data or so), slow logoffs etc. Is this resolved by now?
    – isync
    Nov 28, 2011 at 22:26
  • -1. Terminal Server is not the way to go given Terminal Services Gateway available. Let them keep their worksations. There may be good reasons for that. Use the Gateway Services to protect the machines and allow connection via http.
    – TomTom
    Nov 28, 2011 at 22:50

Terminal Services Gateway Server. Here is Microsoft's step-by-step guide.

It will give you granular control over who can access what, and it only exposes one port (port 443) to the Internet.

  • +1. Thanks for reading the documetnation, unlike mailq.
    – TomTom
    Nov 28, 2011 at 22:50
  • After everyone's comments this is what I plan to do (RFC!): I let everyone keep their fat-clients/workstations. I grant access to individual machines via RDP, either through TS Gateway or the router and non standard ports. Below that "user-layer" I use roaming profiles and Folder Redirection Policies to consolidate data and profiles as much as possible on the server to centralise backup. Machines need to be humming for remote users to be able to log in, at least until I implement a Wake-on-LAN scheme to have the machines sleeping until a user wants to connect.
    – isync
    Nov 28, 2011 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.