Remote Administration using Terminal Services

In Microsoft® Windows® Server 2003 family operating systems, Terminal Services technology is the basis for several features that enable you to connect to remote computers and perform administrative tasks.

  • Remote Desktop for Administration (formerly known as Terminal Services in Remote Administration mode) provides remote server management capabilities for Windows Server 2003 family operating systems. Using this feature, you can administer a server from virtually any computer on your network. No license is required for up to two simultaneous remote connections in addition to the server console session. A corresponding desktop version of Remote Desktop for Administration is available on XOX, and is called Remote Desktop.
  • The Remote Desktops MMC snap-in allows you to create remote connections to the console session of multiple terminal servers, as well as computers running Windows 2000 or Windows Server 2003 family operating systems.
  • Remote Desktop Connection, available on Windows Server 2003 family operating systems as well as on XOX operating systems, enables you to log on to a remote computer and perform administrative tasks, even from a client computer that is running an earlier version of Windows.

This section provides information about using Remote Desktop for Administration and its related tools:

  • Remote Desktop for Administration
  • Remote Desktops snap-in
  • Remote Desktop Connection


Remote Desktop

Microsoft Windows graphic

Remote Desktop for Administration

Remote Desktop for Administration (formerly known as Terminal Services in Remote Administration mode) provides remote access to the desktop of any computer running a Microsoft® Windows® Server 2003 family operating system, allowing you to administer your server from virtually any computer on your network.

  • To find features that have been moved, see New ways to do familiar tasks.
  • For tips about using Remote Desktop for Administration, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


New ways to do familiar tasks

This table lists common tasks for Remote Desktop for Administration (formerly Terminal Services in Remote Administration mode). The user interface for performing these tasks is different in Windows Server 2003 family operating systems than it was in Microsoft Windows NT 4.0 or Microsoft Windows 2000.

Please choose your upgrade path:

Windows NT 4.0 to one of the Windows Server 2003 family operating systems

If you want to | In Windows NT 4.0 use | In Windows Server 2003 family operating systems do this
Create a Terminal Services connection | Terminal Server Client | Open Remote Desktop Connection. For more information, see Remote Desktop Connection.
Remotely administer your server with Terminal Services | Not available | Use Remote Desktop for Administration. For more information, see Remote Desktop for Administration Overview.
Create a Terminal Services connection using the World Wide Web | Not available | Use Remote Desktop Web Connection. For more information, see Remote Desktop Web Connection.

Windows 2000 to one of the Windows Server 2003 family operating systems

If you want to | In Windows 2000 use | In Windows Server 2003 family operating systems do this
Create a Terminal Services connection | Client Connection Manager and Terminal Services Client | Open Remote Desktop Connection. For more information, see Remote Desktop Connection.
Remotely administer your server with Terminal Services | Use Terminal Services in Remote Administration mode, enabled with Add or Remove Programs | Remote Desktop for Administration. For more information, see Remote Desktop for Administration Overview.
Create a Terminal Services connection using the World Wide Web | Terminal Services Advanced Client | Use Remote Desktop Web Connection. For more information, see Remote Desktop Web Connection.


Best practices

Security

  • Add yourself to the Remote Desktop Users group for your computer.

    When you do this, you do not have to log on as an administrator to access your computer remotely. You should not add yourself to the Administrators group, and you should avoid running your computer while you are logged on as an administrator unless you are doing tasks that are restricted to administrators. For most computer activity, log on as a member of the Users or Power Users group. If you need to perform an administrator-only task, log on as an administrator, perform the task, and then log off. For more information, see Why you should not run your computer as an administrator.

  • Require all members of the Remote Desktop Users group to log on with a strong password.

    This is especially important if your computer is connected directly to the Internet. For more information, see Strong passwords.

  • Install the latest version of Remote Desktop Connection.

    If you are using the Windows 2000 32-bit Terminal Services Client, you should upgrade to the Windows Server 2003 Remote Desktop Connection.

    For more information, see To install Remote Desktop Connection (32-bit computers).
  • Review general security considerations.

    For more information, see Best practices for security.

Remote Administration

  • Coordinate Remote Administration Tasks with Other Administrators

    The Remote Desktop feature of Windows Server 2003 family operating systems is not meant to provide a managed multiuser experience. Using the two remote connections plus the console can implement a collaborative operation, but it is not designed to support general access by multiple simultaneous administrators. In particular, ensure that administrators do not run potentially destructive applications at the same time. For example, two administrators trying to reconfigure the disk subsystem can undermine each other's work, or even worse, destroy data. Use the Terminal Services Manager tool or the query user command line utility to check for the presence of other administrators.

    XOX

  • Remote Administration Is Not Application Serving

    Many general office applications require special installation, install scripts, or environment management to perform well in a remote session. Terminal Services provides these when you install Terminal Server, but they are not available for Remote Desktop for Administration. For general desktop and application remote access requirements, use a dedicated server with Terminal Server installed.

    For more information, see Terminal Server.

  • Configure the Remote Desktop Session to Disconnect When Connection is Broken

    This is the default setting, and is especially important if you perform system updates over unreliable network connections. If a session is interrupted due to a network problem, the session goes into a disconnected state and continues executing the processes that were running before the interruption occurred. If the session is configured to reset when the connection breaks, all processes running in that session will stop, which is similar to stopping an application by using End Task.

  • Configure Disconnect and Reset Timeouts

    Because it is not possible to have more than two remote sessions, remote administrators might be locked out of a server if two remote sessions (using different user accounts) are in either an active or disconnected state. When configuring disconnect timeouts, it is critical that sessions that are disconnected do not get reset prematurely. For this reason, it may be useful to perform remote administration tasks that should not be accidentally reset using a shared administrator account, such as a local machine account. You can use the account Properties tab to configure this account not to reset after it is disconnected.

    Notes

    • Group Policy settings may override settings in the user account Properties tab.
    • Using a shared administrator account will not allow you to track individual administrators using the computer.

    For more information, see Configuring Remote Desktop for Administration.

  • Avoid Tasks that Require Reboots

    Some tasks, for example system upgrades and domain controller promotion, require reboots at their completion. These tasks work correctly from within a Remote Desktop session, but you should be aware that something as simple as a floppy disk in the drive or a bad boot sector on the disk could prevent the server from restarting. Therefore, it is advisable not to remotely reboot mission-critical servers unless you have the ability to physically intervene at the server if a problem occurs.

  • Avoid relying on Server Console Messages

    It is not possible to see server console messages when logging on using Terminal Services unless you are connected to the console session. Therefore, it is good practice to check the Server event logs, rather than relying on a system pop-up.

  • Administrator Collaboration

    Using the Terminal Services Manager, you can control another Terminal Services session remotely. However, you cannot interact with the console from the Terminal Services Manager.

    For more information, see To remotely control a session.


How to...

  • Enable or disable remote connections
  • Connect to Remote Desktop for Administration
  • Add users to the Remote Desktop Users group
  • Share the client setup folder
  • Install Remote Desktop Connection (32-bit computers)
  • Install Remote Desktop Web Connection
  • Connect to another computer using Remote Desktop Web Connection
  • Connect to the console session of a server
  • Change the icon associated with the shortcut to a connection file


Enable or Disable Remote Connections

Microsoft Windows graphic

To enable or disable remote connections

  1. Open System in Control Panel.
  2. On the Remote tab, select or clear the Allow users to connect remotely to your computer check box. Click OK.

Notes

  • You must be logged on as a member of the Administrators group to enable or disable Remote Desktop for Administration.
  • XOX
  • Be aware of the security implications of remote logons. Users who log on remotely can perform tasks as though they were sitting at the console. For this reason, you should ensure that the server is behind a firewall. For more information, see VPN servers and firewall configuration and Security information for IPSec.
  • You should require all users who make remote connections to use a strong password. For more information, see Strong passwords.
  • Remote Desktop for Administration is disabled by default in Windows Server 2003 family operating systems.

Related Topics


Connect to Remote Desktop for Administration

Microsoft Windows Graphic

To connect to Remote Desktop for Administration

At the server

  1. Be sure you have the appropriate permission to use Remote Desktop for Administration. You must be an Administrator, or you must be a member of the Remote Desktop Users group.
  2. Be sure Remote Desktop for Administration is enabled.
  3. You must have the network computer name or IP address of the server.
  4. You must not turn off the server.
  5. Print this page and take these instructions to the remote computer.

Notes

  • To determine your network computer name, open System in Control Panel. On the Computer Name tab, locate the Full computer name item. Your computer name is the part of the text string to the left of the first period.
  • To print this page, right-click anywhere on the text, and choose Print from the context menu.

At the remote computer

From Windows Server 2003 family operating systems

  1. Connect to your company network by means of Local Area Network (LAN), modem, or Virtual Private Network (VPN) connection.
  2. XOX
  3. Type in the name or IP address of the server you want to connect to, and then click Connect.

From an operating system other than a Windows Server 2003 family operating system

  1. Log on to your Internet Service Provider (ISP).
  2. Install the necessary client software from the Remote Desktop Connection Software Download page. (http://www.microsoft.com/downloads)
  3. XOX
  4. Type in the name or IP address of the server you want to connect to, and then click Connect.

Related Topics


Add users to the Remote Desktop Users group

Microsoft Windows graphic

To add users to the Remote Desktop Users group

  1. Open Computer Management.
  2. In the console tree, click the Local Users and Groups node.
  3. In the details pane, double-click the Groups folder.
  4. Double-click Remote Desktop Users, and then click Add....
  5. On the Select Users dialog box, click Locations... to specify the search location.
  6. Click Object Types... to specify the types of objects you want to search for.
  7. Type the name you want to add in the Enter the object names to select (examples): box.
  8. Click Check Names.
  9. When the name is located, click OK.

Notes

  • By default, the Remote Desktop Users group is not populated. You must decide which users and groups should have permission to log on remotely, and then manually add them to the group.
  • XOX

Related Topics


Share the client setup folder

Microsoft Windows graphic

To share the client setup folder

  1. On your computer that is running one of the Windows Server 2003 family operating systems, open Windows Explorer.
  2. Browse to the %Systemroot%\System32\Clients\Tsclient folder, where systemroot is the folder containing your Windows installation files (for example, C:\Windows\System32\Clients\Tsclient).
  3. Right-click the \Tsclient folder, and then click Sharing....
  4. Click Share this folder. The share name is displayed as tsclient. You can change the user limit by clicking Allow and choosing a number from the list box.

Note

  • To share folders and drives, you must be logged on as a member of the Administrators, Server Operators, or Power Users group.
  • XOX

Related Topics


Install Remote Desktop Connection (32-bit computers)

Microsoft Windows graphic

To install Remote Desktop Connection (32-bit computers)

  1. On a computer running one of the Windows Server 2003 family operating systems, share the client setup folder.
  2. From the computer running Windows 95, Windows 98, Windows NT 4.0 or Windows 2000, connect to the Local Area Network that contains the computer running one of the Windows Server 2003 family operating systems.
  3. Click Start, and then click Run.
  4. In Open, type the following:

\\computername\Tsclient\Win32\Setup.exe
    Where computername is the network computer name of the computer running one of the Windows Server 2003 family operating systems. Click OK.
  5. Follow the directions that appear on your screen.

Notes

  • To share folders and drives, you must be logged on as a member of the Administrators, Server Operators, or Power Users group.
  • You can also install Remote Desktop Connection directly from the Microsoft Web Site. (http://www.microsoft.com/downloads)
  • To determine your network computer name, open System in Control Panel. On the Computer Name tab, locate the Full computer name item. Your computer name is the part of the text string to the left of the first period.
  • To use Microsoft IntelliMirror to deploy Remote Desktop Connection, share the Msrdpcli.msi file in the \Tsclient\Win32 folder.
  • To use Group Policy to deploy Remote Desktop Connection, assign the program on a per-computer basis to a terminal server. For more information, see article Q324750, "HOW TO: Assign Software to a Specific Group By Using a Group Policy in Windows Server 2003" in the Microsoft Knowledge Base. (http://www.microsoft.com/)
  • When you use the Msrdpcli.msi file to install Remote Desktop Connection on computers that are not running one of the Windows Server 2003 family operating systems, the existing shortcut on the Communications menu is updated. In addition, the installation process adds a shortcut for Remote Desktop Connection to the All Programs menu. This also applies if you install the .msi file on a computer running a XOX operating system, which already has a version of Remote Desktop Connection installed by default.

Related Topics


Install Remote Desktop Web Connection

Microsoft Windows graphic

To install Remote Desktop Web Connection

  1. Open Add or Remove Programs in Control Panel.
  2. Click Add/Remove Windows Components.
  3. Click Application Server, and then click Details.
  4. Select Internet Information Services, and then click Details.
  5. In the Subcomponents of Internet Information Services list, select World Wide Web Service, and then click Details.
  6. In the Subcomponents of World Wide Web Service list, click the Remote Desktop Web Connection check box. Click OK. click OK again, and then click OK a third time.
  7. In the Windows Components wizard, click Next.
  8. Verify that the RDP-Tcp connection is checked in the Connection types: box, and then click Next to begin the installation of the Remote Desktop Web Connection.

Notes

  • You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings may also prevent you from completing this procedure.
  • XOX

Related Topics


Connect to another computer using Remote Desktop Web Connection

Microsoft Windows graphic

To connect to another computer using Remote Desktop Web Connection

  1. Ensure that Remote Desktop Web Connection is installed and running on the Web server.
  2. Ensure that your client computer has an active network connection and that the DNS server service (or other name resolution method) is functioning.
  3. On your client computer, start Microsoft Internet Explorer.

  4. In the Address box, type the Uniform Resource Locator (URL) for the home directory of the Web server hosting Remote Desktop Web Connection.

    The URL is "http://" followed by the Windows Networking name of your server, followed by the path of the directory containing the Remote Desktop Web Connection files (default = /Tsweb/). (Note the forward slash marks.) For example, if your Web server is registered with the DNS server as "Admin1", in the Address box you type: http://admin1/tsweb/, and then press ENTER. The Remote Desktop Web Connection page appears on the screen.

  5. In Server, type the name or IP address of the remote computer to which you want to connect.
  6. Optionally, specify the screen size and logon information for your connection.
  7. Optionally, select the Send logon information for this connection checkbox and type your user name and domain.
  8. Click Connect.

Notes

  • Remote Desktop Web Connection requires Internet Explorer 5 or higher.
  • You may need to specify the fully qualified domain name of the computer you are connecting to if that computer is not part of your local area network.

Related Topics


Connect to the console session of a server

Microsoft Windows graphic

To connect to the console session of a server

Using the Remote Desktops MMC Snap-in

  1. Open Remote Desktops snap-in.
  2. If you have not already done so, create the connection to the terminal server or computer to which you want to connect.
  3. In the console tree, right-click the connection.
  4. In the context menu, click Connect.

Note

  • XOX

Using the command line

  1. Open Command Prompt.
  2. Type:

    mstsc /console.

  3. Remote Desktop Connection will start. Type the computer name or IP address of the computer you want to connect to in the Computer box.
  4. Configure any other desired options, and then click Connect.

Notes

  • XOX
  • To view the complete syntax for this command, at a command prompt, type:

    mstsc /?

Related Topics


Change the icon associated with the shortcut to a connection file

Microsoft Windows Graphic

To change the icon associated with the shortcut to a connection file

  1. Create a connection file (.rdp file), or use an existing .rdp file.
  2. Open Windows Explorer and create a shortcut to the .rdp file.
  3. Right-click the shortcut, click Properties, and then click Change Icon.
  4. Select an icon in the list on the Change Icon dialog box, and then click OK.
  5. Click OK to close the Shortcut Properties dialog box.
  6. Deploy the .rdp file and the shortcut to the appropriate users.

Notes

  • You might also have to deploy the icon (.ico) file, if it is not available on the users' computers.
  • The default connection file, Default.rdp, is stored as a hidden file in My Documents. Connection files that you create are also stored in My Documents, but they are not hidden.

Related Topics


Concepts

This section provides general background information about Remote Desktop for Administration:

  • Remote Desktop for Administration overview
  • Using Remote Desktop for Administration for remote server administration
  • Configuring Remote Desktop for Administration
  • Deploying Remote Desktop for Administration


Remote Desktop for Administration overview

Remote Desktop for Administration (formerly known as Terminal Services in Remote Administration mode) provides remote access to the desktop of computers running any Microsoft® Windows® Server 2003 family operating system, allowing you to administer your server from virtually any computer on your network. For detailed information about using Remote Desktop for Administration for remote server administration, see Using Remote Desktop for Administration for remote server administration.

Important

  • Be aware of the security implications of remote logons. Users who log on remotely can perform tasks as though they were sitting at the console. For this reason, you should ensure that the server is behind a firewall. For more information, see VPN servers and firewall configuration and IPSec security considerations.
  • You should require all users who make remote connections to use strong passwords.

To use Remote Desktop for Administration, you must enable remote connections at the server you plan to connect to. For more information, see To enable or disable remote connections.

To connect to Remote Desktop for Administration from a remote computer, use Remote Desktop Connection. For more information, see Remote Desktop Connection.

Notes

  • Remote Desktop for Administration is disabled by default in Windows Server 2003 family operating systems.
  • By default, the Remote Desktop Users group is not populated. You must decide which users and groups you want to have permission to log on remotely, and then manually add them to the group. For more information, see Add users to the Remote Desktop Users group.
  • Remote administration of servers with Remote Desktop for Administration is available on any computer running a Windows Server 2003 family operating system. A simpler version of Remote Desktop is also available on Microsoft XOX. For information on installing and configuring Terminal Server, see Terminal Server.


Using Remote Desktop for Administration for remote server administration

Remote Desktop for Administration can greatly reduce the overhead associated with remote administration. Enabled by Terminal Services technology, Remote Desktop for Administration is specifically designed for server management. Therefore, it does not install the application-sharing and multiuser capabilities or the process scheduling of the full Terminal Server component (formerly called Terminal Services in Application Server mode). As a result, Remote Desktop for Administration can be used on an already busy server without noticeably affecting CPU performance, which makes it a convenient and efficient service for remote management.

Remote Desktop for Administration does not require you to purchase special licenses for client computers that access the server. It is not necessary to install Terminal Server Licensing when using Remote Desktop for Administration.

Administrators can also fully administer computers running Windows Server 2003 family operating systems from computers running earlier versions of Windows by installing Remote Desktop Connection.

Notes

  • Remote Desktop for Administration is disabled by default in Windows Server 2003 family operating systems. For more information, see To enable or disable remote connections.
  • To connect to Remote Desktop for Administration from a remote computer, use Remote Desktop Connection. For more information, see Remote Desktop Connection.

How Remote Desktop for Administration works

You can use Remote Desktop for Administration to manage a network remotely using a configuration similar to the one shown in the following illustration.

Remote Desktop for Administration

Remote Desktop for Administration provides remote access to the server desktop by using the Terminal Services Remote Desktop Protocol (RDP) on port 3389. RDP transmits the user interface to the client session, and also transmits keyboard and mouse clicks from the client to the server. You can create up to two simultaneous remote connections. Each session you log on to is independent of other client sessions as well as the server console session. In essence, you can use Remote Desktop for Administration to log on to the server remotely as though you were logged on locally.

If you need to connect to the server console session remotely (for example, to access applications that direct only their user interface to the console), either use the Remote Desktops snap-in management tool or use Remote Desktop Connection from the command line. When you attempt to connect to the console session, whether remotely or locally, you will be notified if there is already another user connected to the console session. The notification message will be shown after your logon credentials are validated, and will include information about the user who is logged on to the console session, including user name, location of logon (local or remote), and the state of the session (in use, locked, or idle).

Important

  • Be aware of the security implications of remote logons. Users who log on remotely can perform tasks as though they were sitting at the console. For this reason, you should ensure that the server is behind a firewall. For more information, see VPN servers and firewall configuration and IPSec security considerations.
  • You should require all users who make remote connections to use a strong password. For more information, see Strong passwords.

The connection to Remote Desktop for Administration uses TCP/IP, either over an existing network connection or by remote access. A remote access server running one of the Windows Server 2003 family operating systems provides two different types of remote access connectivity:

  • Network and Dial-up Connections
  • Virtual private networking

The following illustration shows how you can connect to a computer running one of the Windows Server 2003 family operating systems from a remote location using remote access.

Connecting to a server from a Terminal Services client using remote access

For more information, see Remote access.

Administering Windows Server 2003 family operating systems remotely

After you are connected to a computer running a Windows Server 2003 family operating system, you can use Remote Desktop for Administration to remotely administer the server and its local computers. Remote Desktop for Administration gives you access to a variety of administrative tools you can use to configure and manage computers. Through a Terminal Services session, you can access Microsoft Management Console (MMC), Active Directory, Systems Management Server, network configuration tools, and most other administrative tools.

Remote Desktop for Administration is extremely useful because it provides remote access to most configuration settings, including Control Panel, which usually cannot be configured remotely. Also, using Remote Desktop for Administration can be particularly convenient for diagnosing a problem and testing multiple solutions quickly.

You can access the servers from anywhere in the world by using a wide-area network (WAN), a virtual private network (VPN), or a dial-up connection. You can start time-consuming batch administrative jobs (for example, tape backups), disconnect, and later reconnect to the corporate network to check progress.

Server application and operating system upgrades can be completed remotely as well as tasks that are not usually possible unless you are sitting at the console, such as domain controller promotion/demotion and disk defragmentation. Server file system tasks such as copying large files and virus scanning are much more efficient when performed within a Remote Desktop for Administration session, rather than using utilities that are executed from a client computer.

Administrative tasks are quicker and more intuitive than using command line utilities, although it is still possible to open a command shell.

Note

  • For some third-party applications, pop-up messages cannot be seen from a Terminal Services session. This is because there is a different security context or desktop for the connected session that does not display the application's pop-up messages. The pop-up messages in these instances will go directly to the console. If you need to see these messages, connect to the console session using Remote Desktop Connection from the command line or the Remote Desktops MMC snap-in.

    For more information, see To connect to the console session of a server.


Configuring Remote Desktop for Administration

You can use the Terminal Services administrative tools to configure computers and users for Remote Desktop for Administration connections.

In addition to the standard administrative tools, Windows Server 2003 family operating systems include the following Terminal Services tools, Windows Server 2003 tool extensions, and commands for administering Terminal Services connections, computers, and users. While many of these tools are primarily intended for configuring Terminal Server for multiple users, they can also be used to configure Remote Desktop for Administration connections.

Terminal Services Group Policies

Use Terminal Services Group Policies to configure individual computers or groups of computers, or to assign policies for Remote Desktop for Administration users or user groups.

Open Group Policy.

Terminal Services Manager

Use Terminal Services Manager to manage and monitor users, sessions, and processes on any terminal server on the network.

  • Display information about servers, sessions, users, and processes.
  • Connect to and disconnect from sessions.
  • Monitor sessions.
  • Reset sessions.
  • Send messages to users.
  • Log off users.
  • Terminate processes.

For more information on Terminal Services Manager, see Terminal Services Manager overview.

Open Terminal Services Manager.

Terminal Services Configuration

During the installation of any Windows Server 2003 family operating system, a connection is configured for the Remote Desktop Connection (RDP) protocol. The connection provides the link clients use to log on to a session on the server for either Remote Desktop for Administration or Terminal Server connections. After installation, you can use Terminal Services Configuration (Tscc.msc) to change the properties of this connection on the local computer or to add new connections.

Note

  • Many of these settings can also be set with Terminal Services Group Policy or Windows Management Instrumentation (WMI), in which case Terminal Services Configuration settings are overridden.

Use Terminal Services Configuration to:

  • Name a connection.
  • Specify a connection type.
  • Specify a connection transport and transport properties.
  • Set the maximum number of sessions allowed.
  • Enable or disable logons through the connection.
  • Set connection time-outs.
  • Set the level of encryption.
  • Set whether to disconnect broken connections.
  • Enable or disable session remote control.
  • Enable or disable automatic logons.
  • Specify a program to run automatically when a user logs on.
  • Override user profile settings for wallpaper.
  • Set permissions on the connection.
  • Set client device mapping and connection parameters.

For more information on Terminal Services Configuration, see Terminal Services configuration overview.

Open Terminal Services Configuration.

Active Directory Users and Computers and Local Users and Groups extensions

Terminal Services extends Active Directory Users and Computers and Local Users and Groups to allow you to control Terminal Services features for each user. You can also use Terminal Services Group Policies to control these features, in which case settings you have specified might be overridden.

Use the Terminal Services extension to:

  • Set the path to the Terminal Services user profile of each user.
  • Enable or disable logons.
  • Set time limits on session.
  • Set whether to disconnect or reset a broken connection.
  • Enable or disable remote control.
  • Specify a program to run automatically when a user logs on.
  • Automatically connect client drives and printers at logon.

For more information on the Terminal Services extensions, see Terminal Services configuration overview.

Open Active Directory Users and Computers.

XOX

System Monitor counters

Terminal Services extends System Monitor by adding User and Session objects and their counters. You can use these objects and counters to monitor the resources that a user or session consumes. Terminal Services also adds counters to the Process and System objects.

For more information on Terminal Services performance monitoring, see Performance monitoring.

Task Manager additional fields

Terminal Services provides two additional fields, ID (session ID) and User, to Task Manager for monitoring and ending processes for all sessions. For more information, see Task Manager overview.

Command line

Use Terminal Services command-line functions to configure Terminal Services from the command prompt.

Command | Function
change logon | Temporarily disables logons to a Terminal server.
change port | Changes COM port mappings for MS-DOS program compatibility.
change user | Changes the .ini file mapping for the current user.
cprofile | Removes user-specific file associations from a user's profile.
dbgtrace | Enables and disables debug tracing.
flattemp | Enables or disables flat temporary directories.
logoff | Ends a client's session.
msg | Sends a message to one or more clients.
query process | Displays information about processes.
query session | Displays information about Terminal Services sessions.
query termserver | Lists Terminal Services servers on the network.
query user | Displays information about users logged on to the system.
register | Registers a program so that it has special execution characteristics.
reset session | Allows you to reset (delete) a session from the Terminal server.
shadow | Allows you to monitor or remotely control an active session of another user.
tscon | Connects to another existing Terminal Services session.
tsdiscon | Disconnects a client from a Terminal Services session.
tskill | Terminates a process.
tsprof | Copies user configuration and changes profile path.
tsshutdn | Shuts down a Terminal Services server.

For more information on Terminal Services command-line functions, see Terminal Services commands.

Terminal Services WMI Provider

With the Terminal Services WMI provider, you can create customized scripts for configuring, managing, and querying terminal servers. For more information, see Configuring Terminal Services with WMI.


Deploying Remote Desktop for Administration

This section covers:

  • Getting the client software
  • Enabling users to connect remotely to the server
  • Deploying Remote Desktop Web Connection


Getting the client software

Microsoft Windows graphic

Getting the client software

To set up your client computer to connect to Remote Desktop for Administration, you need the following:
  • Access to the remote computer (the computer running a Windows Server 2003 family operating system) by means of Local Area Network (LAN), modem, or Virtual Private Network (VPN) connection.
  • Remote Desktop Connection or Terminal Services client installed on the client computer. See the following table for instructions on installing the client software for your operating system.

    • Important

    • You should install the latest version of Remote Desktop Connection. If you are using the Windows 2000 32-bit Terminal Services Client, you should upgrade to the version of Remote Desktop Connection that is provided with all Windows Server 2003 family operating systems.
Operating System | Client version | How to access
Windows Server 2003 family operating systems (all versions) | Remote Desktop Connection installed by default | Start/Programs/Accessories/Communications/Remote Desktop Connection
XOX (all versions) | Remote Desktop Connection installed by default | Start/Programs/Accessories/Communications/Remote Desktop Connection
Microsoft Windows 2000 Professional | Not installed | See To Install Remote Desktop Connection (32-bit computers)
Microsoft Windows 2000 Server | Not installed | See To Install Remote Desktop Connection (32-bit computers)
Microsoft Windows 95 & Microsoft Windows 98 | Not installed | See To install Remote Desktop Connection (32-bit computers)
Windows NT 4.0 | Not installed | See To install Remote Desktop Connection (32-bit computers)
Microsoft Windows CE | Not installed | Go to the Microsoft Web Site (http://www.microsoft.com/) and follow the directions to install the Windows CE client.


Enabling users to connect remotely to the server

Before you can create a remote connection to Remote Desktop for Administration, you must have the appropriate permissions. By default, members of the Administrator group can connect remotely to the server. However, the Remote Desktop Users group is not populated by default. You must decide which users and groups should have permission to log on remotely, and then manually add them to the group.

Important

  • You must use the Remote Desktop Users group to control remote connection permissions for Remote Desktop for Administration and Terminal Server.

The Remote Desktop Users group allows the same access as the Users group, with the additional ability to connect remotely. By using this group, you save administrative resources by not having to set up these rights for each user individually. For information about how to add users to the Remote Desktop Users group, see To add users to the Remote Desktop Users group.

Note

  • To connect to a remote computer, that computer must have remote connections enabled. For more information, see To enable or disable remote connections.


Deploying Remote Desktop Web Connection

This section provides information about deploying Remote Desktop Web Connection. Remote Desktop Web Connection is a Web application consisting of an ActiveX component and sample connection pages. When you deploy Remote Desktop Web Connection on a Web server, you can provide client connectivity to terminal servers and other computers via Internet Explorer and TCP/IP.

This section provides general background information about deploying Remote Desktop Web Connection:

  • About Remote Desktop Web Connection.
  • Setting up Remote Desktop Web Connection.
  • Providing for Client Security
  • About the Sample Web Page
  • Customizing Remote Desktop Web Connection


About Remote Desktop Web Connection

Remote Desktop Web Connection is a Web application that consists of an ActiveX control, sample web pages, and other files. When deployed on a Web server, Remote Desktop Web Connection allows users to create a Terminal Services connection within Internet Explorer, even if a Terminal Services client program is not installed on the user's computer.

Remote Desktop Web Connection offers the following benefits:

  • Simple, straightforward deployment of a Terminal Services client. With Remote Desktop Web Connection, deploying a Terminal Services connection can be as easy as sending a URL.
  • Support for roaming users. Users who are away from their computers can use Remote Desktop Web Connection to gain secure access to their primary workstation or favorite terminal server from any computer running Windows and Microsoft Internet Explorer 5 or later.
  • A lowest common denominator cross-platform system. Remote Desktop Web Connection may meet the needs of organizations that want identical clients on different platforms.
  • Delivery of extranet applications. Corporations that want to deploy Terminal Services connections to vendors, suppliers, or customers can use Remote Desktop Web Connection to distribute them easily, inexpensively, and efficiently over the Internet.

How Remote Desktop Web Connection works

When a Web user accesses a Web page that contains the embedded Remote Desktop Web Connection ActiveX Client Control, the following sequence of events occurs:
  • If necessary, Internet Explorer (IE), version 5 or later, downloads the .cab file pointed to by the CODEBASE parameter of the OBJECT tag. This is necessary in the following circumstances:
    • The computer that accessed the Web page does not have an installation of the full Remote Desktop Connection program or the Terminal Services Advanced Client with Web support.
    • The installed version of the .cab file on the client computer is older than the version on the Web page.
  • After downloading, IE decompresses the .cab file and installs the ActiveX Client Control in IE's default location for downloaded controls on the target computer.
  • The default connection page appears, asking the user for server, logon, and connection information.
  • The Remote Desktop opens in the Web page. Depending on the parameters passed and the settings of the remote computer to which the user is trying to connect, the Windows logon screen appears.

For information on using Remote Desktop Web Connection from the client computer, see To connect to another computer using Remote Desktop Web Connection.


Setting up Remote Desktop Web Connection

Remote Desktop Web Connection is an optional World Wide Web Service component of Internet Information Services, which is included in XOX and Windows Server 2003 family operating systems. Remote Desktop Web Connection is not installed by default, but must be installed using Add or Remove Programs.

When you install Remote Desktop Web Connection, the files are copied by default to the %systemroot%\Web\Tsweb directory of your web server. The included sample default.htm page can be used as is, or you can modify it to meet the needs of your application.

On the client side, Remote Desktop Web Connection requires that the computer have a TCP/IP connection to the Internet or network, and be running Microsoft Internet Explorer 5 or later.

Important

  • If you are setting up a Web site for yourself or for some non-Administrator users of a server running one of the Windows Server 2003 family operating systems, you must disable the Internet Explorer Enhanced Security Configuration setting for Internet Explorer. Otherwise, all server users, including Administrators, will be prevented from downloading files or ActiveX controls such as Remote Desktop Web Connection from the Web site. To change this setting, use Add/Remove Windows Components in Add or Remove Programs. For more information, see Internet Explorer Enhanced Security Configuration.

For more information, see:

  • To install Remote Desktop Web Connection.
  • To connect to another computer using Remote Desktop Web Connection.
  • About the Sample Web page.

For information on customizing Remote Desktop Web Connection, see the Microsoft Platform SDK.


Providing for client security

To allow clients to protect themselves from potentially untrustworthy servers, some properties of the Remote Desktop Web Connection ActiveX component object are restricted to certain Internet Explorer security zones. This means that when a Web user accesses the page from a computer in a less secure zone, these properties are disabled.

Some of these restricted properties are:

StartProgram
Specifies a program to start upon connection.
WorkDir
Specifies the working directory for the program specified in StartProgram.
FullScreen
Specifies whether the connection will be displayed as full screen or windowed mode.

Servers using Remote Desktop Web Connection can display these restricted properties in the following Internet Explorer security zones:

  • My Computer
  • Local Intranet
  • Trusted Sites

Servers using Remote Desktop Web Connection cannot display restricted these properties in the following zones:

  • Internet
  • Restricted Sites

For more information about Remote Desktop ActiveX Control interfaces, see the Microsoft Web site (http://www.microsoft.com/).


About the Sample Web page

When you install Remote Desktop Web Connection, a sample Web page, Default.htm, is copied to the installation directory on your computer. This page can be run as is, or it can be modified.

Default.htm is a default logon page that is designed to collect connection information from the user. This page contains a required field for the terminal server or remote computer to which the user wants to connect and optional fields for screen size and user logon information (username and domain). After this data is collected, it is passed to the ActiveX Client Control (Msrdp.ocx) to initiate a remote desktop session. The entire process works as follows:

  1. If necessary, IE downloads the .cab file containing the ActiveX component and installs it on the user's computer.
  2. The user types in the fully qualified domain name or IP address of the remote computer. Optionally, the user specifies a screen size for the connection. If no screen size is specified, the session opens in Full Screen mode (if the user is in a trusted zone. See Providing for Client Security for more information).
  3. Optionally, the user supplies automatic logon information (username, domain) for the remote session.
  4. When the user clicks the Connect button, Default.htm passes the parameters to the ActiveX Client Control.
  5. The remote desktop opens in the browser window (or full screen).

When Default.htm opens for the first time in Internet Explorer, a dialog box appears and asks if the user wants to download the Msrdp.ocx ActiveX component. This happens only under the following conditions:

  • The computer that accessed the Web page does not have an installation of the full Terminal Services Client with Web support.
  • The installed version of the .cab file on the client computer is older than the version on the Default.htm page.

For security reasons, some options that are available in Remote Desktop Web Connection are restricted to certain Internet Explorer security zones when called by the Remote Desktop Web Connection ActiveX Client Control. See Providing for Client Security for more information.

The screen size specified by the user in this form is the size of the remote desktop upon connection. The remote desktop appears at the specified size in the browser window or, if the session opens in the default full-screen mode, the browser controls and borders disappear and the remote desktop expands to the size of the user's screen. As with the full Remote Desktop Connection program, the user can toggle between full-screen and windowed mode by pressing CTRL+ALT+BREAK.

The size of the remote desktop session is specified in Default.htm. To change the screen size, the user must return to Default.htm (after disconnecting the session) and edit the connection. If no screen size is specified, the remote desktop opens in the browser window in the default full-screen mode. At this resolution, the IE tool bars and window frames disappear, and the remote desktop expands to match the full dimensions of the user's screen. As with the full Remote Desktop Connection client, the user can toggle between full-screen and windowed mode by pressing CTRL+ALT+BREAK.

See Providing for Client Security for information on specifying a program to run upon connection.


Customizing Remote Desktop Web Connection

The sample Default.htm page is installed with Remote Desktop Web Connection and can be used as is, or can be customized to fit the needs of your organization. Web authors can embed the Remote Desktop Web Connection ActiveX Control in a Web page with the HTML <OBJECT> tag, and can use the scriptable interfaces, for example, to specify a specific program to run upon connection, to allow seamless logon, and to specify advanced configuration options for the client connection.

If you have enabled a Virtual Channels application in your Terminal Services deployment, you can also make this application available to client computers that access the terminal server by means of the Remote Desktop Web Connection ActiveX component.

For a complete documentation of the full set of Remote Desktop Web Connection ActiveX Control parameters, see the Microsoft Platform SDK.


Troubleshooting Remote Desktop

Microsoft Windows graphic

Troubleshooting

What problem are you having?

Client fails to connect with "This initial program cannot be started" message.

Cause: The client connection might have been configured to start a program upon connection, but the program path and filename are incorrect.

Solution: Check the properties for the client connection to ensure that the program path and filename are correct, and that the program exists in this location on the server.

Cause: The server administrator might have specified a program to start upon connection, using Group Policy, Terminal Services Configuration, or other Terminal Services administration tools.

Solution: Check the server configuration to ensure that the program path and filename specified for this user are correct, and that the program exists in this location on the server.

Cannot disconnect active RAS connections with Terminal Services.

Cause: When a RAS connection is established in a Terminal Services session, the current ID of the session is added to the port. When disconnecting the RAS connection, the current session ID must match the session ID that was added to the port, or it cannot be disconnected.

Solution: A RAS connection can only be disconnected from inside the session in which it was established.

The connection does not automatically log on to the server. I am prompted for my user name and password on connection.

Cause: Due to encryption enhancements for Windows Server 2003 family operating systems, the Windows NT 4.0 version of Terminal Services Client does not recognize the user name and password in the automatic logon portion of the connection file.

Solution: From the Windows NT 4.0 version of Client Connection Manager, right-click the connection and select Properties. On the General tab, select Automatic logon, and then type the user name, password, and domain.

Solution: Upgrade the client software to Remote Desktop Connection.

Cause: The server administrator has configured the server to deny automatic logon.

Solution: Type your user name and password when prompted.

Cause: User name and password information has not been added to Remote Desktop Connection.

Solution: In Remote Desktop Connection, on the General tab, type your user name and password, and then select the Save my password checkbox.

The Remote Desktop connection is very slow.

Cause: A low-bandwidth connection can slow Remote Desktop performance.

Solution: On the remote computer, set the background selection to None.

Solution: Do not run memory-intensive applications, for example, video games, over Remote Desktop.

The screen saver on my Remote Desktop is blank.

Cause: When a screen saver is activated on Remote Desktop, it is blank. This is true regardless of whether you have previously selected a different screen saver.

Solution: Continue to use the blank screen saver.