85
It turns out that much of the configuration data for RDSH is stored in the Win32_TSGeneralSetting class in WMI in the root\cimv2\TerminalServices namespace. The configured certificate for a given connection is referenced by the Thumbprint value of that certificate on a property called SSLCertificateSHA1Hash.
UPDATE: Here's a generalized Powershell solution ...
35
You can type "Query User" into a command prompt on the remote machine to get a very quick look
23
Generally, I'm opposed to the idea that a Windows server should be rebooted on a regular schedule EXCEPT in relation to TS/RDS servers. We reboot ours every day. It clears up old sessions, releases in use resources (CPU, RAM, file handles, etc.), so my opinion and suggestion would be that you do configure a daily scheduled reboot of your RDS servers.
Note ...
23
Run the "qwinsta" command on the server, or with the /server:servername switch.
>qwinsta /?
Display information about Remote Desktop Sessions.
QUERY SESSION [sessionname | username | sessionid]
[/SERVER:servername] [/MODE] [/FLOW] [/CONNECT] [/COUNTER] [/VM]
sessionname Identifies the session named sessionname.
username ...
18
You can see in the Task manager users Tab
17
Users refuse to log off instead of disconnect
Setup the appropriate group policies to auto-logoff them. You can separately control an idle timeout and logoff. That should certainly minimize some of the issue during the day.
I restart my 3 server TS farm daily at 3:00am. Because, yes crap can build up over time when you have lots of people using a single ...
16
Windows by default allows two RDS RDP* connections out of the box, and they are known as "administrative connections" regardless of if the user account is an administrator or not. If you need more remote connections you need to research RDS which requires it's own set of user connection licenses in addition to CALs.
RDS can allow for a number of ...
10
I've found myself in the same scenario as you. Deploying Remote Desktop on a standalone Server 2012 box is quite hard, because the guys at Microsoft don't let you run this on a domain-less network and if you do, you can't manage all the settings.
So, you can install a workgroup-based-box and get the Remote Desktop roles working on it. We need also to ...
10
Yes, you can use your DC as a RDP Licensing server. I do so myself. However, after a while, I started thinking I should have made it a single purpose VM instead but not because of any problem, just a foreseeable future where it ties in this function into my DC. But I have no problem with this set up particularly.
So my recommendation is that while it is ...
10
Open Server Manager.
Navigate to the Remote Desktop Services navigation area.
Select the Overview branch.
Under the Deployment Overview area, select Edit Deployment Properties from the Tasks menu.
Select the RD Licensing page of the displayed dialog.
Specify the licensing mode and the license server, then click OK.
9
I'm going to posit that you can't do this. With NLA (network-level authentication) enforced, a user cannot log in remotely and change his or her password.
You can use tsconfig.msc on the Remote Desktop server, right-click the RDP-Tcp connection and choose Properties, and change the security layer drop-down menu to 'RDP Security Layer,' but then you lose NLA. ...
9
In the end, this issue was caused by incorrect certificate installation in the Remote Desktop Gateway. When I opened the RD Gateway Manager it gave me options to select a certificate to import and use.
It has nothing to do with Network Access Protection, although through this process I ended up adjusting some of my policies anyway to lock it down further.
9
There are two components required for users to log on to a server via RDP: User Rights and Permissions.
Rights: Users must have the "Allow logon through Remote Desktop Services" user right.
Permissions: Users must have the "User Access" and "Guest Access" permission set to Allow on the RDP-Tcp protocol.
By default, users or groups in the local Remote ...
8
You need to use Loopback Policy processing. Move the RDS server to a new OU. Link your "drive restriction" GPO to this OU. Configure Loopback Policy processing in this GPO to Replace or Merge mode (depending on whether you want to replace the users normal GPO settings with these GPO settings or merge the users normal GPO settings with these settings). I ...
8
I'm guessing that RDP is open to the world to your server (as it's probably the only way you can get in), and that you are being attacked by bots who have scanned their way to your IP.
You're saying that there are no other users than your self logged on.. the only thing that makes sense is that there are bots trying to brute-force their way in with known ...
8
This is a very common issue when RDP is working with insufficient bandwidth or high latency. I'm not sure if it is a protocol bug or an implementation bug (eg. if packets are arriving out of order and not being reassembled correctly, or if they are being misinterpreted altogether), but the solution is either to increase available bandwidth, or adjust the ...
8
If you have a user that this happens to often in a day, give them a straight client/server VPN into the RDP server over their internet connection instead of the MPLS, bypassing QoS and the bandwidth congestion of the MPLS circuits themselves.
If all is well for a few days, then you can set aside bugs/issues within the client or server and focus on the MPLS ...
8
Try Group Policy Preferences. These provide fairly painless support for the mapping of network drives, and can be set to only apply to particular groups, leaving you to create just one GPP for each group. You could then bundle up any other custom settings for each group into the same Group Policy object while you were at it.
8
Mark, I had a lot of fun tracking this down for you. I can totally see where your line of thought is, but you're asking the wrong question. The question should be "Why can't I establish a 'servermanagerworkflows' session on my machine?"
If you look in the $enf:systemroot\system32\WindowsPowerShell\v1.0\Modules\RemoteDesktop and open the ...
8
Finally I found solution!
First of all, name of the server had to be changed by adding DNS suffix. For example, if you want to connect to the server by srv.example.com address, your server name should be "srv" and DNS suffix "example.com". It can be done in computer properties.
Then setup licensing in "RD Licensing Manager"
Now issue certificate to domain ...
7
Session-based
Session-based refers to Microsoft’s implementation of session virtualisation, isolation which is what was previously called Terminal Services.
Each user runs on a server operating system (OS) desktop that is semi-isolated from the other user.
Each session shares the same OS kernel.
A RDS server is normally a locked down secured environment ...
7
I have found a solution to the tsadmin problem. Copy these files from a 2008 server to the Windows 2012/8 computer under C:\windows\system32:
tsadmin.dll
tsadmin.msc
umcRes.dll
wts.dll
Then import the following registry settings:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns\FX:{3FCE72B6-A31B-43ac-ADDA-120E1E56EB0F}]
"ApplicationBase"=hex(2):43,00,...
7
The Windows Audio and Windows Audio Endpoint Builder services must be running in order for audio to work. The second service doesn't run automatically in Windows Server 2012. Change the service to start automatically, start it, and you're good to go.
7
Remote Desktop Services actually have a pretty rich WMI object library you can take advantage of to query and manipulate the configuration. As of Vista/2008, it's located in the root\cimv2\TerminalServices namespace. Here's a good place to start on browsing what's available: Remote Desktop Services Configuration classes
In regards to your specific ...
7
I wouldnt be surprised if its caused by the "++" in the name. Try and rename the app?
7
Start by checking the basics as described in Microsoft's technet article on event 1130:
Make sure the Remote Desktop server has network connectivity to the licensing server. If you can ping the licensing server, you're probably OK as far as the basics go (but see below).
Make sure the license server is configured to be automatically discovered. Use the "...
6
Gateway wins for me every time. If your clients are running a modern OS (read: XP SP3 or above) with NLA, you can expose dozens or hundreds of terminal servers behind a single interface with a single point of entry. This makes applying NAP much easier, along with controlling who can go where and connect to what.
A VPN is more universally accepted (I.e. ...
6
As I was setting up an environment in a lab to try this (a simple RDS deployment wihtout a domain), I found the answer to your question, though it's not the one you want to hear.
RDS in [Server 2012 and 2012 R2] requires all its servers to be added to a domain. That, according to a program manager at Microsoft on the Remote Desktop Virtualization team, who ...
6
Essentially my question boils down to: does a computer joined to the domain automatically trust certificates issued by a CA on the same domain, or would they still need to be manually installed on each client device?
Typically, the root certificate for your internal PKI is distributed via GPO to all clients. This makes it "automatic"
6
Depending on your cash, time, and the savviness of your users, another idea could be to stand up a second server. You'll still need to reboot occasionally, but you seem to be reaching the limits of a single server.
You should be able to use the same client CAL's (licensing's not my strongest area), and depending on your virtualization solution an additional ...
Only top voted, non community-wiki answers of a minimum length are eligible
