Terminal Services User Properties

You can configure Terminal Services-specific user account properties by using the Local Users and Groups snap-in or the Active Directory Users and Computers snap-in.

The Terminal Services Extension adds Terminal Services-specific tabs to the Properties sheet of a user account in Local Users and Groups or Active Directory Users and Computers. The Terminal Services-specific tabs are:

  • Remote Control

  • Terminal Services Profile

  • Environment

  • Sessions

For more information about Terminal Services, see the Terminal Services page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?Linkid=48555).

Additional references

  • Add the Terminal Services Extension

  • Configuring Terminal Services User Properties

  • User Interface: Terminal Services User Properties


Configuring Terminal Services User Properties

This section provides information about configuring Terminal Services-specific user account properties. The following topics are covered:

  • Understanding Terminal Services User Properties

  • Add the Terminal Services Extension

  • Using Group Policy Settings


Understanding Terminal Services User Properties

You can configure Terminal Services-specific user account properties by using the Local Users and Groups snap-in or the Active Directory Users and Computers snap-in. The Terminal Services-specific user account properties that you can configure are the following:

  • Remote Control

  • Terminal Services Profile

  • Environment

  • Sessions

You can also configure many of these Terminal Services-specific properties by using either of the following:

  • Terminal Services Configuration snap-in

  • Terminal Services-specific Group Policy settings

You can use Terminal Services Configuration to configure per-connection settings on a terminal server. You can configure the following settings by using Terminal Services Configuration:

  • Remote Control

  • Environment

  • Sessions

Settings configured by using Terminal Services Configuration will take precedence over the user account properties that have been configured in Local Users and Groups or Active Directory Users and Computers.

There are additional per-connection settings that can be configured by using Terminal Services Configuration. For more information about configuring per-connection settings by using Terminal Services Configuration, see the topic "Configuring Terminal Services Connections" in the Windows Server 2008 Terminal Services Configuration Help.

For information about configuring Terminal Services-specific properties by using Group Policy settings, see Using Group Policy Settings.

Additional references

  • Configuring Terminal Services User Properties


Add the Terminal Services Extension

The Terminal Services Extension can be added to the Local Users and Groups snap-in or to the Active Directory Users and Computers snap-in.

The Terminal Services Extension adds Terminal Services-specific tabs to the Properties sheet of a user account. The Terminal Services-specific tabs are:

  • Remote Control

  • Terminal Services Profile

  • Environment

  • Sessions

To add the Terminal Services Extension to Local Users and Groups

  1. Open Microsoft Management Console. To open Microsoft Management Console, click Start, click Run, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, in the Available snap-ins list, select Local Users and Groups, and then click Add.

  4. In the Choose Target Machine dialog box, select the computer that you want Local Users and Groups to manage, and then click Finish.

  5. In the Selected snap-ins list, select Local Users and Groups, and then click Edit Extensions.

  6. In the Extensions for Local Users and Groups dialog box, do one of the following:

    • Select Always enable all available extensions. This is the default setting. The Terminal Services - Extension check box will be automatically selected.

    • Select Enable only selected extensions and select the Terminal Services - Extension check box.

  7. Click OK, and then click OK to close the Add or Remove Snap-ins dialog box.
To add the Terminal Services Extension to Active Directory Users and Computers

  1. Open Microsoft Management Console. To open Microsoft Management Console, click Start, click Run, type mmc, and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, in the Available snap-ins list, select Active Directory Users and Computers, and then click Add.

  4. In the Selected snap-ins list, select Active Directory Users and Computers, and then click Edit Extensions.

  5. In the Extensions for Active Directory Users and Computers dialog box, do one of the following:

    • Select Always enable all available extensions. This is the default setting. The Terminal Services - Extension check box will be automatically selected.

    • Select Enable only selected extensions and select the Terminal Services - Extension check box.

  6. Click OK, and then click OK to close the Add or Remove Snap-ins dialog box.

Additional references

  • Configuring Terminal Services User Properties


Using Group Policy Settings

Terminal Services-specific Group Policy settings can be used to automate the application of a standard configuration to one or more terminal servers or to a group of users. Terminal Services-specific Group Policy settings can be found in the following locations in either the Local Group Policy Editor or the Group Policy Management Console (GPMC):

  • Computer Configuration\Administrative Templates\Windows Components\Terminal Services

  • User Configuration\Administrative Templates\Windows Components\Terminal Services

Terminal Services settings configured by using Group Policy take precedence over the following:

  • User account properties that have been configured in the Local Users and Groups snap-in or the Active Directory Users and Computers snap-in

  • Per-connection settings configured by using the Terminal Services Configuration snap-in

The following is a list of some of the Terminal Services-specific Group Policy settings that are related to the Terminal Services settings that can be configured on a user account.

Group Policy setting name Group Policy setting location

Set TS User Home Directory

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Profiles

Set path for TS Roaming User Profile

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Profiles

Start a program on connection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Remote Session Environment

User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Remote Session Environment

Do not allow drive redirection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Device and Resource Redirection

Do not allow client printer redirection

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Printer Redirection

Set time limit for disconnected sessions

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

Set time limit for active but idle Terminal Services sessions

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

Set time limit for active Terminal Services sessions

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

Terminate session when time limits are reached

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits

Set rules for remote control of Terminal Services user sessions

Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections

User Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections

For more information about Terminal Services-specific Group Policy settings, see the Terminal Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=89673).

Additional references

  • Configuring Terminal Services User Properties


User Interface: Terminal Services User Properties

The Terminal Services Extension adds the following tabs to the Properties sheet of a user account in the Local Users and Groups snap-in and the Active Directory Users and Computers snap-in:

  • <UserAccount> Properties: Remote Control Tab

  • <UserAccount> Properties: Terminal Services Profile Tab

  • <UserAccount> Properties: Environment Tab

  • <UserAccount> Properties: Sessions Tab


<UserAccount> Properties: Remote Control Tab

The Remote Control tab allows you to configure the remote control settings for a user's Terminal Services session.

Item | Details
Enable remote control | Select if you want to observe or actively control the user's Terminal Services session. If you want to remote control the user's session without the user's permission, clear the Require user's permission check box.
Level of control | Specify the level of control that you want to have over a user's session. If you select Interact with the session, you will be able to input keyboard and mouse actions to the session.

Additional considerations

  • Membership in Administrators, or equivalent, is the minimum required to configure the properties of a local user account.

  • Membership in Account Operators, or equivalent, is the minimum required to configure the properties of most domain user accounts. In some cases, membership in Domain Admins, or equivalent, is the minimum required.

  • Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

  • For more information about remotely controlling a user session on a terminal server, see the topic "Remotely Control a User Session" in the Windows Server 2008 Terminal Services Manager Help.

  • You can use Terminal Services Configuration to configure remote control settings on a per-connection basis on a terminal server. Remote control settings configured by using Terminal Services Configuration will take precedence over the remote control settings that have been configured for a specific user account.

  • For information about configuring remote control settings on a per-connection basis on a terminal server by using Terminal Services Configuration, see the topic "Configuring Terminal Services Connections" in the Windows Server 2008 Terminal Services Configuration Help.

  • For information about configuring remote control settings by using Group Policy settings, see Using Group Policy Settings.

Additional references

  • User Interface: Terminal Services User Properties

  • Terminal Services User Properties


<UserAccount> Properties: Terminal Services Profile Tab

The Terminal Services Profile tab allows you to configure the user profile environment for when a user remotely connects to a terminal server.

Item | Details
Profile Path | Specify the profile path assigned to the user when the user connects to a terminal server. Assign the user a separate profile for Terminal Services sessions. Many of the common options that are stored in profiles, such as screen savers and animated menu affects, are not desirable when using Terminal Services.
Terminal Services Home Folder | Specify a path to a home folder to be used for Terminal Services sessions. The folder can be either a local folder or a network share.
Deny this user permissions to log on to Terminal Server | Specify if the user can connect to terminal servers. Even if this check box is cleared, the user still needs to be given permission to connect to a terminal server. The Remote Desktop Users group on the terminal server is used to give users and groups permission to log on remotely to a terminal server.

Additional considerations

  • Membership in Administrators, or equivalent, is the minimum required to configure the properties of a local user account.

  • Membership in Account Operators, or equivalent, is the minimum required to configure the properties of most domain user accounts. In some cases, membership in Domain Admins, or equivalent, is the minimum required.

  • Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

  • If you do not configure a profile path or a home folder on the Terminal Services Profile tab, the settings configured on the Profile tab will be used, even for remote connections. If settings are configured on both tabs, the settings configured on the Terminal Services Profile tab will take precedence over the settings configured on the Profile tab for remote connections.

  • For information about configuring profile settings by using Group Policy settings, see Using Group Policy Settings.

  • For more information about implementing user profiles for users connecting to a terminal server, see the Terminal Server page on the Windows Server 2008 TechCenter (http://go.microsoft.com/fwlink/?LinkID=79608).

Additional references

  • User Interface: Terminal Services User Properties

  • Terminal Services User Properties


<UserAccount> Properties: Environment Tab

The Environment tab allows you to configure the startup environment for a Terminal Services client.

Item Details

Starting program

Specify the program that will open whenever the user connects to a terminal server. The program specified will be the only program that can be used by the user in the Terminal Services session. When the user closes the program, the connection to the terminal server will close.

If you want to provide a working folder, specify the folder location in the Start in box.

Client devices

Specify whether the user's local drives and printers will be available in the Terminal Services session when a user connects to a terminal server.

The Connect client drives at logon check box currently is not used by Windows Server Terminal Services.

If the user has multiple local printers configured, you can direct print jobs in the Terminal Services session to the default printer on the user's local computer by selecting Default to main client printer.

Additional considerations

  • Membership in Administrators, or equivalent, is the minimum required to configure the properties of a local user account.

  • Membership in Account Operators, or equivalent, is the minimum required to configure the properties of most domain user accounts. In some cases, membership in Domain Admins, or equivalent, is the minimum required.

  • Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

  • You can use Terminal Services Configuration to configure environment settings on a per-connection basis on a terminal server. Environment settings configured by using Terminal Services Configuration will take precedence over the environment settings that have been configured for a specific user account.

  • For information about configuring environment settings on a per-connection basis on a terminal server by using Terminal Services Configuration, see the topic "Configuring Terminal Services Connections" in the Windows Server 2008 Terminal Services Configuration Help.

  • For information about configuring environment settings by using Group Policy settings, see Using Group Policy Settings.

Additional references

  • User Interface: Terminal Services User Properties

  • Terminal Services User Properties


<UserAccount> Properties: Sessions Tab

The Sessions tab allows you to configure the timeout and reconnection settings for Terminal Services sessions.

Item Details

End a disconnected session

Specify the maximum amount of time that a disconnected user session is kept active on the terminal server. If you specify "Never," the user's disconnected session is maintained for an unlimited time.

When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected.

Active session limit

Specify the maximum amount of time that the user's Terminal Services session can be active before the session is automatically disconnected or ended.

The user receives a warning two minutes before the Terminal Services session is disconnected or ended, which allows the user to save open files and close programs.

Idle session limit

Specify the maximum amount of time that an active Terminal Services session can be idle (without user input) before the session is automatically disconnected or ended.

The user receives a warning two minutes before the session is disconnected or ended, which allows the user to press a key or move the mouse to keep the session active.

When a session limit is reached or connection is broken

Specify whether to disconnect or end the user's Terminal Services session when an active session limit or an idle session limit is reached.

If the user's session is disconnected, the programs that the user is running are kept active even though the user is no longer actively connected.

If the user's session is ended, the user will need to establish a new Terminal Services session with a terminal server.

Allow reconnection

Specify whether the user can reconnect from any computer to a disconnected session on a terminal server.

The From originating client only option currently is not used by Windows Server Terminal Services.

Additional considerations

  • Membership in Administrators, or equivalent, is the minimum required to configure the properties of a local user account.

  • Membership in Account Operators, or equivalent, is the minimum required to configure the properties of most domain user accounts. In some cases, membership in Domain Admins, or equivalent, is the minimum required.

  • Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

  • You can use Terminal Services Configuration to configure session timeout settings on a per-connection basis on a terminal server. Session timeout settings configured by using Terminal Services Configuration will take precedence over the session timeout settings that have been configured for a specific user account.

  • For information about configuring timeout and reconnection settings on a per-connection basis on a terminal server by using Terminal Services Configuration, see the topic "Configuring Terminal Services Connections" in the Windows Server 2008 Terminal Services Configuration Help.

  • For information about configuring timeout and reconnection settings by using Group Policy settings, see Using Group Policy Settings.

Additional references

  • User Interface: Terminal Services User Properties

  • Terminal Services User Properties