Terminal Services Configuration

You can use Terminal Services Configuration to configure settings for new connections, modify the settings of existing connections, and delete connections. You can configure settings on a per-connection basis, or for the server as a whole.

The following topics are covered:

  • Overview of Terminal Services Configuration

  • Configuring Terminal Services Connections

  • Configuring Terminal Server Settings

  • Managing Terminal Services Connections

In addition, for information about installing, configuring, and managing the TS Session Broker role service, see TS Session Broker.

New in Terminal Services Configuration for Windows Server 2008 is the Licensing Diagnosis tool. For more information about Licensing Diagnosis, see Identify Possible Licensing Problems for the Terminal Server.

Additional references

  • Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=79608)

  • TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=79607)

  • TS Session Broker page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=79606)


Overview of Terminal Services Configuration

You can use Terminal Services Configuration to configure settings for new connections, modify the settings of existing connections, and delete connections. You can configure settings on a per-connection basis, or for the server as a whole.

Important

You can only use Terminal Services Configuration in Windows Server 2008 to configure a terminal server running Windows Server 2008.

In addition, new in Terminal Services Configuration for Windows Server 2008 is the Licensing Diagnosis tool. Licensing Diagnosis provides information to help identify possible TS Licensing problems for the terminal server. For more information about Licensing Diagnosis, see Identify Possible Licensing Problems for the Terminal Server.

The following topics provide information about settings that apply to the server as a whole:

  • Restrict Users to a Single Session

  • Configure Temporary Folders for a Terminal Server

  • Deny New User Logons to a Terminal Server

  • Configure License Settings for a Terminal Server

  • Configure TS Session Broker Settings for a Terminal Server

The following topics provide information about settings that apply to connections:

  • Managing Terminal Services Connections

  • Configure Security Settings for Terminal Services Connections

  • Configure Client Settings for Terminal Services Connections

  • Configure Session Settings for Terminal Services Connections

The following topics are also covered:

  • Running Terminal Services Configuration

  • Connect to Another Terminal Server by Using Terminal Services Configuration

  • Remote Desktop for Administration


Running Terminal Services Configuration

You can run Terminal Services Configuration from any of the following locations:

  • Start menu

  • Server Manager

  • Microsoft Management Console

Note

Terminal Services Configuration is only available in Server Manager if the Terminal Services role is installed on the computer.

To run Terminal Services Configuration from the Start menu

  • Click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  • Click Start, click Run, type tsconfig.msc and then press ENTER.
To run Terminal Services Configuration from Server Manager

  1. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, expand Roles.

  3. Expand Terminal Services, and then click Terminal Services Configuration.
To run Terminal Services Configuration from the Microsoft Management Console

  1. Click Start, click Run, type mmc and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Terminal Services Configuration, and then click Add.

  4. In the Select Computer dialog box, select whether you want to connect to the local computer or to another computer. If you select Another Computer, either type in the name of the computer or use Browse to search for the computer.

  5. Click OK.

  6. In the Add or Remove Snap-ins dialog box, click OK.

Additional references

  • Overview of Terminal Services Configuration

  • Connect to Another Terminal Server by Using Terminal Services Configuration


Connect to Another Terminal Server by Using Terminal Services Configuration

In Windows Server 2008 you can use Terminal Services Configuration to configure the settings on the local terminal server or to connect to another terminal server and configure the settings for that terminal server remotely.

Important

You can only use Terminal Services Configuration in Windows Server 2008 to configure a terminal server running Windows Server 2008.

To connect to another terminal server by using Terminal Services Configuration

  1. Click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. On the Action menu, click Connect to Terminal Server.

  3. In the Select Computer dialog box, select Another Computer, type the name of the computer in the box, and then click OK.

Additional references

  • Overview of Terminal Services Configuration

  • Running Terminal Services Configuration


Remote Desktop for Administration

You can use Terminal Services Configuration on a computer even if the Terminal Server role service is not installed on the computer. If the Terminal Server role service is not installed, Terminal Services Configuration will display that the computer is configured for Remote Desktop for Administration.

The following are limitations of Remote Desktop for Administration:

  • The default connection (RDP-Tcp) only allows a maximum of two simultaneous remote connections.

  • Licensing settings cannot be configured.

  • TS Session Broker settings cannot be configured.

  • User logon mode cannot be configured.

To remove these limitations, you must install the Terminal Server role service on the computer. For more information about installing the Terminal Server role service, see Checklist: Terminal Server Installation Prerequisites.

Additional references

  • Overview of Terminal Services Configuration

  • Configure the Number of Simultaneous Remote Connections Allowed for a Connection

  • Configure License Settings for a Terminal Server

  • Configure TS Session Broker Settings for a Terminal Server

  • Deny New User Logons to a Terminal Server


Configuring Terminal Services Connections

This section provides procedures for configuring Terminal Services connections. The following topics are covered:

  • Configure Security Settings for Terminal Services Connections

  • Configure Client Settings for Terminal Services Connections

  • Configure Session Settings for Terminal Services Connections

Additional references

  • Managing Terminal Services Connections


Configure Security Settings for Terminal Services Connections

This section provides procedures for configuring security settings for Terminal Services connections. The following topics are covered:

  • Configure Server Authentication and Encryption Levels

  • Configure Network Level Authentication for Terminal Services Connections

  • Configure Client Logon Information for Terminal Services Connections

  • Configure Permissions for Terminal Services Connections

Additional references

  • Configuring Terminal Services Connections

  • Managing Terminal Services Connections


Configure Server Authentication and Encryption Levels

By default, Terminal Services sessions use native Remote Desktop Protocol (RDP) encryption. However, RDP does not provide authentication to verify the identity of a terminal server. You can enhance the security of Terminal Services sessions by using Transport Layer Security (TLS) 1.0 for server authentication and to encrypt terminal server communications. The terminal server and the client computer must be correctly configured for TLS to provide enhanced security.

Note

For more detailed information about configuring security settings for a terminal server, see the Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=79608).

Three security layers are available.

Security layer | Description
SSL (TLS 1.0) | SSL (TLS 1.0) will be used for server authentication and for encrypting all data transferred between the server and the client.
Negotiate | This is the default setting. The most secure layer that is supported by the client will be used. If supported, SSL (TLS 1.0) will be used. If the client does not support SSL (TLS 1.0), the RDP Security Layer will be used.
RDP Security Layer | Communication between the server and the client will use native RDP encryption. If you select RDP Security Layer, you cannot use Network Level Authentication.
Note

You can enhance terminal server security by providing user authentication earlier in the connection process when a client connects to a terminal server. This early user authentication method is referred to as Network Level Authentication. For more information about Network Level Authentication, see Configure Network Level Authentication for Terminal Services Connections.

A certificate is needed to authenticate a terminal server when SSL (TLS 1.0) is used to secure communication between a client and a terminal server during RDP connections. You can select a certificate that you have installed on the terminal server or you can used the default self-signed certificate.

Note

It is recommended that you obtain and install a certificate issued by one of the trusted public certification authorities that participate in the Microsoft Root Certificate Program Members program.

For Terminal Services connections, data encryption can protect your data by encrypting it on the communications link between the client and the server. Encryption helps protect against the risk of unauthorized transmission interception on the link between server and client.

By default, Terminal Services connections are encrypted at the highest level of security available (128-bit). However, some older versions of the Terminal Services client do not support this high level of encryption. If your network contains such legacy clients, you can set the encryption level of the connection to send and receive data at the highest encryption level supported by the client.

Note

To determine the maximum encryption strength supported by the version of Remote Desktop Connection running on the computer, start Remote Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. Look for the phrase "Maximum encryption strength" in the About Remote Desktop Connection dialog box. Remote Desktop Connection 5.2 and above supports 128 bits of encryption.

Four encryption levels are available.

Encryption level | Description
FIPS Compliant | This level encrypts and decrypts data sent from the client to the server and from the server to the client by using Federal Information Process Standard (FIPS) 140-1 validated encryption methods. Clients that do not support this level of encryption cannot connect.
High | This level encrypts data sent from the client to the server and from the server to the client by using 128-bit encryption. Use this level when the terminal server is running in an environment containing 128-bit clients only (such as Remote Desktop Connection clients). Clients that do not support this level of encryption will not be able to connect.
Client Compatible | This is the default setting. This level encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this level when the terminal server is running in an environment containing mixed or legacy clients.
Low | This level encrypts data sent from the client to the server by using 56-bit encryption. Data sent from the server to the client is not encrypted.

Use the following procedure to configure the server authentication and encryption settings for a connection on the terminal server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the server authentication and encryption settings for a connection

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the General tab.

  4. Select the server authentication and encryption settings that are appropriate for your environment, based on your security requirements and the level of security that your client computers can support.

  5. If you select SSL (TLS 1.0), either select a certificate that is installed on the terminal server or click Default to generate a self-signed certificate. If you are using a self-signed certificate, the name of the certificate will display as Auto generated.

  6. Click OK.

You can also configure server authentication and encryption settings by applying the following Group Policy settings:

  • Set client connection encryption level

  • Require use of specific security layer for remote (RDP) connections

  • Server Authentication Certificate Template

  • Require user authentication for remote connections by using Network Level Authentication

These Group Policy settings are located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that these Group Policy settings will take precedence over the settings configured in Terminal Services Configuration, with the exception of the Server Authentication Certificate Template policy setting.

You can configure the terminal server to use FIPS as the encryption level by applying the System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing Group Policy setting. This Group Policy setting is located in Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that this Group Policy setting will take precedence over the setting configured in Terminal Services Configuration and takes precedence over the Set client connection encryption level policy setting.

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configure Security Settings for Terminal Services Connections


Configure Network Level Authentication for Terminal Services Connections

You can enhance terminal server security by providing user authentication earlier in the connection process when a client connects to a terminal server. This early user authentication method is referred to as Network Level Authentication.

Network Level Authentication is a new authentication method that completes user authentication before you establish a Remote Desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer from malicious users and malicious software. The advantages of Network Level Authentication are:

  • It requires fewer remote computer resources initially. The remote computer uses a limited number of resources before authenticating the user, rather than starting a full Remote Desktop connection as in previous versions.

  • It can help provide better security by reducing the risk of denial-of-service attacks.

To use Network Level Authentication, you need to meet all of the following requirements:

  • On the client computer, be using at least Remote Desktop Connection 6.0.

  • On the client computer, be using an operating system, such as Windows Vista, that supports the Credential Security Support Provider (CredSSP) protocol.

  • On the terminal server, be using Windows Server 2008.

Use the following procedure to configure Network Level Authentication for a connection.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure Network Level Authentication for a connection

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the General tab.

  4. Select the Allow connections only from computers running Remote Desktop with Network Level Authentication check box.

    If the Allow connections only from computers running Remote Desktop with Network Level Authentication check box is selected and is dimmed, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the terminal server.

  5. Click OK.

The Network Level Authentication setting for a terminal server can also be set in the following ways:

  • During the installation of the Terminal Server role service in Server Manager, on the Specify Authentication Method for Terminal Server page in the Add Roles Wizard.

  • On the Remote tab in the System Properties dialog box on a terminal server.

    If the Allow connections from computers running any version of Remote Desktop (less secure) is not selected and is dimmed, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the terminal server.

    To configure the Network Level Authentication setting by using the Remote tab in the System Properties dialog box on a terminal server, see Change Remote Connection Settings.

  • By applying the Require user authentication for remote connections by using Network Level Authentication Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration or on the Remote tab.

To determine whether a computer is running a version of Remote Desktop Connection that supports Network Level Authentication, start Remote Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. Look for the phrase "Network Level Authentication supported" in the About Remote Desktop Connection dialog box.

For more information about security and Terminal Services, see the Terminal Services page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=48555).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configure Security Settings for Terminal Services Connections


Configure Client Logon Information for Terminal Services Connections

To connect remotely to the terminal server, the user must provide credentials in order to be authenticated and for the terminal server to determine what actions the user is authorized to perform.

By default, a connection will use the logon information provided by the user, which the user provides when using Remote Desktop Connection to connect remotely to the terminal server.

Instead of using the logon information provided by the client, you can specify the logon information to be used for the connection on the Log on Settings tab in the Properties dialog box for the connection.

You can also specify that a user is always prompted to provide a password when connecting to the terminal server, even if the user has configured Remote Desktop Connection to use saved credentials when connecting to the terminal server.

Use the following procedure to configure the logon settings for a connection.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the logon settings for a connection

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Log on Settings tab.

  4. Configure the logon settings as appropriate for your environment and then click OK.

    If the Always prompt for password check box is selected and is dimmed, the Always prompt for password upon connection Group Policy setting has been enabled and has been applied to the terminal server.

You can also specify that a user is prompted for a password when connecting remotely to the terminal server by applying the Always prompt for password upon connection Group Policy setting. This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration.

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

For more information about security and Terminal Services, see the Terminal Services page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=48555).

Additional references

  • Configure Security Settings for Terminal Services Connections


Configure Permissions for Terminal Services Connections

Terminal Services permissions are used to control which users or groups can perform particular tasks on the terminal server, such as logging on to the terminal server or remotely controlling a user session. You can manage permissions on a per connection basis in Terminal Services Configuration.

Note

To control who can connect remotely to the terminal server, it is recommended that you modify the Remote Desktop Users group. For more information about modifying the Remote Desktop Users group, see Configure the Remote Desktop Users Group.

The connection permissions that are set in Terminal Services Configuration also determine the actions that a given user can perform in Terminal Services Manager. For example, a user must have at least the Remote Control special access permission in order to remotely control a user session by using Terminal Services Manager.

The following is a list of the permissions that you can set in Terminal Services Configuration and the capability that each permission provides.

Permission | Capability
Query Information | Query sessions and terminal servers for information
Set Information | Configure properties of the connection
Remote Control | View or actively control another user's session
Logon | Log on to a session on the terminal server
Logoff | Log off a user from a session
Message | Send a message to a user session
Connect | Connect to another user session
Disconnect | Disconnect a user session
Virtual Channels | Use a virtual channel in a session, which provides local device and resource redirection

By default, the Remote Desktop Users group is assigned the following permissions: Query Information, Logon, Message, and Connect.

There are three standard preconfigured sets of permissions:

  • Full Control

  • User Access

  • Guest Access

The following is a list of permissions that are associated with each of the standard preconfigured sets of permissions.

Permission set | Permissions assigned
Full Control | Query Information, Set Information, Remote Control, Logon, Logoff, Message, Connect, Disconnect, Virtual Channels
User Access | Query Information, Logon, Connect
Guest Access | Logon

Use the following procedure to configure permissions for a connection.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure permissions for a connection

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Security tab.

  4. You might receive one of the following informational messages:

    • A message that recommends that you control access to the terminal server by using the Remote Desktop Users group.

    • A message telling you that the permission settings are read-only because the Do not allow local administrators to customize permissions Group Policy setting has been enabled and has been applied to the terminal server.

  5. Click OK.

  6. Configure the permissions as appropriate for your environment and then click OK.

You can prevent administrators from changing the permissions for a connection by applying the Do not allow local administrators to customize permissions Group Policy setting. This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

For more information about security and Terminal Services, see the Terminal Services page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=48555).

Additional references

  • Configure Security Settings for Terminal Services Connections


Configure Client Settings for Terminal Services Connections

This section provides procedures for configuring client settings for Terminal Services connections. The following topics are covered:

  • Make Local Devices and Resources Available in a Remote Session

  • Specify a Program to Start Automatically When A User Logs On

  • Configure Maximum Color Depth for a Remote Session

Additional references

  • Configuring Terminal Services Connections

  • Managing Terminal Services Connections


Make Local Devices and Resources Available in a Remote Session

Terminal Services provides users the ability to access their local devices and resources in remote sessions. Users can access resources such as local drives, printers, the Clipboard, and supported Plug and Play devices. This is usually referred to as redirection.

In Windows Server 2008 redirection has been enhanced and expanded. Now you can redirect Windows Portable Devices, specifically media players based on the Media Transfer Protocol (MTP) and digital cameras based on the Picture Transfer Protocol (PTP).

In Windows Server 2008 you can also redirect devices that use Microsoft Point of Service (POS) for .NET 1.1. Microsoft POS for .NET device redirection is only supported if the terminal server is running an x86-based version of Windows Server 2008.

Users can specify which types of devices and resources they would like to redirect to the remote computer on the Local Resources tab of Remote Desktop Connection.

You can specify which local devices and resources will be available to users for remote sessions by using a connection on the terminal server. You can enable or disable the redirection of the following:

  • Drives

  • Printers

  • LPT Port

  • COM Port

  • Clipboard

  • Audio

  • Supported Plug and Play devices

Note

Terminal Services in Windows Server 2008 supports redirection of some additional supported Plug and Play devices. These additional supported Plug and Play devices exclude the various kinds of Plug and Play devices that are already supported in other categories, such as Drives, Printers, or Smart Cards. For example, a USB thumb drive that gets installed as a drive letter on the client computer will be listed as available for redirection under the Drives category, and a USB Plug and Play printer attached to the client computer will be redirected under the Printers category. The "Supported Plug and Play devices" category is for other Plug and Play devices, such as Windows Portable Devices and Windows POS for .NET 1.11-based devices.

If you disable redirection of the Clipboard, for example, users connecting remotely to the terminal server on this connection will not be able to redirect their Clipboard in their remote session, even if they select the Clipboard check box on the Local Resources tab under Options in Remote Desktop Connection. If you enable redirection of a local device or resource on the terminal server, users will still have to specify that they want to redirect that type of local device or resource by making the appropriate selection on the Local Resources tab under Options in Remote Desktop Connection.

Use the following procedure to enable or disable the redirection of local devices and resources for the connection on the terminal server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable or disable the redirection of local devices and resources

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Client Settings tab.

  4. Under Redirection, do one of the following for a given local device or resource category:

    • Select the check box to disable redirection of that type of local device or resource.

    • Clear the check box to enable redirection of that type of local device or resource.

  5. Click OK.

You can also configure which local devices and resources will be available to users in their remote sessions by applying Group Policy settings.

The following is a list of some of the Terminal Services-specific Group Policy settings that are related to local device and resource redirection.

Group Policy setting name Group Policy setting location

Allow audio redirection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Device and Resource Redirection

Do not allow clipboard redirection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Device and Resource Redirection

User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Device and Resource Redirection

Do not allow COM port redirection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Device and Resource Redirection

Do not allow drive redirection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Device and Resource Redirection

Do not allow LPT port redirection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Device and Resource Redirection

Do not allow supported Plug and Play device redirection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Device and Resource Redirection

Do not allow client printer redirection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Printer Redirection

These Group Policy settings can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that these Group Policy settings will take precedence over the settings configured in Terminal Services Configuration and will take precedence over the settings specified by the user in Remote Desktop Connection. If both the Computer Configuration and the User Configuration policy settings are configured, the Computer Configuration policy settings take precedence.

For more information about Terminal Services-specific Group Policy settings, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

For more information about device and resource redirection, see the Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79608).

Additional references

  • Configure Client Settings for Terminal Services Connections

  • Configure Printer Support


Specify a Program to Start Automatically When A User Logs On

By default, Terminal Services sessions provide access to the full Windows desktop, unless a program has been specified to start when the user logs on to the remote session.

If an initial starting program has been specified, it will be the only program that the user can use in the Terminal Services session. The Start menu and the Windows Desktop are not displayed when the user logs on to the remote session, and when the user exits the program the session is automatically logged off.

Note

Specifying an initial program to run does not apply to a RemoteApp session. For more information about TS RemoteApp, see the topic "Overview of TS RemoteApp" in the Windows Server 2008 TS RemoteApp Manager Help.

Configuring the initial starting program on a per-connection basis affects all users that use the connection.

You can configure the initial starting program on a per-user basis by using the Terminal Services Extension to the Local Users and Groups snap-in or to the Active Directory Users and Computers snap-in.

Initial starting program settings configured by using Terminal Services Configuration will take precedence over initial starting program settings that have been configured for a specific user account or that the user has specified in Remote Desktop Connection.

Use the following procedure to specify a program to start when the user logs on to a remote session.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify a program to start when the user logs on to a remote session

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Environment tab.

  4. Configure the initial starting program settings as appropriate for your environment.

    If you select the Start the following program when the user logs on option, in Program path and file name, type the fully qualified path and file name of the executable file to be run when the user logs on. If necessary, in Start In, type the fully qualified path to the starting directory for the program. If you leave Start In blank, the program runs with its default working directory. If the specified program path, file name, or working directory is not the name of a valid directory, the terminal server connection fails with an error message.

  5. Click OK. Changes made on the Environment tab are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the terminal server.

You can also configure whether a program or the desktop appears when the user logs on to a remote session by applying the following Group Policy settings:

  • Start a program on connection

  • Always show desktop on connection

These Group Policy settings are located in the following locations:

  • Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Remote Session Environment

  • User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\ Remote Session Environment

These Group Policy settings can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that these Group Policy settings will take precedence over the settings configured in Terminal Services Configuration. If both the Computer Configuration and the User Configuration policy settings are configured, the Computer Configuration policy settings take precedence. Also, the Always show desktop on connection policy setting will take precedence over the Start a program on connection policy setting.

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

For information about starting a program on a per-user basis, see the topic "<UserAccount> Properties: Environment Tab " in the Windows Server 2008 Terminal Services User Properties Help.

Additional references

  • Configure Security Settings for Terminal Services Connections


Configure Maximum Color Depth for a Remote Session

You can specify the maximum color resolution (color depth) for a remote session. Limiting the color depth can improve connection performance, particularly over slow links, and reduce server load.

The actual color depth for the connection is determined by the color support available on the client computer. The user can also specify a color depth for the connection on the Display tab under Options in Remote Desktop Connection, but the specified color depth cannot exceed the value configured on the terminal server.

Use the following procedure to specify the maximum color depth for a remote session.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify the maximum color depth for a remote session

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Client Settings tab.

  4. Select the Limit Maximum Color Depth check box, and then select the appropriate value for your environment.

    The default value is 32 bpp. A color depth of 24 bpp is only supported on Windows XP Professional and Windows Server 2003.

  5. Click OK. Changes to color depth settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the terminal server.
  • You can also set the maximum color depth for a remote session by applying the Limit maximum color depth Group Policy setting. This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Remote Session Environment and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration.

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configure Client Settings for Terminal Services Connections


Configure Session Settings for Terminal Services Connections

This section provides procedures for configuring session settings for Terminal Services connections. The following topics are covered:

  • Configure Timeout and Reconnection Settings for Terminal Services Sessions

  • Configure Remote Control of Terminal Services Sessions

Additional references

  • Configuring Terminal Services Connections

  • Managing Terminal Services Connections


Configure Timeout and Reconnection Settings for Terminal Services Sessions

By default, Terminal Services allows users to disconnect from a remote session without logging off and ending the session. When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected.

You can limit the amount of time that active, disconnected, and idle (without user input) sessions remain on the server. This is useful because sessions that remain running indefinitely on the terminal server continue to consume system resources.

Configuring timeout and reconnection settings on a per-connection basis affects all sessions that use the connection.

You can configure timeout and reconnection settings on a per-user basis by using the Terminal Services Extension to the Local Users and Groups snap-in or to the Active Directory Users and Computers snap-in.

Timeout and reconnection settings configured by using Terminal Services Configuration will take precedence over timeout and reconnection settings that have been configured for a specific user account.

You can configure the following timeout and reconnection settings in Terminal Services Configuration.

Setting Details

End a disconnected session

Specify the maximum amount of time that a disconnected user session is kept active on the terminal server. If you specify "Never," the user's disconnected session is maintained for an unlimited time.

When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected.

Active session limit

Specify the maximum amount of time that the user's Terminal Services session can be active before the session is automatically disconnected or ended.

The user receives a warning two minutes before the Terminal Services session is disconnected or ended, which allows the user to save open files and close programs.

Idle session limit

Specify the maximum amount of time that an active Terminal Services session can be idle (without user input) before the session is automatically disconnected or ended.

The user receives a warning two minutes before the session is disconnected or ended, which allows the user to press a key or move the mouse to keep the session active.

When a session limit is reached or connection is broken

Specify whether to disconnect or end the user's Terminal Services session when an active session limit or an idle session limit is reached.

If the user's session is disconnected, the programs that the user is running are kept active even though the user is no longer actively connected.

If the user's session is ended, the user will need to establish a new Terminal Services session with a terminal server.

Use the following procedure to specify the timeout and reconnection settings for a remote session.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify timeout and reconnection settings for a remote session

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Sessions tab.

  4. Click OK. Changes to timeout and reconnection settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the terminal server.

You can also configure timeout and reconnection settings by applying the following Group Policy settings:

  • Set time limit for disconnected sessions

  • Set time limit for active but idle Terminal Services sessions

  • Set time limit for active Terminal Services sessions

  • Terminate session when time limits are reached

These Group Policy settings are located in the following locations:

  • Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

  • User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

These Group Policy settings can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that these Group Policy settings will take precedence over the settings configured in Terminal Services Configuration. If both the Computer Configuration and the User Configuration policy settings are configured, the Computer Configuration policy settings take precedence.

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

For information about configuring timeout and reconnection settings on a per-user basis, see the topic "<UserAccount> Properties: Sessions Tab " in the Windows Server 2008 Terminal Services User Properties Help.

Additional references

  • Configure Session Settings for Terminal Services Connections


Configure Remote Control of Terminal Services Sessions

You can monitor the actions of a client logged on to a terminal server by using remote control from another session. Remote control allows you to either observe or actively control a client session. If you choose to actively control a client session, you will be able to input keyboard and mouse actions to the session. You can warn a client that you want to remotely control their session by choosing to display a message on the client that asks permission to view or take part in the session.

Configuring remote control on a per-connection basis affects all sessions that use the connection. By default, remote control is not allowed.

You can configure remote control on a per-user basis by using the Terminal Services Extension to the Local Users and Groups snap-in or to the Active Directory Users and Computers snap-in.

Remote control settings configured by using Terminal Services Configuration will take precedence over the remote control settings that have been configured for a specific user account.

Use the following procedure to specify the remote control settings for a remote session.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify the remote control settings for a remote session

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Remote Control tab.

  4. To use the remote control settings specified for the user account, select the Use remote control with default user settings option. The default setting for a user account is that remote control users have full control of the session if the user gives permission.

    To specify remote control settings for the connection, select the Use remote control with the following settings option and then configure whether the user's permission is required and what level of control is allowed.

  5. Click OK. Changes to remote control settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the terminal server.

You can also configure remote control settings by applying the Set rules for remote control of Terminal Services user sessions Group Policy setting. This Group Policy setting is located in the following locations:

  • Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections

  • User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections

This Group Policy setting can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration. If both the Computer Configuration and the User Configuration policy settings are configured, the Computer Configuration policy setting takes precedence.

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

For information about how to remotely control a user session, see the topic "Remotely Control a User Session" in the Windows Server 2008 Terminal Services Manager Help.

For information about configuring remote control settings on a per-user basis, see the topic "<UserAccount> Properties: Remote Control Tab" in the Windows Server 2008 Terminal Services User Properties Help.

Additional references

  • Configure Session Settings for Terminal Services Connections


Configuring Terminal Server Settings

This section provides procedures for configuring terminal server settings. The following topics are covered:

  • Restrict Users to a Single Session

  • Configure Temporary Folders for a Terminal Server

  • Deny New User Logons to a Terminal Server

  • Configure License Settings for a Terminal Server

  • Configure Printer Support

  • Configure TS Session Broker Settings for a Terminal Server


Restrict Users to a Single Session

To improve the performance of the terminal server, you can restrict users to a single session (either active or disconnected) on the terminal server. By restricting users to a single session on the terminal server, you can minimize the number of remote sessions that are created on the terminal server. This can help conserve system resources on the terminal server, thereby allowing more users to connect to the terminal server.

If a terminal server is configured to restrict users to a single session and the user leaves the session in a disconnected state, the user will automatically reconnect to that session the next time the user connects to the terminal server.

By default, a terminal server is configured to restrict users to a single session.

Use the following procedure to configure the Restrict each user to a single session setting on the terminal server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the Restrict each user to a single session setting on the terminal server

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under General, double-click Restrict each user to a single session.

  3. On the General tab of the Properties dialog box, select the setting for Restrict each user to a single session that is most appropriate for your environment, and then click OK.

You can also restrict users to a single session on the terminal server by enabling the Restrict Terminal Services users to a single remote session Group Policy setting. This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration.

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

If a user specifies a different program to start when the user connects to the terminal server, a new session will be created on the terminal server for the user, even if the terminal server is configured to restrict users to a single session. A user can specify a program to start on connection on the Programs tab under Options in Remote Desktop Connection. However, you can prevent a user from starting a program on connection; for more information about preventing a user from starting a program on connection, see Specify a Program to Start Automatically When A User Logs On.

Additional references

  • Configuring Terminal Server Settings


Configure Temporary Folders for a Terminal Server

By default, Terminal Services creates a separate temporary folder on the terminal server for each active session that a user maintains on the terminal server. The temporary folder is created on the terminal server in a Temp folder under the user’s profile folder and is named with the "sessionid." This temporary folder is used to store individual temporary files.

To reclaim disk space, the temporary folder is deleted when the user logs off from a session.

Use the following procedure to configure temporary folders on the terminal server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure temporary folders on the terminal server

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under General, double-click either Delete temporary folders on exit or Use temporary folders per session.

  3. On the General tab of the Properties dialog box, make the appropriate selection for your environment for the Delete temporary folders on exit and the Use temporary folders per session check boxes.

    If you clear the Use temporary folders per session check box, a user's temporary files for all sessions on the terminal server are stored in a common Temp folder under the user’s profile folder on the terminal server.

You can also configure temporary folders on the terminal server by using the Do not delete temp folder upon exit and the Do not use temporary folders per session Group Policy settings. These Group Policy settings are located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Temporary folders and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration.

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configuring Terminal Server Settings


Deny New User Logons to a Terminal Server

You can configure the user logon mode on the terminal server to prevent new user sessions from being created on the terminal server. This capability is new for Windows Server 2008.

You might want to prevent new user sessions from being created on the terminal server when you are planning to take the terminal server offline for maintenance or to install new applications.

You can specify one of the following settings for the user logon mode:

  • Allow all connections

  • Allow reconnections, but prevent new logons

  • Allow reconnections, but prevent new logons until the server is restarted

By default, Allow all connections is selected and is the recommended setting. This allows users to connect remotely to the terminal server to establish a remote session.

If you select Allow reconnections, but prevent new logons, a user who already has a remote session running on the terminal server can reconnect to that session. However, a new user—that is, a user that does not currently have a remote session running on the terminal server—will not be able to connect to the terminal server. If the terminal server is restarted, no users will be able to connect to the terminal server.

If you select Allow reconnections, but prevent new logons until the server is restarted, a user who already has a remote session running on the terminal server can reconnect to that session. However, a new user—that is, a user that does not currently have a remote session running on the terminal server—will not be able to connect to the terminal server. If the terminal server is restarted, the user logon mode will be set to Allow all connections and users will be able to connect to the terminal server.

Use the following procedure to configure the user logon mode on the terminal server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the user logon mode on the terminal server

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under General, double-click User logon mode.

  3. On the General tab of the Properties dialog box, select the user logon mode setting that is most appropriate for your environment, and then click OK.

You can also use the change logon command at a command prompt to configure the user logon mode on the terminal server. For more information about the change logon command-line tool, see the Terminal Services Command Reference (http://go.microsoft.com/fwlink/?LinkId=89674).

If you want to prevent all users—even users with remote sessions running on the terminal server—from being able to connect remotely to the terminal server over a given connection, you can disable the connection. For more information about disabling a connection, see Disable a Terminal Services Connection.

Additional references

  • Configuring Terminal Server Settings


Configure License Settings for a Terminal Server

Each user or computing device that connects to a terminal server must have a valid Terminal Services client access license (TS CAL) issued by a Terminal Services license server.

To ensure that a terminal server can contact (discover) a Terminal Services license server to request TS CALs for clients, you need to do the following on the terminal server:

  • Specify the Terminal Services Licensing Mode

  • Specify the License Server Discovery Mode

To be alerted to possible licensing configuration issues, use Licensing Diagnosis in Terminal Services Configuration. For more information about Licensing Diagnosis, see Identify Possible Licensing Problems for the Terminal Server.

Additional references

  • Configuring Terminal Server Settings


Specify the Terminal Services Licensing Mode

The Terminal Services licensing mode determines the type of Terminal Services client access licenses (TS CALs) that a terminal server will request from a license server on behalf of a client connecting to the terminal server.

Important

The Terminal Services licensing mode configured on a terminal server must match the type of TS CALs available on the license server.

There are two types of TS CALs:

  • TS Per Device CAL, which permits one device (used by any user) to connect to a terminal server.

  • TS Per User CAL, which gives one user the right to access terminal servers from an unlimited number of client computers or devices.

The Terminal Services licensing mode for the terminal server can be set in the following ways:

  • During the installation of the Terminal Server role service in Server Manager, on the Specify Licensing Mode page in the Add Roles Wizard.

    On the Specify Licensing Mode page, you can select Configure later if you are unsure during the installation whether to select Per Device or Per User. If you select Configure later, each time you log on to the terminal server, a message will appear in the lower-right corner of the desktop reminding you that you need to configure the licensing mode for the terminal server.

  • By configuring the Terminal Services licensing mode for the terminal server by using the Terminal Services Configuration tool.

    If the Specify the Terminal Services licensing mode choices are dimmed and you cannot make a selection, the Set Terminal Services licensing mode Group Policy setting has been enabled and has been applied to the terminal server.

  • By applying the Set Terminal Services licensing mode Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration.

To be alerted to possible licensing configuration issues, use Licensing Diagnosis in Terminal Services Configuration. For more information about Licensing Diagnosis, see Identify Possible Licensing Problems for the Terminal Server.

For more information about TS CALs and configuring TS Licensing, see the TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79607).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configure License Settings for a Terminal Server


Specify the License Server Discovery Mode

A terminal server must be able to contact (discover) a Terminal Services license server in order to request Terminal Services client access licenses (TS CALs) for users or computing devices that are connecting to the terminal server.

The license server discovery mode for the terminal server can be set in the following ways:

  • By configuring License Server discovery mode for the terminal server in the Terminal Services Configuration tool.

    If the Specify the license server discovery mode choices are dimmed and you cannot make a selection, the Use the specified Terminal Services license servers Group Policy setting has been enabled and has been applied to the terminal server.

  • By applying the Use the specified Terminal Services license servers Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration.

In the license server discovery process, a terminal server in a Windows Server-based domain attempts to contact a license server in the following order:

  • License servers that are specified in Terminal Services Configuration

  • A license server that is installed on the same computer as the terminal server

  • License servers that are published in Active Directory Domain Services

  • License servers that are installed on domain controllers in the same domain as the terminal server

Important

To see which license servers the terminal server discovers and to be alerted to possible licensing discovery and configuration issues, use Licensing Diagnosis in Terminal Services Configuration. For more information about Licensing Diagnosis, see Identify Possible Licensing Problems for the Terminal Server.

For more information about license server discovery and configuring TS Licensing, see the TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79607).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configure License Settings for a Terminal Server


Identify Possible Licensing Problems for the Terminal Server

Terminal Services Configuration for Windows Server 2008 includes the Licensing Diagnosis tool. Licensing Diagnosis provides information to help identify possible licensing problems for the terminal server.

Each user or computing device that connects to a terminal server must have a valid Terminal Services client access license (TS CAL) issued by a Terminal Services license server.

A terminal server must be able to contact (discover) a Terminal Services license server in order to request TS CALs for users or computing devices that are connecting to the terminal server.

The primary purpose of Licensing Diagnosis is to determine which license servers the terminal server can discover and whether those license servers have TS CALs available to issue to users or computing devices that are connecting to the terminal server. In addition, Licensing Diagnosis will try to identify any possible licensing problems and provide suggested resolutions to those problems.

Use the following procedure to run the Licensing Diagnosis tool.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To run the Licensing Diagnosis tool

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. In the left pane, click Licensing Diagnosis. Licensing Diagnosis will automatically run and try to discover license servers and identify licensing configuration problems, and then display the results.

There are four main sections to Licensing Diagnosis:

  • Terminal Server Configuration Details, which displays configuration information about the terminal server, including the licensing mode and discovery mode that have been specified for the terminal server.

  • Licensing Diagnosis Information, which displays any licensing problems that were identified along with suggested resolutions to the problems.

  • Terminal Services License Server Information, which displays the license servers that were discovered by the terminal server.

  • License Server Configuration Details, which displays configuration information about a license server, including the type and version of TS CALs installed and available on that license server.

To view the configuration details of a selected license server, the account that you are logged on as needs administrator privileges on the license server. If your account does not have administrator privileges on the license server, you can use Provide Credentials in the Licensing Diagnosis tool to provide credentials that have administrative privileges on the license server.

For more information about Licensing Diagnosis, see the TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79607).

Additional references

  • Configure License Settings for a Terminal Server

  • Specify the Terminal Services Licensing Mode

  • Specify the License Server Discovery Mode


Configure Printer Support

Terminal Services provides printer redirection, which routes printing jobs from a server to a printer that is attached to a client computer or to a shared printer that is available to the client computer. On a terminal server, you can use the Terminal Services Easy Print printer driver to simplify printer configuration. The Terminal Services Easy Print driver is useful if a terminal server does not have a printer driver installed that matches the printer driver on a client computer.

By default, the terminal server first tries to use the Terminal Services Easy Print driver. If the client computer does not support this driver, the server looks for a matching printer driver on the server. You can either install a matching printer driver on the terminal server, or you can create a custom printer mapping file.

Note

The terminal server fallback printer driver is not supported in Windows Server 2008.

Client requirements

To use Terminal Services Easy Print, the client computer must have the following components installed:

  • Remote Desktop Connection (RDC) 6.1

    Note

    The RDC 6.1 client supports Remote Desktop Protocol 6.1.

  • Microsoft .NET Framework 3.0 Service Pack 1

    Note

    The version of Microsoft .NET Framework that is included with Windows Server 2008 and Windows Vista with Service Pack 1 supports Terminal Services Easy Print.

Configure printer driver behavior

To change the default printer driver behavior, you can use Group Policy to modify the Use Terminal Services Easy Print driver first policy setting. This policy setting is located in the following node of the Group Policy Management Console (GPMC) or the Local Group Policy Editor:

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Printer Redirection

By using this policy setting, you can configure the terminal server to do either of the following:

  • Use the Terminal Services Easy Print driver first. If that fails, look for a matching printer driver. (This is the behavior if you enable or do not configure the policy setting.)

  • Look for a matching printer driver first. If that fails, use the Terminal Services Easy Print driver. (This is the behavior if you disable the policy setting.)

Other printer redirection policy settings that are available in this node of Local Group Policy Editor include:

  • Do not allow client printer redirection

  • Do not set default client printer to be default printer in a session

  • Redirect only the default client printer

For more information about these policy settings, view the policy setting descriptions in the GPMC or the Local Group Policy Editor.

Additional references

  • Configuring Terminal Server Settings

  • Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79608)


Configure TS Session Broker Settings for a Terminal Server

For information about configuring Terminal Services Session Broker (TS Session Broker) settings for a terminal server, see Configure a Terminal Server to Join a Farm in TS Session Broker.


Managing Terminal Services Connections

This section provides procedures for managing Terminal Services connections. The following topics are covered:

  • Create a Terminal Services Connection

  • Configure the Number of Simultaneous Remote Connections Allowed for a Connection

  • Enable a Terminal Services Connection

  • Disable a Terminal Services Connection

  • Rename a Terminal Services Connection

  • Delete a Terminal Services Connection


Create a Terminal Services Connection

By default, a connection is automatically created and enabled on a computer running Windows Server 2008, even if the Terminal Server role service is not installed on the computer. This connection is named RDP-Tcp and only allows a maximum of two simultaneous remote connections to the computer.

When you install the Terminal Server role service on the computer, the RDP-Tcp connection is changed to allow an unlimited number of simultaneous remote connections. For more information about configuring the number of simultaneous remote connections that a connection will allow, see Configure the Number of Simultaneous Remote Connections Allowed for a Connection.

Only one Remote Desktop Protocol (RDP) connection can be configured for each network adapter installed on the terminal server. Typically, the default RDP-Tcp connection is the only connection needed to support remote administration of the server or to support the Terminal Server role service. If you want to configure additional connections that use RDP, you must install an additional network adapter for each RDP connection that you want to create.

Use the following procedure to create a new connection.

Membership in the local Administrators group, or equivalent, on the terminal server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a new connection

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. On the Action menu, click Create New Connection.

  3. On the Welcome page of the Terminal Services Connection Wizard, click Next.

  4. On the Connection Protocol page, type the name for the connection. You cannot have two connections with the same name on the computer.

  5. If there is more than one Connection Type available on the computer, select the appropriate one for your environment.

    You cannot have more than one of the same Connection Type assigned to a given network adapter.

  6. Click Next.

  7. On the Network Adapter page, do the following:

    • Select the network adapter that the connection will use. If you want the connection to use all network adapters available on the computer, select All network adapters configured with this protocol.

    • Select the number of simultaneous remote connections that the connection will support.

  8. Click Next, and then on the Summary page, click Finish. The new connection will appear under Connections on the main page of Terminal Services Configuration.

Additional references

  • Managing Terminal Services Connections


Configure the Number of Simultaneous Remote Connections Allowed for a Connection

You can configure the number of simultaneous remote connections that are allowed for a connection. Restricting the number of simultaneous remote connections can improve performance of the computer because fewer sessions are demanding system resources.

If the Terminal Server role service is not installed on the computer, a connection can only allow a maximum of two simultaneous remote connections to the computer.

Use the following procedure to configure the number of simultaneous remote connections allowed for a connection.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the number of simultaneous remote connections allowed for a connection

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Network Adapter tab.

  4. Select the Maximum connections option, enter the number of simultaneous remote connections that you want to allow for the connection, and then click OK.

    If the Maximum connections option is selected and is dimmed, the Limit number of connections Group Policy setting has been enabled and has been applied to the terminal server.

You can also set the maximum number of simultaneous connections allowed for a terminal server by applying the Limit number of connections Group Policy setting. This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration.

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Managing Terminal Services Connections


Enable a Terminal Services Connection

You must enable a connection on the terminal server so that users can log on to the terminal server by using that connection.

Use the following procedure to enable a connection on the terminal server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable a connection on the terminal server

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, click the name of the connection—for example, RDP-Tcp—that you want to enable.

  3. On the Action menu, click Enable Connection. A green up arrow on the icon associated with the connection name indicates that the connection is enabled.

Additional references

  • Managing Terminal Services Connections

  • Disable a Terminal Services Connection


Disable a Terminal Services Connection

You can disable a connection on the terminal server so that no users can log on to the terminal server by using that connection. You might want to disable all connections to the terminal server when you are planning to take the terminal server offline for maintenance or to install new applications.

Important

When you disable a connection on the terminal server, all users using that connection to access the terminal server will be immediately disconnected from the terminal server. Before you disable the connection, you should send a message to users connected to the terminal server to warn them that they will be disconnected from the terminal server.

For more information about sending a message to a user connected to a terminal server, see the topic "Send a Message to a User" in the Windows Server 2008 Terminal Services Manager Help.

Use the following procedure to disable a connection on the terminal server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To disable a connection on the terminal server

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, click the name of the connection—for example, RDP-Tcp—that you want to disable.

  3. On the Action menu, click Disable Connection. The connection is immediately disabled and all users using that connection will be immediately disconnected from the terminal server. A red down arrow on the icon associated with the connection name indicates that the connection is disabled.

You can also deny new logons to the terminal server. For more information, see Deny New User Logons to a Terminal Server.

Additional references

  • Managing Terminal Services Connections

  • Enable a Terminal Services Connection


Rename a Terminal Services Connection

You can rename a connection on the terminal server. You might want to rename a connection to make the name more descriptive.

The connection name appears when you view session information in Terminal Services Manager. For more information about viewing session information in Terminal Services Manager, see the topic "View Sessions Running on a Terminal Server" in the Windows Server 2008 Terminal Services Manager Help.

You cannot have two connections with the same name on a terminal server.

Use the following procedure to rename a connection on the terminal server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To rename a connection on the terminal server

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, click the name of the connection—for example, RDP-Tcp—that you want to rename.

  3. On the Action menu, click Rename Connection.

  4. In the Rename Connection dialog box, type the new name for the connection, and then click OK.

Additional references

  • Managing Terminal Services Connections


Delete a Terminal Services Connection

You can delete a connection on the terminal server.

Important

When you delete a connection on the terminal server, all users using that connection to access the terminal server will be immediately disconnected from the terminal server. Before you delete the connection, you should send a message to users connected to the terminal server to warn them that they will be disconnected from the terminal server.

For more information about sending a message to a user connected to a terminal server, see the topic "Send a Message to a User" in the Windows Server 2008 Terminal Services Manager Help.

Use the following procedure to delete a connection on the terminal server.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To delete a connection on the terminal server

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, click the name of the connection—for example, RDP-Tcp—that you want to delete.

  3. On the Action menu, click Delete, and then click Yes. The connection is immediately disabled, and all users using that connection will be immediately disconnected from the terminal server.

    Users will not be able to reconnect to their sessions until you create a new connection that uses the same connection protocol and network adapter as the connection that was deleted. For more information about creating a new connection, see Create a Terminal Services Connection.

You can temporarily prevent users from connecting to the terminal server by doing either of the following:

  • Disabling a connection on the terminal server. For more information, see Disable a Terminal Services Connection.

  • Denying new logons to the terminal server. For more information, see Deny New User Logons to a Terminal Server.

Additional references

  • Managing Terminal Services Connections


TS Session Broker

What is TS Session Broker?

Terminal Services Session Broker (TS Session Broker) is a role service in Windows Server 2008 that keeps track of user sessions in a load-balanced terminal server farm. The TS Session Broker database stores session state information that includes session IDs, their associated user names, and the name of the server where each session resides. TS Session Broker uses this information to redirect users who have an existing session to the terminal server where their session exists.

If the TS Session Broker Load Balancing feature is enabled, TS Session Broker also tracks the number of user sessions on each terminal server in the farm, and directs new sessions to the terminal server with the fewest sessions.

Why use TS Session Broker?

TS Session Broker provides the following advantages:

  • Allows a user to reconnect to an existing session in a load-balanced terminal server farm. This prevents a user with a disconnected session from being connected to a different server in the farm and starting a new session.

  • Enables you to evenly distribute the session load between terminal servers in the farm.

Additional references

  • Overview of TS Session Broker

  • Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker

  • TS Session Broker page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79606)


Overview of TS Session Broker

TS Session Broker is a role service that provides the following functionality:

  • Allows a user to reconnect to their existing session in a load-balanced terminal server farm.

  • Enables you to evenly distribute the session load between servers in a load-balanced terminal server farm.

TS Session Broker stores session state information that includes session IDs, their associated user names, and the name of the server where each session resides.

If a user disconnects from a session (whether intentionally or because of a network failure), their applications will continue to run. When they reconnect, TS Session Broker is queried to determine whether they have an existing session, and if so, on which server in the farm. If there is an existing session, TS Session Broker redirects the client to the terminal server where their session exists.

With TS Session Broker Load Balancing, when a user without an existing session connects to a terminal server in the load-balanced farm, the user will be redirected to the terminal server with the fewest sessions. (To distribute the session load between more powerful and less powerful servers in the farm, you can assign a relative server weight value to a server.) If a user with an existing session reconnects, they are redirected to the terminal server where their existing session resides.

TS Session Broker components

There are two TS Session Broker components to consider.

  • TS Session Broker server. This is the server that runs the Terminal Services Session Broker service and tracks user sessions for one or more load-balanced terminal server farms. TS Session Broker uses a farm name to determine which servers are in the same terminal server farm.

  • Terminal servers that use TS Session Broker. These are load-balanced terminal servers that are members of a farm in TS Session Broker. To participate in TS Session Broker, a server must meet the following criteria:

    • The server must have the Terminal Server role service installed.

    • The server must be a member of an Active Directory domain.

    • The server must be a member of a load-balanced terminal server farm.

      If you are using the TS Session Broker Load Balancing feature, you can configure load-balancing settings together with other TS Session Broker settings. For more information, see Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker. Note that if you use TS Session Broker Load Balancing, all terminal servers in the farm must be running Windows Server 2008.

    • The server must be a member of the Session Directory Computers local group on the TS Session Broker server.

    • The server must be joined to a farm in TS Session Broker.

    Important

    If the terminal server is running a version of Windows Server 2008, it can only use a TS Session Broker server that is also running a version of Windows Server 2008.

Additional references

  • Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker

  • Install the TS Session Broker Role Service

  • Add Each Terminal Server in the Farm to the Session Directory Computers Local Group

  • Configure a Terminal Server to Join a Farm in TS Session Broker

  • Configure DNS for TS Session Broker Load Balancing

  • About TS Session Broker Redirection Modes

  • TS Session Broker page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79606)


Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker

With a load-balanced terminal server farm, you can scale the performance of a single terminal server by distributing Terminal Services sessions across multiple servers. You can configure a load-balanced farm by using the TS Session Broker Load Balancing feature, Network Load Balancing (NLB), or a third-party solution. TS Session Broker also enables a user to reconnect to their existing session in a load-balanced terminal server farm.

This checklist shows the steps that are required to create and configure a load-balanced terminal server farm by using TS Session Broker Load Balancing.

Important

The TS Session Broker Load Balancing feature is only supported on terminal servers that are running Windows Server 2008.

Task | Reference
Install the TS Session Broker role service on the server that you want to use to track user sessions for a farm. | Install the TS Session Broker Role Service
Add the terminal servers in the farm to the Session Directory Computers local group on the TS Session Broker server. | Add Each Terminal Server in the Farm to the Session Directory Computers Local Group
Configure the terminal servers in the farm to join a farm in TS Session Broker, and to participate in TS Session Broker Load Balancing. | Configure a Terminal Server to Join a Farm in TS Session Broker
Configure DNS round robin entries for terminal servers in the farm. | Configure DNS for TS Session Broker Load Balancing

Additional references

  • The TS Session Broker page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79606)

  • The Windows Server 2008 TS Session Broker Load Balancing Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=92670)

  • The Windows Server 2008 Terminal Services Deployment Guide (http://go.microsoft.com/fwlink/?LinkId=79603)

  • The Windows Server 2008 Configuring NLB with Terminal Services Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=80406)


Install the TS Session Broker Role Service

You must install the TS Session Broker role service on the server that you want to use to track user session information for a load-balanced terminal server farm. The Windows Server 2008-based server where you install the TS Session Broker role service does not have to be a terminal server or have Remote Desktop enabled.

You can use a single TS Session Broker server to track user sessions across multiple farms, as there is minimal performance overhead.

When you install the TS Session Broker role service, the following changes occur on the local computer:

  • The Terminal Services Session Broker service is installed. By default, the service is set to Started and to Automatic.

  • The Session Directory Computers local group is created.

Installation prerequisites

The server where you install TS Session Broker must be a member of a domain.

Note

If you install the TS Session Broker role service on a domain controller, the Session Directory Computers group will be a domain local group and available on all domain controllers.

Installation procedure

Membership in the local Administrators group is the minimum required to complete this procedure.

To install the TS Session Broker role service

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. If the Terminal Services role is already installed:

    1. Under Roles Summary, click Terminal Services.

    2. Under Role Services, click Add Role Services.

    3. On the Select Role Services page, select the TS Session Broker check box, and then click Next.

    If the Terminal Services role is not already installed:

    1. Under Roles Summary, click Add Roles.

    2. On the Before You Begin page of the Add Roles Wizard, click Next.

    3. On the Select Server Roles page, select the Terminal Services check box, and then click Next.

    4. On the Terminal Services page, click Next.

    5. On the Select Role Services page, select the TS Session Broker check box, and then click Next.

  3. On the Confirm Installation Selections page, confirm that TS Session Broker is listed, and then click Install.

  4. On the Installation Results page, click Close.

Additional references

  • Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker


Add Each Terminal Server in the Farm to the Session Directory Computers Local Group

For a terminal server to use TS Session Broker, you must add the computer account for the terminal server to the Session Directory Computers local group on the TS Session Broker server.

Membership in the local Administrators group is the minimum required to complete this procedure.

Important

You must perform this procedure on the server where you installed the TS Session Broker role service.

To add a terminal server to the Session Directory Computers local group

  1. On the TS Session Broker server, click Start, point to Administrative Tools, and then click Computer Management.

  2. In the left pane, expand Local Users and Groups, and then click Groups.

  3. In the right pane, right-click the Session Directory Computers group, and then click Properties.

  4. Click Add.

  5. In the Select Users, Computers or Groups dialog box, click Object Types.

  6. Select the Computers check box, and then click OK.

  7. Locate and then add the computer account for each terminal server that you want to add.

  8. When you are finished, click OK.

Additional references

  • Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker


Configure a Terminal Server to Join a Farm in TS Session Broker

You can configure a terminal server to join a farm in TS Session Broker, and to participate in TS Session Broker Load Balancing, by using Group Policy, Terminal Services Configuration, or the Terminal Services Windows Management Instrumentation (WMI) provider. However, you cannot use Group Policy to configure the following settings:

  • The IP addresses to be used for reconnection.

  • The relative server weight when using TS Session Broker Load Balancing.

For information about how to configure the settings by using Group Policy, see Configure TS Session Broker Settings by Using Group Policy. Configuring the settings by using Group Policy is a recommended best practice.

For information about how to configure the settings by using Terminal Services Configuration, see Configure TS Session Broker Settings by Using Terminal Services Configuration.

Important

Group Policy settings take precedence over configuration settings in Terminal Services Configuration and those made by using the Terminal Services WMI provider.

Additional references

  • Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker


Configure TS Session Broker Settings by Using Group Policy

You can use Group Policy to configure TS Session Broker settings. However, to configure the IP addresses to be used for reconnection, or the relative server weight when using TS Session Broker Load Balancing, you must use Terminal Services Configuration.

To assign TS Session Broker settings through Group Policy, it is a best practice to group the terminal servers that are in the same terminal server farm into a single organizational unit (OU) in Active Directory Domain Services (AD DS). Then, configure the TS Session Broker settings in a Group Policy object (GPO) that applies to the OU.

Note

For the TS Session Broker settings to be effective on a server, the server must have the Terminal Server role service installed.

The following procedure describes how to configure TS Session Broker Group Policy settings by using the Group Policy Management Console (GPMC).

Note

To manage Group Policy on a Windows Server 2008-based domain controller, you must first add the Group Policy Management Console feature. To do this, start Server Manager, and then under Feature Summary, click Add Features. On the Select Features page, select the Group Policy Management Console check box. Follow the on-screen instructions to complete the installation.

To change Group Policy settings for a domain or an OU, you must be logged on as a member of the Domain Admins, Enterprise Admins, or the Group Policy Creator Owners group, or have been delegated the appropriate control over Group Policy to complete this procedure.

To apply TS Session Broker settings to an Active Directory OU

  1. To start the GPMC, click Start, point to Administrative Tools, and then click Group Policy Management.

  2. In the left pane, locate the OU that contains the terminal servers.

  3. To modify an existing GPO for the OU, expand the OU, and then click the GPO.

    To create a new GPO, follow these steps:

    1. Right-click the OU, and then click Create a GPO in this domain, and link it here.

    2. In the Name box, type a name for the GPO, and then click OK.

    3. In the left pane, locate and then click the new GPO.

  4. In the right pane, click the Settings tab.

  5. Right-click Computer Configuration, and then click Edit.

  6. In the left pane, under Computer Configuration, expand Administrative Templates, Windows Components, Terminal Services, Terminal Server and then click TS Session Broker.

  7. In the right pane, double-click the Join TS Session Broker policy setting, click Enabled, and then click OK.

  8. Double-click the TS Session Broker Farm Name policy setting, and then do the following:

    1. Click Enabled.

    2. In the TS Session Broker farm name box, type the name of the farm in TS Session Broker that you want to join, and then click OK.

      Important

      TS Session Broker uses a farm name to determine which servers are in the same terminal server farm. You must use the same farm name for all servers that are in the same load-balanced terminal server farm. Although the farm name in TS Session Broker does not have to be registered in AD DS, it is recommended that you use the same name that you will use in DNS for the terminal server farm. (The terminal server farm name in DNS represents the virtual name that clients will use to connect to the terminal server farm.) If you type a new farm name, a new farm is created in TS Session Broker and the server is joined to the farm. If you type an existing farm name, the server joins the existing farm in TS Session Broker.

  9. Double-click the TS Session Broker Server policy setting, and then do the following:

    1. Click Enabled.

    2. In the TS Session Broker server name box, type the name of the server where you installed the TS Session Broker role service, and then click OK.

  10. To use TS Session Broker Load Balancing, double-click the TS Session Broker Load Balancing policy setting, click Enabled, and then click OK.

  11. Optionally, if you have a hardware load balancer that supports TS Session Broker token redirection, double-click Use IP Address Redirection and configure the setting. For more information, see the Group Policy Explain text and About TS Session Broker Redirection Modes.
Note

To configure TS Session Broker settings by using the local computer policy, use the Local Group Policy Editor. To start the Local Group Policy Editor, click Start, click Run, type gpedit.msc, and then click OK. To configure local Group Policy settings, you must be a member of the Administrators group on the local computer or you must have been delegated the appropriate authority.

Additional references

  • Configure a Terminal Server to Join a Farm in TS Session Broker

  • Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker


Configure TS Session Broker Settings by Using Terminal Services Configuration

You can configure a terminal server to join a farm in TS Session Broker, and to participate in TS Session Broker Load Balancing, by using Terminal Services Configuration.

Note

The following steps are only applicable if the Terminal Server role service is installed.

Membership in the local Administrators group is the minimum required to complete this procedure.

To configure TS Session Broker settings

  1. Start Terminal Services Configuration. To do this, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. In the Edit settings area, under TS Session Broker, double-click Member of farm in TS Session Broker.

  3. On the TS Session Broker tab, click to select the Join a farm in TS Session Broker check box.

  4. In the TS Session Broker server name or IP address box, type the name of the TS Session Broker server.

    Note

    The TS Session Broker server is the server where you installed the TS Session Broker role service.

  5. In the Farm name in TS Session Broker box, type the name of the farm that you want to join in TS Session Broker.

    Important

    TS Session Broker uses a farm name to determine which servers are in the same terminal server farm. You must use the same farm name for all servers that are in the same load-balanced terminal server farm. Although the farm name in TS Session Broker does not have to be registered in Active Directory Domain Services, it is recommended that you use the same name that you will use in DNS for the terminal server farm. (The terminal server farm name in DNS represents the virtual name that clients will use to connect to the terminal server farm.) If you type a new farm name, a new farm is created in TS Session Broker and the server is joined to the farm. If you type an existing farm name, the server joins the existing farm in TS Session Broker.

  6. To participate in TS Session Broker Load Balancing, select the Participate in Session Broker Load-Balancing check box.

  7. Optionally, in the Relative weight of this server in the farm box, modify the server weight. By default, the value is 100. The server weight is relative. Therefore, if you assign one server a value of 50, and one a value of 100, the server with a weight of 50 will receive half the number of sessions.

  8. Verify that you want to use IP address redirection. By default, the Use IP address redirection setting is enabled. If you clear the check box, the server switches to token redirection mode. For more information, see About TS Session Broker Redirection Modes.

  9. In the Select IP addresses to be used for reconnection box, click to select the check box next to each IP address that you want to use. When you select the IP addresses to use, consider the following:

    • Only the first selected IPv4 address will be used by clients that are running Remote Desktop Connection 5.2 and earlier.

    • Using IPv6 addresses is not recommended if the terminal server farm contains servers that are running Windows Server 2003.

  10. When you are finished, click OK.

Additional references

  • Configure a Terminal Server to Join a Farm in TS Session Broker

  • Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker


Configure DNS for TS Session Broker Load Balancing

To load balance sessions in a terminal server farm, you can use the TS Session Broker Load Balancing feature together with Domain Name System (DNS) round robin. To configure DNS, you must create a DNS host resource record for each terminal server in the farm that maps the terminal server’s IP address to the terminal server farm name in DNS.

The following procedure provides the steps to configure DNS on a Windows Server 2008-based domain controller.

You must be a member of the Domain Admins, Enterprise Admins, or the DnsAdmins group to complete this procedure.

To add DNS entries for each terminal server in the farm

  1. Click Start, point to Administrative Tools, and then click DNS.

  2. Expand the server name, expand Forward Lookup Zones, and then expand the domain name.

  3. Right-click the appropriate zone, and then click New Host (A or AAAA).

  4. In the Name (uses parent domain name if blank) box, type the terminal server farm name.

    The farm name is the virtual name that clients will use to connect to the terminal server farm. Do not use the name of an existing server. For management purposes, it is recommended that you use the same farm name that you specified when you configured the terminal servers to join a farm in TS Session Broker.

  5. In the IP address box, type the IP address of a terminal server in the farm.

  6. Click Add Host.

  7. Repeat steps three through six for each terminal server in the farm.

    Important

    You must specify the same farm name in the Name (uses parent domain name if blank) box for each DNS entry.

    For example, if you have three terminal servers in a farm named FARM1, with IP addresses of 192.168.1.20, 192.168.1.21, and 192.168.1.22, the entries would look similar to the following:

    Farm1     Host(A)     192.168.1.20
Farm1     Host(A)     192.168.1.21
Farm1     Host(A)     192.168.1.22

  8. When you are finished, click Done.
Note

By default, DNS round robin is enabled when using DNS on a Windows Server 2008-based domain controller. The Enable round robin setting is available on the Advanced tab when you view the properties of the server in DNS.

Additional references

  • Checklist: Create a Load-Balanced Terminal Server Farm by Using TS Session Broker


About TS Session Broker Redirection Modes

TS Session Broker redirection modes

TS Session Broker can use either IP address redirection or routing token redirection to redirect a client to the terminal server where their session exists. When you configure TS Session Broker settings, you can choose the client redirection mode.

IP address redirection

By default, a terminal server uses IP address redirection, where a client queries TS Session Broker and is redirected to their existing session by using the IP address of the server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to terminal servers in the farm. If clients can connect directly to the terminal servers, it is recommended that you accept the default behavior. For example, you must use IP address redirection if you use any of the following as your load-balancing solution:

  • TS Session Broker Load Balancing, using DNS round robin

  • Network Load Balancing (NLB)

  • A hardware load balancer that does not support TS Session Broker routing tokens

TS Session Broker routing token redirection

You can configure a terminal server to use TS Session Broker routing token redirection instead of IP address redirection. However, only use this mode when your network load-balancing solution supports the use of TS Session Broker routing tokens. For more information about token redirection and supported hardware load balancers, see the Session Directory and Load Balancing Using Terminal Server white paper for Windows Server 2003 (http://go.microsoft.com/fwlink/?LinkId=18379).

If you configure a terminal server to use TS Session Broker routing tokens as the redirection method, the IP address of the terminal server is not sent to the client. Instead, the IP address is embedded in a token. When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct terminal server in the farm.

If you switch to token redirection mode, you can select only one IP address for reconnection. The address that you select must meet both of the following criteria:

  • It must be the IP address of the network adapter that is connected to the load balancer.

  • It must be the address that is configured on the load balancer as the IP address for the terminal server.

Note

Only select an IPv6 address if your load-balancing solution supports the use of IPv6.

Additional references

  • Configure TS Session Broker Settings by Using Terminal Services Configuration

  • Configure TS Session Broker Settings by Using Group Policy


Terminal Server

A terminal server is the server that hosts Windows-based programs or the full Windows desktop for Terminal Services clients. Users can connect to a terminal server to run programs, to save files, and to use network resources on that server. Users can access a terminal server by using Remote Desktop Connection or by using TS RemoteApp.

The following topics are covered:

  • Overview of Terminal Server

  • Checklist: Terminal Server Installation Prerequisites

  • Checklist: Configure Terminal Server

  • Configuring Terminal Server

  • Managing Terminal Server

For more information about deploying terminal servers, see the Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?linkid=79608).


Overview of Terminal Server

The Terminal Services server role in Windows Server 2008 consists of several sub-components, referred to as "role services." One of these role services is Terminal Server.

A terminal server is the server that hosts Windows-based programs or the full Windows desktop for Terminal Services clients. Users can connect to a terminal server to run programs, to save files, and to use network resources on that server. Users can access a terminal server from within a corporate network or from the Internet by using Remote Desktop Connection or by using TS RemoteApp.

For more information about TS RemoteApp, see the Windows Server 2008 TS RemoteApp & TS Web Access page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?linkid=79609).

When a user accesses a program on a terminal server, the program execution occurs on the server. Only keyboard, mouse, and display information is transmitted over the network. Each user sees only their individual session. The session is managed transparently by the server operating system and is independent of any other client session.

If you deploy a program on a terminal server instead of on each device, there are many benefits. These include the following:

  • You can quickly deploy Windows-based programs to computing devices across an enterprise. This is especially useful when you have programs that are frequently updated, infrequently used, or difficult to manage.

  • Users can access programs that are running on a terminal server from devices such as home computers, kiosks, low-powered hardware, and operating systems other than Windows.

  • Branch office workers who need access to centralized data stores can receive better program performance by accessing a program remotely on a terminal server. Data-intensive programs sometimes do not have client/server protocols that are optimized for low-speed connections. Programs of this kind frequently perform better over a Terminal Services connection than over a typical wide area network.

For more information about deploying terminal servers, see the Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?linkid=79608).


Checklist: Terminal Server Installation Prerequisites

A terminal server is the server that hosts Windows-based programs or the full Windows desktop for Terminal Services clients. Users can connect to a terminal server to run programs, to save files, and to use network resources on that server. Users can access a terminal server by using Remote Desktop Connection or by using TS RemoteApp.

This checklist provides tasks that an administrator should perform before installing and configuring a terminal server.

Note

Installing a terminal server on an Active Directory domain controller is not recommended. For more information, see Installing Terminal Server on a Domain Controller.

Task Reference

Determine if you need a terminal server.

To allow remote connections for administrative purposes only, you do not have to install a terminal server.

For more information about remote connections for administrative purposes, see Using Remote Desktop.

Review licensing requirements for a terminal server.

Each user or computing device that connects to a terminal server must have a valid Terminal Services client access license (TS CAL).

A terminal server running Windows Server 2008 can only communicate with a Terminal Services license server running Windows Server 2008 and the license server must have Windows Server 2008 TS CALs installed.

For more information about licensing requirements for Terminal Services, see the TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79607).

Decide which programs you want to host on the terminal server.

You should install the Terminal Server role service on the computer before you install any programs that you want to make available to users. If you install the Terminal Server role service on a computer that already has programs installed, some of the existing programs may not work correctly in a multiple user environment. Uninstalling and then reinstalling the affected programs may resolve these issues.

For more information, see Install Programs on a Terminal Server.

Review information about:

  • Hardware requirements.

  • Capacity and scaling.

See the Terminal Services page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=48555).

Determine if you need to deploy a load-balanced terminal server farm.

See the TS Session Broker page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79606).

Determine the Terminal Services licensing mode that the terminal server will use.

The Terminal Services licensing mode configured on a terminal server must match the type of TS CALs available on the Terminal Services license server.

For more information about types of TS CALs, see the TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79607).

Determine how the terminal server will discover a license server.

A terminal server must be able to contact a Terminal Services license server to request TS CALs for users or computing devices that are connecting to the terminal server.

For more information about license server discovery, see the TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79607).

Determine which users will be able to remotely connect to the terminal server.

The Remote Desktop Users group on a terminal server is used to give users and groups permission to log on remotely to a terminal server.

For more information, see Configure the Remote Desktop Users Group.

Determine if the terminal server will require Network Level Authentication.

You can enhance terminal server security by providing user authentication earlier in the connection process when a client connects to a terminal server. This early user authentication method is referred to as Network Level Authentication.

For more information, see Configure the Network Level Authentication Setting for a Terminal Server.

Review information about Windows Firewall.

The installation of the Terminal Server role service changes the configuration of Windows Firewall.

For more information, see Terminal Services and Windows Firewall.


Using Remote Desktop

To allow remote connections for administrative purposes only, you do not have to install a terminal server. Instead, you enable Remote Desktop on the computer that you want to remotely administer.

Note

Remote Desktop supports only two concurrent remote connections to the computer. You do not need Terminal Services client access licenses (TS CALs) for these connections.

You can use the following procedure to enable Remote Desktop on a Windows Server 2008 computer.

Membership in the local Administrators group, or equivalent, on the computer that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable Remote Desktop

  1. Start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click either of the following, depending on your environment:

    • Allow connections from computers running any version of Remote Desktop (less secure)

    • Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)

    For more information about the two options, click the Help me choose link on the Remote tab.

  4. Click Select Users to add the users and groups that need to connect to the computer by using Remote Desktop. The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

Additional references

  • Configuring Terminal Server

  • Configure the Network Level Authentication Setting for a Terminal Server

  • Configure the Remote Desktop Users Group

  • Overview of Terminal Server

  • Checklist: Terminal Server Installation Prerequisites


Installing Terminal Server on a Domain Controller

Installing a terminal server on an Active Directory domain controller is not recommended. Allowing users to run programs on a domain controller could create security risks and performance issues.

If the Terminal Server role service is installed on a domain controller, the security settings of the domain controller will need to be adjusted to allow users remote access to the server. This remote access is controlled by the "Allow log on through Terminal Services" user rights assignment, which can be configured by using the Group Policy Management Console (GPMC).

On a domain controller, by default, only the Administrators group is granted the "Allow log on through Terminal Services" user right. To allow remote access to the terminal server for users who are not members of the Administrators group, you should grant the Remote Desktop Users group the "Allow log on through Terminal Services" user right.

For more information about using GPMC to configure user rights assignments, see the Windows Server 2008 Group Policy Management Console Help.

Note

Installing the TS Licensing role service on a domain controller is recommended in certain circumstances. If a Terminal Services license server is installed on a domain controller, terminal servers in the same domain as the license server will automatically be able to discover the license server. Because users are not connecting directly to the license server to run programs on the license server, the security risks and performance issues can be mitigated.

For more information about license server discovery and configuring TS Licensing, see the TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79607).

Additional references

  • Checklist: Terminal Server Installation Prerequisites


Terminal Services and Windows Firewall

The Windows Firewall is on by default in Windows Server 2008. Windows Firewall helps control which programs or ports can be used to communicate between the Windows Server 2008 server and other computers on the network or the Internet. To allow a program or port to communicate through Windows Firewall, an exception needs to be enabled.

If you enable Remote Desktop, Windows Firewall automatically enables the Remote Desktop exception.

When the Terminal Server role service is installed, Windows Firewall automatically enables the following exceptions:

  • Remote Desktop

  • Terminal Services

If you install other Terminal Services role services, Windows Firewall will automatically enable other exceptions. For example, when you install the TS Licensing role service, Windows Firewall enables the Terminal Services Licensing Server exception.

When you uninstall (remove) a role service from the computer, Windows Firewall automatically removes the exception for that role service.

Important

When the Terminal Server role service is uninstalled (removed), only the Terminal Services exception is removed. The Remote Desktop exception is not removed.

Use the following procedure to view Windows Firewall exceptions.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To view Windows Firewall exceptions

  1. Click Start, and then click Control Panel.

  2. Click Security, and then click Windows Firewall.

  3. Click Change Settings, and then, in the Windows Firewall Settings dialog box, click the Exceptions tab.

  4. If the check box associated with the program or port listed is selected, the Windows Firewall exception for that program or port is enabled.

    Some programs only appear in the list when the role service is installed. For example, the Terminal Services Licensing Server program only appears in the list when the TS Licensing role service is installed on the computer.

To view more detailed information about Windows Firewall settings, use the Windows Firewall with Advanced Security snap-in.

Use the following procedure to use Windows Firewall with Advanced Security.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To use the Windows Firewall with Advanced Security snap-in

  1. Click Start, point to Administrative Tools, and then click Windows Firewall with Advanced Security.

  2. To view detailed information about Windows Firewall settings, click either of the following nodes in the left pane:

    • Inbound rules

    • Outbound rules

For more information about configuring Windows Firewall, see the Windows Server 2008 Windows Firewall with Advanced Security Help.

For more information about Terminal Services-specific Windows Firewall exceptions, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Using Remote Desktop

  • Install the Terminal Server Role Service

  • Checklist: Terminal Server Installation Prerequisites


Checklist: Configure Terminal Server

A terminal server is the server that hosts Windows-based programs or the full Windows desktop for Terminal Services clients. Users can connect to a terminal server to run programs, to save files, and to use network resources on that server. Users can access a terminal server by using the Remote Desktop Connection or by using TS RemoteApp.

This checklist provides tasks that an administrator needs to complete to install and configure a terminal server.

Please note the following:

  • Installing the Terminal Server role service requires the computer to be restarted.

  • Installing a terminal server on an Active Directory domain controller is not recommended. For more information, see Installing Terminal Server on a Domain Controller.

  • You should install the Terminal Server role service on the computer before you install any programs that you want to make available to users. For more information, see Install Programs on a Terminal Server.

Task | Reference
Review prerequisites for installing a terminal server. | Checklist: Terminal Server Installation Prerequisites
Install the Terminal Server role service. | Install the Terminal Server Role Service
Configure the license settings on the terminal server. | Configure License Settings for a Terminal Server
Configure the Network Level Authentication setting for the terminal server. | Configure the Network Level Authentication Setting for a Terminal Server
Install programs on the terminal server. | Install Programs on a Terminal Server
Configure which users can remotely connect to the terminal server. | Configure the Remote Desktop Users Group

Additional references

  • Overview of Terminal Server


Configuring Terminal Server

This section provides procedures for configuring a terminal server. The following topics are covered:

  • Install the Terminal Server Role Service

  • Configure License Settings for a Terminal Server

  • Configure the Network Level Authentication Setting for a Terminal Server

  • Install Programs on a Terminal Server

  • Configure the Remote Desktop Users Group

Additional references

  • Overview of Terminal Server

  • Checklist: Terminal Server Installation Prerequisites

  • Checklist: Configure Terminal Server


Install the Terminal Server Role Service

In Windows Server 2008, you can use Server Manager to install the Terminal Server role service. For more information about other ways to install the Terminal Server role service, including by using servermanagercmd.exe, see the Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?linkid=79608).

Use the following procedure to install the Terminal Server role service by using Server Manager if Terminal Services is not already installed on the server. If Terminal Services is already installed on the server, see Install the Terminal Server role service (when Terminal Services is already installed).

Membership in the local Administrators group, or equivalent, on the terminal server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The installation of the Terminal Server role service requires the computer to be restarted.

To install the Terminal Server role service

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, right-click Roles, and then click Add Roles.

  3. In the Add Roles Wizard, on the Before You Begin page, click Next.

  4. On the Select Server Roles page, under Roles, select the Terminal Services check box.

    Note

    If Terminal Services is already installed on the server, the Terminal Services check box will be selected and dimmed.

  5. Click Next.

  6. On the Terminal Services page, click Next.

  7. On the Select Role Services page, select the Terminal Server check box, and then click Next.

    Note

    If you are installing the Terminal Server role service on a domain controller, you will receive a warning message because installing the Terminal Server role service on a domain controller is not recommended. For more information, see Installing Terminal Server on a Domain Controller.

  8. On the Uninstall and Reinstall Applications for Compatibility page, click Next.

  9. On the Specify Authentication Method for Terminal Server page, select the appropriate authentication method for the terminal server, and then click Next. For more information about authentication methods, see Configure the Network Level Authentication Setting for a Terminal Server.

  10. On the Specify Licensing Mode, select the appropriate licensing mode for the terminal server, and then click Next. For more information about licensing modes, see Specify the Terminal Services Licensing Mode.

  11. On the Select User Groups Allowed Access To This Terminal Server page, add the users or user groups that you want to be able to remotely connect to this terminal server, and then click Next. For more information, see Configure the Remote Desktop Users Group.

  12. On the Confirm Installation Selections page, verify that the Terminal Server role service will be installed, and then click Install.

  13. On the Installation Progress page, installation progress will be noted.

  14. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then click Yes to restart the server.

  15. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  16. After the server restarts and you log on to the computer, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that the installation of Terminal Server succeeded.

    You can also confirm that Terminal Server is installed by following these steps:

    1. Start Server Manager.

    2. Under Roles Summary, click Terminal Services.

    3. Under System Services, confirm that Terminal Services has a status of Running.

    4. Under Role Services, confirm that Terminal Server has a status of Installed.

Install the Terminal Server role service (when Terminal Services is already installed)

Use the following procedure to install the Terminal Server role service when Terminal Services is already installed on the server.

Membership in the local Administrators group, or equivalent, on the terminal server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The installation of the Terminal Server role service requires the computer to be restarted.

To install the Terminal Server role service when Terminal Services is already installed

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, expand Roles.

  3. Right-click Terminal Services, and then click Add Role Services.

  4. On the Select Role Services page, select the Terminal Server check box, and then click Next.

    Note

    If you are installing the Terminal Server role service on a domain controller, you will receive a warning message because installing the Terminal Server role service on a domain controller is not recommended. For more information, see Installing Terminal Server on a Domain Controller.

  5. On the Uninstall and Reinstall Applications for Compatibility page, click Next.

  6. On the Specify Authentication Method for Terminal Server page, select the appropriate authentication method for the terminal server, and then click Next. For more information about authentication methods, see Configure the Network Level Authentication Setting for a Terminal Server.

  7. On the Specify Licensing Mode, select the appropriate licensing mode for the terminal server, and then click Next. For more information about licensing modes, see Specify the Terminal Services Licensing Mode.

  8. On the Select User Groups Allowed Access To This Terminal Server page, add the users or user groups that you want to be able to remotely connect to this terminal server, and then click Next. For more information, see Configure the Remote Desktop Users Group.

  9. On the Confirm Installation Selections page, verify that the Terminal Server role service will be installed, and then click Install.

  10. On the Installation Progress page, installation progress will be noted.

  11. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then click Yes to restart the server.

  12. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  13. After the server restarts and you log on to the computer, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that the installation of Terminal Server succeeded.

    You can also confirm that Terminal Server is installed by following these steps:

    1. Start Server Manager.

    2. Under Roles Summary, click Terminal Services.

    3. Under System Services, confirm that Terminal Services has a status of Running.

    4. Under Role Services, confirm that Terminal Server has a status of Installed.

Additional references

  • Configuring Terminal Server

  • Overview of Terminal Server

  • Checklist: Terminal Server Installation Prerequisites

  • Checklist: Configure Terminal Server


Configure License Settings for a Terminal Server

Each user or computing device that connects to a terminal server must have a valid Terminal Services client access license (TS CAL) issued by a Terminal Services license server.

To ensure that a terminal server can contact (discover) a Terminal Services license server to request TS CALs for clients, you need to do the following on the terminal server:

  • Specify the Terminal Services Licensing Mode

  • Specify the License Server Discovery Mode

Additional references

  • Configuring Terminal Server

  • Checklist: Terminal Server Installation Prerequisites


Specify the Terminal Services Licensing Mode

The Terminal Services licensing mode determines the type of Terminal Services client access licenses (TS CALs) that a terminal server will request from a license server on behalf of a client connecting to the terminal server.

Important

The Terminal Services licensing mode configured on a terminal server must match the type of TS CALs available on the license server.

There are two types of TS CALs:

  • TS Per Device CALs, which permits one device (used by any user) to connect to a terminal server.

  • TS Per User CALs, which gives one user the right to access terminal servers from an unlimited number of client computers or devices.

The Terminal Services licensing mode for the terminal server can be set in the following ways:

  • During the installation of the Terminal Server role service in Server Manager, on the Specify Licensing Mode page in the Add Roles Wizard.

    On the Specify Licensing Mode page, you can select Configure later if you are unsure during the installation whether to select Per Device or Per User. If you select Configure later, each time you log on to the terminal server, a message will appear in the lower-right corner of the desktop reminding you that you need to configure the licensing mode for the terminal server.

  • By configuring the Terminal Services licensing mode for the terminal server by using the Terminal Services Configuration tool.

    If the Specify the Terminal Services licensing mode choices are dimmed and you cannot make a selection, the Set Terminal Services licensing mode Group Policy setting has been enabled and has been applied to the terminal server.

  • By applying the Set Terminal Services licensing mode Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration.

For more information about TS CALs and configuring TS Licensing, see the TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79607).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configure License Settings for a Terminal Server


Specify the License Server Discovery Mode

A terminal server must be able to contact (discover) a Terminal Services license server in order to request Terminal Services client access licenses (TS CALs) for users or computing devices that are connecting to the terminal server.

The license server discovery mode for the terminal server can be set in the following ways:

  • By configuring License Server discovery mode for the terminal server in the Terminal Services Configuration tool.

    If the Specify the license server discovery mode choices are dimmed and you cannot make a selection, the Use the specified Terminal Services license servers Group Policy setting has been enabled and has been applied to the terminal server.

  • By applying the Use the specified Terminal Services license servers Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration.

In the license server discovery process, a terminal server in a Windows Server-based domain attempts to contact a license server in the following order:

  • License servers that are specified in Terminal Services Configuration

  • A license server that is installed on the same computer as the terminal server

  • License servers that are published in Active Directory Domain Services

  • License servers that are installed on domain controllers in the same domain as the terminal server

Important

To see which license servers the terminal server discovers and to be alerted to possible licensing discovery and configuration issues, use Licensing Diagnosis in Terminal Services Configuration. For information about Licensing Diagnosis, see the topic "Identify Possible Licensing Problems for the Terminal Server" in the Windows Server 2008 Terminal Services Configuration Help.

For more information about license server discovery and configuring TS Licensing, see the TS Licensing page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79607).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configure License Settings for a Terminal Server


Configure the Network Level Authentication Setting for a Terminal Server

You can enhance terminal server security by providing user authentication earlier in the connection process when a client connects to a terminal server. This early user authentication method is referred to as Network Level Authentication.

Network Level Authentication is a new authentication method that completes user authentication before you establish a Remote Desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer from malicious users and malicious software. The advantages of Network Level Authentication are:

  • It requires fewer remote computer resources initially. The remote computer uses a limited number of resources before authenticating the user, rather than starting a full Remote Desktop connection as in previous versions.

  • It can help provide better security by reducing the risk of denial-of-service attacks.

To use Network Level Authentication, you need to meet all of the following requirements:

  • On the client computer, be using at least Remote Desktop Connection 6.0.

  • On the client computer, be using an operating system, such as Windows Vista, that supports the Credential Security Support Provider (CredSSP) protocol.

  • On the terminal server, be using Windows Server 2008.

You can configure a terminal server to only support connections from clients running Network Level Authentication. The Network Level Authentication setting for a terminal server can be set in the following ways:

  • During the installation of the Terminal Server role service in Server Manager, on the Specify Authentication Method for Terminal Server page in the Add Roles Wizard.

  • On the Remote tab in the System Properties dialog box on a terminal server.

    If the Allow connections from computers running any version of Remote Desktop (less secure) is not selected and is dimmed, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the terminal server.

    To configure the Network Level Authentication setting by using the Remote tab in the System Properties dialog box on a terminal server, see Change Remote Connection Settings.

  • On the General tab of the Properties dialog box for a connection in the Terminal Services Configuration tool by selecting the Allow connections only from computers running Remote Desktop with Network Level Authentication check box.

    If the Allow connections only from computers running Remote Desktop with Network Level Authentication check box is selected and is dimmed, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the terminal server.

  • By applying the Require user authentication for remote connections by using Network Level Authentication Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Terminal Services Configuration or on the Remote tab.

To determine whether a computer is running a version of Remote Desktop Connection that supports Network Level Authentication, start Remote Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. Look for the phrase "Network Level Authentication supported" in the About Remote Desktop Connection dialog box.

For more information about security and Terminal Services, see the Terminal Services page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=48555).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configuring Terminal Server

  • Install the Terminal Server Role Service


Install Programs on a Terminal Server

You should install the Terminal Server role service on the computer before you install any programs that you want to make available to users. If you install the Terminal Server role service on a computer that already has programs installed, some of the existing programs may not work correctly in a multiple user environment. Uninstalling and then reinstalling the affected programs may resolve these issues.

To ensure that an application is installed correctly to work in a multiple user environment, you must put the terminal server into a special installation mode before you install the application on the terminal server. This special installation mode ensures that the correct registry entries and .ini files that are needed to support running the application in a multiple user environment are created during the installation process.

You can put a terminal server into this special installation mode by using either of the following:

  • Install Application on Terminal Server tool under Programs in Control Panel. This tool will run a wizard to help install the application.

  • Change user /install command at a command prompt. You will have to start the installation of the application manually.

After the application is installed, you must put the terminal server into execution mode before remote users begin using the application. The Install Application on Terminal Server tool will automatically put the terminal server into execution mode when it is finished running. To put the terminal server into execution mode from a command prompt, use the change user /execute command.

Additional considerations

  • Some programs may require minor setup modifications to run correctly on a terminal server.

  • If you have programs that are related to each other or have dependencies on each other, you should install the programs on the same terminal server. For example, you should install Microsoft Office as a suite on the same terminal server instead of installing individual Office programs on separate terminal servers.

  • You should consider installing individual programs on separate terminal servers in the following circumstances:

    • The program has compatibility issues that may affect other programs.

    • A single program and the number of associated users may fill server capacity.

  • For more information about the change user command-line tool, see the Terminal Services Command Reference (http://go.microsoft.com/fwlink/?LinkId=89674).

  • For more information about deploying programs on a terminal server, see the Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79608).

Additional references

  • Configuring Terminal Server


Configure the Remote Desktop Users Group

The Remote Desktop Users group on a terminal server is used to give users and groups permission to remotely connect to a terminal server.

You can add users and groups to the Remote Desktop Users group in the following ways:

  • Local Users and Groups snap-in

  • Active Directory Users and Computers snap-in, if the terminal server is installed on a domain controller

  • On the Remote tab in the System Properties dialog box on a terminal server

You can use the following procedure to add users and groups to the Remote Desktop Users group by using the Remote tab in the System Properties dialog box on a terminal server.

Membership in the local Administrators group, or equivalent, on the terminal server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To add users and groups to the Remote Desktop Users group by using the Remote tab

  1. Start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click Select Users. Add the users or groups that need to connect to the terminal server by using Remote Desktop. The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

    If you select Don't allow connections to this computer on the Remote tab, no users will be able to connect remotely to this computer, even if they are members of the Remote Desktop Users group.

Additional references

  • Configuring Terminal Server


Managing Terminal Server

This section provides procedures for managing a terminal server. The following topics are covered:

  • Change Remote Connection Settings

  • Enable Single Sign-On for Terminal Services

  • Manage User Profiles for Terminal Services

  • Install Desktop Experience on a Terminal Server

  • Configure Font Smoothing for Remote Sessions

  • Monitor a Terminal Server with Windows System Resource Manager

  • Uninstall the Terminal Server Role Service


Change Remote Connection Settings

You can use the following procedure to change the remote connection settings on a terminal server.

On the Remote tab in the System Properties dialog box on the terminal server you can change the following remote connection settings:

  • Network Level Authentication requirement for Remote Desktop connections

  • Membership of the Remote Desktop Users group

Membership in the local Administrators group, or equivalent, on the terminal server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To change remote connections settings

  1. Start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click either of the following, depending on your environment:

    • Allow connections from computers running any version of Remote Desktop (less secure)

    • Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)

    For more information about the two options, click the Help me choose link on the Remote tab.

    On the Remote tab, if you select Don't allow connections to this computer, no users will be able to connect remotely to this computer, even if they are members of the Remote Desktop Users group.

  4. Click Select Users to add the users and groups that need to connect to the computer by using Remote Desktop. The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

Additional references

  • Managing Terminal Server

  • Configure the Network Level Authentication Setting for a Terminal Server

  • Configure the Remote Desktop Users Group


Enable Single Sign-On for Terminal Services

Single sign-on is an authentication method that allows users with a domain account to log on once, by using a password or smart card, and then gain access to remote servers without being asked for their credentials again.

To implement single sign-on functionality in Terminal Services, ensure that you meet the following requirements:

  • You can only use single sign-on for remote connections from a computer running Windows Vista to a terminal server running Windows Server 2008. You can also use single sign-on for remote connections from one server running Windows Server 2008 server to another server running Windows Server 2008.

  • Ensure that the user accounts that are used for logging on have appropriate rights to log on to both the terminal server and the Windows Vista client computer.

  • Your client computer and terminal server must be joined to a domain.

To configure the recommended settings for your terminal server, complete the following steps:

  • Configure authentication on the terminal server.

  • Configure the computer running Windows Vista to allow default credentials to be used for logging on to the specified terminal servers.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure authentication on the terminal server

  1. Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, point to Administrative Tools, point to Terminal Services, and then click Terminal Services Configuration.

  2. Under Connections, right-click the appropriate connection (for example, RDP-Tcp), and then click Properties.

  3. In the Properties dialog box, on the General tab, verify that the Security Layer value is set to either Negotiate or SSL (TLS 1.0).

  4. On the Log on Settings tab, ensure that the Always prompt for password check box is not selected, and then click OK.
To allow default credential usage for single sign-on

  1. On the Windows Vista-based computer, open Local Group Policy Editor. To open Local Group Policy Editor, click Start, and in the Start Search box, type gpedit.msc and then press ENTER.

  2. In the left pane, expand the following: Computer Configuration, Administrative Templates, System, and then click Credentials Delegation.

  3. Double-click Allow Delegating Default Credentials.

  4. In the Properties dialog box, on the Setting tab, click Enabled, and then click Show.

  5. In the Show Contents dialog box, click Add to add servers to the list.

  6. In the Add Item dialog box, in the Enter the item to be added box, type the prefix termsrv/ followed by the name of the terminal server; for example, termsrv/Server1, and then click OK.

  7. Click OK to close the Properties dialog box.

For more information about security and Terminal Services, see the Terminal Services page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=48555).

Additional references

  • Managing Terminal Server


Manage User Profiles for Terminal Services

A user profile describes the configuration for a specific user, including the user’s environment and preference settings. Unless you carefully plan and manage user profiles in a terminal server environment, user profiles can become large in size and can cause problems, such as slow logon times, when a user connects to a terminal server. User profile management is also important when users connect to several different terminal servers or connect to terminal servers in remote locations.

You can specify a Terminal Services-specific profile path and home folder for a user connecting to a terminal server. This profile and home folder will only be used for Terminal Services sessions. You should assign a separate profile for Terminal Services sessions because many of the common options that are stored in profiles, such as screen savers and animated menu affects, are not desirable when using Terminal Services.

You can manually configure these settings on the Terminal Services Profile tab on the Properties sheet of a user account in the Local Users and Groups snap-in or the Active Directory Users and Computers snap-in.

You can also use the following Group Policy settings to configure these settings:

  • Set TS User Home Directory

  • Set path for TS Roaming Profiles

  • Use mandatory profiles on the terminal server

The Group Policy settings can be found in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Profiles and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about implementing user profiles for users connecting to a terminal server, see the Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkId=79608).

For more information about Group Policy settings for Terminal Services, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Managing Terminal Server


Install Desktop Experience on a Terminal Server

When a user uses Remote Desktop Connection to connect to a terminal server, the desktop that exists on the terminal server is reproduced, by default, in the remote session. To make the remote session look and feel more like the user's local Windows Vista desktop experience, install the Desktop Experience feature on a Windows Server 2008 terminal server. Desktop Experience installs applications and features of Windows Vista, such as Windows Media Player, Windows Defender, and Windows Calendar.

Install Desktop Experience

Use the following procedure to install Desktop Experience on the server.

Membership in the local Administrators group, or equivalent, on the terminal server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The installation of Desktop Experience requires the computer to be restarted.

To install Desktop Experience

  1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.

  2. Under Features Summary, click Add Features.

  3. On the Select Features page, select the Desktop Experience check box, and then click Next.

  4. On the Confirm Installation Selections page, verify that the Desktop Experience feature will be installed, and then click Install.

  5. On the Installation Progress page, installation progress will be noted.

  6. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then click Yes to restart the server.

  7. After the server restarts and you log on to the computer, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that the installation of Desktop Experience succeeded.

    You can also confirm that Desktop Experience is installed by following these steps:

    1. Start Server Manager.

    2. Under Features Summary, confirm that Desktop Experience is listed as installed.

After you install Desktop Experience, the Windows Vista applications, such as Windows Calendar, will appear under All Programs on the Start menu.

For more information about configuring the look and feel of remote sessions, see the Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?linkid=79608).

Uninstall (Remove) Desktop Experience

Use the following procedure to uninstall (remove) Desktop Experience from the server.

Membership in the local Administrators group, or equivalent, on the terminal server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The removal of Desktop Experience from the server requires the computer to be restarted.

To uninstall (remove) Desktop Experience

  1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.

  2. Under Features Summary, click Remove Features.

  3. On the Select Features page, clear the Desktop Experience check box, and then click Next.

  4. On the Confirm Removal Selections page, click Remove.

  5. On the Removal Progress page, removal progress will be noted.

  6. On the Removal Results page, you are prompted to restart the server to finish the removal process. Click Close, and then click Yes to restart the server.

  7. After the server restarts and you log on to the computer, the remaining steps of the removal process will finish. When the Removal Results page appears, confirm that the removal of Desktop Experience succeeded.

    You can also confirm that Desktop Experience is removed by following these steps:

    1. Start Server Manager.

    2. Under Features Summary, confirm that Desktop Experience is no longer listed as installed.

Additional references

  • Managing Terminal Server


Configure Font Smoothing for Remote Sessions

Windows Server 2008 supports ClearType®, which is a technology for displaying computer fonts so that they appear clear and smooth, especially when you are using an LCD monitor.

A Windows Server 2008 terminal server can provide ClearType functionality in a remote session when a client computer connects to the Windows Server 2008 terminal server by using Remote Desktop Connection.

Note

ClearType functionality is referred to as font smoothing in Remote Desktop Connection.

Font smoothing is available if the client computer is running any of the following:

  • Windows Vista

  • Windows Server 2003 with SP1 and at least Remote Desktop Connection 6.0

  • Windows XP with SP2 and at least Remote Desktop Connection 6.0

Important

Using font smoothing in a remote session will increase the amount of bandwidth used between the client computer and the Windows Server 2008 terminal server.

To make font smoothing available for a remote session, follow this procedure on the client computer.

To make font smoothing available in a remote session

  1. Open Remote Desktop Connection. To open Remote Desktop Connection on Windows Vista, click Start, point to All Programs, click Accessories, and then click Remote Desktop Connection.

  2. In the Remote Desktop Connection dialog box, click Options.

  3. On the Experience tab, select the Font smoothing check box.

  4. Configure any remaining connection settings, and then click Connect.

Additional references

  • Managing Terminal Server


Monitor a Terminal Server with Windows System Resource Manager

Windows System Resource Manager (WSRM) on Windows Server 2008 allows you to control how CPU and memory resources are allocated to applications, services, and processes on the computer. Managing resources in this way improves system performance and reduces the chance that applications, services, or processes will take CPU or memory resources away from one another and slow down the performance of the computer. Managing resources also creates a more consistent and predictable experience for users of applications and services running on the computer.

You can use WSRM to manage multiple applications on a single computer or users on a computer on which Terminal Services is installed.

Install the Terminal Server role service on your computer before installing and configuring WSRM. To install WSRM, go to Features in Server Manager.

For more information about installing, configuring, and using WSRM, see the Windows Server 2008 Windows System Resource Manager Help.

There are two features of WSRM that will be of particular interest to terminal server administrators:

  • Resource-Allocation Policies

  • Resource Monitor

Resource-Allocation Policies

WSRM uses resource-allocation policies to determine how computer resources, such as CPU and memory, are allocated to processes running on the computer. There are two resource-allocation policies that are specifically designed for computers running Terminal Services. The two Terminal Services-specific resource-allocation policies are:

  • Equal_Per_User

  • Equal_Per_Session

Note

The Equal_Per_Session resource-allocation policy is new for Windows Server 2008.

If you implement the Equal_Per_Session resource-allocation policy, each user session (and its associated processes) gets an equal share of the CPU resources on the computer.

Resource Monitor

You should collect data about the performance of your terminal server before and after implementing the Equal_Per_Session resource-allocation policy (or making any other WSRM-related configuration changes). You can use Resource Monitor in the Windows System Resource Manager snap-in to collect and view data about the usage of hardware resources and the activity of system services on the computer.

Additional references

  • Managing Terminal Server


Uninstall the Terminal Server Role Service

Use the following procedure to uninstall (remove) the Terminal Server role service from the server.

Membership in the local Administrators group, or equivalent, on the terminal server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The removal of the Terminal Server role service from the server requires the computer to be restarted.

To uninstall (remove) the Terminal Server role service

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, expand Roles.

  3. Right-click Terminal Services, and then click Remove Role Services.

  4. On the Select Role Services page, clear the Terminal Server check box, and then click Next.

  5. On the Confirm Removal Selections page, click Remove.

  6. On the Removal Progress page, removal progress will be noted.

  7. On the Removal Results page, you are prompted to restart the server to finish the removal process. Click Close, and then click Yes to restart the server.

  8. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  9. After the server restarts and you log on to the computer, the remaining steps of the removal process will finish. When the Removal Results page appears, confirm that the removal of Terminal Server succeeded.

    You can also confirm that Terminal Server is removed by following these steps:

    1. Start Server Manager.

    2. Under Roles Summary, click Terminal Services.

    3. Under Role Services, confirm that Terminal Server has a status of Not Installed.

Additional references

  • Managing Terminal Server