Windows 2003 What's new in TS - TechGenix

Windows 2003 What's new in TS - TechGenix

Windows 2003 Whats new in Terminal Services ? Ruben Spruijt - PQR Diensten 1 Upgrading Concerns Upgrading from Microsoft Windows NT 4.0 Terminal Server to Windows 2003 Server -blocked In Windows NT 4.0 Terminal Server - compatibility scripts modified permissions on registry, security, folders, etc. Some were done on a Windows 2000 server During upgrade, the security template applied to an application server does not reset the ACLs Best to do a clean installation on the server in Full Security Mode Ruben Spruijt - PQR Diensten 2 New Client User Interface MSTSC Experience tab

Optimize wallpaper, visual styles, etc. for speed of network connection Full screen connection bar No Connection Manager: save connection settings from client user interface /migrate Greater color depth and screen resolution - high color (24 bit) Ruben Spruijt - PQR Diensten 3 Remote Desktop for Administration Remote Desktop for administration is installed automatically Two concurrent remote connections plus console session (mstsc/console) By default, it is toggled off System properties in Control Panel

Allow Users to Connect remotely to this computer on the Remote tab Does not require licenses Remote Desktop Connection tool is available for download for earlier versions of Windows Ruben Spruijt - PQR Diensten 4 Remote Desktop Snap-in Used for network administration Multiple computers in one window Connect to console Local Group Policies and Default.rdp settings affect connection settings Help Desk users - Remote Assistance Ruben Spruijt - PQR Diensten 5 Installing Terminal Services for Application Hosting Installed using Add/Remove Programs

Previously installed applications must be reinstalled for multisession access All members of the Local Users group are copied into the Remote Desktop Users group Security mode for the Terminal Server connections Windows 2000/Windows 2003 Server permissions mode (full security) Windows NT 4.0/Terminal Server Edition permissions compatibility mode (relaxed security) Unattended installation [Components] TerminalServer = On [TerminalServices] LicensingMode = PerDevice Ruben Spruijt - PQR Diensten 6 Terminal Server Advertising Windows 2003 - Only Terminal Servers in Application Server mode Windows 2000 - All servers with Terminal Services

installed To prevent a Terminal Services-based computer from advertising, set the following registry key : HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ Terminal Server REG_DWORD value: TSAdvertise 0 disables and 1 enables advertising Ruben Spruijt - PQR Diensten 7 The Remote Desktop Users Group Remote logon permissions Use TSCC.msc to give users or groups the appropriate rights By default, the Remote Desktop Users local group is empty Restricted groups Add remote desktop users to the restricted groups Security templates MMC snap-in Security features Per network adapter connection permissions Custom rights assignment

Remote interactive right May be administered using Security Policy Editor Ruben Spruijt - PQR Diensten 8 Redirection Features Enabled by using virtual channels Local Drive Audio Time Smart Card Port (LPT/COM) Printer Ruben Spruijt - PQR Diensten 9

Virtual Channels Virtual channel permissions Permissions to use capabilities introduced through virtual channels can be set in the Terminal Server Client Configuration tool Virtual Channel permissions TSCC.MSC snap-in - RDP properties On the Permissions tab, click Advanced Select the group or account and then View/Edit Allow or deny virtual channels Virtual channels setting effects all redirection Ruben Spruijt - PQR Diensten 10 Local Drive Redirection Local file system available to the Remote Desktop session Local drives appear in My Computer \ on tsclient From command line or run line: \\tsclient\

Disable per server Terminal Services Group Policies Terminal Services Configuration Disable on individual client On the Local Resources tab, click Local devices, and then click to select the Disk drives check box Group Policies will override this selection Must be Windows XP or Windows .NET Ruben Spruijt - PQR Diensten 11 Audio Redirection Possible settings: Bring to this computer Do not play Leave at the remote computer Mid and midi files are not transferable with audio redirection Following must apply: Both the Terminal Server and the client have a sound card The client is set to Bring to this Computer The TSCC.MSC - allows audio mapping

Ruben Spruijt - PQR Diensten 12 Advantages of Audio Redirection Audio mixing If there are multiple applications - the resulting stream is an audio mix of the different streams Minimized performance impact of the audio stream input/output (I/O) on the RDP session Renegotiates sound stream quality if network bandwidth changes No user interaction Best to disable sound redirection on a very slow network Ruben Spruijt - PQR Diensten 13 Time Zone Redirection Allow Time Zone Redirection Group Policy setting Terminal Services uses the server base time on the

Terminal Server and the client time zone information to calculate the time on the session Session time = server base time + client time zone Client time zone must be set correctly Client version support: Windows XP client Windows .NET Server client Windows CE 4.0 Ruben Spruijt - PQR Diensten 14 Using Smart Cards with Terminal Server Require strong credentials Must have Microsoft Active Directory deployed Client computers must be running a Microsoft client

operating system with built-in Smart Card support Windows XP or Windows 2000 Most devices are running Windows CE .NET 4 Smart card readers on the client computers Uses trusted X.509v3 certificates that are stored on a smart card Ease of deployment Ruben Spruijt - PQR Diensten 15 Port Redirection LPT and COM port redirection Bar code readers or scanners USB redirection is only possible with installed local printers By default, no FireWire or IEEE 1394 ports redirected However, can enable FireWire port redirection on clients by enabling all ports to be redirected Registry on the client computer: HKEY_CURRENT_USER\Software\Microsoft\Terminal Server

Client\Default\AddIns\RDPDR New DWORD Value. FilterQueueType Value FFFFFFFF For more information about filtering port redirection, see article 302361, Multifunction Printers That Use DOT4 Ports Are Not Redirected By Using Remote Desktop;en-us;302361 Ruben Spruijt - PQR Diensten 16 Com Port Redirection Win32 COMM APIs open communication ports CreateFile against COM port The CreateFile automatically maps from applications session DOS Device namespace to the correct client-side device Without writing any adjusting server-side code Ruben Spruijt - PQR Diensten 17 Printer Redirection Redirected printers in the Printers folder in the

following format: on (from client computer name) in Session . Local port redirection Network printers redirected Ruben Spruijt - PQR Diensten 18 Managing Printers Enabled by default Group Policies Computer Configuration\ Windows Components\ Terminal Services\Client/Server data redirection Individual remote desktop connection Local Resources tab Terminal Services Configuration

Client Settings tab Allowing/disallowing virtual channels Bidirectional printing is not supported Ruben Spruijt - PQR Diensten 19 Printer Data Stored on the Client Client disconnects The printer queue is deleted from the server Incomplete or pending print jobs are lost Configuration data for those printers, however, is stored in the clients registry: Automatic - HKEY_CURRENT_USER\Software\Microsoft\ Terminal Server Client\Default\AddIns\RDPDR.SYS\ \AutoPrinterCacheData Manual - HKEY_CURRENT_USER\Software\Microsoft\ Terminal Server Client\Default\AddIns\RDPDR.SYS\ \PrinterCacheData Retain same settings to different terminal servers

Ruben Spruijt - PQR Diensten 20 Driver String Mapping for Printer Queues The Terminal Server has only the 2003 version of the driver When there is no matching driver on the server end: Event ID: 1111 Driver drivername required for printer printertype is unknown. Event ID: 1105 Printer security information for the printername/clientcomputername/Session number could not be set. Event ID: 1106 The printer could not be installed. Install a driver on the server that matches the print queue attached to the client machine The client-side and the server-side driver names must match Client-side driver shipped post 2003 new OEM driver OEM supplied driver Can create a custom .inf file. Ntprint.inf 239088, Windows 2000 Terminal Services Server Logs Events 1111, 1105, and 1106 Ruben Spruijt - PQR Diensten

21 Automatic Reconnection RDP layers over TCP Re-authenticate no user credentials Enable automatic reconnection HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\ Windows NT\Terminal Services DWORD value: fDisableAutoReconnect 1= on 0= off Default.rdp File - autoreconnection enabled:i:1 1= enabled 0= disabled Auto-reconnection cookie is flushed and regenerated any time the user logs in New cookie at hourly intervals Ruben Spruijt - PQR Diensten 22 Using Group Policy vs. TSCC.msc Group Policies

Remote Desktop Users group Individual computers Local Group Policy Groups of computers Terminal Server organizational unit TSCC.msc snap-in RDP connection parameters Connection permissions Single Terminal Server and its users Cannot configure remote server Settings that are set only by using TSCC.msc Licensing Mode Disable Active Desktop Ruben Spruijt - PQR Diensten 23 Management GP and WMI

New Group Policy settings Extensive set of polices Both computer and user configuration settings Control permissions using Remote Desktop Users group Restricted Groups in Security Templates MMC Software Restriction Policies New WMI provider Full read/write Nearly all Terminal Server Settings

Terminal Server Configuration, APIs, and command lines WMIC: Command line interface to WMI RDAccount; RDPermissions; RDToggle; RDNic RDTOGGLE To Enable/ Disable TS connections: wmic /node:"ServerName" /user:"DomainName\administrator" /password:"password" RDToggle where ServerName="ServerName" call SetAllowTSConnections 1 Ruben Spruijt - PQR Diensten 24 Terminal Services Group Policies

Keep-Alive Messages Single remote session Remote Desktop Wallpaper Limit number of connections Limit maximum color depth Allows users to connect remotely Do not allow local administrators to customize permissions Remove Windows Security item from Start menu Remove Disconnect item from Shut Down dialog Set path for TS Roaming Profiles TS User Home Directory Sets rules for remote control of Terminal Services user sessions Start a program on connection Ruben Spruijt - PQR Diensten 25 More Group Policies Client/server data redirection

Time zone Clipboard Smart Card Audio COM port Printer redirection LPT port redirection Drive redirection Default printer Encryption and security Always prompt for password Encryption level Temporary folders Do not use temp folders per session

Do not delete temp folder upon exit Sessions Time limit for disconnected Time limit for active Time limit for active but idle Reconnection from original client only Terminate session when time limits reached Ruben Spruijt - PQR Diensten 26 Session Directory Users reconnect to the correct disconnected session within a farm

A service that runs on any server Farm seems like one server to users Farmed TS servers: must be Enterprise Server Session directory server: any server SKU Possible to cluster Session Directory server using MSCS Session Directory is not a load balancer A database of user sessions across servers Redirects farm connections to correct server Used with load balanced farms The Session Directory database resides in %systemroot%\ system32\tssesdir\ This location is not configurable

Ruben Spruijt - PQR Diensten 27 Installation and Configuration Two components Session Directory Host server Client servers - Terminal Servers configured to talk with Session Directory Host server not required to be a Terminal Server May service multiple load balanced farms cluster name is the identifier Very small CPU, memory, and hard disk requirements Minimum level for clients - Remote Desktop client 5.1 Ruben Spruijt - PQR Diensten 28 Server Configuration Host server configuration must be done using the Computer Management MMC Start the Terminal Services Session Directory Service set to Automatic start

The group that is created is named "Session Directory Computers" Empty by default Add computer accounts Do not run the Session Directory service on a domain controller group will be a domain local group Ruben Spruijt - PQR Diensten 29 Client Configuration TSCC.msc Server settings Cluster name Session Directory server name or IP address Cluster name must be uniform across the cluster Terminal Server IP address redirection All protocol" If

network adapters configured with this Session Directory redirection may not work properly if one of the NICs on the server is not accessible to users Use only one network adapter for each Session Directory a Terminal Services connection is required on additional network cards, create one new connection Ruben Spruijt - PQR Diensten 30 Client Configuration Group Policies Computer Configuration / Administrative Templates / Terminal Services / Session Directory Terminal Server IP Address Redirection Join Session Directory Session Directory Server Session Directory Cluster Name Best to put farmed Terminal Servers in an organizational unit, with Group Policies applied to the organizational unit Ruben Spruijt - PQR Diensten 31

Session Directory Overview (User Session Previously on TS-3) 1. User connects to cluster. Session Directory 2. Load Balancer Cluster routes user to least loaded server, TS-1. TS-1 UserId Domain Cluster TS-2 3. TS-1 checks the Session Directory for existing session. 5. Client reconnects to existing session TS-3. 4. TS-3, as session owner, is communicated to the client.

Ruben Spruijt - PQR Diensten User Session 32 TS-3 Session Directory Event Logs 1001 The RPC call to join Session Directory to got Access Denied. This TS server is not a member of the SD server Session Directory Computers group. 1002 Session Directory service on server is not available. Session Directory service on the SD server is not started 1003 Session Directory server name is invalid. Cannot find the specified SD server. 1004 Tssdjet calling TSSDRpcServerOffline failed with %.

The SD service is stopped or restarted. 1007 The server failed to join Session Directory because RpcMgmtInqServerPrincName failed with error code %1. 0x5: Access denied. You can see this error if TS and SD are in different domains and the two domains are not trusted. 0x6BB: Server too busy. Normally, you see this when SD service is restarted and all TS servers try to join the SD at the same time. The following attempts to join the SD should succeed. 1005 The server successfully joined the Session Directory %1. This is a success event. Ruben Spruijt - PQR Diensten 33 Session Directory Logging HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ Tssdis

DWORD value: TraceOutputMode 0 (no output) 3 (output to log file) Tssdis.log in the System32 folder Contains the following entries: Session Directory service started/stopped Computer joins/leaves session directory User logs in / logs out User disconnects / reconnects Session Directory-related event log messages Ruben Spruijt - PQR Diensten 34 Upgrading Licensing from Windows 2000

Can mix Windows 2000 and Windows 2003 Servers Windows 2000 cannot issue 2003 Licenses A 2003 License Server will issue licenses to both Must have a 2003 License Server for 2003 Terminal Services CALs Windows 2003 Server requires a new version of TS CAL Clients cannot connect with a Windows 2000 TS CAL License Server will automatically replace Windows 2000 CAL Can enable or prevent upgrade on Windows 2000 connection TSCC.msc or Group Policy; Prevent Automatic License Upgrade License Server Security Group Local group created - Terminal Services computers Prevent license upgrade Ruben Spruijt - PQR Diensten 35 More Licensing Terminal Server Licensing Wizard redesigned to improve usability Re-issuance is automatic/built-in

Secure licensing mode Off by default Controlled through Group Policy Terminal Services Licensing local group Both Terminal Servers and License Servers Best to use high availability configuration Example: Two license servers per device LS1: 1,000 CALs installed LS2: Zero CALs installed LS1 is used until there is a problem, then LS2 issues temporary licenses Ruben Spruijt - PQR Diensten 36 Licensing: Not Optional License Service is always required

Grace period provides time for this (~120 days) TS never supplies licenses Discovery process Broadcast in workgroup or TS4 domain Active Directory enumeration in Windows 2000 and Windows .NET domain New optional registry key specify multiple machine names Like KB article 239107, Establishing Preferred Windows 2000 Terminal Services License Server, but now works for multiple names New LS may be deployed on any member server Enterprise LS are discovered automatically

Domain LS are not Ruben Spruijt - PQR Diensten 37 New Licensing Options for the Server/CAL Model 1. User CALs 2. External Connector Customers will have the option of acquiring Device or User CALs to license access to the server software. The External Connector license will be an option for licensing access to the server software by users other than employees or independent contractors for example, business partners or customers. Benefits: Flexible for customers Economical for users with multiple devices Consistent across many

server/CAL products Benefits: Simple Cost-effective Eliminates need to count nonemployees Consistent across many server/CAL products Ruben Spruijt - PQR Diensten 38 Key Elements of User CAL Todays Model Device CALs Acquire a CAL for every device accessing the server software New Model Option of User or Device CALs Acquire a CAL for every User or Device accessing the server software 1. Products: Will apply to most products licensed on server/CAL basis

2. Pricing: 1 User CAL = 1 Device CAL 3. Choice: Will be able to acquire: Device CALs only User CALs only Mix of Device and User CALs Ruben Spruijt - PQR Diensten 39 Choosing Between User and Device CALs Choice between Device CALs and User CALs is likely based on two factors: May prefer Device CALs if... May prefer User CALs if... 1. Economic factors Less expensive to acquire Device CALs Fewer devices than users

For example, call center or factory floor Less expensive to acquire User CALs Fewer users than devices For example, information worker with multiple devices (PCs, PDAs, cell phones) 2. Ease of management Easier to track devices For example, asset management systems are set up to track devices Easier to track users For example, purchasing systems are tightly linked with HR processes Ruben Spruijt - PQR Diensten 40

Helping Choose Between User and Device CALs Administrators may choose between Device CALs and User CALs based on two factors: Management Considerations Economic Considerations Easier to track devices if: Asset management systems are set to track devices Users Devices Acquire: 2 User CALs or 6 Device CALs (cheaper option highlighted)

Examples: 4 User CALs or 2 Device CALs Easier to track users if: Purchasing systems are tightly linked with HR processes Call center Office workers with multiple Factory devices PC, floor laptop, PDA Ruben Spruijt - PQR Diensten 41 Key Elements of the External Connector Todays Model

1. Products: External Connector will apply to most products licensed on server/CAL basis that does not offer per processor option 2. Pricing: One price per product, independent of edition Internet Connector for Windows Server and Terminal Services Covers customers devices Excludes business partners devices No solution for some other products (for example, Exchange Server) New Model External Connector license 3. Choice: Customer will be

Covers all users except able to choose for nonemployees and independent employees: contractors for example, customers and partners EC Provides an unlimited number of Individual CALs users access to a copy of the Ruben Spruijt - PQR Diensten 42 server software and/or services Choosing Between EC and CALs May choose between EC and individual Device, or User CALs for business partners or customers based on two factors: May prefer EC if... May prefer individual CALs if... Less expensive to acquire EC Company has many partners or customers For example, large number of authenticating customers

Less expensive to acquire individual CALs Company has few partners or customers Partners or customers access many copies of the server software Easier to track EC 2. Ease of Difficult to count partners or management Easier to track individual CALs Easy to count partners or customers Difficult to count number of copies of server software 1. Economic factors customers For example, identity or number of partners or

customers changes Ruben Spruijt - PQR Diensten frequently 43 External Connector: Definitions and Examples Employees and Independent Contractors Definition: Examples: Person that performs work for the company as an employee or in any other capacity such as an independent contractor, agent, vendor, or service provider.

Employees Vendors Independent contractors Consultants Agents Faculty Staff Currently enrolled students Ruben Spruijt - PQR Diensten Other Any person other than a person that performs work for the company as an employee, independent contractor, agent, vendor, service provider for example, a business partner or customer. Business partners Customers Alumni 44 Summary: Comparison of EC and CAL Licensing 1 User CAL = One employee accessing all copies of server software (for example,

Exchange) from unlimited number of devices 1 Device CAL = Unlimited number of users accessing all copies of server software from one device 1 External Connector = Unlimited number of business partners or customers accessing one copy of server software Ruben Spruijt - PQR Diensten 45 Questions ? [email protected] Ruben Spruijt - PQR Diensten 46

Recently Viewed Presentations

  • Bioinformatics Toolbox - Amirkabir University of Technology

    Bioinformatics Toolbox - Amirkabir University of Technology

    The MATLAB language facilitates computation, visualization, prototyping, and deployment. Using the Bioinformatics Toolbox in combination with other MATLAB toolboxes and products will allow you to solve multidisciplinary problems. The Bioinformatics Toolbox includes many functions to help you with genome and...


    1. Crook lying . From Lying, the hips and knees are bent so that the feet rest on thefloor or plinth. Provided the feet are fixed by friction, very little muscles work is required apart from that of the abductors...
  • Middle English Literature and Chaucer's The Canterbury Tales

    Middle English Literature and Chaucer's The Canterbury Tales

    Middle English Literature and Chaucer's The Canterbury Tales Part I: The Anglo-Norman Period: 1066-1350 A.D. The Norman Conquest of Britain took place on October 14, 1066 (The Battle of Hastings). 1066 also marks the end of Old English and the...
  • IDM Chapter 104 Utility Coordination Gail Lee Utility

    IDM Chapter 104 Utility Coordination Gail Lee Utility

    RFC. for at least one utility that exists within the project limits. Exceptions: Go to . [email protected] . The undersigned affirms that they are an INDOT Certified Utility Coordinator and have performed all of the required duties for the project....
  • HEAT TRANSFER Heat is not a substance (matter)

    HEAT TRANSFER Heat is not a substance (matter)

    Sound ≠ Lamp. Light ≠ Wood. Heat ... The heat moves from a warmer to a neighboring cooler fiber, leaving the warmer one cooler and warming the cooler one. Mix the Heat Activity. Convection: ... PowerPoint Presentation Last modified by:...
  • Irregular Past Tense Verbs - Hazleton Area High School

    Irregular Past Tense Verbs - Hazleton Area High School

    Irregular Past Tense Verbs Level 2 ... Past - Past Participle catch caught choose chose come came cut cut do did drink drank drive drove eat ate Present - Past - Past Participle fall fell feed fed feel felt fight...
  • Example: Data Mining for the NBA

    Example: Data Mining for the NBA

    Analyzing and Securing Social Networks Dr. Bhavani Thuraisingham The University of Texas at Dallas Introduction to the Course August 28 - December 4, 2015
  • Rapport d'activité 2007 - MIRABEL

    Rapport d'activité 2007 - MIRABEL

    Prise en compte de l'avis des CG ou du CR en fonction des dossiers lors de l'instruction Origines géographiques des déchets fixées dans l'arrêté d'autorisation Pour une installation d'incinération ou stockage de DND (création, extension, modification substancielle) : l'autorisation préfectorale...