We are in the process of switching from VNC to Remote Desktop for accessing shared computer resources. Currently we run a mixed environment of Windows 7, Windows XP SP3, and Windows Server 2008 R2. The primary role of these shared servers is to run desktop applications that should only have a single instance running but are managed by multiple individuals. Currently, we have a processing account logged into the console of the processing machines, remote in using VNC and our personal credentials for VNC authentication, then log into the console using the processing account credentials and manage the applications. VNC logs the user access.
We've made the decision to switch to Remote Desktop for our remote access in order to eliminate any shared passwords. However, I am at a loss as to how to implement this to allow users to log into a shared desktop using their personal credentials. Our consultant has recommended using "impersonation" as he calls it, but I'm finding no details on how to implement impersonation.
We've decided to use Remote Desktop Gateway to handle 2 stage authentication for shared desktops. Users log in to the gateway using their credentials, then proxy through to the desktop using the shared credentials. Unfortunately, this does not resolve shared passwords for processing accounts, but it does leave us the audit trail necessary to log access to shared accounts.