2

We are in the process of switching from VNC to Remote Desktop for accessing shared computer resources. Currently we run a mixed environment of Windows 7, Windows XP SP3, and Windows Server 2008 R2. The primary role of these shared servers is to run desktop applications that should only have a single instance running but are managed by multiple individuals. Currently, we have a processing account logged into the console of the processing machines, remote in using VNC and our personal credentials for VNC authentication, then log into the console using the processing account credentials and manage the applications. VNC logs the user access.

We've made the decision to switch to Remote Desktop for our remote access in order to eliminate any shared passwords. However, I am at a loss as to how to implement this to allow users to log into a shared desktop using their personal credentials. Our consultant has recommended using "impersonation" as he calls it, but I'm finding no details on how to implement impersonation.

Update:

We've decided to use Remote Desktop Gateway to handle 2 stage authentication for shared desktops. Users log in to the gateway using their credentials, then proxy through to the desktop using the shared credentials. Unfortunately, this does not resolve shared passwords for processing accounts, but it does leave us the audit trail necessary to log access to shared accounts.

  • I'm not sure this is possible on a workstation. On a Terminal Server (Remote Desktop Services) you can take over another user's session through the Terminal (Remote Desktop) Manager, but that's obviously not available as a role to add to a workstation. – gravyface Jul 18 '13 at 23:17
  • That would defeat the purpose of using shared passwords as everyone would need to know everyone else's password. Unfortunately there's no way that I know of for one user to connect to another user's session via RDP. There's no concept of "sharing" an RDP session between multiple users. – joeqwerty Jul 18 '13 at 23:39
  • Why switch from VNC? Why not use a VNC server that can use the Windows authentication? Also, where is this 'shared desktop' running? Can it be moved into a virtual machine? It would be pretty easy to setup users to access the ESXi or Hyper-V console, which they could then use to access the VM console? As for RDP, I don't think there is any possible way for you to do what you are asking. – Zoredache Jul 18 '13 at 23:45
  • At the end of the day, Bob can't log into Bill's session as Bob. Bob can only logon to Bill's session as Bill. – joeqwerty Jul 18 '13 at 23:53
0

Products to do this do exist. They are mostly targeted to healthcare institutions where there is frequently a lot of logging in and out, but login speed is of the essence. Do a google search for healthcare shared desktop for windows.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.