Terminal Services

Terminal Services provides remote access to a Windows desktop through "thin client" software, allowing the client computer to serve as a terminal emulator. Terminal Services transmits only the user interface of the program to the client. The client then returns keyboard and mouse clicks to be processed by the server. Each user logs on and sees only their individual session, which is managed transparently by the server operating system and is independent of any other client session. To connect to a computer via Terminal Services, use Remote Desktop Connection (the new Terminal Services client). For more information, see Remote Desktop Connection.

Terminal Server uses Terminal Services technology to provide an effective and reliable way to distribute Windows-based programs with a network server. With Terminal Server, a single point of installation allows multiple users access to the desktop of a computer running one of the Windows Server 2003 family operating systems, where they can run programs, save files, and use network resources. Terminal Server is not installed by default. For more information about Terminal Server, see Terminal Server. (Terminal Server is not available on XOX.)

Important

  • It is not necessary to install Terminal Server for remote administration of your server. Remote Desktop for Administration is installed by default. To use Remote Desktop for Administration, you must first enable remote connections. For more information, see To enable or disable remote connections. For more information about Remote Desktop for Administration, see Remote Desktop for Administration.

Terminal Server has its own method for licensing clients that log on to terminal servers, separate from the licensing method for clients running one of the Windows Server 2003 family operating systems. Clients must receive a valid license issued by a license server before they are allowed to log on to a Terminal Server. For more information about Terminal Server Licensing, see Terminal Server Licensing.

A Terminal Services connection provides the link clients use to log on to a session on the server. A TCP/IP connection is configured on port 3389 when Terminal Services is installed. Using Terminal Services Configuration, you can change the default properties of the connection, as well as other settings that apply to Terminal Services sessions. For more information about Terminal Services configuration, see Terminal Services Configuration.

User accounts can be set up and managed for a specific computer using Local Users and Groups or for a domain of computers using Active Directory Users and Computers. For more information about Terminal Services user properties, see Terminal Services User Properties.

Terminal Services Manager can be used to view information about terminal servers that reside in trusted domains. Use this tool to monitor users, sessions, and applications on each terminal server, and to carry out assorted actions to manage the server. For more information about Terminal Services Manager, see Terminal Services Manager.


Terminal Server

On Microsoft® Windows Server 2003 family operating systems, the Terminal Server feature gives users at client computers throughout your network access to Windows-based programs installed on terminal servers. With Terminal Server, you can provide a single point of installation that allows multiple users access to the Windows Server 2003 family operating system desktop, where they can run programs, save files, and use network resources, all from a remote location, as if these resources were installed on their own computers.

For computers running XOX or Windows Server 2003 family operating systems, the Terminal Services client program (Remote Desktop Connection) is already installed. Remote Desktop Connection can also be installed on other 32-bit Windows-based operating systems.

Terminal Server is not included in XOX.

  • Before you begin using Terminal Server, see Checklists: Setting up Terminal Server.
  • To find features that have been moved in this release, see New ways to do familiar tasks.
  • For tips about using Terminal Server, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.

Important

  • It is not necessary to install Terminal Server for remote administration of your server. Remote Desktop for Administration is installed by default. To use Remote Desktop for Administration, you must first enable remote connections. For more information, see To enable or disable remote connections. For more information about Remote Desktop for Administration, see Remote Desktop for Administration.

Note

  • For additional information about deploying Terminal Server, see "Hosting Applications with Terminal Server" at the Microsoft Windows Resource Kit Web site. (http://www.microsoft.com/)


Checklists: Setting up Terminal Server

  • Plan your Terminal Server deployment
  • Configure Terminal Server
  • Configure Terminal Server Licensing
  • Install Applications
  • Choose client software deployment options


Checklist: Plan your Terminal Server deployment

Plan your Terminal Server deployment
Step | Reference
Read the "Guidelines for Deploying Terminal Server" white paper and the Terminal Services overview. Guidelines for Deploying Terminal Server (http://www.microsoft.com/)

Terminal Services overview
Review information about hosting applications with Terminal Server. | Using Terminal Server to host applications centrally
Plan your hardware configuration. | System planning
Read "Hosting Applications with Terminal Server" at the Windows Server 2003 Technical Reference Web site. | Windows Server 2003 Technical Reference Web site (http://www.microsoft.com/)
Follow pre-installation recommendations. | Before installing Terminal Server
Determine whether you need to change the Internet Explorer Enhanced Security Configuration settings for Internet Explorer.

Note

  • This applies to servers running one of the Windows Server 2003 operating systems where the installation of Terminal Server was performed using the Configure Your Server Wizard. If you install Terminal Server using Add or Remove Programs, you can change this setting during the installation process.
Terminal server role: Configuring a terminal server

Internet Explorer Enhanced Security Configuration
Understand how to use Terminal Services administrative tools. | Terminal Services administrative tools
Read the "Windows Server 2003 Terminal Server Licensing" white paper and the Terminal Server Licensing overview.

Important

  • You must configure Terminal Server Licensing correctly in order for your terminal server to continue to accept connections from clients. To allow ample time for you to deploy a license server, Terminal Server provides a licensing grace period, during which no license server is required. During this grace period, a terminal server can accept connections from unlicensed clients without contacting a license server. The grace period begins the first time the terminal server accepts a client connection. It ends after you deploy a license server and that license server issues its first permanent client access license (CAL), or after 120 days, whichever comes first. For more information about the licensing grace period, see Terminal Server Licensing grace period.
Windows Server 2003 Terminal Server Licensing (http://www.microsoft.com/)

Terminal Server Licensing overview
Review program considerations. | Program considerations

Next checklist: Configure Terminal Server


Checklist: Configure Terminal Server

Configure Terminal Server
Step | Reference
Configure Terminal Server by using Terminal Services Configuration. | Configure Terminal Services connections
Read about using Network Load Balancing with Terminal Servers. | Load balancing and terminal servers
Review the steps for enabling and configuring Network Load Balancing. | Checklist: Enabling and configuring Network Load Balancing
Configure Session Directory settings. | To configure Session Directory settings
Configure Terminal Server Licensing. This step is required.

Warning

  • You must configure Terminal Server Licensing correctly in order for your terminal server to continue to accept connections from clients. To allow ample time for you to deploy a license server, Terminal Server provides a licensing grace period, during which no license server is required. During this grace period, a terminal server can accept connections from unlicensed clients without contacting a license server. The grace period begins the first time the terminal server accepts a client connection. It ends after you deploy a license server and that license server issues its first permanent client access license (CAL), or after 120 days, whichever comes first.
Checklist: Configure Terminal Server Licensing
Install applications. | Checklist: Install applications
Choose client software deployment options. | Checklist: Choose client software deployment options

Previous checklist: Plan your Terminal Server deployment

Next checklist: Configure Terminal Server Licensing

For more information: Guidelines for Deploying Terminal Server (http://www.microsoft.com/)


Checklist: Configure Terminal Server Licensing

Configure Terminal Server Licensing
Step | Reference
Read the "Windows Server 2003 Terminal Server Licensing" white paper and the Terminal Server Licensing overview. Windows Server 2003 Terminal Server Licensing (http://www.microsoft.com/)

Terminal Server Licensing
Choose a Terminal Server license server role. | Terminal Server License server roles
Install Terminal Server Licensing. | To install Terminal Server Licensing
Choose a Terminal Server license server activation method. | Activating a Terminal Server license server
Activate the Terminal Server license server. | Activate a Terminal Server license server
Review information about purchasing and installing client access licenses. | Purchasing and installing client access licenses on a Terminal Server license server
Decide what type of client access license to purchase. | Choosing the Licensing Model (http://www.microsoft.com/)
Purchase client access licenses. | Purchase client access licenses
Install client access licenses.

Important

  • You must configure Terminal Server Licensing correctly in order for your terminal server to continue to accept connections from clients. To allow ample time for you to deploy a license server, Terminal Server provides a licensing grace period, during which no license server is required. During this grace period, a terminal server can accept connections from unlicensed clients without contacting a license server. The grace period begins the first time the terminal server accepts a client connection. It ends after you deploy a license server and that license server issues its first permanent client access license (CAL), or after 120 days, whichever comes first. For more information about the licensing grace period, see Terminal Server Licensing grace period.
Install client access licenses
Ensure that the terminal server can detect the license server.

Note

  • Although Terminal Server attempts to detect a license server automatically, it is recommended that you explicitly specify the license server that a terminal server connects to.
How to override the license server discovery process in Windows Server 2003 Terminal Services (http://www.microsoft.com/)
Ensure that the Terminal Server role matches the type of CALs purchased. | Guidelines for Deploying Terminal Server (http://www.microsoft.com/)

Previous checklist: Configure Terminal Server

Next checklist: Install Applications


Checklist: Install applications

Install Applications
 | Step | Reference
 | Review program compatibility information. | Program compatibility
 | Prepare for installation. | Getting ready to install programs
 | Install programs. | Starting the installation
 | Test the application installation. | Testing the installation

Previous checklist: Configure Terminal Server Licensing

Next checklist: Choose client software deployment options


Checklist: Choose client software deployment options

Choose Client Software Deployment options
 | Step | Reference
 | Determine Remote Desktop Connection deployment method. | About the Terminal Services Client MSI Setup Package
 | Install Remote Desktop Connection. | To install Remote Desktop Connection (32-bit computers)
 | Review Remote Desktop Web Connection concepts. | Deploying Remote Desktop Web Connection
 | Add users to the Remote Desktop Users group. | To add users to the Remote Desktop Users group

Previous checklist: Install applications


New ways to do familiar tasks

The following table lists common tasks for Terminal Services. The user interface for performing these tasks is different in Windows Server 2003 family operating systems from the way it was in Microsoft Windows NT 4.0 or Microsoft Windows 2000.

Please choose your upgrade path:

Windows NT 4.0 to one of the Windows Server 2003 family operating systems

If you want to | In Windows NT 4.0 use | In Windows Server 2003 family operating systems use
Connect to a terminal server | Terminal Services Client in Program Manager | Open Remote Desktop Connection. For more information, see Remote Desktop Connection
Configure a terminal server | Terminal Server Connection Configuration in Administrative Tools | To configure groups of servers or individual servers, open Group Policy and use Terminal Services Group Policies. To configure a terminal server locally, use Terminal Services Configuration. For more information, see Terminal Services configuration overview
Use Terminal Services for Remote Administration | Not available | Remote Desktop (installed by default). For more information, see Remote Desktop for Administration.
Manage the terminal server and view all sessions, users, and processes | Terminal Server Administration in Administrative Tools | Terminal Services Manager. For more information, see Terminal Services Manager.
Manage Terminal Server licenses | Terminal Server License Manager in Administrative Tools | Terminal Server Licensing. For more information, see Terminal Server Licensing.
Manage Terminal Server user accounts | User Manager in Administrative Tools | Terminal Services Group Policies. For more information, see Managing Terminal Services Users with Group Policy

Windows 2000 to one of the Windows Server 2003 family operating systems

If you want to | In Windows 2000 use | In Windows Server 2003 family operating systems use
Connect to a terminal server | Terminal Services Client and Client Connection Manager | Open Remote Desktop Connection. For more information, see Remote Desktop Connection
Configure a terminal server | Terminal Services Configuration in Administrative Tools | To configure groups of servers or individual servers, open Group Policy and use Terminal Services Group Policies. To configure a terminal server locally, use Terminal Services Configuration. For more information, see Terminal Services configuration overview
Use Terminal Services for Remote Administration | Terminal Services in Remote Administration mode (must be installed using Add or Remove Programs) | Remote Desktop (installed by default). For more information, see Remote Desktop for Administration.
Manage the terminal server and view all sessions, users, and processes | Terminal Services Manager in Administrative Tools | Terminal Services Manager. For more information, see Terminal Services Manager.
Manage Terminal Server licenses | Terminal Services Licensing in Administrative Tools | Terminal Server Licensing. For more information, see Terminal Server Licensing.
Manage Terminal Server user accounts | For a domain user account, use Active Directory Users and Computers. For a local user account, use Computer Management. | Terminal Services Group Policies. For more information, see Managing Terminal Services Users with Group Policy


Best practices

  • Install Terminal Server on a standalone server and not on a domain controller.
    Installing Terminal Server on a domain controller can affect the performance of the server because of the additional memory, network traffic, and processor time required to perform the tasks of a domain controller in a domain.
  • Install Terminal Server on an NTFS file system partition.
    NTFS provides greater security for users in a multisession environment who access the same data structures.
  • When shutting down a terminal server, use the tsshutdn command instead of the Shut Down option on the Start menu. This will shut down the server in a controlled manner. The Shut Down option on the Start menu does not notify users before ending user sessions and is not recommended. Ending a user's session without warning can result in loss of data at the client. For more information about using tsshutdn, see Tsshutdn.
  • Back up your license server regularly.
    Backing up your license server regularly protects data from accidental loss due to hardware or storage failure. Create a duplicate copy of the data on your hard disk and then archive the data on another storage device such as a removable disk or tape. In the event that the original data on your hard disk is accidentally erased or overwritten, or becomes inaccessible because of a hard disk failure, you can easily restore the data from the archived copy.

Program installation

  • Use Add or Remove Programs in Control Panel to install applications on the terminal server. Using this method, you can install programs for multisession use. For more information about installing applications on a terminal server, see Starting the installation.
  • After you install Terminal Server, do not use Add or Remove Programs to switch Terminal Server on and off.
    Terminal Server installs programs for use in a multisession environment. Programs that were installed while Terminal Server was installed might not work correctly when Terminal Server is uninstalled. Instead, reinstall all programs for use without Terminal Server if you decide to remove the component.
  • Check for application compatibility scripts before installing programs for use with Terminal Server.
    Many commonly used programs have been tested for compatibility. Some programs require minor changes to the installation. Scripts are available for these programs and must be run after the program installation is complete. Scripts are located in the systemroot in \Application Compatibility Scripts\Install.

Configuring Terminal Services

  • Use Terminal Services Group Policy to configure one or more terminal servers, or to manage Terminal Server user settings. Terminal Server Group Policies can be applied on individual computers or on groups of computers belonging to a single organizational unit.

Managing users

  • Use Terminal Services-specific groups
    Create User Groups that are specifically for Terminal Services users. Maintaining users through groups is much easier and less time consuming than managing users individually.

    Windows Server 2003 family server operating systems contain a default User group called Remote Desktop Users, which has been specifically created to manage Terminal Server users. This group is not populated by default. You must add users to the Remote Desktop Users group if you want them to be able to establish remote connections.

  • Use Terminal Services-specific profiles
    Assign a separate profile for logging onto Terminal Services. Many of the common options that are stored in profiles, such as screen savers and animated menu affects, are not desirable when using Terminal Services. Assigning a specific profile allows users to get the most out of the system they are using without expending additional server resources. For information about assigning a Terminal Services specific profile, see To change a user's Terminal Services profile path.
  • Use mandatory profiles
    Use a mandatory Terminal Services profile that is created to suit the needs of all of the different types of clients and that provides the best server performance. Be aware that 16-bit computers and Windows-based terminals might not support some screen resolutions.
  • Set time limits
    Setting limits on the duration of client connections can improve server performance. You can set the limits on how long a session lasts, how long a disconnected session is allowed to remain active on the server, and the time allowed for a session to remain connected, yet idle. For information about setting session limits, see Configuring session limits.
  • Use the Starting program option
    If you have users who need access to only one application on the terminal server, use the Starting program option to restrict users to that application. For more information, see To specify a program to start on session connection .
  • Create preconfigured connection files for users or groups of users
    To make connecting to Terminal Services easier, you can supply users with preconfigured connection files. Collections of connection files can also be made either for different departments within your organization or for different job titles. preconfigured connection files are created using Remote Desktop Connection. For more information, see Managing Terminal Services connection files.


How to...

  • Install Terminal Server
  • Disable Terminal Services connections
  • Uninstall Terminal Server
  • Deploy Applications
  • Deploy Client Software
  • Use Client Software


Install Terminal Server

Microsoft Windows graphic

To install Terminal Server

  1. Open Configure Your Server Wizard.
  2. Click Next and follow the instructions on the Preliminary Steps screen.
  3. Click Next, and on the Server Role screen, select Terminal Server.
  4. Click Next and follow the instructions in the wizard.
  5. Some programs might not work correctly when Terminal Server is installed. If so, you must reinstall these programs for multisession access using Add or Remove Programs after Terminal Server is installed. For more information, see Program compatibility.

Warning

  • Terminal Server Licensing is a required component that licenses clients on a terminal server. You must install Terminal Server Licensing or your terminal server will stop accepting connections from unlicensed clients 120 days from the date of the first client logon.
  • For small deployments, it is acceptable to install both the Terminal Server and Terminal Server Licensing service on the same physical computer; however, for larger deployments, it is recommended that Terminal Server Licensing be installed on a separate server.
  • For more information on Terminal Server Licensing, see Terminal Server Licensing.

Important

  • When you install Terminal Server using the Configure Your Server Wizard, as a security precaution the Internet Explorer Enhanced Security Configuration is set by default to prevent Administrators from downloading files or running ActiveX controls from the Web. If you want to change this setting to either permit all users to download files or run ActiveX controls or prevent all users from doing so, use Add/Remove Windows Components in Add or Remove Programs. This setting applies to servers running one of the Windows Server 2003 family operating systems. For more information, see Terminal server role: Configuring a terminal server and Internet Explorer Enhanced Security Configuration.
  • You must use the Remote Desktop Users group to control remote connection permissions for Terminal Server. For more information, see Managing Terminal Services Users and To add users to the Remote Desktop Users group.
  • It is not necessary to install Terminal Server for remote administration of your server. Remote Desktop for Administration is installed by default. To use Remote Desktop for Administration, you must first enable remote connections. For more information on enabling remote connections, see To enable or disable remote connections and Enabling users to connect remotely to the server.

Notes

  • XOX
  • XOX
  • XOX
  • You can also use Add or Remove Programs to install Terminal Server.

Related Topics


Disable Terminal Services connections

Microsoft Windows graphic

To disable Terminal Services connections

  1. Click the System in Control Panel.
  2. On the Remote tab, clear the Allow users to connect remotely to your computer check box, and then click OK.

    The terminal server no longer accepts new connections, but existing connections are maintained until closed by the users. This allows administrators to shut down a terminal server gradually.

Notes

  • You must be logged on as Administrator or a member of the Administrators group to disable Terminal Services connections.
  • XOX

Related Topics


Uninstall Terminal Server

Microsoft Windows graphic

To uninstall Terminal Server

  1. Open Add or Remove Programs in Control Panel.
  2. Click Add or Remove Windows Components to open the Windows Components wizard.
  3. In the Windows Components wizard, deselect the Terminal Server check box, and then click Next.
  4. Follow the instructions in the wizard.

Important

  • Use this procedure only if you want to completely uninstall Terminal Server. To disable Terminal Services connections temporarily (for example, to install an application on a terminal server), you can do so using the Remote tab in System Properties and clearing the Allow users to connect remotely to your computer checkbox.

Notes

  • XOX
  • XOX
  • XOX

Related Topics


Deploy applications

  • Install a program using Add or Remove Programs
  • Install a program using the change user command


Install a program using Add or Remove Programs

Microsoft Windows graphic

To install a program using Add or Remove Programs

  1. Log on to the terminal server as an administrator and close all programs.
  2. Open Add or Remove Programs in Control Panel.
  3. In Add or Remove Programs, click Add New Programs.
  4. Select the method to install the program and follow the instructions in the wizard.
  5. The installation wizard will guide you through the rest of the installation process. For security purposes, install the program on an NTFS file system partition.
  6. If applicable, edit and run the program installation script.

Notes

  • XOX
  • XOX
  • If you are prompted to restart the computer to finish the installation, click Finish in Add or Remove Programs before accepting the prompt to restart the computer. It might be necessary to log on as the same user after the server has been rebooted in order to finish the application installation properly. Do not allow other users to log on before this step has been completed.

Related Topics


Install a program by using the change user command

Microsoft Windows graphic

To install a program by using the change user command

  1. Log on to the terminal server as an administrator and close all applications.
  2. XOX
  3. Type change user /install and press ENTER.
  4. Install the program on a local NTFS file system formatted drive as directed by the installation program.
  5. At the command prompt, type change user /execute when installation is complete.
  6. If applicable, edit and run the program installation script.

Notes

  • XOX
  • If prompted by a program to install an additional program, you can leave your initial program running.
  • You can type change user /query at the Command Prompt to see whether execute mode is enabled and .ini file mapping is on.
  • You should use Add or Remove Programs to install programs whenever possible.

Related Topics


Deploy client software

  • Share the client setup folder
  • Create a connection file
  • Install the 32-bit Terminal Services Client (Remote Desktop Connection)


Share the client setup folder

Microsoft Windows graphic

To share the client setup folder

  1. On a computer that is running one of the Windows Server 2003 family operating systems, open Windows Explorer.
  2. Browse to the systemroot\System32\Clients\Tsclient\win32 folder, where systemroot is the folder containing your Windows installation files (for example, C:\Windows\System32\Clients\Tsclient\win32).
  3. Right-click the \win32 folder, click Sharing and security, check Share this folder, and then click OK.

Notes

  • To share folders and drives, you must be logged on as a member of the Administrators, Server Operators, or Power Users group.

Related Topics


Create a connection file

Microsoft Windows graphic

To create a connection file

  1. Open Remote Desktop Connection.
  2. In Computer, type a computer name or IP address.
  3. Click Options.
  4. Specify the connection settings that you want for this connection, (such as screen size, automatic logon information, and performance options).
  5. On the General tab, click Save As.
  6. Enter a file name for the saved connection file, and then click Save.

Note

  • XOX

Related Topics


Install the 32-bit Terminal Services Client (Remote Desktop Connection)

Microsoft Windows graphic

To install the 32-bit Terminal Services Client (Remote Desktop Connection)

  1. At a command prompt, type drive:setup (where drive is the letter of the drive containing the Terminal Services Client disk or path to shared installation files), and press ENTER.
  2. Follow the instructions in the Wizard.

Notes

  • Remote Desktop Connection is already installed on XOX and Windows Server 2003 family operating systems.
  • To use Group Policy to deploy Remote Desktop Connection, assign the program on a per-computer basis to a terminal server. For more information, see article Q324750, "HOW TO: Assign Software to a Specific Group By Using a Group Policy in Windows Server 2003" in the Microsoft Knowledge Base. (http://www.microsoft.com/)

Related Topics


Use client software

  • Connect to a terminal server using Remote Desktop Connection
  • Use Terminal Services shortcut keys
  • Check the version number of Remote Desktop Connection
  • Disconnect without ending a session
  • Log off and end the session


Connect to a terminal server using Remote Desktop Connection

Microsoft Windows graphic

To connect to a terminal server using Remote Desktop Connection

  1. XOX

    The Remote Desktop Connection dialog box appears.

  2. In Computer, type a computer name or IP address. In the Computer list, you can also choose Browse for more... to select a computer from your domain or network.

  3. Click Options>> to configure the connection settings in the available tabs.

  4. Click Save As... to save the current connection settings or click Open to choose a previously saved connection file.

  5. Click Connect.

    The Logon Information dialog box appears.

  6. Type your user name, password, and domain (if required), and then click OK.

Related Topics


Use Terminal Services shortcut keys

If you choose not to apply Windows key combinations to your terminal server sessions, you can use these Terminal Services shortcut keys to perform many of the same functions.

Shortcut key | Description
ALT+PAGE UP | Switches between programs from left to right.
ALT+PAGE DOWN | Switches between programs from right to left.
ALT+INSERT | Cycles through the programs in the order they were started.
ALT+HOME | Displays the Start menu.
CTRL+ALT+BREAK | Switches the client between a window and full screen.
CTRL+ALT+END | Displays the Windows Security dialog box.
ALT+DELETE | Displays the Windows menu.
CTRL+ALT+Minus (-) symbol on the numeric keypad | Places a shadow copy of the active window, within the client, on the terminal server clipboard (provides the same functionality as pressing PrintScrn on a local computer.)
CTRL+ALT+Plus (+) symbol on the numeric keypad | Places a shadow copy of the entire client window area on the terminal server clipboard (provides the same functionality as pressing ALT+PrintScrn on a local computer.)

Note

  • On an NEC98, these shortcut keys are different in two cases:
    • CTRL+ALT+BREAK is replaced by CTRL+GRPH+VF2.
    • CTRL+ALT+END is replaced by CTRL+GRPH+VF1.

Related Topics


Check the version number of Remote Desktop Connection

Microsoft Windows graphic

To check the version number of Remote Desktop Connection

  1. XOX

    The Remote Desktop Connection dialog box appears.

  2. Click the computer icon in the upper-left corner of the title bar, and then click About.

Related Topics


Disconnect without ending a session

Microsoft Windows graphic

To disconnect without ending a session

  1. In the remote desktop window, click Start, and then click Shut Down.

    The Shut Down Window dialog box appears.

  2. Select Disconnect from the list at the top of this dialog, and then click OK.

Note

  • Remote Desktop Connection reconnects to this session the next time you connect to this terminal server (if the connection is configured for reconnection of disconnected sessions).

Related Topics


Log off and end the session

Microsoft Windows graphic

To log off and end the session

  1. In the remote desktop window, click Start, and then click Shut Down.

    The Shut Down Windows dialog box appears.

  2. Click Log Off, and then click OK.

Related Topics


Concepts

This section provides general background information about Terminal Server:

  • Getting Started with Terminal Server
  • Deploying Terminal Server
  • Deploying Applications
  • Deploying Client Software
  • Terminal Services Client overview


Getting started with Terminal Server

This topic covers information about getting started with Terminal Server. The following topics are included:

  • Terminal Services overview
  • Using Terminal Server to host applications centrally
  • Terminal Services administrative tools


Terminal Services overview

Terminal Services provides remote access to a Windows desktop through "thin client" software, allowing the client computer to serve as a terminal emulator. Terminal Services transmits only the user interface of the program to the client. The client then returns keyboard and mouse clicks to be processed by the server. Each user logs on and sees only their individual session, which is managed transparently by the server operating system and is independent of any other client session. Client software can run on a number of client hardware devices, including computers and Windows-based terminals. Other devices, such as Macintosh computers or UNIX-based workstations, can use additional third-party software to connect to a server running Terminal Server.

Terminal Services is the underlying technology for several features and components of Microsoft® Windows Server 2003 family operating systems. Among these are Terminal Server and Remote Desktop for Administration.

Terminal Server provides an effective and reliable way to distribute Windows-based programs with a network server. With Terminal Server, a single point of installation allows multiple users to access the desktop on a server running one of the Windows Server 2003 family operating systems. Users can run programs, save files, and use network resources as if they were sitting at that computer. For more information on using Terminal Server for multisession application hosting, see Using Terminal Server to host applications centrally.

Remote Desktop for Administration (formerly known as Terminal Services in Remote Administration mode) provides remote access to the desktop of any computer running one of the Windows Server 2003 family operating systems, allowing you to administer your server—even a Microsoft® Windows 2000 server—from virtually any computer on your network. For more information on using Remote Desktop for Administration for remote server administration, see Remote Desktop for Administration.

Terminal Services benefits:

  • Brings Windows Server 2003 family operating systems to desktops faster. Terminal Services helps bridge the gap while older desktops are migrated to Microsoft XOX, providing a virtual desktop experience of any Windows Server 2003 family operating system to computers that are running earlier versions of Windows. Terminal Services clients are available for many different desktop platforms including Microsoft MS-DOS, Windows-based terminals, Macintosh, and UNIX. Additionally, a Web-based version of the Terminal Services client (Remote Desktop Web Connection) provides Terminal Services connectivity to computers with Web access and an Internet Explorer browser. (Connectivity for MS-DOS, Macintosh, and UNIX-based computers requires additional software.)
  • Takes full advantage of existing hardware. Terminal Services extends the model of distributed computing by allowing computers to operate as both thin clients and full-featured personal computers simultaneously. Computers can continue to be used as they have been within existing networks while also functioning as thin clients capable of emulating the XOX desktop.

Terminal Server benefits:

  • Centralized deployment of programs. With Terminal Server, all program execution, data processing, and data storage occur on the server, centralizing the deployment of programs. Terminal Server ensures that all clients can access the same version of a program. Software is installed only once on the server, rather than on every desktop throughout the organization, reducing the costs associated with updating individual computers. For more information on centralized deployment of programs, see Using Terminal Server to host applications centrally.

Remote Desktop for Administration benefits:

  • Remote administration. Terminal Services Remote Desktop for Administration provides remote administration for Windows Server 2003 family operating systems, giving system administrators a method of remotely managing their server from any client over a LAN, WAN or dial-up connection. Up to two remote sessions, plus the console session, can be accessed simultaneously. Terminal Server licensing is not required to use this feature.


Using Terminal Server to host applications centrally

Terminal Server provides an effective and reliable way to distribute Windows-based programs by making them available on a network server. With Terminal Server, a single point of installation allows multiple users to access the desktop of a server running one of the Windows Server 2003 family operating systems. Users can run programs, save files, and use network resources as though they were sitting at that computer. Terminal Server delivers the Windows desktop and Windows-based applications to computers that might not typically be able to run Windows operating systems.

Note

  • Terminal Server is not included in XOX.

Ease of use

Feature | Description | For more information, see:
Improved client: Remote Desktop Connection | Renamed Remote Desktop Connection, the Terminal Services client features a more streamlined user interface that allows you to connect to terminal servers, change connection settings, save connection information, and connect to a remote computer. The old Terminal Services Client Connection Manager tool is no longer needed, although you can still use any connections that were created with that tool. With Remote Desktop Connection, users can create connection files, which are predefined connections to servers for either a single program or full desktop access, and save them in My Documents. You can ensure that the same version of a single program is being used across the computing environment by creating a connection file and distribute it along with the Remote Desktop Connection client software. | Remote Desktop Connection Overview
Automated local printer support | Terminal Services can both add and automatically reconnect printers attached to Terminal Services clients. | Providing client access to local printers
Drive and file system redirection | Users can see their local drives while logged on to a terminal server. In Microsoft Windows Explorer, users' local drives appear in the session folder tree as <driveletter> on <client>. | Providing client access to local file system
Audio redirection | Users of a terminal server can direct audio output from the terminal server to the audio device on their local computer. | Providing client access to server audio
Clipboard redirection | Users can cut and paste between the programs running on the local computer and the terminal server. | Shared clipboard
Performance enhancements | Enhancements to caching, including persistent caching, packet utilization, and frame size, provide significant performance improvements over earlier versions of Terminal Services. | Bitmap caching
Roaming disconnect support | This feature enables users to disconnect from a session without logging off. A session can remain active while disconnected, enabling the user to reconnect to the existing session from another computer or at a later time. Logon is required for reconnection, keeping each session secure at all times. | Log off or disconnect
Multiple logon support | Users can log on to multiple sessions simultaneously from one or more clients, to multiple terminal servers, or to a single server multiple times. As a result, the user can do several tasks concurrently or run multiple unique desktop sessions. | Terminal Services user properties

Manageability

Feature | Description | For more information, see:
Terminal Services Group Policies | With the addition of Terminal Services Group Policies, administrators can use one tool (Group Policy) to manage Terminal Services-related settings throughout an organization. Terminal Services nodes have been added to the Computer and User section of the Administrative Group Policy template (System.adm). | Configuring Terminal Services with Group Policy
Terminal Services WMI provider | The Windows Management Instrumentation (WMI) provider for Terminal Services allows you to use scripts to manage, configure, and troubleshoot terminal servers remotely, bypassing the Terminal Services tools, command-line options, and other management methods. | Configuring Terminal Services with WMI
Session remote control | Support staff can either view or control another Terminal Services session. Keyboard input, mouse movements, and display graphics are shared between two Terminal Services sessions, giving support staff the ability to diagnose and resolve configuration problems, as well as provide user training from a remote location. This feature is particularly useful for organizations with branch offices. | Using remote control
Load balancing | Terminal Services Connection Management (TSCM), combined with load balancing technology, allows Terminal Services clients to connect to the least busy member of a group of terminal servers. Session Directory services ensure that disconnected sessions are reconnected to the same server where the original connection was established. | Load Balancing and Terminal Servers
Terminal Services Web Client: Remote Desktop Web Connection | Remote Desktop Web Connection is an ActiveX control that provides virtually the same functionality as the full Remote Desktop Connection client, but is designed to deliver this functionality over the Web. When embedded in a Web page, Remote Desktop Web Connection can host a Terminal Services client session even if the full client is not installed on the user's computer. | About Remote Desktop Web Connection
Microsoft Windows Installer (MSI) package for client deployment | Remote Desktop Connection can be installed with Windows Installer. Windows Installer provides a quick and efficient means for deploying client software to target computers, using either a network-based share point or Microsoft IntelliMirror. | About the Terminal Services Client MSI Setup Package
Windows-based terminals | Windows-based terminals are available from a variety of manufacturers. They use a custom implementation of the Microsoft Windows CE operating system and the Remote Desktop Protocol (RDP). |
Terminal Server Licensing | Terminal Server Licensing helps system administrators and purchasing offices track clients and their associated licenses. | Licensing Terminal Server
Distributed File System (DFS) support | Support for Distributed File System (DFS) enables users to connect to a DFS share, and administrators to host a DFS share from a terminal server. | Distributed file system overview
Terminal Services Manager | Administrators can use Terminal Services Manager to query and manage Terminal Services sessions, users, and processes. | Terminal Services Manager
Terminal Services Configuration | Terminal Services Configuration allows you to create, modify, configure, and delete Remote Desktop Protocol (RDP) connections. You can also use Terminal Services Configuration to view and set terminal server settings. | Configuring Terminal Services with the Terminal Services Configuration tool
Integration with Local Users and Groups and Active Directory Users and Computers | Administrators can create accounts for Terminal Services users the same way they create accounts for users on any Windows Server 2003 family operating system. Extra fields exist for specifying information specific to Terminal Services, such as the Terminal Services Profile Path and Home Directory. | Terminal Services users
Integration with System Monitor | Integration with System Monitor enables administrators to monitor Terminal Services system performance, including tracking processor use, memory allocation, and paged memory usage and swapping per-user session. | Performance monitoring
Messaging support | Administrators can alert users to important information, such as system shutdowns, upgrades, or new programs. | To send a message to a user
Remote administration with Remote Desktop for Administration | Any member of the Administrators group with access to the Terminal Services administrative utilities can remotely manage all aspects of a server. Remote Desktop for Administration is installed automatically on all Windows Server 2003 family operating systems. | Remote Desktop for Administration
Configurable session time-out | Administrators can reduce server resource usage by configuring session time-outs. Administrators can specify the length of an active session and how long a session can remain idle on the server. | Configuring session limits

Security

Feature | Description | For more information, see:
Security modes Terminal Server can run in one of two security modes, depending on the applications you plan to run:
Full Security
Select this option to take advantage of new security features in Windows Server 2003 family operating systems and provide the most secure environment for your terminal server.
Relaxed Security
This option allows access to the system registry, enabling most legacy applications to run as they did under Windows 2000, Terminal Server Edition.
 Choosing the security mode for a terminal server
Encryption Terminal Services has four levels of encryption.
  • By default, Terminal Services connections between any of the Windows Server 2003 family operating systems and client computers running the Remote Desktop Connection client are encrypted with High (128-bit) encryption.
  • The FIPS Compliant encryption level encrypts and decrypts data sent from client to server and from server to client with the Federal Information Processing Standard (FIPS) encryption algorithms using the Microsoft cryptographic modules. If FIPS compliance has already been enabled by the System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Group Policy, administrators cannot change the encryption level for Terminal Services connections either by changing the Terminal Services Set client connection encryption level Group Policy setting or by using Terminal Services Configuration.
  • For legacy clients that support only low levels of encryption, administrators can set the encryption level to Client Compatible.
  • The Low level encrypts data sent from the client to the server using 56-bit encryption.

    Important

    • Data sent from the server to the client is not encrypted.

In addition, the Terminal Services logon process includes change password, unlock desktop, and unlock screen saver features. The logon process is encrypted, ensuring secure transfer of user name and password.

 Determining the level of encryption

System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing
Limit logon attempts and connection time | Administrators can limit the number of user logon attempts to prevent unauthorized access to a server. Additionally, the connection time of an individual user or a group of users can be limited. | Configuring Terminal Services


Terminal Services administrative tools

In addition to the standard administrative tools, the following Terminal Services tools, tool extensions, and commands for administering Terminal Services connections, computers, and users are included in all of the Windows Server 2003 family operating systems.

  • Terminal Services Group Policies.
  • Terminal Services Manager.
  • Terminal Services Configuration.
  • Remote Desktops MMC snap-in.
  • Active Directory Users and Computers and Local Users and Groups extensions.
  • Terminal Server Licensing.
  • System Monitor counters.
  • Task Manager additional fields.
  • Multiuser support in Add or Remove Programs.
  • Commands.

Terminal Services Group Policies

Use Terminal Services Group Policies to configure individual terminal servers or groups of terminal servers, or to assign policies for Terminal Server users or user groups. For more information, see Configuring Terminal Services with Group Policy.

Terminal Services Manager

Use Terminal Services Manager to manage and monitor users, sessions, and processes on any server running Terminal Services on the network. Use it to:

  • Display information about servers, sessions, users, and processes.
  • Connect to and disconnect from sessions.
  • Monitor sessions.
  • Reset sessions.
  • Send messages to users.
  • Log off users.
  • Terminate processes.

For more information about Terminal Services Manager, see Terminal Services Manager.

Terminal Services Configuration

During the installation of a Windows Server 2003 family operating system, a connection is configured for the Remote Desktop Protocol (RDP). This connection provides the link clients use to log on to a session on the server for either Remote Desktop for Administration or Terminal Server connections. After installation, you can use Terminal Services Configuration (Tscc.msc) to change the properties of this connection on the local computer or to add new connections.

Note

  • Many of these settings can also be set with Terminal Services Group Policy or Windows Management Instrumentation (WMI), in which case Terminal Services Configuration settings are overridden.

Use Terminal Services Configuration to:

  • Name a connection.
  • Specify a connection type.
  • Specify a connection transport and transport properties.
  • Set the maximum number of sessions allowed.
  • Enable or disable logons through the connection.
  • Set connection time-outs.
  • Set the level of encryption.
  • Set whether to disconnect broken connections.
  • Enable or disable session remote control.
  • Enable or disable automatic logons.
  • Specify a program to run when a user logs on.
  • Override user profile settings for wallpaper.
  • Set permissions on the connection.
  • Set client device mapping and connection parameters.

For more information about Terminal Services Configuration, see Terminal Services Configuration.

Remote Desktops MMC snap-in

This Microsoft Management Console (MMC) Remote Desktops snap-in allows you to create connections to multiple terminal servers, configure them to run specific programs upon connecting, and switch easily between Terminal Services connections by clicking the connection in the console tree. A special MMC version of the Terminal Services client displays the desktop of the selected computer in the MMC results pane.

For more information about the Remote Desktops snap-in, see Remote Desktops snap-in.

Active Directory Users and Computers and Local Users and Groups extensions

Terminal Services extends Active Directory Users and Computers and Local Users and Groups to allow you to control Terminal Services features for each user. You can also use Terminal Services Group Policies to control these features, although settings you have specified might be overridden.

Use the Terminal Services extension to:

  • Set the path to the Terminal Services user profile for each user.
  • Enable or disable logons.
  • Set time limits on session.
  • Set whether to disconnect or reset a broken connection.
  • Enable or disable remote control.
  • Specify a program to run when a user logs on.
  • Make client drives and printers connect at logon.

Terminal Server Licensing

Use Terminal Server Licensing to register and track licenses for Terminal Server clients. For more information, see Terminal Server Licensing.

Warning

  • You must install Terminal Server Licensing or your terminal server will stop accepting connections from unlicensed clients 120 days from the date of the first client logon.

System Monitor counters

Terminal Services extends System Monitor by adding User and Session objects and their counters. You can use these objects and counters to monitor the resources that a user or session consumes. Terminal Services also adds counters to the Process and System objects.

For more information on System Monitor, see System Monitor overview.

Task Manager additional fields

Terminal Services provides two additional fields, ID (session ID) and User, to Task Manager for monitoring and ending processes for all sessions.

Multiuser support in Add or Remove Programs

Add or Remove programs ensures that applications are installed for use in a multisession environment.

Commands

The following table shows the commands you can use to manage Terminal Services at the command prompt.

Command | Function
change logon | Temporarily disable logons to a terminal server.
change port | Changes COM port mappings for MS-DOS program compatibility.
change user | Changes the .ini file mapping for the current user.
cprofile | Removes user-specific file associations from a user's profile.
flattemp | Enables or disables flat temporary directories.
logoff | Ends a clients session.
msg | Sends a message to one or more clients.
mstsc | Runs Remote Desktop Connection.
query process | Displays information about processes.
query session | Displays information about Terminal Services sessions.
query termserver | Lists Terminal Services servers on the network.
query user | Displays information about users logged on to the system.
register | Registers a program so that it has special execution characteristics.
reset session | Allows you to reset (delete) a session from the terminal server.
shadow | Allows you to monitor or remotely control an active session of another user.
tscon | Connects to another existing Terminal Services session.
tsdiscon | Disconnects a client from a Terminal Services session.
tskill | Terminates a process.
tsprof | Copies user configuration and changes profile path.
tsshutdn | Shuts down a Terminal Services server.


Deploying Terminal Server

This section provides information about deploying Terminal Server:

  • Installing Terminal Server
  • System Planning


Installing Terminal Server

This section covers information about installing Terminal Server:

  • Before Installing Terminal Server
  • Choosing the security mode for a terminal server
  • Switching Terminal Services on and off
  • Managing Terminal Services from the command line

When you install one of the Windows Server 2003 family operating systems, Remote Desktop for Administration is installed automatically. With Remote Desktop for Administration, you can create up to two concurrent remote connections to your server for remote administration and other tasks. To use Remote Desktop for Administration, you must first enable remote connections. For more information, see To enable or disable remote connections.

To use Terminal Services for multiuser application hosting, you must install the Terminal Server component using the Configure Your Server Wizard. (Terminal Server is not included in XOX.)

For information on using Remote Desktop for Administration, see Remote Desktop for Administration.


Before installing Terminal Server

Review the following information before you install Terminal Server:

  • Read System planning for system sizing and performance considerations.
  • Read "Hosting Applications with Terminal Server" at the Microsoft Windows Resource Kit Web site (http://www.microsoft.com/).
  • Plan to install Terminal Server on a standalone server, not on a domain controller. When installed on a domain controller, Terminal Server performance is affected because of the additional memory, network traffic, and processor time required to perform the tasks of a domain controller in a domain.
  • Install Terminal Server on a server installed on an NTFS file system partition. NTFS provides greater security for users in a multisession environment.
  • Understand the effect of the Internet Explorer Enhanced Security Configuration setting on users of a terminal server. When you install Terminal Server using the Configure Your Server Wizard, this setting prohibits Administrators from downloading files or ActiveX controls from the Web by default as a security precaution. However, all non-Administrator users can download files or ActiveX controls. After you install Terminal Server, you can change this setting to allow both Administrators and non-Administrator users to perform these tasks, or to prevent all users from performing these tasks. Use Add/Remove Windows Components in Add or Remove Programs to change this setting. This setting applies to servers running one of the Windows Server 2003 family operating systems. For more information, see Terminal server role: Configuring a terminal server and Internet Explorer Enhanced Security Configuration.
  • Install the programs you want to use with Terminal Server after Terminal Server is installed. This allows Terminal Server to register the programs for multisession access, making the programs easier to manage. For more information about installing programs, see Installing programs.

For instructions on installing Terminal Server, see To install Terminal Server


Choosing the security mode for a terminal server

In Windows 2000 and Windows Server 2003 family operating systems, you can choose one of two security modes:

  • Relaxed security: Windows NT 4.0/Terminal Server Edition permissions compatibility mode
  • Full security: Windows 2000/Windows Server 2003 family operating systems permissions mode

In both modes, the TERMINAL SERVER USER security descriptor is applied to many keys in the registry and directories in the file system. The difference between the two modes is based on the way the security descriptor is applied.

  • In Relaxed Security mode, the security descriptor is added to each member of the Users group. On Windows NT 4.0, when a user’s permissions are evaluated to determine access to a file or registry entry, the presence of the security descriptor authorizes access.

    This application of the security descriptor allows members of the Users group to run programs that otherwise might not work at all in the more rigorous Full Security permissions mode used on Windows 2000 and Windows Server 2003 family operating systems. However, when you choose Relaxed Security mode, any user on the system can change files and registry settings in many places throughout the system, although others users’ data files may not be visible. A malicious user could exploit this situation by replacing a known and trusted program with a program of the same name but some bad intent.

  • By contrast, Full Security mode does not apply the descriptor to each user. Instead, applications must be written to run in the context of an ordinary user. When in doubt, you should choose Full Security mode and test your applications in that mode.

    Important

    • Use Relaxed Security mode only if your test results indicate that it is necessary.

For information on changing the security mode, see To switch default permissions for application compatibility.


Switching Terminal Services on and off

To disable Terminal Services connections temporarily (for example, to install an application on a terminal server), go to the Remote tab in System Properties and clear the Allow users to connect remotely to your computer checkbox. (This checkbox is cleared by default when you install any of the Windows Server 2003 family operating systems.) When you disable remote connections, Terminal Services remains active on the computer, but no new remote connections are accepted.

If Terminal Server is installed on your computer, you can also uninstall it by using Add or Remove programs. When you do so, the computer is returned to its default state, Remote Desktop for Administration.

Caution

  • Many older applications were not designed for multiple users and need to be modified before they will run properly on a terminal server. If you decide to uninstall Terminal Server using Add or Remove programs, the applications you installed and configured to run on a terminal server might not run the next time you install Terminal Server. You must configure or install the application again. For this reason, you should not use Add or Remove programs to temporarily disable Terminal Server.

Note

  • For more information on disabling Terminal Services connections using the Remote tab in System Properties, see To disable Terminal Services Connections


Managing Terminal Services from the command line

You can manage users, sessions, processes, and terminal servers by using command-line utilities. The following table lists the Terminal Services administrative utilities that you can invoke from the command line.

Command | Function
change logon | Disables, temporarily, logons to a terminal server.
change port | Changes COM port mappings for MS-DOS program compatibility.
change user | Changes the .ini file mapping for the current user.
cprofile | Removes user-specific file associations from a user profile.
flattemp | Enables or disables flat temporary directories.
logoff | Logs off a user from a session and deletes the session from the server.
msg | Sends a message to a user or group of users.
mstsc | Displays the Remote Desktop Connection to establish a connection with a Terminal Server.
query process | Displays information about processes running on a terminal server.
query session | Displays information about sessions on a terminal server.
query termserver | Displays a list of all terminal servers on the network.
query user | Displays information about user sessions on a terminal server.
register | Registers applications to execute in a global context on the system.
reset session | Resets a session to known initial values.
shadow | Monitors another user's session.
tscon | Connects to another existing terminal server session.
tsdiscon | Disconnects a client from a terminal server session.
tskill | Ends a process.
tsprof | Copies user configuration and changes profile path.
tsshutdn | Shuts down a terminal server.

For information about other command-line utilities, see Command-line reference A-Z. For more information about manageability, see Management Strategies and Tools.


System planning

This section presents information on system sizing and system components that can help you decide on a hardware configuration for a terminal server that gives your users optimal performance.

  • System sizing
  • Peripherals that affect performance
  • Application performance
  • Performance monitoring
  • Load Balancing and Terminal Servers

Note

  • For additional information about deploying Terminal Server, see "Hosting Applications with Terminal Server" at the Microsoft Windows Resource Kit Web site. (http://www.microsoft.com/)


System sizing

Most computer users can be placed into one of three categories:

  • Light users. A light user typically runs one program at a time—for example, a word processing program or a line-of-business program.
  • Structured task users. A structured task user simultaneously runs two or more programs but does not frequently switch between programs. This user runs programs whose data-processing demands on the system are not heavy—for example, productivity programs such as word processing and an Internet browser.
  • Power users. A power user is a more sophisticated user who runs three or more programs, and often has several active at the same time. A power user runs programs whose data processing demands on the system are heavy, such as detailed queries on large databases.

When determining how powerful your servers need to be, consider the types of users who will be using them. Light users place the lightest load on computational resources while power users consume the most computational resources. Also consider the types of programs your server runs. Keep in mind that a terminal server shares executable resources between individual users, just as any of the Windows Server 2003 family operating systems shares executable resources (.dll, .exe, and so on) between individual programs. As a result, the memory requirements for additional users running the same program are typically less than the requirements for the first user to load the application.

For adequate performance, a terminal server requires a Pentium or higher processor. A terminal server requires a minimum of 128 MB RAM, plus additional RAM for each user to support running each user's programs on the server. An additional 10 MB RAM is recommended for each light user and up to 21 MB RAM for each power user.

In general, processor and memory requirements scale linearly: You can support double the number of users on a multiprocessor-capable Pentium system by doubling the number of processors and doubling the amount of memory. Purchasing a system that supports multiple processors, even if you initially purchase only one processor, allows you to add capacity easily as your requirements grow.

Performance can vary depending on the programs you run on a terminal server. To judge the processing power and RAM required for each user, test your system by running the programs you use.

The bus architecture in single and multiprocessor systems also affects system performance. The ISA (AT bus) architecture is low bandwidth and is not recommended for a terminal server. Use a higher-performance bus, such as EISA, MCA, PCI, PCI-X, or InfiniBand for best performance. All of these buses support the sustained high data transfer rates typically required when running Terminal Server.

Peripherals can affect the performance of a terminal server. For more information, see Peripherals that affect performance.


Peripherals that affect performance

Hard-disk throughput also affects the performance of a terminal server. SCSI disk drives and adapters, especially devices compatible with Fast SCSI and SCSI-2, have significantly better throughput than ST-506, IDE, or ESDI disk drives and adapters.

For highest disk performance, consider using a SCSI RAID controller. RAID (Redundant Array of Independent Disks) controllers place data on multiple disks to increase disk performance and improve data reliability.

Although the Remote Desktop Protocol (RDP) used with a terminal server causes minimal network load, a high-performance network adapter is recommended. This is particularly important if many users require either access to data stored on network servers or run client/server programs. Consider using two network adapters, dedicating one to RDP traffic only.

If a multiport asynchronous communication adapter is installed for supporting dial-up users, be sure to use an intelligent (microprocessor-based) adapter to both reduce interrupt overhead and increase throughput.

Applications can also affect performance. For more information, see Application performance.


Application performance

Windows Server 2003 family operating systems are 32-bit environments, whereas Microsoft Windows 3.11 is a 16-bit environment. The Windows Server 2003 family operating systems run 16-bit programs through a process called Windows on Windows (WOW), translating 16-bit programs in enhanced mode. This process causes 16-bit programs to consume additional system resources. Running 16-bit programs on a terminal server can reduce the number of users a processor can support by 40 percent and increase the memory required for each user by 50 percent. For this reason, use 32-bit versions of programs whenever possible.

Here are additional considerations for installing programs on a terminal server:

  • Some video active applications can decrease performance. Turn off the video effects of an application for better performance.
  • MS-DOS applications are not recommended because they can consume all of the available CPU.
  • Application features that are always on and run in the background, such as automatic spelling and grammar checking in Microsoft Word, require more system resources.

For more information about 16-bit and 32-bit programs, see Comparing 16-bit and 32-bit programs. For more information about installing programs on a terminal server, see Installing programs.


Performance monitoring

Use the performance monitoring tools supplied with the Windows Server 2003 family operating systems to monitor system performance and the effects of configuration changes on system throughput. Some of the most important measurements for performance monitoring include:

  • Processor utilization
  • Hard-disk I/O rates
  • Memory utilization
  • Pagefile activity

A good way to estimate how many users a server can support is to measure system performance with two to five users on the system, and then scale the results.

Terminal Services adds the Terminal Services User and Terminal Services Session objects and their counters to the set of objects you can observe using System Monitor.

For more information about performance monitoring, see "WSRK System Performance and Troubleshooting Guide Part One: Operating System Performance" at the Microsoft Windows Resource Kit Web site. (http://www.microsoft.com/)


Load balancing and terminal servers

Load Balancing pools the processing resources of several servers using the TCP/IP networking protocol. You can use this service with a cluster of terminal servers to scale the performance of a single terminal server by distributing sessions across multiple servers. Session Directory (included in XOX and XOX) keeps track of disconnected sessions on the cluster, and ensures that users are reconnected to those sessions.

Terminal Services Connection Management

Terminal Services Connection Management works with your load balancing service to ensure that users are transparently reconnected to the original server hosting their disconnected Terminal Server sessions. The components of Terminal Services Connection Management are:

  • A network load-balancing solution (Network Load Balancing, Domain Name System (DNS) round-robin, or a third-party solution).
  • Two or more terminal servers, logically grouped into a Terminal Server cluster.
  • A session directory server. This computer can be any running XOX, or XOX, that is visible on the network and running the Terminal Services Session Directory service. As a Best Practice, make the Session Directory server a highly available network server that is not itself running Terminal Server.

The Terminal Server Connection Management process is as follows:

  1. When the user logs on to the terminal server cluster, the terminal server receiving the initial client logon request sends a query to the session directory server.
  2. The session directory server checks the username against its database and sends the result to the requesting server.
    • If the user has no disconnected sessions, logon continues at the server hosting the initial connection.
    • If the user has a disconnected session on another server, the client session is passed to that server and logon continues.
  3. When the user logs on to the disconnected session, the session directory is updated.

Terminal Services Session Directory

The Terminal Services Session Directory service is a database that keeps track of sessions on terminal servers in a cluster and provides the information used at connection time to connect users to existing sessions.

When the Session Directory service starts up, it creates the "Session Directory Computers" local group. By default, this group is not populated. You must choose the individual computers or groups you want to participate in the Session Directory service, and then manually add them to the Session Directory Computers group.

For more information about configuring Session Directory settings, see To configure Session Directory settings and "Hosting Applications with Terminal Server" at the Microsoft Windows Resource Kit Web site. (http://www.microsoft.com/) For more information about adding members to a security group, see Changing group membership.

To start Session Directory service

  1. Open Services.
  2. Double-click Terminal Services Session Directory Properties.
  3. To start the service, click Start. To ensure that the service runs each time the server boots, in Startup Type, click Automatic.

Note

  • To open the Services snap-in manually, click Start, point to Administrative Tools, and then click Services.

To create a Terminal Server Cluster

  1. Open the Group Policy object for the organizational unit that contains the terminal servers you want to participate in the cluster.
  2. In Administrative Templates, in the Windows Components/Terminal Services/Session Directory folder, enable the Session Directory Active setting.
  3. In the Session Directory Server setting, click Enable, type the name of the server running the Session Directory service, and then click OK.
  4. In the Session Directory Cluster name setting, click Enable, specify a name for this Terminal Server cluster, and then click OK.


Deploying applications

To deploy an application for use by Terminal Server users, you install it on the terminal server.

For information about program considerations, see Program considerations

For information about installing programs for use on a terminal server, see Installing programs

For information about compatibility of programs with Terminal Server, see Program compatibility


Program considerations

Consider the following before selecting and installing programs on Terminal Server.

  • Assigned and published programs
  • 16-bit Vs. 32-bit programs
  • System resource considerations
  • Programs starting programs

Note

  • For additional information about deploying Terminal Server, see "Hosting Applications with Terminal Server" at the Microsoft Windows Resource Kit Web site. (http://www.microsoft.com/)


Assigned and published programs

Windows Server 2003 family operating systems provide Windows Installer for deploying programs within your organization. You can assign a program to either computers or users, or you can publish programs to users. For more information on using Windows Installer to install programs, see Managing options for computers through Group Policy.

Because Terminal Server is designed to provide multisession access to programs, additional consideration is needed before deploying applications in environments that contain terminal servers.

Applications are installed on the terminal server, and are available to any user with remote access to the terminal server. Terminal Server cannot accept published programs because they are published on a per-user basis. Additionally, assigned programs must be assigned on a per-computer basis, rather than on a per-user basis.

When installing assigned programs, members of the Administrators group on the terminal server can install the program from either the console session or from a remote session.

Caution

  • Program installation often requires restarting the computer. Always ensure that no users are logged on to the terminal server before starting any program installation.
  • If the program is installed from a remote session, the session is disconnected or reset if the program installation requires rebooting the server. When the server reboots, your session is reset and you need to again log on to the terminal server to ensure that the program is correctly installed.
  • Whenever possible, install programs from the console session.

Deploying programs on terminal servers by using Windows Installer

Microsoft Windows Installer installs programs at different levels, depending on how the .msi package was created. Many .msi packages require minimal installation where only a small number of program components are installed. When a user first invokes the program, there are enough components installed for Windows Installer to know where to find the remainder of the components and install the program. For Terminal Server, members of the Users security group cannot invoke a Windows Installer installation. Therefore, it is important to install these programs locally. To do this, a transform file (.mst) can be used. Transform files appear as modifications to .msi packages and tell Windows Installer which bits to install locally. Since transform files might not be available for all programs, you can either ensure that all necessary components are fully installed during installation or create a transform file. For more information on transform files, see Windows Installer technologies.

Legacy programs can also be repackaged as Windows Installer programs, using tools that capture the changes made to the system when the program is installed. These changes are then used to create an .msi package for the legacy program. This method allows you to continue using programs developed specifically for your organization.


Comparing 16-bit and. 32-bit programs

Microsoft Windows graphic

Comparing 16-bit and 32-bit programs

Terminal Server supports 16-bit and 32-bit Windows-based programs. Running 16-bit programs can reduce the number of users a processor supports by 40 percent and increase the memory required for each user by 50 percent. In addition, some 16-bit programs must be able to write to the directory where the program .ini file is stored. Most 32-bit programs use the registry to read and write program settings and need only to write to specific registry values. For both performance and security reasons, 32-bit programs are recommended whenever possible.

For more information about application performance, see Application performance.


System resource considerations

Because Terminal Server is designed for multisession use, you should limit the number of installed programs that require large amounts of system resources. Consider restricting user or group access to certain program types, disabling unnecessary features that require the most resources, or installing these programs on separate servers.

Check system requirements for each program carefully and remember that RAM and CPU requirements increase with the number of sessions running. While there is not a true one-to-one correlation between these, this gives you a basis for projecting program performance.

For more information, see System planning.


Programs starting programs

Some programs enable users to start other programs. For example, Microsoft Access has a toolbar that can be used to start other Microsoft Office programs. In this situation, you should disable toolbar access to other programs from the program that is installed on the terminal server.

Many Microsoft products include the Microsoft System Information (Msinfo.exe) program. There is the potential that users can breach security or gather system information, such as server hardware configuration, with this program. Set file permissions on the Microsoft System Information program so that only administrators can use it to gather system configuration information, aid in problem resolution, and start programs by the appropriate users.

For more information about setting file permissions, see To set, view, change, or remove file and folder permissions.


Installing programs

This section covers:

  • Getting ready to install programs
  • Starting the installation
  • Testing the installation

Note

  • For additional information about deploying Terminal Server, see "Hosting Applications with Terminal Server" at the Microsoft Windows Resource Kit Web site. (http://www.microsoft.com/)


Getting ready to install programs

You should install programs on a terminal server before giving clients access to the terminal server. Doing so ensures that you can test each program before clients access it, and can reduce the time it takes to perform program tuning.

If you are installing a program after clients have been granted access, you must ensure that there are no users logged on to the terminal server during installation. You can send clients a message detailing the time and duration of the installation and then disable all connections before starting.

For more information about currently connected sessions, see Terminal Services Manager overview.

For more information about sending messages to users, see To send a message to a user.

For more information about disabling a connection, see To disable a connection.

Note

  • When installing programs, log on using an administrator account.


Starting the installation

Use either of the following methods to install programs for multisession Terminal Server access:

  • Use Add or Remove Programs in Control Panel (recommended).
  • Use the change user command at the command prompt before and after installing the program.

One of the primary functions of the change user command is to ensure that program files are installed to the systemroot rather than the windows subdirectory of the user's home directory (%homepath%\windows). This makes the programs available for multisession access.

Before the program is installed, type change user /install at the command prompt to place the system in install mode and turn off .ini file mapping. The system then records how the setup APIs initially install the program.

After the program is installed, type change user /execute at the command prompt to return the system to execute mode, restore .ini file mapping, and redirect user-specific data to the user's home directory.

When the user opens the program, user-specific registry setting files (.ini, .dll, .ocx, and so on) are propagated as needed to the user's home directory.

Add or Remove Programs, which runs the change user command, is the preferred method of installing programs. Enter change user at the command prompt only when you install a program by another method and want to ensure multisession access. For example, when Internet Explorer prompts you to install an add-on program, use change user at the command prompt to ensure that the program is installed for multisession access.

For more information, see To install a program using Add or Remove Programs.

Important

  • Microsoft provides scripts for some programs that need tuning in order to work correctly in a multisession environment. Before installing a program, see the Microsoft Web Site (http://www.microsoft.com/) for a list of programs that require scripts and information about how to use them.

Notes

  • Do not copy program files from one directory to another or manually edit the registry during installation.
  • Install programs on the terminal server local drive rather than on a file server. This improves program performance by reducing network traffic.
  • Install programs on NTFS file system drives rather than on FAT drives. You can only set file permissions on NTFS drives.


Testing the installation

Some programs installed using change user might not work at first because of the locked-down state of the system. Some 16-bit programs must be able to write to the directory where the program .ini file is stored. Some 32-bit programs create registry entries that are needed for proper operation.

Enable event logging and then log onto the server using a temporary user account created to mimic the user or users that will be accessing the program. Start the program and go through the basic procedures for using it. Then, use Event Viewer to determine which files or directories need Write access and which registry keys require Read access by the user for correct operation.

Note

  • This process might not find all files, directories, and registry keys for which access is required by the application in all user scenarios. The only way to ensure that you have accounted for all access requirements is to perform tasks manually.

Consider creating two user accounts and testing with each account before proceeding. This allows you to make changes to program preferences and templates, while ensuring that those changes do not affect other users of the same group.

Keep track of all files, and any issues that arise. For information about how to tune programs for multisession use, see Program compatibility.


Program compatibility

Many programs, particularly older ones, were not designed for multisession use. As a result, some programs need to be tuned before they can run on a terminal server.

Microsoft provides installation scripts for some programs that have known installation issues. Run the scripts after the application installation process is complete and before running the application the first time.

Application compatibility scripts

Many commonly used applications have been tested for compatibility with Terminal Server. For maximum performance on a terminal server, some applications require minor changes after installation. Scripts are available for these applications and must be run after the application installation is complete. The scripts are located in systemroot in \Application Compatibility Scripts\Install.

Many newer applications, such as Microsoft Office XP, do not require modification to work properly with Terminal Server. For information about specific applications requiring modification for compatibility with Terminal Server, see the Microsoft Web Site. (http://www.microsoft.com/)

Note

  • For information about specific script capabilities and how to modify them for custom installations, refer to the notes within the script for the application you are installing. You can modify scripts by using a text editor such as Notepad.

In addition to running scripts, you might need to perform some additional tuning. The following topics describe some of the changes that might be required:

  • Registry settings
  • File and directory issues
  • Program compatibility flags


Registry settings

Programs store configuration information in a system database called the registry. For configuration purposes, the two most important sections of the registry are labeled HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.

You should store information that pertains to the entire system in HKEY_LOCAL_MACHINE. For example, a program might store the following information in this section:

  • The components of a program that were installed.
  • The path used to load program components.
  • The path to a shared database. For example, a point-of-sale program where all users reference the same database.

Programs store user-specific information in the HKEY_CURRENT_USER section, which is part of the user profile. When a user logs on, a profile is loaded into the system registry where it becomes HKEY_CURRENT_USER. When the user logs off, any changes to HKEY_CURRENT_USER are written back to the user profile. A program might store the following types of information in this section:

  • Per-user paths are particularly important for multiuser operation. For example, paths to custom dictionaries, mailboxes, configuration files, and temporary directories.
  • Per-user preference settings. For example, some users might want to enable background spell checking while others might want to disable it.

Per-user data in HKEY_LOCAL_MACHINE

Problems arise if programs store per-user data in HKEY_LOCAL_MACHINE instead of HKEY_CURRENT_USER. If a program stores personal preferences, such as color and font size, in HKEY_LOCAL_MACHINE, users are not able to specify custom preferences.

Settings created when a program is run

A program might create HKEY_CURRENT_USER registry settings the first time a user runs the program, rather than during installation. If you do not run the program while install mode is still active, the HKEY_CURRENT_USER settings are not copied to HKEY_LOCAL_MACHINE. The first time each user runs the program, HKEY_CURRENT_USER will be loaded with the default settings. Depending on the program, this might or might not be appropriate. If the default settings are not sufficient, they need to be corrected for each user individually.

To avoid this problem, run the program once before clicking Finish in Add\Remove Programs (or before running change user /execute). This will cause the program to create the necessary registry settings.

If you have already left install mode and have not run the program, re-enter install mode with change user /install and run the program. If you have already run the program while in execute mode, create another administrator account, log on with this new account, run change user /install, run the program, and then run change user /execute to leave install mode. For more information about the change user command, see Change user.


File and directory issues

The files and directories a program creates and uses might present problems if the program was not originally designed for a multiuser environment.

Files that store per-user data

A program might use a single path for a file that contains per-user data. In some cases, this can mean that if one user updates this file, it affects all users. More severe problems include preventing multiple users from running the program simultaneously and corruption of the file, which can cause the program to fail for all users.

Note

  • Most files do not contain per-user data and are safe to share. Some files can be classified either way, depending on the system administrator's preference. For instance, document template files can be made read-only and safely shared. Or, users can have their own set of template files that they can update as desired.

If you have difficulty finding a shared file, you can use file auditing to track successful write operations.

Another path issue arises when programs store files in public directories such as systemroot. Some public directories have read-only permission for nonadministrative users, which prevents accidental modification of common files. However, if a program attempts to write a file into one of these shared directories, the program fails.

A frequent symptom of this problem is a program that can be successfully executed by an administrative user, but fails for a nonadministrative user. To isolate this problem, use file auditing to log all write operations that fail.

Some programs use temporary directories to store information that relates to the current user. The program might not create a separate directory for each user, thus causing temporary data for multiple users to be stored in a single location. If the program is not intelligent about handling this data, one user can delete data that is still needed by another user.

Updating the path

When you identify a file that stores per-user data, update the path so that a copy of the file resides in each user's home directory.

Programs can store a file path in several places, including:

  • HKEY_LOCAL_MACHINE
  • HKEY_CURRENT_USERS
  • A configuration file
  • Hard-coded within the program itself

Some per-user files are generated by the program. Other per-user files, such as document templates, must be provided for the user by copying them into the user's home directory. If you specified the path as a subdirectory of the user's home directory, you might need to create the subdirectory as well.

Per-user tasks can be performed in a script that is run during logon. The script checks the user's home directory to determine whether the files or directories in question already exist. If not, it can copy them from a master. Using a script allows you both to update current users with a new program and to set up new users.

Permissions and accessibility

Another path-related issue arises when a program cannot locate files in or below systemroot.

This problem occurs with some programs that use the GetWindowsDirectory() function to determine the name of the directory where Terminal Server was installed. Programs that use this function benefit from an automatic remapping. The function returns the Windows subdirectory of the user's home directory.

This automatic remapping can be disabled with a program compatibility flag. This is appropriate if the files under systemroot are being used only for read access. For more information about compatibility flags, see Program compatibility flags.


Program compatibility flags

Program compatibility flags are registry entries that provide the system with information about compatibility issues for particular programs. Some of these entries are created by default. Administrators can create new entries or change existing entries to alleviate many program compatibility issues.

Following is a list of compatibility flags that can be stored under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Terminal Server\ Compatibility\Applications\app_name

The keys are created using the program's executable name and the flag is stored as a DWORD value.

Value | Description
0x00000001 | MS-DOS-based program
0x00000002 | OS/2-based program
0x00000004 | Windows-based 16-bit program
0x00000008 | Windows-based 32-bit program
0x0000000C | Windows-based 16-bit and 32-bit program
0x0000000F | Any version of a program
0x00000010 | Return user name instead of computer name for GetComputerName.
0x00000020 | Return Terminal Server build number instead of Windows 2000 build number for GetVersion.
0x00000040 | Synchronize user .ini file to system version.1
0x00000080 | Do not substitute user \Windows directory.2
0x00000100 | Disable registry mapping for program or registry key.
0x00000200 | Per-object user/system global mapping
0x00000400 | Return system \Windows directory instead of user \Windows directory for GetWindowsDir.
0x00000800 | Limit the reported physical memory for GlobalMemoryStatus.
0x00001000 | Log object creation to file.
0x20000000 | Do not put program to sleep on unsuccessful keyboard polling (Windows-based 16-bit programs only).

1 This setting adds new entries from the system version of the .ini file to the user's version, but does not delete any existing entries in the user's .ini file. By default, the user's .ini file is deleted when it is out of date with the system version.

2 This setting requires that the user's \Windows directory not be substituted for the system root directory for any paths inside the .ini file when the system version of the .ini file is copied to the user's \Windows directory. It is recommended that you make this substitution so that the program uses the user's \Windows directory for all of the modifications it makes to data or .ini files.

For more information about registry settings, see Registry settings.


Deploying client software

This section provides information about setting up and configuring Remote Desktop Connection (formerly known as the Terminal Services client) on client computers.

Important

  • You should install the latest version of Remote Desktop Connection. If you are using the Windows 2000 32-bit Terminal Services Client, you should upgrade to the version of Remote Desktop Connection that is provided with each of the Windows Server 2003 family operating systems.
  • About the Terminal Services Client MSI Setup Package
  • Remote Desktop Web Connection


About the Terminal Services Client MSI Setup Package

The Terminal Services Client MSI Setup package is a tool for deploying Remote Desktop Connection (formerly known as the Terminal Services client) and associated files on computers running earlier versions of Windows. These versions include Microsoft Windows 2000 Server, Microsoft Windows 2000 Professional, Microsoft Windows NT 4.0, Microsoft Windows 98, and Microsoft Windows 95. The MSI Setup package can also be placed on a share for distribution to workstations running Windows 2000 by using Microsoft IntelliMirror.

For procedural information on installing the client with the MSI setup package, see:
  • To share the client setup folder
  • To install the 32-bit Terminal Services Client (Remote Desktop Connection)

For more information on using Group Policy, see Group Policy overview.

Note

  • Remote Desktop Connection is installed automatically with XOX and Windows Server 2003 family operating systems.


Remote Desktop Web Connection

Remote Desktop Web Connection is an ActiveX control that provides virtually the same functionality as the full Terminal Services client, but it is designed to deliver this functionality over the Web. When embedded in a Web page, Remote Desktop Web Connection can host a client session with a terminal server, even if the full Terminal Server client is not installed on a user's computer.

For more information, see Deploying Remote Desktop Web Connection.


Terminal Services Client overview

The Terminal Services Client is a thin client that delivers the 32-bit functionality of Windows Server 2003 family operating systems to a wide range of desktop hardware devices. The client appears as a window within the local desktop environment. It contains only the minimum amount of software necessary to establish a connection to the server and present the user interface. All other operating system functions, as well as applications, run on the server. The client can be run on a range of desktop hardware:

  • Computers running Microsoft Windows 95, Microsoft Windows 98, Microsoft Windows ME, Microsoft Windows NT 4.0, Microsoft Windows 2000 or Microsoft Windows Server 2003 operating systems.
  • Windows-based Terminal devices (embedded).

For more information about Remote Desktop Connection, the new Terminal Services client, see Remote Desktop Connection Overview.

For information about specific client features, see:

  • Bitmap caching
  • Shared clipboard
  • Providing client access to local printers
  • Log off or disconnect
  • Managing Terminal Services connection files
  • Using a dial-up connection to access a terminal server

Note

  • The Terminal Services Client was known as the Terminal Server Client in Windows NT 4.0.


Remote Desktop Connection overview

Remote Desktop Connection (formerly known as the Terminal Services client) is installed by default on all Windows Server 2003 family operating systems. You can use Remote Desktop Connection to connect to terminal servers, or to the desktop of a computer running one of the Windows Server 2003 family operating systems or XOX for remote administration.

Remote Desktop Connection allows you to create and configure your connection, save your connection settings to a file, and open and edit your saved connection files, all in the same program. For more information on Remote Desktop Connection, see Remote Desktop Connection.

Notes

  • When you install a XOX or one of the Windows Server 2003 family operating systems, Remote Desktop Connection is installed, but not enabled. For more information on enabling remote connections, see To enable or disable remote connections.
  • To use Group Policy to deploy Remote Desktop Connection, assign the program on a per-computer basis to a terminal server. For more information, see article Q324750, "HOW TO: Assign Software to a Specific Group By Using a Group Policy in Windows Server 2003" in the Microsoft Knowledge Base. (http://www.microsoft.com/)


Bitmap caching

Bitmap caching places commonly used bitmaps, such as the one that displays the Start button, in a file on the client computer. This improves performance by minimizing the amount of display information that must be passed over a connection.

Bitmap caching is enabled on a per-session basis from the client software and requires 10MB of free hard-drive space on the client computer.

For more information, see To configure bitmap caching.


Shared clipboard

On Windows Server 2003 family operating systems, Terminal Services provides seamless clipboard sharing. Clipboard contents can be available to applications locally on a user's computer and to programs within a Terminal Services session.

The shared clipboard synchronizes its contents with the local clipboard and can be viewed using the Windows Clipbook Viewer (clipbrd.exe). For example, you can copy text from a document within a session, and paste it into a document on your local computer. You cannot, however, copy and paste files or folders. The shared clipboard is intended only for data such as text and graphics.

Clipboard sharing can be disabled using Terminal Services Group Policies or Terminal Services Configuration. For more information, see Managing drive, printer, and device mappings for clients.

For more information about the Clipbook Viewer, see Clipboard Viewer overview.


Providing client access to local printers

Terminal Services provides printer redirection, which routes printing jobs from the terminal server to a printer attached to the client computer, or to a network printer available to the client computer.

Print redirection is enabled by default, but it can be disabled using Terminal Services Group Policies (see Configuring Terminal Server with Group Policy) or on a per-connection basis using Terminal Services Configuration (see To connect client drives and printers at logon).

There are two ways to provide client access to local printers:

  • Automatic printer redirection—for Remote Desktop Connection.
  • Manual printer redirection—for 16-bit clients, Windows-based Terminals, and local printers that require drivers other than those shipped with Windows Server 2003 family operating systems.

Notes

  • Bidirectional printing is not supported.
  • Redirected printers are available for use with applications running on the server. Redirected printers appear in the Printers folder in Control Panel.
  • Clients see only their own redirected printers in the Printers dialog box.

Automatic printer redirection

For Remote Desktop Connection, printer redirection is automatic when the local printer uses a driver that is installed on the server.

When a client logs on to Terminal Services, local printers attached to LPT, COM, and USB ports on the client computer are automatically detected and a local queue is created on the server. The client computer printer settings for the default printer and some properties, such as printing on both sides of the page, are used by the server.

Information about the client's local printers and settings are saved on the client computer. On subsequent logons, the printer queue is created using the information stored on the client computer.

Warning

  • When a client disconnects or ends the session, the printer queue is deleted and any incomplete or pending print jobs are lost.

If a printer driver is not found on the server, an event is logged and the client printer is not created. To make the printer available, the driver must be manually installed on the server.

Manual printer redirection

Administrators can manually redirect printers that are attached to LPT and COM ports on the client's local computer so they can be used with Remote Desktop Connection.

Note

  • Manual redirection of printers connected through USB ports is not supported.

To manually redirect a client printer, contact your administrator and provide the name of your computer (or IP address for a Windows-based Terminal). The client must be connected to the terminal server during manual redirection.

The administrator uses Add Printers in Printers in Control Panel to manually add the printer. The administrator uses the client computer name to select the printer port from the list of available ports in Add Printer. Ports for all clients currently connected to the server appear in the Port list. Terminal Services client ports are listed as follows:

Port | Description
TS | computername:PortX (where Port is the type of port and X is the port number)

When a client disconnects or ends the session, the printer queue is deleted, and any incomplete or pending print jobs are lost. Information about client local printers and settings are saved on the client computer. On subsequent logons, the printer queue is created using the information stored on the client computer.

Notes

  • When automatic redirection for 32-bit client printers fails, an event is logged. Typically, this event in the log contains information about the reason for redirection failure and, if applicable, which server-side driver is missing.
  • When the client disconnects or logs off, the printer queue is deleted, and incomplete or pending print jobs are lost.
  • After the initial manual redirection, printers are automatically redirected during subsequent logons.


Log off or disconnect

Terminal Services provides two options when closing a client session: you can either log off or disconnect.

Disconnecting leaves the session running on the server. You can reconnect to the server and resume the session. If you are running a task on the server, such as running a time consuming query on a database, you can start the task and disconnect from the session. Later, you can log back onto the server, reenter the session, and check the results. This is especially helpful when operating over a remote access connection on a long-distance toll line. For information about how to disconnect from a Terminal Services session, see To disconnect without ending a session.

Network administrators can limit the amount of time a disconnected session is allowed to remain on the server. For more information, see To set time-out settings for disconnected, active, and idle sessions.

Logging off ends the session running on the server. Any applications running within the session will be closed and unsaved changes made to open files will be lost. The next time you log onto the server, a new session is created. For information about how to log off from a Terminal Services session, see To log off and end the session.

If printer redirection is enabled for the session, when the session is disconnected or logged off, the printer queue is deleted and any incomplete or pending print jobs are lost.


Managing Terminal Services connection files

Remote Desktop Connection allows administrators and users to set up predefined connection files to servers for single program or full desktop access. By using Remote Desktop Connection, you can save connection information and settings to a connection file that is saved in the My Documents/Remote Desktops folder with the .rdp extension. This way, for example, an administrator who wants to provide a single line-of-business program across the computing environment can create the connection file, and distribute that file to all desktops.

For information on how to use the Remote Desktop Connection to save connection settings to a file, see To create a connection file.


Using a dial-up connection to access a terminal server

If you have remote access to a network that contains terminal servers, you can access those terminal servers using a dial-up connection from a remote location.

To use remote access to connect to a terminal server, you must first configure a dial-up connection on your computer. Then you can connect to the network where the terminal server resides and use Remote Desktop Connection to create a connection to the terminal server itself. You can then log on to the terminal server as usual.

Administrators can grant users the ability to reconnect to a session if the connection is broken, for example, if a phone connection is interrupted. For more information, see To set time-out settings for disconnected, active, and idle sessions to allow reconnection on a per-connection basis or To change settings for when a session limit is reached or a connection is broken on a per-user basis.


Troubleshooting

What problem are you having?

The connection does not automatically log on to the server. I am prompted for my User name and Password on connection.

Cause: Encryption enhancements for Windows 2000 and Windows Server 2003 family operating systems cause the Windows NT 4.0 version of the Terminal Services client not to recognize the user name and password in the automatic logon portion of the connection file.

Solution: From the Windows NT 4.0 version of Client Connection Manager, right-click the connection and select Properties. On the General tab, check Automatic logon and type the User name, Password, and Domain.

Installation of an .msi package fails from a remote Terminal Services session.

Cause: You must be logged in as a member of the Administrators group to install .msi packages for Terminal Services from a remote session.

Solution: Log on as a member of the Administrators group or use Run as to install the .msi package.

See also: To install a program using Add or Remove Programs.

Installed program does not work correctly.

Cause: The program was installed before Terminal Server was installed.

Solution: Uninstall the program, and reinstall using either Add or Remove Programs or the change user command.

See also: Starting the installation.

Cause: The program was installed using change user /execute rather than change user /install.

Solution: Uninstall the program, and reinstall using either Add or Remove Programs or the change user /install command.

See also: Starting the installation.

Cause: Program compatibility scripts were not run properly.

Solution: Run the program scripts again.

See also: Program compatibility.

Client fails to connect with "This initial program cannot be started" message.

Cause: The client connection might have been configured to start a program upon connection, but the program path and filename are incorrect.

Solution: Check the properties for the client connection to ensure that the program path and filename are correct, and that the program exists in this location on the server.

Cause: The server administrator might have specified a program to start upon connection, using Group Policy, Terminal Services Configuration, or other Terminal Services administration tools.

Solution: Check the server configuration to ensure that the program path and filename specified for this user are correct, and that the program exists in this location on the server.


Terminal Services Configuration

You can configure new connections for Terminal Services, modify the settings of existing connections, and delete connections by using the Terminal Services Configuration tool (TSCC.msc) or Group Policy (gpedit.msc).

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


How to...

  • Install Terminal Server
  • Configure Terminal Services connections
  • Manage Terminal Services connections
  • Configure server settings
  • Configure Group Policy settings


Configure Terminal Services connections

  • Make a new connection
  • Specify a maximum number of sessions that can connect to the server
  • Change the level of encryption
  • Specify a program to start when a user logs on
  • Allow a user to log on to the server automatically
  • Manage remote control
  • Configure time-out and reconnection settings
  • Manage client settings
  • Manage connection permissions


Make a new connection

Microsoft Windows graphic

To make a new connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. On the Action menu, click Create New Connection.
  4. The Terminal Services Connection wizard appears. Follow the instructions on your screen to configure the connection.

Notes

  • XOX
  • XOX
  • Only one Remote Desktop Protocol (RDP) connection can be configured for each network adapter in a terminal server. Typically, the RDP connection that is configured when Terminal Services is installed is the only connection needed. You can configure additional connections using RDP if you install an additional network adapter for each connection.

Related Topics


Specify a maximum number of sessions that can connect to the server

Microsoft Windows graphic

To specify a maximum number of sessions that can connect to the server

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Limit number of connections setting, and then click Enabled.
  3. In the TS Maximum Connections allowed box, type the maximum number of connections you want to allow, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Note

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy by using the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to specify a maximum number of sessions, and then click Properties.
  4. On the Network Adapter tab, click Maximum connections, type the maximum number of sessions that can connect to the server, and then click Apply.

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.
  • By default, the connection is configured to allow an unlimited number of sessions to connect to the server.
  • Restricting the number of sessions improves performance because fewer sessions are demanding system resources.

Related Topics


Change the level of encryption

Microsoft Windows graphic

To change the level of encryption

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Encryption and Security, double-click the Set client connection encryption level setting, and then click Enabled.
  3. In the Encryption Level list, click the desired security level, and then click OK.

    Important

    • If Federal Information Processing Standard (FIPS) compliance has already been enabled by the System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Group Policy, you cannot change the encryption level by using this Group Policy or by using Terminal Services Configuration.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Note

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection you want to modify, and then click Properties.

  4. On the General tab, in Encryption level, select the appropriate level for your organization. You can select from these levels of encryption:

    • The FIPS Compliant level encrypts and decrypts data sent from client to server and from server to client with the Federal Information Processing Standard (FIPS) encryption algorithms using the Microsoft cryptographic modules.

      Important

      • If FIPS compliance has already been enabled by either the System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Group Policy or the Terminal Services Set client connection encryption level Group Policy, you cannot change the encryption level by using Terminal Services Configuration.
    • The High level encrypts data sent from client to server and from server to client by using strong 128-bit encryption. Use this level when the terminal server is running in an environment containing 128-bit clients only (such as clients running one of the Windows Server 2003 family operating systems). Clients that do not support this level of encryption will not be able to connect.
    • The Client Compatible level encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this level when the terminal server is running in an environment containing mixed or legacy clients.
    • The Low level encrypts data sent from the client to the server using 56-bit encryption.

      Important

      • Data sent from the server to the client is not encrypted.
  5. If you want the connection to default to the standard Windows authentication when another authentication package has been installed on the server, select the Use standard Windows authentication check box.

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.

Related Topics


Specify a program to start when a user logs on

Microsoft Windows graphic

To specify a program to start when a user logs on

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Start a program on connection setting, and then click Enabled.
  3. In the Program path and file name box, type the path and filename of the program you want to start when a user logs on.
  4. In the Working Directory box, type the working directory, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

  • These policies affect every client that connects to the terminal server. To specify a program to start on a per-user basis, use the corresponding policy under User Configuration.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to specify an initial program, and then click Properties.
  4. On the Environment tab, under Initial program, select the Override settings from user profile and Remote Desktop Connection or Terminal Services client check box.

    This enables you to configure an initial program for the connection.

  5. In Program path and file name, type the path and file name of the program that you want to start when the user logs on to the terminal server.
  6. In Start in, type the working directory path for the program.

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.
  • Some client option settings are not applied when a connection is made to the console session of a remote computer running XOX. For example, if the client has specified a program to start upon connection to a remote computer, that program does not start if the connection is made to the console session of the remote computer. Instead, the default desktop appears. If the connection is made to a session other than the console session, the specified program starts as expected. The console session is the only session available for Remote Desktop on XOX, so the default desktop always appears when a connection is made, even if the client has specified a different program.

Related Topics


Allow a user to log on to the server automatically

Microsoft Windows graphic

To allow a user to log on to the server automatically

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection through which you want to allow a user to log on automatically, and then click Properties.
  4. On the Logon Settings tab, click Always use the following logon information.

    This setting enables you to configure logon information for a user. However, you should be aware that when all users are logged in under the same account, it is more difficult to track down a user who might be causing trouble.

  5. In User name, type the name of the user you want to allow to log on to the server automatically.
  6. In Domain, type the name of the domain to which the user's computer belongs.
  7. In both Password and Confirm password, type the user's password.
  8. Click Always prompt for password to specify that the user is prompted for a password before logging on to the server.

Notes

  • XOX
  • XOX

Related Topics


Manage remote control

  • Configure remote control settings
  • Disable remote control


Configure remote control settings

Microsoft Windows graphic

To configure remote control settings

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Set rules for remote control of Terminal Services user sessions setting, and then click Enabled.
  3. In the Options box, click the desired remote control permissions, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

  • These policies affect every client that connects to the terminal server. To configure Remote Control on a per-user basis, use the corresponding policy under User Configuration.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to configure remote control, and then click Properties.
  4. On the Remote Control tab, click Use remote control with the following settings to configure remote control for the connection.
  5. To display a message on the client, asking permission to view or take part in the session, select the Require user's permission check box.
  6. Under Level of control, click View the session to specify that the user's session can be viewed only, or click Interact with the session to specify that the user's session can be actively controlled with your keyboard and mouse.

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.
  • Configuring remote control on a per-connection basis affects all sessions that use the connection. You can configure remote control on a per-user basis using the Terminal Services User Configuration Group Policies, or by using the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.
  • Changes to remote control permissions are not applied to sessions that are connected when the change is made.

Related Topics


Disable remote control

Microsoft Windows graphic

To disable remote control

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Set rules for remote control of Terminal Services user sessions setting, and then click Enabled.
  3. In the Options box, click "No remote control allowed", and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

  • These policies affect every client that connects to the terminal server. To configure Remote Control on a per-user basis, use the corresponding policy under User Configuration.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to disable remote control, and then click Properties.
  4. On the Remote Control tab, click Do not allow remote control.

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.

Related Topics


Configure time-out and reconnection settings

  • Set time-out settings for disconnected, active, and idle sessions
  • Change settings for when a session limit is reached or connection is broken
  • Change settings for reconnecting disconnected Citrix ICA sessions


Set time-out settings for disconnected, active, and idle sessions

Microsoft Windows graphic

To set time-out settings for disconnected, active, and idle sessions

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Sessions, enable the settings you want to configure. See the policy explain text for more information.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

  • These policies affect every client that connects to the terminal server. To define Session settings on a per-user basis, use the Sessions policies under User Configuration.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to modify time-out settings, and then click Properties.
  4. On the Sessions tab, above End a disconnected session, select the Override user settings check box. This allows you to configure time-out settings for the connection.
  5. Configure the following time-out settings as appropriate:
    • In End a disconnected session, select the maximum amount of time that a disconnected session remains on the server. When the time limit is reached, the disconnected session ends. When a session ends, it is permanently deleted from the server. Select Never to allow disconnected sessions to remain on the server indefinitely.
    • In Active session limit, select the maximum amount of time that a user's session can remain active on the server. When the time limit is reached, either the user is disconnected from the session or the session ends. When a session ends, it is permanently deleted from the server. Select Never to allow the session to continue indefinitely.
    • In Idle session limit, select the maximum amount of time that an idle session (a session without client activity) remains on the server. When the time limit is reached, either the user is disconnected from the session or the session ends. When a session ends, it is permanently deleted from the server. Select Never to allow idle sessions to remain on the server indefinitely.

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.
  • These settings affect every client that uses the connection to connect to the terminal server. To define Session settings on a per-user basis, use the User Configuration Group Policies or the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.

Note

  • XOX

Related Topics


Change settings for when a session limit is reached or connection is broken

Microsoft Windows graphic

To change settings for when a session limit is reached or connection is broken

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Sessions, double-click the Terminate session when time limits are reached setting, and do one of the following:
    • To ensure that users are always disconnected from the session, allowing the session to be reconnected (default behavior), click Disabled, and then click OK.
    • To configure Terminal Server to terminate sessions rather than disconnect them, click Enabled, and then click OK. See the policy explain text for more information.

      Important

      • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • This policy affects every client that connects to the terminal server. To define Session settings on a per-user basis, use the Sessions policies under User Configuration.

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection you want to modify, and then click Properties.
  4. On the Sessions tab, above When session limit is reached or connection is broken, select the Override user settings check box.

    This allows you to configure these settings for the connection.

  5. Under When session limit is reached or connection is broken, do one of the following:
    • Click Disconnect from session to disconnect the user from the session, allowing the session to be reconnected.
    • Click End session to end the session. When a session ends, it is permanently deleted from the server. Any running applications are forced to shut down, which can result in loss of data at the client.

Notes

  • XOX
  • A connection to the server can be broken for any reason, including by request, connection error, idle time-out, or connection time-out.
  • These settings affect every client that uses the connection to connect to a terminal server. To define settings on a per-user basis, use Terminal Services Group Policies or the Terminal Services Extension to Local Users and Groups.

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.

Related Topics


Change settings for reconnecting disconnected Citrix ICA sessions

Microsoft Windows graphic

To change settings for reconnecting disconnected Citrix ICA sessions

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Sessions, double-click the Allow reconnection from original client only setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • This policy affects every client that connects to the terminal server. To define Session settings on a per-user basis, use the Sessions policies under User Configuration.

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection you want to modify, and then click Properties.
  4. On the Sessions tab, above Allow reconnection, select the Override user settings check box.

    This allows you to configure reconnection settings for the connection.

  5. Under Allow reconnection, do one of the following:
    • Click From any client to allow the user to reconnect to a disconnected session from any computer.
    • Click From previous client to allow the user to reconnect to a disconnected session from only the client computer where the session originated.

Note

XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.
  • This setting is supported only for Citrix ICA-based clients.
  • By default, you can reconnect to a disconnected session from any computer.

Related Topics


Manage client settings

  • Connect client drives and printers at logon
  • Configure settings for mapping client devices
  • Limit the maximum color depth


Connect client drives and printers at logon

Microsoft Windows graphic

To connect client drives and printers at logon

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Client/Server data redirection double-click the specific setting for the feature you want to configure, and then click Enabled.
    • To disable the mapping of client printers in Terminal Services sessions, enable Do not allow client printer redirection.
    • To disable the mapping of client drives in Terminal Services sessions, enable Do not allow client drive redirection.
    • To enable the redirection of audio data between the server and the client in Terminal Services sessions, enable Allow audio redirection.
    • To disable the setting of the default client printer as the default printer in Terminal Services sessions, enable Do not set default client printer to be default printer in a session.

      Important

      • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection to which you want to connect client drives and printers, and then click Properties.
  4. On the Client Settings tab, under Connection, clear the Use connection settings from user settings check box.

    This allows you to configure these settings for the connection.

  5. Choose from the following options:
    • Select the Connect client drives at logon check box to reconnect to all mapped client drives while logging on. (This option is supported for clients running any of the Windows Server 2003 family operating systems.)
    • Select the Connect client printers at logon check box to reconnect to all mapped local client printers while logging on.
    • Select the Default to main client printer check box to print to the default printer of the client. Otherwise, the default printer of the server is used as the default printer for all client sessions.

Notes

  • XOX
  • These settings affect all clients that use the connection to log on to a terminal server. If you want to define settings on a per-user basis, use Terminal Services Group Policies or the Terminal Services Extension to Local Users and Groups.

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.

Related Topics


Configure settings for mapping client devices

Microsoft Windows graphic

To configure settings for mapping client devices

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Client/Server data redirection double-click the specific setting for the feature you want to configure, and then click Enabled.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.
    • To disable the redirection of clipboard data between server and client in Terminal Services sessions, enable Do not allow clipboard redirection.
    • To enable the redirection of audio data between the server and the client in Terminal Services sessions, enable Allow audio redirection. (Note that audio redirection is disabled by default in Terminal Server).
    • To disable the mapping of client COM ports in Terminal Services sessions, enable Do not allow COM port redirection.
    • To disable the mapping of client printers in Terminal Services sessions, enable Do not allow client printer redirection.
    • To disable the mapping of client LPT ports in Terminal Services sessions, enable Do not allow LPT port redirection.
    • To disable the mapping of client drives in Terminal Services sessions, enable Do not allow drive redirection.
    • To disable specifying of the default client printer as the default printer in a Terminal Services session, enable Do not set default client printer to be default printer in a session. The client printer is designated as the default printer for a Terminal Services session.

Notes

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

  • These policies affect every client that connects to the terminal server. To define client device settings on a per-user basis, use the corresponding policies under User Configuration.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to configure client device mappings, and then click Properties.
  4. On the Client Settings tab, under Disable the following, select the appropriate check boxes:
    • Drive mapping to disable client-drive mapping. By default, Drive mapping is enabled (cleared).
    • Windows printer mapping to disable client Windows printer mapping. By default, Windows printer mapping is enabled (cleared). When enabled, clients can map Windows printers, and all client printer queues reconnect at logon. However, when both LPT and COM port mappings are disabled, you will be unable to manually add printers. When Windows printer mapping is disabled (checked), clients are unable to map Windows printers and client printer queues are not reconnected at logon. However, you will be able to manually reconnect printers if LPT port mapping or COM port mapping is enabled (cleared).
    • LPT port mapping to disable client LPT port mapping. By default, LPT port mapping is enabled (cleared). When enabled, client LPT ports are mapped for printing and are available in the port list of the Add Printer wizard. You need to manually create the printer to the LPT port using the Add Printer wizard. When LPT port mapping is disabled (checked), client LPT ports are not automatically mapped. You will be unable to manually create printers using LPT ports.
    • COM port mapping to disable client COM port mapping. By default, COM port mapping is disabled (cleared). When enabled, client COM ports are mapped for printing and are available in the port list of the Add Printer wizard. You will need to manually create the printer to the COM port using the Add Printer wizard. When COM port mapping is disabled (checked), client COM ports are not automatically mapped. You will be unable to manually create printers using COM ports.
    • Clipboard mapping to disable client clipboard mapping. By default, Clipboard mapping is enabled (cleared).
    • Audio mapping to disable client audio mapping. By default, Audio mapping is disabled (checked).

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.

Related Topics


Limit the maximum color depth

Microsoft Windows graphic

To limit the maximum color depth

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Limit maximum color depth setting, and then click Enabled.
  3. In the Color Depth box, click the desired maximum color depth, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Note

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection on which you want to limit the maximum client color depth, and then click Properties.
  4. On the Client Settings tab, select the Limit Maximum Color Depth check box.

    This allows you to configure this settings for the connection.

  5. Select the desired maximum color depth from the list, and then click OK

Note

  • XOX

Note

  • XOX

Related Topics


Manage connection permissions

You can customize permissions on a per-connection basis using the Terminal Services Configuration tool.

  • Add users and groups to permissions lists
  • Change the permissions a user or group has to a connection
  • Remove a user or group from permission lists

Note

  • As a best practice, set Terminal Services permissions on a per-computer basis.


Add users and groups to permissions lists

Microsoft Windows graphic

To add users and groups to permissions lists

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to configure permissions, and then click Properties.
  4. On the Permissions tab, click Add....
  5. On the Select Users or Groups dialog box, click Locations... to specify the search location.
  6. Click Object Types... to specify the types of objects you want to search for.
  7. Click Check Names.
  8. When the name is located, click OK. The name now appears in the Group or user names: list on the Permissions tab.

Notes

  • XOX
  • XOX
  • After you add a user or group, default permissions are applied. To change permissions, see Related Topics.

Related Topics


Change the permissions a user or group has to a connection

Microsoft Windows graphic

To change the permissions a user or group has to a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to change permissions, and then click Properties.
  4. On the Permissions tab, click Advanced to open the Advanced Security Settings dialog box.
  5. In Permission Entries, select the user or group for which you want to change permissions, and then click Edit... to open the Permission Entry dialog box.
  6. In Permissions, select or clear, as appropriate, the Allow or Deny check boxes next to the permissions you want to set for the group.

Notes

  • XOX
  • XOX
  • You must use the Remote Desktop Users group to control remote access to Terminal Server and Remote Desktop for Administration.

Related Topics


Remove a user or group from permissions lists

Microsoft Windows graphic

To remove a user or group from permission lists

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to change permissions, and then click Properties.
  4. On the Permissions tab, in Group or user names:, select the user or group you want to remove, and then click Remove.

Notes

  • XOX
  • XOX
  • You must use the Remote Desktop Users group to control remote access to Terminal Server and Remote Desktop for Administration.

Related Topics


Manage Terminal Services connections

  • Disable a connection
  • Enable a connection
  • Rename a connection
  • Delete a connection


Disable a connection

Microsoft Windows graphic

To disable a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.

  3. In the details pane, right-click the connection you want to disable, point to All Tasks, and then click Disable Connection.

    Click Yes to confirm that you want to disable the connection. If there are active sessions on the server, you are warned that these sessions will end if you disable the connection. Ending an active session without warning can result in loss of data at the user's session.

    The connection is disabled and no users can log on to the server using the connection until it is re-enabled.

Notes

  • XOX
  • XOX
  • You should disable all connections while you install new applications. This prevents users from logging on to the server during installation.

Related Topics


Enable a connection

Microsoft Windows graphic

To enable a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.

  3. In the details pane, right-click the connection you want to enable, point to All Tasks, and then click Enable Connection.

    The connection is enabled and users can log on to the terminal server using the connection.

Notes

  • XOX
  • XOX

Related Topics


Rename a connection

Microsoft Windows graphic

To rename a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection you want to rename, point to All Tasks, and then click Rename Connection.
  4. In New name, type a new name for the connection, and then click OK.

Notes

  • XOX
  • XOX

Related Topics


Delete a connection

Microsoft Windows graphic

To delete a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.

  3. In the details pane, right-click the connection you want to delete, and then click Delete.

    Click Yes to confirm that you want to delete the connection.

    Caution

    • If there are active sessions on the server, you are warned that these sessions end if you delete the connection. Ending an active session without warning can result in loss of data at the user's session.

    The connection is permanently deleted from the server.

Note

  • XOX
  • XOX

Related Topics


Configure server settings

  • Delete or retain temporary folders when exiting
  • Use separate temporary folders for each session
  • Disable Active Desktop
  • Switch default permissions for application compatibility
  • Configure Session Directory settings
  • Set the terminal server licensing mode
  • Limit users to one remote session


Delete or retain temporary folders when exiting

Microsoft Windows graphic

To delete or retain temporary folders when exiting

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Temporary folders, double-click the Do not delete temp folder upon exit setting.
  3. To retain users' temporary folders when a user logs off from a session, click Enabled. To delete users' temporary folders when a user logs off, click Disabled.
  4. Click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Note

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Delete temporary folders on exit, and then click Properties.
  4. Click Yes to have temporary folders deleted when a user logs off from a session, or click No to retain temporary folders, and then click OK.

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.

Related Topics


Use separate temporary folders for each session

Microsoft Windows graphic

To use separate temporary folders for each session

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Temporary folders, double-click the Do not use temp folders per session setting.
  3. To disable the creation of a separate temporary folder for each terminal server session, click Enabled. To enable the creation of a separate temporary folder for each terminal server session, click Disabled.
  4. Click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Use temporary folders per session, and then click Properties.
  4. Click Yes to create a separate temporary folder for each new session or No if you do not want to create temporary folders for each new session.

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.

Related Topics


Disable Active Desktop

Microsoft Windows graphic

To disable Active Desktop

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Active Desktop, and then click Properties.
  4. Select the Disable Active Desktop check box, and then click OK.

Notes

  • XOX
  • XOX

Related Topics


Switch default permissions for application compatibility

Microsoft Windows graphic

To switch default permissions for application compatibility

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Permission Compatibility, and then click Properties.
  4. Select Full Security to provide the most secure environment or select Relaxed Security to provide an environment that is compatible with most legacy applications, and then click OK.

Notes

  • XOX
  • XOX
  • You can configure this option only when Terminal Server is installed on a server. This option does not apply to servers that are used for remote administration.
  • If you select Full Security, Terminal Server Users will have the same permissions as members of the Users group. You should use Full Security whenever possible.
  • If you select Relaxed Security, all Users will have full access to critical registry and file system locations. This may be necessary in order to run legacy applications.

Related Topics


Configure Session Directory settings

Microsoft Windows graphic

To configure Session Directory settings

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Session Directory, enable the Join Session Directory setting.
  3. Enable the Session Directory Server setting and, in Session Directory Server, type the name of the server where the Terminal Services Session Directory service is running.
  4. Enable the Session Directory Cluster Name setting and, in Session Directory Cluster Name, type the name of the cluster to which the Terminal Server belongs. See the policy explain text for more information.
  5. Optionally, enable the Terminal Server IP Address Redirection setting. See the policy explain text for more information.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Session Directory, and then click Properties.
  4. Select the Join session directory check box.
  5. In Cluster name:, type the name of the Terminal Server cluster for this terminal server.
  6. In Session directory server name:, type the DNS name or IP address of the domain server where the Terminal Services Session Directory service is running.

    The server name must be a valid server name, and it cannot be left blank.

  7. Select an IP address and network adapter from the Network adapter and IP address session directory should redirect users to: list.
  8. Optionally, uncheck the IP address redirection (uncheck for routing token redirection) check box to have client devices reconnect to disconnected sessions by using the virtual IP address of the terminal server cluster. You should uncheck this check box if clients have visibility only to the virtual IP address of the cluster and cannot connect to the IP address of an individual terminal server. This option is checked by default, which enables clients to reconnect by using the individual IP addresses of the terminal servers in the Session Directory.

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.

Related Topics


Set the terminal server licensing mode

Microsoft Windows graphic

To set the terminal server licensing mode

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Licensing, and then click Properties.
  4. In the Licensing box, select the desired licensing mode, and then click OK.

Notes

  • XOX
  • XOX
  • You can configure this option only when Terminal Server is installed.

Related Topics


Limit users to one remote session

Microsoft Windows graphic

To limit users to one remote session

Using Group Policies (best practice)

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Restrict Terminal Services users to a single remote session setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Using Terminal Services Configuration

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Restrict each user to one session, and then click Properties.
  4. Check the Restrict each user to one session check box, and then click OK.

Note

  • XOX

Notes

  • XOX
  • Group Policy overrides the configuration set with the Terminal Services Configuration tool.
  • Users will always be able to create more than one session by specifying a different program to start on connection for each session.

Related Topics


Configure Group Policy settings

  • Ensure the session state is consistent with the client state
  • Prevent automatic license upgrades
  • Allow remote connections
  • Remove the Disconnect item from the Shut Down dialog
  • Remove the Windows Security item from the Start menu
  • Secure Terminal Server RPC traffic
  • Control the issuance of Terminal Server licenses
  • Always prompt client for password upon connection
  • Enforce removal of Remote Desktop wallpaper
  • Disallow smart card device redirection


Ensure the session state is consistent with the client state

Microsoft Windows graphic

To ensure the session state is consistent with the client state

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Keep-Alive Messages setting, and then click Enabled. select the desired Keep-Alive interval.
  3. In the Keep-Alive interval box, type the desired keep-alive interval, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Prevent automatic license upgrades

Microsoft Windows graphic

To prevent automatic license upgrades

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Licensing, double-click the Prevent License Upgrade setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Allow remote connections

Microsoft Windows graphic

To allow remote connections

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Allows users to connect remotely using Terminal Services setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Remove the Disconnect item from the Shut Down dialog

Microsoft Windows graphic

To remove the Disconnect item from the Shut Down dialog

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Remove Disconnect item from Shut Down dialog setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Remove the Windows Security item from the Start menu

Microsoft Windows graphic

To remove the Windows Security item from the Start menu

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Remove Windows Security item from Start menu setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Secure Terminal Server RPC traffic

Microsoft Windows Graphic

To secure Terminal Server RPC traffic

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Encryption, RPC Security Policy, double-click the Secure Server (Require Security) setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX
  • The remote procedure call (RPC) interface is used for administering and configuring Terminal Services.
  • If the status of this setting is Enabled, the terminal server accepts requests from RPC clients that support secure requests, and does not allow unsecured communication with untrusted clients.
  • If the status of this setting is Disabled, the terminal server always requests security for all RPC traffic. However, unsecured communication is allowed for RPC clients that do not respond to the request.
  • If the status of this setting is Not Configured, unsecured communication is allowed. This is the default.

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Control the issuance of Terminal Server licenses

Microsoft Windows Graphic

To control the issuance of Terminal Server licenses

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the License Server Security Group setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX
  • If the status of this setting is Enabled, only the computers you add to the Terminal Services Computers security group will receive licenses. By default, this group is not populated. You must add computers or groups to this security group if you want them to receive licenses. Any changes you make to the membership of this group take effect only after you stop and restart the Terminal Server Licensing service. For more information, see Related Topics.
  • If the status of this setting is either Disabled or Not Configured, the Terminal Server License Server issues a license to any computer that requests one. The Terminal Services Computers group is not deleted or changed in any way. This is the default behavior.

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Always prompt client for password upon connection

Microsoft Windows graphic

To always prompt client for password upon connection

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Encryption and Security, double-click the Always prompt client for password upon connection setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Enforce removal of Remote Desktop wallpaper

Microsoft Windows graphic

To enforce removal of Remote Desktop wallpaper

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Enforce Removal of Remote Desktop Wallpaper setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Disallow smart card device redirection

Microsoft Windows graphic

To disallow smart card device redirection

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Do not allow smart card device redirection setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in.

Related Topics


Concepts

This section provides information about configuring Terminal Services.

  • Terminal Services Configuration overview
  • Configuring Terminal Services with Group Policy
  • Configuring Terminal Services with WMI
  • Configuring Terminal Services with TSCC
  • Managing sessions
  • Managing permissions on connections
  • Managing drive, printer, and device mappings for clients
  • Using temporary folders with terminal servers


Terminal Services Configuration overview

Several tools exist for configuring terminal servers, Terminal Services user settings, Terminal Services connections, and Terminal Services sessions. These tools include Terminal Services Group Policies, the Terminal Services WMI provider, the Terminal Services Configuration Tool, the Terminal Services extension to Local Users and Groups and Active Directory Users and Computers. Additionally, connection settings that are not configured at the group, computer or user level can be set in the client software itself on a per-session basis.

Which tool should I use?

Typically, you use the tool that gives you the most control with the least administrative overhead, given the constraints of your usage profile. For an environment containing only terminal servers running one of the Windows Server 2003 family operating systems, using Terminal Services Group Policies will allow you to configure all settings that will apply across an organizational unit or group of Terminal Services users. The Active Directory Service Interfaces (ADSI) further extend the Terminal Services extensions to Local Users and Groups and Active Directory Users and Computers by allowing you to create scripts tailored to your Terminal Services configuration requirements. You can also configure individual Windows Server 2003 family operating systems by using Group Policies on the local Group Policy object.

However, there are situations where Group Policy is not the preferred tool. In mixed environments where several different Windows platforms are present, it might be necessary to use a combination of tools—for example, configuring Windows Server 2003 family operating systems with Group Policies, while using the Terminal Services Configuration tool to configure servers that are running previous versions of Windows.

If two or more connections are present on the same computer, and you want to configure each connection differently, Group Policies cannot be used. Instead, use the Terminal Services Configuration tool, which allows you to configure Terminal Services settings on a per-connection basis.

Configuration order of precedence

Configuration settings take precedence in the following order. Settings higher on the list take precedence over those below:

  • Computer level Group Policies (if set)
  • User level Group Policies (if set)
  • Local computer configuration set with Terminal Services Configuration tool
  • User level policies set with Local Users and Groups
  • Local client settings

Note

  • Configuration settings applied with Terminal Services WMI operate at the same order of precedence as the same settings when set with the corresponding configuration tool. In general, Group Policy settings always override settings applied with WMI.

For more information about configuring Terminal Services with Group Policy, see Configuring Terminal Services with Group Policy.

For more information about configuring Terminal Services with Terminal Services Configuration, see Terminal Services Configuration.

For more information about configuring Terminal Services user policies with Local Users and Groups, see Managing Users with the Terminal Services Extension to Local Users and Groups.

For more information about using ADSI, see Programming Interfaces and the Active Directory Programmer's Guide at the Microsoft Web site (http://www.microsoft.com/) .XOX


Configuring Terminal Services with Group Policy

You can use Group Policy to configure Terminal Services connection settings, set user policies, configure terminal server clusters, and manage Terminal Services sessions. You can enable Group Policy for users of a computer, for individual computers, or for groups of computers belonging to an organizational unit of a domain. To set policies for users of a particular computer, you must be an administrator for that computer. To set policies for an organizational unit in a domain, you must be an administrator for that domain.

Enabling Group Policy on an individual computer

To set Terminal Services policies setting for a particular computer or for users of that computer, open the Group Policy Object Editor snap-in to edit the local Group Policy. For more information, see Group Policy overview.

When you open the Group Policy Object Editor snap-in, click to expand Administrative Templates, and then click the Terminal Services folder containing the policies you want want to set. The settings for those policies appear in the details pane.

Where?

  • policy_name Policy
  • Computer Configuration (or User Configuration)
  • Administrative Templates
  • Windows Components
  • Terminal Services

To determine the Enabled, Disabled, and Not Configured behavior of each policy, see the explain text for that policy in the Group Policy Object Editor snap-in.

For more information, see Group Policy overview.

Enabling Group Policy for an organizational unit in a domain

To set Terminal Services policies for a domain, you must use a computer that is configured as a domain controller and you must be an Administrator for that domain.

After you configure your computer as a domain controller, the Active Directory Users and Computers console appears in the Administrative Tools folder on the Programs menu. You can use this tool to set policies for organizational units in the domain. Before you begin, you need to confirm that Group Policy is selected (on the Extensions tab in the Add/Remove Snap-in dialog box). Then you need to confirm that the Administrative Templates (Users) extension is selected for Group Policy.

Note

  • Terminal Services Group Policies can be used to administer only computers running one of the Windows Server 2003 family operating systems.


Configuring Terminal Services with WMI

In Microsoft® Windows Server 2003 family operating systems, you can use the Terminal Services WMI provider to create scripts for remote administration of terminal servers.

About the Terminal Services WMI Provider

The Terminal Services Windows Management Instrumentation (WMI) provider allows administrators to create customized scripts for configuring, managing, and querying terminal servers. It contains properties and methods that can perform the same tasks as the Terminal Services configuration tools and command-line utilities provided with Windows Server 2003 family operating systems, but remotely and through scripted applications.

How the Provider Works

Windows Management Instrumentation (WMI) defines a unified architecture for describing, accessing, and instrumenting objects. Part of this architecture is a large database of WMI classes used to carry out remote management tasks on specific objects.

A provider extends the WMI schema of classes to allow WMI to work with new types of objects. The Terminal Services Provider defines classes for querying and configuring Terminal Services.

The Terminal Services Provider is defined in %systemroot%\System32\Wbem\tscfgwmi.mof.

A general description of the classes associated with the provider can be seen in the following table. For complete list of properties and methods associated with each class, please see the embedded comments in the Terminal Services provider MOF file (tscfgwmi.mof). The contents of this file can be viewed with the Windows Management Instrumentation Tester (Wbemtest.exe), which is located in the %systemroot%\System32\Wbem\. To view the .mof file in Wbemtest, use the procedure below.

To view the Terminal Services Provider classes in Wbemtest.exe

  1. Open Wbemtest.exe
  2. Click Connect.
  3. In Namespace, type root\Cimv2
  4. Click Connect.
  5. Click Open Instance.
  6. In Object Path, type the name of the Terminal Services Provider class (see the table below for the names of the classes.) Click OK.
  7. In Properties, click the name of the property you want to view, and then click Show MOF.

Terminal Services WMI Classes

The Terminal Services Provider has the following WMI classes.

WMI Class | Description
Win32_TerminalService | The Win32_TerminalService class is a subclass of Win32_Service class and inherits all its properties and methods. In addition, Win32_TerminalService represents the Element property of the Win32_TerminalServiceToSetting association.
Win32_TSSessionDirectory | Defines the configuration for Win32_TSSessionDirectorySetting. This includes properties such as Session Directory store, Cluster Name and Additional parameters.
Win32_TerminalServiceSetting | Defines the configuration for TerminalServerSetting. This includes properties such as Terminal Server Mode, Licensing, Active Desktop, Permissions Capability, Deletion of Temporary folders and per-session Temporary folders.
Win32_Terminal | Associates a TerminalSetting and its several configuration setting groups such as: General, Logon, Session, Environment, Remote Control, Client, Network Adapter and Permission.
Win32_TSGeneralSetting | Defines the configuration for properties such as Protocol, Transport, Comment, Windows authentication and Encryption Level
Win32_TSLogonSetting | Defines the configuration for properties such as ClientLogonInfoPolicy, UserName, Domain, and Password.
Win32_TSSessionSetting | Defines the configuration for properties such as time limit policy for connections and session limits for active, idle, and disconnected sessions.
Win32_TSEnvironmentSetting | Defines the configuration for properties such as Initial program policy, Initial program path, Start in, and Client wallpaper.
Win32_TSRemoteControlSetting | Defines the configuration for properties such as Remote Control policy and level of control.
Win32_TSClientSetting | Defines the configuration for properties such as Connection policy, Windows printer mapping, Comport mapping, etc.
Win32_TSNetworkAdapterSetting | Defines the configuration for properties such as LAN Adapter and Maximum number of connections
Win32_TSNetworkAdapterListSetting | Enumerates the list of network adapters that are configurable for Win32_Terminal based on the Terminal Protocol and Transport. The properties include: TerminalProtocol, Transport, NetworkAdapterID, and Description.
Win32_TSPermissionsSetting | Represents an association between a Win32_Terminal and its configuration settings (Win32_TSAccount). Contains properties for adding accounts to defined permission sets and restoring default permissions.
Win32_TSAccount | Defines the configuration for properties such as SID, Allowed and denied permissions.

Important

  • This documentation describes only the classes, methods, and associations specific to Terminal Services. Top-level WMI classes (those with the CIM_ prefix) that are defined in the MOF file are not specific to Terminal Services and are described in the Platform SDK documentation for Windows Management Instrumentation (WMI).

For an overview of WMI, see Windows Management Instrumentation overview.

For a complete description and definition of WMI, as well as technical information about developing for the WMI system, see the WMI Software Development Kit (SDK). The WMI SDK is released by MSDN as part of the Microsoft Platform SDK.


Configuring Terminal Services with TSCC

A Terminal Services connection provides the link clients use to log on to a session on the server. A TCP/IP connection is configured when Terminal Services is installed. Using Terminal Services Configuration, you can change the default properties of the connection or add new connections.

Terminal Services Configuration

When you open Terminal Services Configuration you will see that a connection has already been configured. This is called the RDP-TCP connection. Typically, this is the only connection that needs to be configured for clients to connect to the server for Remote Desktop for Administration or application sharing with Terminal Server. Only one RDP (Remote Desktop Protocol) connection can be configured for each network adapter. If you want to configure additional RDP connections, you must install additional network adapters.

With Terminal Services Configuration, you can reconfigure the properties of the RDP-TCP connection, which includes limiting the amount of time client sessions can remain active on the server, setting protection levels for encryption, and selecting which permissions you want users and groups to have. Some connection properties can also be configured on a per-user basis using Terminal Services Group Policies or the Terminal Services extension to Local Users and Groups. For example, you can set different session time limits for each user when you use the Terminal Services extension to Local Users and Groups. Using Terminal Services Configuration, you can only set session time limits on a per-connection basis, which means the same time limit applies to all users who log on to the server using the connection.

In addition to configuring connections, you can use Terminal Services Configuration to configure settings that apply to the terminal server. These include settings for temporary folders, default connection security, and licensing. For more information, see Configure server settings

Citrix ICA-based client

Terminal Services Configuration is also used to configure connections for Citrix ICA-based clients. These connections can be configured using TCP/IP, asynchronous, IPX/SPX, or NetBIOS transport protocols when the Citrix ICA protocol and Citrix ICA-based client software are added to the system.

Important

  • As a best practice, use Terminal Services Group Policies to configure connection settings wherever possible. For more information, see Configuring Terminal Services with Group Policy.


Managing sessions

This section provides general background information about managing Terminal Services sessions:

  • Determining the level of encryption
  • Using remote control
  • Configuring session limits


Determining the level of encryption

For Terminal Services connections, data encryption can protect your data by encrypting it on the communications link between the client and the server. Encryption protects against the risk of unauthorized transmission interception on the link between server and client.

By default, Terminal Services connections are encrypted at the highest level of security available (128-bit). However, some older versions of the Terminal Services client do not support this high level of encryption. If your network contains such legacy clients, you can set the encryption level of the connection to send and receive data at the highest encryption level supported by the client. For information about installing the latest version of the client software, see Deploying client software.

There are four levels of encryption available:

Level of encryption | Description
Level of encryption | Description
FIPS Compliant This level encrypts and decrypts data sent from client to server and from server to client with the Federal Information Processing Standard (FIPS) encryption algorithms using the Microsoft cryptographic modules.

Important

  • If FIPS compliance has already been enabled by the System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Group Policy, administrators cannot change the encryption level for Terminal Services connections either by changing the Terminal Services Set client connection encryption level Group Policy setting or by using Terminal Services Configuration.
High | This level encrypts data sent from client to server and from server to client by using strong 128-bit encryption. Use this level when the terminal server is running in an environment containing 128-bit clients only (such as Remote Desktop Connection clients). Clients that do not support this level of encryption will not be able to connect.
Client Compatible | This level encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this level when the terminal server is running in an environment containing mixed or legacy clients.
Low This level encrypts data sent from the client to the server using 56-bit encryption.

Important

  • Data sent from the server to the client is not encrypted.

For information on how to change the level of encryption, see To change the level of encryption.

For information on the , see System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing.


Using remote control

You can monitor the actions of a client logged on to a terminal server by remotely controlling the user's session from another session. Remote control allows you to either observe or actively control another session. If you choose to actively control a session, you will be able to input keyboard and mouse actions to the session. A message can be displayed on the client session asking permission to view or take part in the session before the session is remotely controlled. You can use Terminal Services Group Policies or Terminal Services Configuration to configure remote control settings for a connection and Terminal Services Manager to initiate remote control on a client session. For instructions on configuring remote control, see To configure remote control settings. For instructions on using remote control, see To remotely control a session.

Windows Server 2003 family operating systems also support Remote Assistance, which allows greater versatility for controlling another user's session. Remote Assistance also provides the ability to chat with the other user. For more information, see Remote Assistance.

Notes

  • Remote control can also be configured on a per-user basis using Group Policies or the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.
  • The console session cannot remotely control another session, and a client session cannot remotely control the console session.
  • The computer used for your session must be capable of supporting the video resolution used at the remotely controlled client session. Otherwise, the operation fails.


Configuring session limits

For a Terminal Services connection, you can limit the amount of time that active, disconnected, and idle (without client activity) sessions remain on the server. This is useful because sessions that remain running indefinitely on the server consume valuable system resources. When a session limit is reached for active or idle sessions, you can select to either disconnect the user from the session or end the session. A user who is disconnected from a session can reconnect to the same session later. When a session ends, it is permanently deleted from the server and any running applications are forced to shut down, which can result in loss of data at the client. When a session limit is reached for a disconnected session, the session ends, which permanently deletes it from the server. Sessions can also be allowed to continue indefinitely.

Session limits configured in Terminal Services Configuration apply to all sessions using a given connection. Session limits can also be configured on a per-user basis using the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.

For information on configuring time-out and reconnection settings, see Configure time-out and reconnection settings.

Disconnected sessions

A session is disconnected when any of the following occurs: by request, connection error, or the active or idle session limit is reached.

Reconnecting to a disconnected session

By default, a terminal server allows you to reconnect to a disconnected session from any computer. However, you can restrict users and allow them to only reconnect from the computer where the session originated. This option is supported only for clients that provide a serial number when connecting, such as Citrix ICA-based clients. For more information, see To change settings for reconnecting disconnected Citrix ICA sessions.

Note

  • As a best practice, use Terminal Services Group Policies to configure these settings wherever possible.

    For more information, see Configuring Terminal Services with Group Policy.


Managing permissions on connections

Permissions define how users and groups can access a terminal server, allowing you to secure the server. Terminal Services permissions can be handled easily on a per-computer basis, using the Remote Desktop Users user group and the RemoteInteractiveLogon right. In some cases, however, it might be necessary to manage permissions on a per-connection basis.

Managing Permissions on a per-connection basis

Terminal Services Configuration allows you to manage permissions on an individual connection by means of the Permissions tab in the connection Properties page.

The TCP/IP connection installed with Terminal Services comes with a set of default permissions. You can modify these default permissions by setting different permissions for different users or groups, adjusting them to fit the requirements of your organization. You must be logged on as a member of the Administrators group to manage connection permissions.

The default permissions on Terminal Services objects are as follows:

Group | Permission
Administrators | Full control
LOCAL SERVICE | Service permissions
NETWORK SERVICE | Service permissions
Remote Desktop Users | User access
SYSTEM | Full control
Guest | Guest access

For information about managing permissions for users and groups, see Adding users and groups.

For information about the types of permissions used to control access to Terminal Services, see Controlling connection access.


Controlling connection access

Use the permissions provided for Terminal Services to control how users and groups access the server. You can alter the default permissions to restrict individual users and groups from performing certain tasks, such as logging off a user from a session or ending sessions. You manage permissions from Terminal Services Configuration. You must be logged in as a member of the Administrators group to set permissions.

By default, there are three types of permissions: Full Control, User Access, and Guest Access.

You can configure these by setting permissions for which users or groups can use a specific task. You can set the following permissions.
Permission | Allows you to
Query Information | Query sessions and servers for information.
Set Information | Configure connection properties.
Remote Control | View or actively control another user's session.
Logon | Log on to a session on the server.
Logoff | Log off a user from a session. Be aware that logging off a user without warning can result in loss of data at the client.
Message | Send a message to another user's sessions.
Connect | Connect to another session.
Disconnect | Disconnect a session.
Virtual Channels | Use virtual channels. Be aware that turning off virtual channels disables some Terminal Services features such as clipboard and printer redirection.

Note

  • You must use the Remote Desktop Users group to control remote access to Terminal Server and Remote Desktop for Administration. For more information, see Enabling users to connect remotely to the server.


Adding users and groups

You control how users and groups access a terminal server by setting permissions. You should assign permissions that reflect the level of access you want to permit. Before adding users and groups to permissions lists, consider what types of access are required for each individual user or group.

You can add any user, group, or computer in your network to permissions lists. If your server belongs to a domain, you can also add user accounts and global groups from both the local domain and trusted domains. Local groups in some domains can also be added.

You must use the Remote Desktop Users group to control remote connection permissions for Remote Desktop for Administration and Terminal Server. The Remote Desktop Users group allows the same access as the Users group, with the additional ability to connect remotely. By using the Remote Desktop Users group, you save administrative resources by not having to set up these rights for each user individually. For information about how to add users to the Remote Desktop Users group, see To add users to the Remote Desktop Users group.


Full control

Full control allows users to:

  • Query information about a session.
  • Modify connection parameters.
  • Reset (end) a session.
  • Remotely control another user's session.
  • Log on to a session on the server.
  • Log off a user from a session.
  • Send a message to another user's session.
  • Connect to another session.
  • Disconnect a session.
  • Use virtual channels, which provides access from a server program to client devices.

For information on controlling connection access, see Controlling connection access.


User access

User access allows users to:

  • Log on to a session on the server.
  • Query information about a session.
  • Send messages to other user sessions.
  • Connect to another session.

For information on controlling connection access, see Controlling connection access.


Guest access

Guest access allows users to:

  • Log on to a session on the server.

For information on controlling connection access, see Controlling connection access.


Service permissions

Local and Network service permissions allow:

  • Query information about a session.
  • Send a message to another session.

For information on controlling connection access, see Controlling connection access.


Managing drive, printer, and device mappings for clients

Because client sessions can establish multiple data channels between client and server, users can map to local devices, such as drives and printers. By default, drive and printer mappings that a user sets in a client session are temporary and are not available the next time the user logs on to the server. However, using Terminal Services Configuration, you can specify that client mappings be restored when the user logs on. In addition, you can disable specific client devices so that a user cannot map the device. Users can map the following devices:

  • Drives (this option is supported for Remote Desktop Connection clients logging on to one of the Windows Server 2003 family operating systems and for Citrix ICA connections)
  • Windows printers
  • LPT ports
  • COM ports
  • Smart cards
  • Clipboard
  • Audio (this option is supported for Remote Desktop Connection clients logging on to one of the Windows Server 2003 family operating systems and for Citrix ICA connections)

Notes

  • As a best practice, use Terminal Services Group Policies to configure these settings wherever possible.

    For more information, see Configuring Terminal Services with Group Policy.

  • Settings for client drive, printer, and device mappings configured in Terminal Services Configuration apply to all client sessions on the server. If you want to specify client settings on a per-user basis, use Terminal Services Group Policies or the Terminal Services extensions to Local Users and Groups.
  • For clients running Remote Desktop Connection, these settings must also be configured in the client software. For more information, see To make local disk drives available in a session, To make your local printer available in a session, To make your local serial port available in a session, and To make a smart card available in a session.


Using temporary folders with terminal servers

By default, a terminal server creates a separate temporary folder for each new session on the server, enabling each user to store individual temporary files. To reclaim disk space, these temporary folders are deleted when the user logs off from a session. If you want to change these default settings for a terminal server, use Group Policy (best practice) or Terminal Services Configuration to modify them. For more information, see To delete or retain temporary folders when exiting or To use separate temporary folders for each session.


Terminal Services user properties

This topic covers managing the information contained in the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers. The following topics are included:

  • For information about best practices, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


Best practices

  • Use Terminal Services-specific groups
    Create User Groups that are specifically for Terminal Services users. Windows Server 2003 family operating systems contain a default User group called Remote Desktop Users, which has been specifically created to manage Terminal Server users. Maintaining users through groups is much easier and less time consuming than managing users individually.
  • Use Terminal Services-specific profiles
    Assign a separate profile for logging onto Terminal Services. Many common options, such as screen savers and animated menu affects, which are stored in profiles, are not wanted when you use Terminal Services. Assigning a specific profile allows users to get the most out of the system they are working with without expending additional server resources. For information about assigning a Terminal Services specific profile, see To change a user's Terminal Services profile path.
  • Use mandatory profiles
    Use a mandatory Terminal Services profile that is created to suit the needs of all of the different types of clients and that provides the best server performance. Be aware that 16-bit computers and Windows-based Terminals might not support some screen resolutions.
  • Set time limits
    Setting limits on the duration of client connections can improve server performance. You can set the limits on how long a session lasts, how long a disconnected session is allowed to remain active on the server, and the time allowed for a session to remain connected, yet idle. For information about setting session limits, see Sessions.
  • Use Starting program
    If you have users who need access to only one application on the terminal server, use the Starting program option. This can be done for all users by using Terminal Services Configuration or on a per-user basis by using either the Terminal Services Extension to Local Users and Groups or Active Directory Users and Computers. For information about using Starting program, see To specify a program to start on session connection.
  • Create preconfigured connection files for users or groups of users
    To make connecting to Terminal Services easier, you can supply users with preconfigured connection files. Collections of connection files can also be made either for different departments within your organization or for different job titles. preconfigured connection files are created using Remote Desktop Connection. For more information, see Managing Terminal Services connection files.


How to...

  • Add the Terminal Services Extension to Local Users and Groups
  • Add the Terminal Services Extension to Active Directory Users and Computers
  • Change a user's Terminal Services profile path
  • Change the path to a user's home directory
  • Allow a user to log on to Terminal Services
  • Set the maximum duration of an active session
  • Set the maximum time a disconnected session remains active
  • Set the maximum idle time for a session
  • Change settings for when a session limit is reached or a connection is broken
  • Change settings for reconnecting disconnected sessions
  • Specify a program to start on session connection
  • Connect Citrix ICA client drives at logon
  • Connect client printers at logon
  • Default to the client's main printer
  • Enable remote control
  • Require user's permission to observe or control sessions
  • Set the level of control over a user's sessions


Add the Terminal Services Extension to Local Users and Groups

Microsoft Windows graphic

To add the Terminal Services Extension to Local Users and Groups

  1. Open Microsoft Management Console.
  2. On the File menu, click Add/Remove Snap-in. The Add/Remove Snap-in dialog box appears.
  3. Click Add. The Add Standalone Snap-in dialog box appears.
  4. Select Local Users and Groups, and then click Add. The Choose Target Machine dialog box appears.
  5. Select the computer to which to add this console, and then click Finish.
  6. In the Add Standalone Snap-in dialog box, click Close.
  7. In the Add/Remove Snap-in dialog box, click the Extensions tab.
  8. Click Terminal Services - Extension, and then click OK.

Notes

  • XOX
  • XOX
  • The Terminal Services extension is already included in Local Users and Groups if Terminal Server is installed on the server.

Related Topics


Add the Terminal Services Extension to Active Directory Users and Computers

Microsoft Windows graphic

To add the Terminal Services Extension to Active Directory Users and Computers

  1. Open Microsoft Management Console.
  2. On the File menu, click Add/Remove Snap-in. The Add/Remove Snap-in dialog box appears.
  3. Click Add. The Add Standalone Snap-in dialog box appears.
  4. Select Active Directory Users and Computers, click Add, and then click Close.
  5. In the Add/Remove Snap-in dialog box, click the Extensions tab.
  6. Click Terminal Services - Extension, and then click OK.

Notes

  • XOX
  • XOX
  • To complete this procedure, the computer must be joined to an Active Directory domain, and you must have permission to edit the Group Policy object.

Related Topics


Change a user's Terminal Services profile path

Microsoft Windows graphic

To change a user's Terminal Services profile path

Using Group Policies (best practice)

  1. Choose from the following:
    • For a domain user account, from a Domain Controller, open Active Directory Users and Computers.

      In the console tree, right click the domain node, and then click properties. In the Group Policy tab, double-click the Group Policy object, or click Edit.

      Important

      • XOX
    • For a local user account, open Group Policy.
  2. In the Group Policy console tree, click Terminal Services under Computer Configuration.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Administrative Templates
    • Windows Components
    • Terminal Services

    Important

    • XOX
  3. Double-click the Set path for TS Roaming Profiles setting, and then click Enabled.
  4. In the Profile path box, type the path for Terminal Services roaming profiles, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Using Terminal Services Extension to Local Users and Groups

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user whose profile path you want to change.
  3. On the Terminal Services Profile tab, under Profile Path:, type the new path to the user's profile, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Change the path to a user's home directory

Microsoft Windows Graphic

To change the path to a user's home directory

Using Group Policies (best practice)

  1. Choose from the following:
    • For a domain user account, from a Domain Controller, open Active Directory Users and Computers.

      In the console tree, right click the domain node, and then click properties. In the Group Policy tab, double-click the Group Policy object, or click Edit.

      Important

      • XOX
    • For a local user account, open Group Policy.
  2. In the Group Policy console tree, click Terminal Services under Computer Configuration.

    Where?

    • Local Computer Policy
    • Computer Configuration
    • Administrative Templates
    • Windows Components
    • Terminal Services

    Important

    • XOX
  3. Double-click the TS User Home Directory setting, and then click Enabled.
  4. In the Location box, click the location for the Terminal Services home directory.
  5. In the Home Dir Root Path box, type the root path for the Terminal Services home directory.
  6. If the root path is on the network, click the drive letter for the mapped drive in the Drive Letter box. Click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Using Terminal Services Extension to Local Users and Groups

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user whose home directory you want to change.
  3. On the Terminal Services Profile tab, do one of the following:
    • If the Terminal Services home folder is on the local server, click Local path, and then type the path to the home directory.
    • If the Terminal Services home directory is on a network share, click Connect, select a drive to connect, and then type the network path.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Notes

  • XOX

Related Topics


Allow a user to log on to Terminal Services

Microsoft Windows graphic

To allow a user to log on to Terminal Services

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user for which you want to change settings.
  3. On the Terminal Services Profile tab, select the Allow logon to terminal server check box, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Set the maximum duration of an active session

Microsoft Windows graphic

To set the maximum duration of an active session

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      • Important

      • XOX
  2. Double-click the user account that you want to change.
  3. On the Sessions tab, in Active session limit, select the amount of time to wait before the connection times out, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Set the maximum time a disconnected session remains active

Microsoft Windows graphic

To set the maximum time a disconnected session remains active

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user account is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to change settings.
  3. On the Sessions tab, in End a disconnected session, select the amount of time you want to elapse before the disconnected session is reset, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Set the maximum idle time for a session

Microsoft Windows graphic

To set the maximum idle time for a session

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to change settings.
  3. On the Sessions tab, in Idle session limit, select the amount of time you want to elapse before the idle session times out, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Change settings for when a session limit is reached or a connection is broken

Microsoft Windows graphic

To change settings for when a session limit is reached or a connection is broken

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user account is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to change settings.
  3. On the Sessions tab, under When a session limit is reached or connection is broken, click Disconnect from session to allow the session to be reconnected.

    Or, click End session to end the session. Click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Change settings for reconnecting disconnected sessions

Microsoft Windows graphic

To change settings for reconnecting disconnected sessions

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user account is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to change settings.
  3. On the Sessions tab, under Allow reconnection, click From any client to allow connection to that session from any client computer.

    Or, click From originating client only to allow only the client computer where the session was created to reconnect to that session. This option is supported only for Citrix ICA clients. Click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Specify a program to start on session connection

Microsoft Windows graphic

To specify a program to start on session connection

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user account is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to change the Starting program.
  3. On the Environment tab, under Starting program, select the Start the following program at logon check box.
  4. In Program file name, type the name of the program to start when the user logs on. You can also specify a working directory by typing the path in Start in. Click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • Some client option settings are not applied when a connection is made to the console session of a remote computer running XOX. For example, if the client has specified a program to start upon connection to a remote computer, that program does not start if the connection is made to the console session of the remote computer. Instead, the default desktop appears. If the connection is made to a session other than the console session, the specified program starts as expected. The console session is the only session available for Remote Desktop on XOX, so the default desktop always appears when a connection is made, even if the client has specified a different program.
  • XOX

Related Topics


Connect Citrix ICA client drives at logon

Microsoft Windows graphic

To connect Citrix ICA client drives at logon

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user account is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to connect client drives.
  3. On the Environment tab, under Client devices, select the Connect client drives at logon check box, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX
  • This procedure is for Citrix ICA clients only. For clients that use the Remote Desktop Protocol (RDP), client drive redirection is supported if the server is running one of the Windows Server 2003 family operating systems and the client is running Remote Desktop Connection.
  • In Windows Explorer, client drives appear in the session folder tree in the form \\TSClient\<driveletter>$ if drive redirection has been specified as a Remote Desktop Connection option on the client.

Related Topics


Connect client printers at logon

Microsoft Windows graphic

To connect client printers at logon

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user account is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to connect client printers.
  3. On the Environment tab, under Client devices, select the Connect client printers at logon check box, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Default to the client's main printer

Microsoft Windows graphic

To default to the client's main printer

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user account is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to change the printer default.
  3. On the Environment tab, under Client devices, select the Default to main client printer, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Enable remote control

Microsoft Windows graphic

To enable remote control

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user account is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to enable remote control.
  3. On the Remote control tab, select the Enable remote control check box, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Require user's permission to observe or control sessions

Microsoft Windows graphic

To require user's permission to observe or control sessions

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user whose permission you want to require.
  3. On the Remote control tab, select the Require user's permission check box, and then click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Set the level of control over a user's sessions

Microsoft Windows graphic

To set the level of control over a user's sessions

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which the user account is located.

      Important

      • XOX
    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users

      Important

      • XOX
  2. Double-click the user account for which you want to set the level of control.
  3. On the Remote control tab, under Level of control, click View the user's session to allow only session observation.

    Or, click Interact with the session to allow full remote control of the session. Click OK.

Notes

  • XOX

    This procedure works only if the server has been promoted to a domain controller.

  • XOX

Related Topics


Concepts

This section covers:

  • Managing Terminal Services users
  • Managing Terminal Services users with Group Policy
  • Terminal Services users


Managing Terminal Services Users

Each user who logs on to a Terminal Services session must have a user account either on the server or in a domain on the network that the server is on. The Terminal Services user account contains additional information about the user that determines when users log on, under what conditions, and how specific desktop settings are stored. Windows Server 2003 family operating systems contain a built-in User group called Remote Desktop Users, which is used to manage Terminal Services users.

About the Remote Desktop Users group

When you install one of the Windows Server 2003 family operating systems, the Remote Desktop Users group is one of the built-in user groups on your computer. Members of this group have the same access as members of the Users group, but they have the additional ability to log on remotely to the computer.

By default, this group is not populated when you install Terminal Server on your computer. You must choose the users and groups that you want to have permission to log on remotely to the terminal server, and manually add them to the Remote Desktop Users group. This increases the security of remote connections, and also allows you to install any required programs before users start connecting to the terminal server.

The Select Remote Users button on the Remote tab of the System Properties dialog box allows you to add users to the Remote Desktop Users group. However, if a server running a Windows Server 2003 family operating system is being used as a domain controller in a Windows 2000 domain, this button is disabled. This domain controller can have domain groups, but not local groups, so in this situation you cannot use this button to add users to the Remote Desktop Users group.

For information on how to add users to the Remote Desktop Users group, see To add users to the Remote Desktop Users group.


Managing Terminal Services Users with Group Policy

You can use Group Policy to configure Terminal Services user profile information. Group Policy configures these options on a per-computer basis, for easy configuration of all users who connect to a specific computer. For environments where individual user properties are not available to local administrators, using Group Policy provides an alternative to the Terminal Services Extension to Local Users and Groups.

Important

  • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Use the Set path for TS Roaming Profiles setting to configure a network path for Terminal Services user profiles. For more information, see To change a user's Terminal Services profile path.

Use the TS User Home Directory setting to configure a local or network path as the root of the home directory for Terminal Services users. For more information, see To change the path to a user's home directory.

For more information about Terminal Services profiles, see Terminal Services Profile.

For general information about using Terminal Server Group Policy, see Configuring Terminal Services with Group Policy.


Terminal Services users

Each user who logs on to a terminal server must have a user account either on the server or in a domain on the network that the terminal server is on. The Terminal Services user account contains additional information about the user that determines when users log on, under what conditions, and how specific desktop settings are stored. Windows Server 2003 family operating systems contain a built-in User group called Remote Desktop Users, which has been specifically created to manage Terminal Server users.

For more information about the Remote Desktop Users group and for managing users with Group Policies, see Managing Terminal Services Users.

In addition to the Terminal Services Group Policies, User accounts can be set up and managed for a specific computer using Local Users and Groups or for a domain of computers using Active Directory Users and Computers.

Note

  • User settings set with Local Users and Groups and with Active Directory Users and Computers are overridden by Group Policy settings at both the computer and user level. For more information, see Terminal Services Configuration Overview.

The following topics describe the Terminal Services Extension tabs that appear in the Properties dialog box for a user:

  • Environment
  • Sessions
  • Remote control
  • Terminal Services Profile


Environment

The Terminal Services Extension Environment tab on the Properties dialog box contains settings for creating the client working environment.

Starting program

If a starting program is specified in the user’s settings, that program opens whenever the user connects to a terminal server. It is the only application that can be used by the user. When the user closes the application, the connection to the terminal server closes, as though the user has logged off of the terminal server.

You can also use Terminal Services Configuration to specify a starting program that is the only application available to all users who connect to the terminal server. For more information about setting the starting program on a connection basis, see To specify a program to start when a user logs on.

Client devices

You can configure Terminal Services to connect local client printers at logon. When the client logs on to the server, the local printer is detected and the appropriate printer driver is installed on the terminal server. If multiple printers are connected, you can also default all print jobs to the main client printer. For more information, see To connect client printers at logon or Providing client access to local printers.


Sessions

The Sessions tab of the Terminal Services Extension provides settings for limiting the time length of sessions based on their current state (active, idle, or disconnected). You can also specify what action to take when a session has reached a time limit.

Time-out setting | Description
End a disconnected session | Specifies the maximum duration that a disconnected session is retained. The session is reset and can no longer be reconnected after the time limit has expired. For more information, see To set the maximum time a disconnected session remains active.
Active session limit | Specifies the maximum connection duration. When the time limit is reached, the session will either be disconnected, leaving the session active on the server, or reset. To set the maximum duration of an active session.
Idle session limit | Specifies the maximum idle time (time without connection activity) allowed before the session is disconnected or reset. The session is disconnected or reset when the interval elapses without any activity at the connection. To set the maximum idle time for a session.

Note

  • If Never is selected, the timer is disabled.

When the connection to the server is broken for any reason, including a request, a connection error, or an idle or active limit is reached, the client session is either placed into the disconnected state or it is reset. A session that is reset can no longer be activated by a user and is closed. A disconnected session is left active on the server and is available for reconnection. For more information, see To change settings for when a session limit is reached or a connection is broken.

Disconnected sessions

By default, a terminal server allows you to reconnect to a disconnected session from any computer. However, to allow only the original client computer to reconnect the session, you can specify that a user can only reconnect to a disconnected session from the computer where the session originated. This option is supported only for Citrix ICA clients that provide a serial number when connecting.


Remote control

You can monitor the actions of a client logged on to a terminal server by using remote control from another session. Remote control allows you to either observe or actively control a client session. If you choose to actively control a client session, you will be able to input keyboard and mouse actions to the session. You can warn a client that you want to remotely control their session by choosing to display a message on the client that asks permission to view or take part in the session. You can use either Local Users and Groups (for local users) or Active Directory Users and Computers (for domain users) to enable Remote control for a user account. For more information about enabling remote control, see To enable remote control.

Notes

  • You should use care when assigning permissions on connections. For more information on permissions, see Controlling connection access.
  • The system console cannot remotely control a client session.
  • The computer you are logged on to must be capable of supporting the video resolution used at the remotely controlled client session. Otherwise, the operation fails.
  • To end remote control, press CTRL+ASTERISK (*). You can define another hot key to perform this function.


Terminal Services profile

A Terminal Services profile to assign each user a profile is specifically created for terminal server sessions. Administrators can then create user profiles tailored to the Terminal Services environment.

The Terminal Services profile can be used to restrict access to applications by removing them from the user's Start menu. Administrators can also create and store network connections to printers and other resources for use during user sessions.

For more information about profiles, see User profiles.

Terminal Services home folder

You can specify a path to a home folder to be used for terminal server sessions. This can be either a local folder or a network share.

Allow logon to terminal server

You can grant access to a specific terminal server on a per-user basis. If this option is left disabled, the user is not allowed to log onto any terminal servers.


Providing client access to server audio

On Windows Server 2003 family operating systems, Terminal Server administrators can enable users to play server audio on their local computers. This feature is disabled by default when you install Terminal Server. To enable it, configure the Allow audio redirection policy in Terminal Services Group Policies. You can also enable audio redirection locally using the Terminal Services Configuration tool. For more information, see To connect client drives and printers at logon.


Providing client access to the local file system

On Windows Server 2003 family operating systems, Terminal Services provides client drive redirection, making the local file system available on the remote desktop within a Terminal Services session. If drive redirection is specified, client drives appear in Windows Explorer with the designation "tsclient <driveletter>".

When you install Terminal Server, client drive mapping is disabled by default. To enable this feature, use Terminal Services Group Policies or the Terminal Services Configuration tool.


Use the Terminal Services Client

  • Connect to a terminal server from Remote Desktop Connection (32-bit client)
  • Use terminal server shortcut keys
  • Check the version number of a 32-bit client
  • Disconnect without ending a session
  • Log off and end the session


Remove the Terminal Services Client

Microsoft Windows graphic

To remove the Terminal Services Client

  1. In the Terminal Services Client group, click Uninstall.
  2. In the Terminal Services Client Setup dialog box, click Remove All to remove all Terminal Services Client files from your client computer.
  3. Click Yes to confirm the removal.
  4. In the Terminal Services Client - Restart Windows dialog box, click Restart Windows to complete.

Note

  • If you installed the client from a floppy disk, you must place the installation disk in the drive during this procedure. Placing the disk in the drive during uninstall reactivates the disk so that it can be used to install the client for another user.

Related Topics


Restrict local administrators from customizing permissions

Microsoft Windows graphic

To restrict local administrators from customizing permissions

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Do not allow local administrators to customize permissions setting.
  3. Click Enabled, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Note

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in. For information on applying Group Policy to groups of users or computers, see Configuring Terminal Services with Group Policy. For information on configuring the local Group Policy object, see Group Policy overview.


Set the path for Terminal Services roaming profiles

Microsoft Windows graphic

To set the path for Terminal Services roaming profiles

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Set path for TS Roaming Profiles setting, and then click Enabled.
  3. In the Profile path box, type the path for Terminal Services roaming profiles, and then click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Note

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in. For information on applying Group Policy to groups of users or computers, see Configuring Terminal Services with Group Policy. For information on configuring the local Group Policy object, see Group Policy overview.


Specify the Terminal Services user home directory

Microsoft Windows graphic

To specify the Terminal Services user home directory

  1. Open Group Policy.
  2. In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the TS User Home Directory setting, and then click Enabled.
  3. In the Location box, click the location for the Terminal Services home directory.
  4. In the Home Dir Root Path box, type the root path for the Terminal Services home directory.
  5. If the root path is on the network, click the drive letter for the mapped drive in the Drive Letter box.
  6. Click OK.

    Important

    • You should thoroughly test any changes you make to Group Policy settings before applying them to users or computers. For more information on testing policy settings, see Resultant Set of Policy.

Notes

  • XOX

  • Use the above procedure to configure the local Group Policy object. To change a policy for a domain or an organizational unit, you must log on to the primary domain controller as an Administrator. Then, you must invoke Group Policy through the Active Directory Users and Computers snap-in. For information on applying Group Policy to groups of users or computers, see Configuring Terminal Services with Group Policy.


Installing Terminal Services in remote administration mode

It is no longer necessary to install Terminal Services in Remote Administration mode (now called Remote Desktop for Administration). When you install one of the Windows Server 2003 family operating systems, Remote Desktop for Administration is installed automatically. To use Remote Desktop for Administration, you must first enable remote connections. For more information, see To enable or disable remote connections.

For information on using Remote Desktop for Administration, see:

  • Remote Desktop for Administration


Managing Users with the Terminal Services Extension to Local Users and Groups

This topic covers information about managing Terminal Services users with the Terminal Services Extension to Local Users and Groups. The following topics are included:

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.