Windows Server 2003 - Terminal Services Group Policies

Introduction to Terminal Services - Group Policies

If you intend to be serious about Microsoft's Terminal Services then invest time to configure Group Policies.  In fact, choosing your Terminal Server settings will be both fun and a labour of love.  Perhaps you already use Windows Server 2003's Group Policy to control the XP experience?  If so, then configuring the remote desktop will follow on naturally.

Topics for Terminal Services - Group Policies

Getting Started with GPMC
Guy's top 5 Terminal Service Group Policies
\(Root) - 15 Policies
\Client Server Data Redirection
\Encryption and Security
\Licensing
\Temporary Folders
\Client
\Session Directory
\Sessions

Getting Started with GPMC

Assumption: that you have Windows Server 2003 and have downloaded the marvellous Group Policy Management Console (GPMC) from Microsoft's site.

Most of the Terminal Services Group Policies are found under the Computer Configuration.  Whilst some settings are also available under User Configuration, my first piece of advice is just use the Computer Configuration Group Polices for Terminal Services.  My reasoning is keep it simple, and keep all the settings in one place.

Many of these Group Policies can also be controlled via the Terminal Services Configuration Snap-in, a classic case of Microsoft providing two (three) ways of doing everything.  So, my suggestion is to have both the GPMC and the Terminal Services Configuration menus available.

Guy's top 5 Terminal Service Group Policies

About half of the Group Policies are only needed for special situations, such as Microsoft clustering or running Remote Desktop from PDAs.  I have indicated where settings would not be needed if you have a standard configuration of Terminal Services.  However, I have selected 5 Group Policies which you should consider for any Windows Server 2003 configuration.

• Set path for TS Roaming Profiles*
• Terminal Server Fallback printer driver behavior*
• License Server Security Group*
• Set time limit for disconnected sessions*

• Sets a time limit for active but idle Terminal Services sessions*

If you are interested in cost effective Thin Client check out the experts: 2X (Guy's Recommendation)

2X ThinClientServer allows you to deploy a thin client OS to low-cost thin client devices and existing PCs, and centrally manage settings and configure to which terminal servers (Windows or Linux) a user should log on to. More on 2X ThinClientServer

2X LoadBalancer for Windows Terminal Services Provides load balancing, increased security and redundancy for Terminal Servers.

Assumption:

You have access to the Windows 2003 Server, and you have opened the GPMC (Group Policy Management Console).  From there you edit the Group Policy.  See screen shot above showing Terminal Services Group Policy.

 

\(Root) - 15 Policies
Keep Alive Connections	Specifies whether persistent connections are allowed. By default, keep-alive connections are disabled. The idea is to ensure that the session state on the server is consistent with the client state.
Automatic Reconnection	By default, the Terminal Server tries twenty reconnections at five second intervals.  This setting is also available at the Experience tab in Remote Desktop Connection. Users can choose 'Reconnect if connection is dropped'.
Restrict Terminal Services users to a single remote session	This setting is nailed down by default.  It is a good idea to keep it not configured, in which case the default on the Terminal Server takes over.  You need a really good reason to Disable this setting.
Enforce Removal of Remote Desktop Wallpaper	Useful for slow connections.
Deny log off of an administrator logged in to the console session	There is a concept of session 0.  If one administrator has control of the terminal server console they may not want another server to log them off session 0.  Tentatively suggest enable.  Make sure you check the double negative logic
Limit number of connections	Self evident group policy.
Limit maximum color depth	Only useful for slow connections or primitive devices.
Allow users to connect remotely using Terminal Services	I suggest that this is a maintenance setting to stop users logging on during a time when you are servicing the terminal server.
Do not allow local administrators to customize permissions	Guy says you don't need this policy.  Control permissions with Remote Desktop Users Group.
Remove Windows Security item from Start menu and	Policy to make it difficult for users to end a remote desktop session.  Settings for a kiosk.
Remove Disconnect option from Shut Down dialog	Makes it difficult for users to end a remote desktop session.  Useful for an internet café?
Always show Desktop on Connection	Group Policy to prevent people choosing other programs running.  Guy cannot see much call for this setting.
Set path for TS Roaming Profiles *	Type the UNC path to the network share in the form \\Computername\Sharename. Note, no need to specify %username% for the user alias, because Terminal Services automatically appends this at logon.
TS User Home Directory	Type the UNC path to the network share in the form \\Computername\Sharename. Note, no need to specify %username% for the user alias, because Terminal Services automatically appends this at logon.
Start a Program on Connection	Optional
\Client Server Data Redirection  - 10 Policies
Allow Time Zone Redirection	By default the session take's its time from the server.  You can alter the behaviour to display local time on the remote desktop.
Do not allow clipboard redirection	The default is copy and paste between session and local applications is allowed.
Do not allow smart card device redirection	Normally smart cards are detected on connection.
Allow audio redirection	Users can use the "Remote computer sound" option on the Local Resources tab of Remote Desktop Connection to choose whether to play the server's sound on the remote computer or on the local computer
Do not allow COM port redirection	Can also be controlled by the Terminal Services Configuration menu.
Do not allow client printer redirection	Normally, you would want clients to be able to redirect jobs to a local printer.
Do not allow LPT port redirection	Similar Group Policy to the printer settings above.
Do not allow drive redirection	Normally drives are mapped when the initial session is connected.
Do not set default client printer to be default printer in a session	Suppose a client already has a default printer.  When the terminal server session is created, the normal behavior is to retain this default printer.
Terminal Server Fallback printer driver behavior*	If there is no matching printer driver on the client, then Terminal Services finds then nearest match.  Good idea.
- \Encryption and Security - 3 Policies
Secure Server (Require Security)	This is a Group Policy for RPC authentication. If you enable then make sure the Terminal Services clients are capable of secure RPC communication.
Always prompt client for password upon connection	Enabling this setting means that users cannot tick the remember my password box.  A classic of the more security have the more work there is.  If enabled, could annoy users.
Set client connection encryption level	If you enable this setting, choose client compatible.
\Licensing - 2 Policies
License Server Security Group*	You need to enable this setting to control which computers can contact the Terminal Service Licensing server.  (SP1 cures a bug which prevents the very licensing server from obtaining a license)
Prevent License Upgrade	You need to investigate this setting only if you have both Windows 2000 and Windows Server 2003 Terminal services.
\Temporary Folders - 2 Policies
Do not use temp folders per session	If you enable this, Terminal Server heaps all the users temporary files in one directory.  Guy says specialist use only.
Do not delete temp folder upon exit	Enabling this setting may give slightly better performance the next time a user reconnects.  I would not be in a hurry to enable this setting.
\Client - 1 Policies
Do not allow passwords to be saved	Enabling this would be considered high security, but balance security with annoying the users.  Not a policy for me.
\Session Directory - 4 Policies for Clusters of Terminal Server Farms
Terminal Server IP Address Redirection	Microsoft's Cluster settings
Join Session Directory	Policy for Cluster settings
Session Directory Server	More Cluster settings
Session Directory Cluster Name	Cluster settings
\Sessions - 5 Policies
Set time limit for disconnected sessions*	This setting overcomes the problem of users disconnecting without logging off from their terminal server session.
Sets a time limit for active Terminal Services sessions	Not often needed.  Why would you want to stop them working!
Sets a time limit for active but idle Terminal Services sessions*	Worth setting.  The only decision is how long is a reasonable idle time-out 20 mins?  1 Hour, you decide.
Allow reconnection from original client only	If the status is set to Enabled, users can reconnect to disconnected sessions only from the original client computer. If a user attempts to connect to the disconnected session from another computer, a new session is created instead.
Terminate session when time limits are reached	This Group Policy controls whether you are disconnecting or deleting remote desktop sessions that reach their time limits.

Learn more about Terminal Services and VPN. As an MCT trainer, I can thoroughly recommend TrainSignal because they provide practical hands on training.  In particular, I like the way TrainSignal cover all learning methods, instructor lead, video and of course text material.  With TrainSignal you can either take one module, for example Terminal Services and VPN or go for a combination of modules.  See more about Terminal Services and VPN here

Summary of Terminal Services Group Policies

Most of the Terminal Services Group Policies are found under the Computer Configuration.  Whilst some settings are also available under User Configuration, my advice is just use the Computer Configuration Group Polices for Terminal Services.  My reasoning is keep it simple, and keep all the settings in one place.

Many of these Group Policies can also be controlled via the Terminal Services Configuration Snap-in, a classic case of Microsoft providing three ways of configuring.

Related topics

● More Group Policies   ● Terminal Services Home  ● Terminal Server Configuration 

 .