Terminal Services

Terminal Services adds terminal support to Windows 2000 Server. Terminal Services is a multisession environment that provides remote computers access to Windows-based programs running on the server. Windows 2000 Server includes Terminal Services Client software to support 16 and 32-bit Windows-based clients.

  • Before you begin using Terminal Services, see the Checklist: Setting up Terminal Services.
  • To find features that have been moved in Windows 2000 Server, see New ways to do familiar tasks.
  • For tips about using Terminal Services, see Best practices.
  • For background information about Terminal Services and its components and information about enabling Terminal Services, see Getting Started with Terminal Services.
  • For information about managing a Terminal server, see Managing Terminal Services.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Setting up Terminal Services

Step | Reference
Review key Terminal Services concepts. | Getting Started with Terminal Services
Review system sizing and scalability. | System planning
Enable Terminal Services. | Enabling Terminal Services
Enable Terminal Services Licensing. | Enable Terminal Services Licensing
License Terminal Services clients. | Licensing Terminal Services
Configure Terminal Services connection. | Configure Terminal Services connections
Install programs | Program installation
Install clients | Create and install clients


New ways to do familiar tasks

This table lists common tasks for Terminal Services. The user interface for performing these tasks is different in Windows 2000 than it was in Windows NT Server 4.0, Terminal Server Edition.

If you want to | In Windows NT 4.0 use | In Windows 2000 use
Create or modify Terminal Services connections | Terminal Server Connection Configuration in Administrative Tools | Terminal Services Configuration. For more information, see Configuring Terminal Services.
Manage the Terminal server and view all sessions, users, and processes | Terminal Server Administration in Administrative Tools | Terminal Services Manager. For more information, see Administering Terminal Services.
Manage Terminal Services licenses | Terminal Server License Manager in Administrative Tools | Terminal Services Licensing. For more information, see Licensing Terminal Services
Manage Terminal Services user accounts | User Manager in Administrative Tools | For a domain user account, Open Active Directory Users and Computers. Or, for a local user account, . For more information, see Terminal Services user accounts


Best practices

  • Install Terminal Services as a stand-alone server and not as a domain controller.
    Installing Terminal Services as a domain controller can affect the performance of the server because of the additional memory, network traffic, and processor time required to perform the tasks of a domain controller in a domain.
  • Install Terminal Services on an NTFS file system partition.
    NTFS provides greater security for users in a multisession environment who access the same data structures.
  • When shutting down a Terminal server, use the tsshutdn command instead of the Shut Down option on the Start menu. This will shut down the server in a controlled manner. The Shut Down option on the Start menu does not notify users before ending user sessions and is not recommended. Ending a user's session without warning can result in loss of data at the client. For more information about using tsshutdn, see Tsshutdn.
  • Back up your license server regularly.
    Backing up your license server regularly protects data from accidental loss due to hardware or storage failure. Create a duplicate copy of the data on your hard disk and then archive the data on another storage device such as a hard disk or tape. In the event that the original data on your hard disk is accidentally erased or overwritten, or becomes inaccessible because of a hard disk failure, you can easily restore the data from the archived copy.

Program installation

  • Use Add/Remove Programs in Control Panel to install applications on the Terminal server. With this method, you can install programs for multisession use. For more information about installing applications on a Terminal server, see Starting the installation.
  • Once you have enabled Terminal Services and installed programs, do not switch Terminal Services on and off.
    Terminal Services installs programs for use in a multisession environment. Programs that were installed while Terminal Services was installed might not work correctly when Terminal Services is turned off. You should reinstall all programs for use without Terminal Services if you decide to remove the component.
  • Check for application compatibility scripts before installing programs for use with Terminal Services.
    Many commonly used programs have been tested for compatibility. Some programs require minor changes to the installation. Scripts are available for these programs and must be run after the program installation is complete. Scripts are located in the systemroot in \Application Compatibility Scripts\Install.

Managing users

  • Use Terminal Services specific groups
    Create User Groups that are specifically for Terminal Services users. Maintaining users through groups is much easier and less time consuming than managing users individually.
  • Use Terminal Services specific profiles
    Assign a separate profile for logging onto Terminal Services. Many of the common options that are stored in profiles, such as screen savers and animated menu affects, are not desirable when using Terminal Services. Assigning a specific profile allows users to get the most out of the system they are working with without expending additional server resources. For information about assigning a Terminal Services specific profile, see To change a user's Terminal Services profile path.
  • Use mandatory profiles
    Use a mandatory Terminal Services profile that is created to suit the needs of all of the different types of clients and that provides the best server performance. Be aware that 16-bit computers and Windows-based Terminals might not support some screen resolutions.
  • Set time limits
    Setting limits on the duration of client connections can improve server performance. You can set the limits on how long a session lasts, how long a disconnected session is allowed to remain active on the server, and the time allowed for a session to remain connected, yet idle. For information about setting session limits, see Sessions.
  • Use the Starting program option
    If you have users who need access to only one application on the Terminal server, use the Starting program option to restrict users to that application. To specify a program to start on session connection .
  • Create pre-configured connections for users or groups of users
    To make connecting to Terminal Services easier, you can supply users with pre-configured connections. Collections of connections can also be made either for different departments within your organization or for different job titles. Pre-configured connections are created using Client Connection Manager. For more information, see Managing Terminal Services user connections .


Getting Started with Terminal Services

This topic covers information about getting started with Terminal Services. The following topics are included:

  • Terminal Services overview
  • Terminal Services administrative tools
  • Enabling Terminal Services
  • Switching Terminal Services on and off
  • System planning


Terminal Services overview

Terminal Services provides remote access to a server desktop through "thin client" software, serving as a terminal emulator. Terminal Services transmits only the user interface of the program to the client. The client then returns keyboard and mouse clicks back to be processed by the server. Each user logs on and sees only their individual session, which is managed transparently by the server operating system and is independent of any other client session. Client software can run on a number of client hardware devices, including computers and Windows-based Terminals. Other devices, such as Macintosh computers or UNIX-based workstations, can also connect to a Terminal server with additional third party software.

Terminal Services can be deployed on the server in either application server or remote administration mode. As an application server, Terminal Services provides an effective and reliable way to distribute Windows-based programs with a network server. In application server mode, Terminal Services delivers the Windows 2000 desktop and the most current Windows-based applications to computers that might not normally be able to run Windows. When used for remote administration, Terminal Services provides remote access for administering your server from virtually anywhere on your network.

Terminal Services benefits:

  • Bringing Windows 2000 to desktops faster. Terminal Services helps bridge the gap while older desktops are migrated to Windows 2000 Professional, providing the Windows 2000 desktop experience "virtually" to non-computer desktops and computers that require hardware upgrades to run a full Windows 2000 operating system locally. Terminal Services clients are available for many different desktop platforms including MS-DOS, Windows-based Terminals, Macintosh, and UNIX. (Connectivity to MS-DOS, Macintosh, and UNIX-based computers requires additional software).
  • Takes full advantage of existing hardware. Terminal Services extends the model of distributed computing by allowing computers to operate as both thin clients and full-featured personal computers simultaneously. Computers can continue to be used as they have been within existing networks while also functioning as thin clients capable of emulating the Windows 2000 Professional desktop.
  • Centralized deployment of programs. With Terminal Services running on a Windows 2000 Server, all program execution, data processing, and data storage occur on the server, centralizing the deployment of programs. Terminal Services ensures that all clients can access current versions of a program. Software is installed only once on the server, rather than every desktop throughout the organization, reducing the costs associated with updating individual computers.
  • Remote administration. Terminal Services provides remote administration for the Windows 2000 Server, giving system administrators a method of remotely managing their server from any client over a WAN or dial-up connection.

Features:

  • Ease of use
  • Manageability
  • Security

Ease of use

Feature | Description | For more information, see:
Automated local printer support | Windows 2000 Server Terminal Services can both add and automatically reconnect printers attached to Terminal Services clients. | Providing client access to local printers
Clipboard redirection | Users can now cut and paste between the programs running on the local computer and the Terminal server. | Shared clipboard
Performance enhancements | Enhancements to caching, including persistent caching, packet utilization, and frame size, provide significant performance improvements in Terminal Services. | Bitmap caching
Roaming disconnect support | This feature enables users to disconnect from a session without logging off. A session can remain active while disconnected, enabling the user to reconnect to the existing session either from another computer or at a later time. Logon is required for reconnection, keeping each session secure at all times. | Log off or disconnect
Multiple logon support | Users can logon to multiple sessions simultaneously from one or more clients, to multiple Windows 2000 Servers, or to a single server multiple times. As a result, the user can do several tasks concurrently or run multiple unique desktop sessions. | Managing users and clients

Manageability

Feature | Description | For more information, see:
Session remote control | Support persons can either view or control another Terminal Services session. Keyboard input, mouse movements, and display graphics are shared between two Terminal Services sessions, giving a support person the ability to diagnose and resolve configuration problems, as well as train the user remotely. This feature is particularly useful for organizations with branch offices. | Remote control
Network Load Balancing | Network Load Balancing lets Terminal Services clients connect to the least busy member of a group of servers running Terminal Services. | Network Load Balancing and Terminal Services
Windows-based Terminals | Based on a custom implementation of the Windows CE operating system and the Remote Desktop Protocol (RDP), Windows-based terminals are available from a variety of manufacturers. |
Client Connection Manager | Administrators and users can set up pre-defined connections to servers for either a single program or full desktop access. Client Connection Manager creates an icon on the client desktop for single-click connectivity to one or more Terminal servers. Administrators who want to provide a single program across the computing environment can create a connection and distribute that connection along with the Terminal Services Client software. | Managing Terminal Services user connections
Terminal Services Licensing | Terminal Services Licensing helps system administrators and purchasing offices to track clients and their associated licenses. | Licensing Terminal Services
Distributed file system (Dfs) support | Support for Distributed file system (Dfs) enables users to connect to a Dfs share, and administrators to host a Dfs share from a Terminal server. | Distributed file system overview
Terminal Services Manager | Administrators can use Terminal Services Manager to query and manage Terminal Services sessions, users, and processes on Windows 2000 Servers. | Administering Terminal Services
Terminal Services Configuration | Terminal Services Connection Configuration can be used to create, modify, and delete both sessions and sets of sessions on a Windows 2000 Server and access server settings. | Configuring Terminal Services
Integration with Windows 2000 Server Local Users and Groups and Active Directory Users and Computers | Administrators can create accounts for Terminal Services users the same way they create accounts for Windows 2000 Server users. Extra fields exist for specifying information specific to Terminal Services, such as the Terminal Services Profile Path and Home Directory. | Terminal Services user accounts
Integration with Windows 2000 Server System Monitor | Integration with Windows 2000 Server System Monitor enables administrators to monitor Terminal Services system performance, including tracking processor use, memory allocation, and paged memory usage and swapping per-user session. | Performance monitoring
Messaging support | Administrators can alert users to important information, such as system shutdowns, upgrades, or new programs. | Using Terminal Services Manager
Remote administration | Any user with both administrative privileges and access to the Terminal Services administrative utilities can remotely manage all aspects of a server that is running Terminal Services. |
Configurable session time-out | Administrators can reduce server resource usage by configuring session time-outs. Administrators can specify the length of an active session and how long a session can remain idle on the server | Configuring session limits

Security

Feature | Description | For more information, see:
Encryption | Multiple encryption levels enable administrators to encrypt all or some of the data transmitted between the Windows 2000 Server and Terminal Services clients at three different levels (low, medium, or high), depending upon security needs. In addition, the Terminal Services logon process includes change password, unlock desktop, and unlock screen saver features. The logon process is encrypted, ensuring secure transfer of user name and password. Terminal Services supports both 40-bit and 128-bit encryption (available only in the U.S. and Canada) between server and client. | Determining the level of encryption
Limit logon attempts and connection time | Administrators can limit the number of user logon attempts to prevent unauthorized access to a server. Additionally, the connection time of an individual user or a group of users can be limited. | Configuring Terminal Services


Terminal Services administrative tools

All Windows 2000 Server administrative tools are available for the administration of a Terminal server. Terminal Services includes the following additional tools, Windows 2000 Server tool extensions, and commands for system administration.

  • Terminal Services Manager
  • Terminal Services Configuration
  • Active Directory Users and Computers and Local Users and Groups extensions
  • Terminal Services Licensing
  • System Monitor counters
  • Task Manager additional fields
  • Client Creator
  • Client Connection Manager
  • Multiuser support in Add/Remove Programs
  • Commands

Terminal Services Manager

Use Terminal Services Manager to manage and monitor users, sessions, and processes on any server running Terminal Services on the network. Use it to:

  • Display information about servers, sessions, users, and processes.
  • Connect to and disconnect from sessions.
  • Monitor sessions.
  • Reset sessions.
  • Send messages to users.
  • Log off users.
  • Terminate processes.

Terminal Services Configuration

During Windows 2000 Server installation and Terminal Services setup, a connection is configured for TCP/IP. The connection provides the link clients use to log on to a session on the server. After installation, use Terminal Services Configuration to change the properties of this connection or to add new connections. Use it to:

  • Name a connection.
  • Specify a connection type.
  • Specify a connection transport and transport properties.
  • Set the maximum number of sessions allowed.
  • Enable or disable logons through the connection.
  • Set connection time-outs.
  • Set the level of encryption.
  • Set whether to disconnect broken connections.
  • Enable or disable session remote control.
  • Enable or disable automatic logons.
  • Specify a program to run automatically when a user logs on.
  • Override user profile settings for wallpaper.
  • Set permissions on the connection.
  • Set client device mapping and connection parameters.

Active Directory Users and Computers and Local Users and Groups extensions

Terminal Services extends Active Directory Users and Computers and Local Users and Groups to allow you to control Terminal Services features for each user. Use the Terminal Services extension to:

  • Set the path to the Terminal Services user profile of each user.
  • Enable or disable logons.
  • Set time limits on session.
  • Set whether to disconnect or reset a broken connection.
  • Enable or disable remote control.
  • Specify a program to run automatically when a user logs on.
  • Automatically connect client drives and printers at logon.

Open Active Directory Users and Computers.

Terminal Services Licensing

Use Terminal Services Licensing to register and track licenses for Terminal Services clients.

System Monitor counters

Terminal Services extends System Monitor by adding User and Session objects and their counters. You can use these objects and counters to monitor the resources that a user or session consumes. Terminal Services also adds counters to the Process and System objects.

Task Manager additional fields

Terminal Services provides two additional fields to Task Manager for monitoring and ending processes for all sessions.

Client Creator

Client Creator can be used to make disks used to install Terminal Services Client.

Client Connection Manager

When you install Terminal Services Client on a computer, Client Connection Manager is installed as well. Use Client Connection Manager to automate connecting to a Terminal Services server and logging on. You can also specify a program to start automatically when you connect.

Multiuser support in Add/Remove Programs

Add/Remove programs ensures that applications are installed for use in a multisession environment.

Open Add/Remove Programs.

Commands

Command | Function
change logon | Temporarily disable logons to a Terminal server.
change port | Changes COM port mappings for MS-DOS program compatibility.
change user | Changes the .ini file mapping for the current user.
cprofile | Removes user-specific file associations from a user's profile.
dbgtrace | Enables and disables debug tracing.
flattemp | Enables or disables flat temporary directories.
logoff | Ends a clients session.
msg | Sends a message to one or more clients.
query process | Displays information about processes.
query session | Displays information about Terminal Services sessions.
query termserver | Lists Terminal Services servers on the network.
query user | Displays information about users logged on to the system.
register | Registers a program so that it has special execution characteristics.
reset session | Allows you to reset (delete) a session from the Terminal server.
shadow | Allows you to monitor or remotely control an active session of another user.
tscon | Connects to another existing Terminal Services session.
tsdiscon | Disconnects a client from a Terminal Services session.
tskill | Terminates a process.
tsprof | Copies user configuration and changes profile path.
tsshutdn | Shuts down a Terminal Services server.


Enabling Terminal Services

Terminal Services can be enabled in two different modes: remote administration and application server. When used in remote administration mode, Terminal Services provides remote access for administering your server from virtually anywhere within your network. In application server mode, Terminal Services provides an effective and reliable way to distribute Windows-based programs with a network server. You cannot enable Terminal Services in both modes at the same time. For instructions on enabling Terminal Services in either of the modes, select the following:

  • Enabling Terminal Services in remote administration mode
  • Enabling Terminal Services in application server mode


Enabling Terminal Services in remote administration mode

Review the following information before you enable Terminal Services in this mode:

  • Enable Terminal Services on a server installed on an NTFS file system partition.
  • Read the Windows 2000 Deployment Guide chapter on deploying Terminal Services for more detailed information.
  • You do not need to enable Terminal Services Licensing when enabling Terminal Services in remote administration mode. A maximum of two concurrent connections are automatically allowed on a Terminal server in remote administration mode.
  • When upgrading from Windows NT Server 4.0 Terminal Server Edition, Terminal Services will automatically be put into application server mode. It is recommended that you do a clean installation of Windows 2000 Server when you want to use Terminal Services in remote administration mode.
  • You do not need to perform the special installation steps required for installing programs for multisession access when Terminal Services is enabled in remote administration mode. You can install programs either before or after enabling Terminal Services.

For instructions on enabling Terminal Services in this mode, see To enable Terminal Services in remote administration mode


Enabling Terminal Services in application server mode

Review the following information before you enable Terminal Services in this mode:

  • Read System planning for system sizing and performance considerations.
  • Read the Windows 2000 Deployment Guide chapter on deploying Terminal Services for more detailed information.
  • It is recommended that you enable Terminal Services in application server mode on a stand-alone server, and not on a domain controller. When enabled on a domain controller, Terminal server performance is affected because of the additional memory, network traffic, and processor time required to perform the tasks of a domain controller in a domain.
  • Enable Terminal Services on a server installed on an NTFS file system partition. NTFS provides greater security for users in a multisession environment.
  • It is recommended that you install the programs you want to use with Terminal Services after Terminal Services is enabled. This allows Terminal Services to register the programs for multisession access, making the programs easier to manage. For more information about installing programs, see Installing programs for use with Terminal Services in application server mode

For instructions on enabling Terminal Services in this mode, see To enable Terminal Services in application server mode


Switching Terminal Services on and off

Using Add/Remove Programs in Control Panel, you can switch Terminal Services on or off. Terminal Services is initially enabled if it was selected to install as an optional component when Windows 2000 Server Setup is run, or if your system was upgraded from Windows NT Server 4.0 Terminal Server Edition. If you did not enable Terminal Services during Windows 2000 Server Setup, you can enable it at a later time using Add/Remove Programs. If Terminal Services is enabled in application server mode, be aware that when you disable Terminal Services, many complications can occur involving applications and whether they were designed for multiple or single users. When Terminal Services is enabled in remote administration mode, there is no impact on applications when you disable Terminal Services.

Application issues when switching Terminal Services on and off

Many older applications were not designed for multiple users and need to be modified before they will run properly on a Terminal server. If you decide to disable Terminal Services in application server mode, the applications you installed and configured to run on a Terminal server will not run the next time you enable Terminal Services. You must configure or install the application again.

Some applications have been designed for multiple users, so when you enable or disable Terminal Services, these types of applications should run properly.

Note

  • If you need to disable Terminal Services temporarily (for example, to install an application), use the Disable Connection option in Terminal Services Configuration. For more information, see To disable a connection


System planning

This section presents information on system sizing and system components for a Terminal server that can help you decide on a hardware configuration that supports your users with optimal performance.

  • System sizing
  • Peripherals that affect performance
  • Application performance
  • Performance monitoring
  • Network Load Balancing and Terminal Services


System sizing

Most computer users can be placed into one of three categories:

  • Light users. A light user typically runs one program at a time—for example, a word processing program or a line-of-business program written in Visual Basic.
  • Structured task users. A structured task user simultaneously runs two or more programs but does not frequently switch between programs. This user runs programs whose data-processing demands on the system are not heavy—for example, productivity programs such as word processing and an Internet browser.
  • Power users. A power user is a more sophisticated user who runs three or more programs, and often has several active at the same time. A power user runs programs whose data processing demands on the system are heavy, such as detailed queries on large databases.

When determining how powerful your servers need to be, you should consider the types of users who will be using them. Light users place the lightest load on computational resources while power users consume the most computational resources. You should also consider the types of programs your server runs. Keep in mind that a Terminal server shares executable resources between individual users, just as Windows 2000 shares executable resources (.dll, .exe, and so on) between individual programs. As a result, the memory requirements for additional users running the same program are typically less than the requirements for the first user to load the application.

For adequate performance, a Terminal server requires a Pentium or higher processor. A Terminal server requires a minimum of 128 MB RAM, plus additional RAM for each user to support running each user's programs on the server. An additional 10 MB RAM is recommended for each light user and up to 21 MB RAM for each power user.

In general, processor and memory requirements scale linearly: You can support double the number of users on a multiprocessor-capable Pentium system by doubling the number of processors and doubling the amount of memory. For this reason, purchasing a system that supports multiple processors, even if you initially purchase only one processor, allows you to add capacity easily as your requirements grow.

Performance can vary depending on the programs you run on a Terminal server. You should test your system by running the programs you use to judge the processing power and RAM required for each user.

The bus architecture in single and multiprocessor systems also affects system performance. The ISA (AT bus) architecture is low bandwidth and is not recommended for a Terminal server. Use a higher-performance bus, such as EISA, MCA, or PCI for best performance. All of these buses support the sustained high data transfer rates typically required when running Terminal Services.


Peripherals that affect performance

Hard-disk throughput also affects the performance of a Terminal server. SCSI disk drives and adapters, especially devices compatible with Fast SCSI and SCSI-2, have significantly better throughput than ST-506, IDE, or ESDI disk drives and adapters.

For highest disk performance, consider using a SCSI RAID controller. RAID (Redundant Array of Independent Disks) controllers automatically place data on multiple disks to increase disk performance and improve data reliability.

Although the Remote Desktop Protocol (RDP) used with a Terminal server causes minimal network load, a high-performance network adapter is recommended. This is particularly important if many users require either access to data stored on network servers or run client/server programs. It might also be useful to use two network adapters, dedicating one to RDP traffic only.

If a multiport asynchronous communication adapter is installed for supporting dial-up users, be sure to use an intelligent (microprocessor-based) adapter to both reduce interrupt overhead and increase throughput.


Application performance

Windows 2000 Server is a 32-bit environment and Windows 3.11 is a 16-bit environment. Windows 2000 Server runs 16-bit programs through a process called Windows on Windows (WOW), translating 16-bit programs in enhanced mode. This process causes 16-bit programs to consume additional system resources. Running 16-bit programs on a Terminal server can reduce the number of users a processor can support by 40 percent and increase the memory required for each user by 50 percent. For this reason, 32-bit versions of programs should be used whenever possible.

Other application considerations:

  • Some video active applications can decrease performance. Turn off the video effects of an application for better performance.
  • MS-DOS applications are not recommended since they can consume all of the available CPU.
  • Application features that are always on and run in the background, such as automatic spelling and grammar checking in Microsoft Word, require more system resources.


Performance monitoring

Use the performance monitoring tools supplied with Windows 2000 Server to monitor system performance and the effects of configuration changes on system throughput. Among the most important measurements for performance monitoring are:

  • Processor utilization
  • Hard-disk I/O rates
  • Memory utilization
  • Pagefile activity

A good way to estimate how many users a server can support is to measure system performance with two to five users on the system, and then scale the results.

Terminal Services adds the Terminal Services and Terminal Services Session objects and their counters to the set of objects you can observe using System Monitor.


Network Load Balancing and Terminal Services

Network Load Balancing brings together several computers running server programs using the TCP/IP networking protocol. You can use this service with a group of Terminal servers to scale the performance of a single Terminal server by distributing its client requests across multiple servers. There are, however, limitations when using load balancing with Terminal servers. Since individual users can be connected to different Terminal servers within a group, user sessions might become broken when redistributed to another Terminal server. You must take measures to ensure that user information and preferences remain accessible to users in order to use Terminal Services with load balancing.

Client affinity

Network Load Balancing can be used either with or without client affinity. For Terminal Services, you should use client affinity so that Network Load Balancing directs multiple requests from the same client IP address to the same Terminal server. As long as the client connects with the same IP address, the client will always connect to the same Terminal server where user data and preferences are accessible.

However, IP addresses do not always remain the same. When using DHCP to distribute IP addresses as clients log on, clients get different IP addresses each time they connect. In addition, if clients need to connect from multiple locations (such as home and work), using client affinity does not work because the IP addresses are different.

It is possible for you to use Network Load Balancing without client affinity. But to do this, it is recommended that you set the option which automatically ends a session whenever the connection is broken (or disconnected). When a session ends, it is deleted from the Terminal server and cannot be reconnected. Therefore, by setting this option, users cannot have disconnected sessions running on different servers within the group. Since ending sessions automatically can result in loss of data at the client, this method is only useful when running applications which do not require saving current work, such as making queries on a database. For instructions on configuring your server to end sessions automatically, see To change settings for when a session limit is reached or connection is broken.

Redirecting user information and preferences

In scenarios where users might end up connected to a different Terminal server because of a change in IP address, the storage of user data and preferences can be redirected to an alternate location, such as a file server dedicated to storing files. This makes data and preferences accessible to the user regardless of which Terminal server supports the connection. Normally when using Terminal Services, individual user files and preferences are automatically stored on the Terminal server to which the user is currently connected. To redirect user information and preferences to a different location, configure Terminal Services user profiles to store any user data at the specified storage location. For more information, see Manage Terminal Services User Accounts.

Session issues

Even when user data and preferences are redirected to an alternate file server, a session in which a file was created still retains the open file, thereby consuming valuable system resources. The state of a session is specific to the Terminal Services computer on which the session was created and cannot be shared across Terminal servers.


Managing Terminal Services

The following topics are covered in this section:

  • Licensing Terminal Services
  • Program installation
  • Configuring Terminal Services
  • Managing users and clients
  • Administering Terminal Services
  • Terminal Services command reference


Program installation

This section covers information about installing programs for multisession use with Terminal Services.

  • Before installing applications, see Application compatibility scripts.
  • For help with specific tasks, see How to.
  • For general background information, see Installing programs for use with Terminal Services in application server mode.


Application compatibility scripts

Many commonly used applications have been tested for compatibility with Terminal Services. For maximum performance on a Terminal server in application server mode, some applications require minor changes after installation. Scripts are available for these applications and must be run after the application installation is complete. The scripts are located in systemroot in \Application Compatibility Scripts\Install.

Note

  • For information about specific script capabilities and how to modify them for custom installations, refer to the notes within the script for the application you are installing. Scripts can be modified in a text editor, such as Notepad.

The following are the application and corresponding command line script names:

Program name | Script name
Corel Perfect Office 7.0 32-bit | coffice7.cmd
Corel Perfect Office 8.0 32-bit | coffice8.cmd
Microsoft Exchange Client 5.5 | winmsg.cmd
Lotus SmartSuite 97 32-bit | ssuite97.cmd
Lotus SmartSuite 9.0 | ssuite9.cmd
Microsoft Office 4.3 | office43.cmd
Microsoft Office 95 | office95.cmd
Microsoft Office 97 SR1 | office97.cmd
Microsoft Project 95 | msproj95.cmd
Microsoft Project 98 | msproj98.cmd
Netscape Communicator 4.0 | netcom40.cmd
Netscape Navigator 3.0 | netnav30.cmd
Microsoft Outlook 98 | outlk98.cmd
Peachtree 2000 | pchtree6.cmd
Microsoft SNA Server 3.0 | mssna30.cmd
Microsoft SNA Client 4.0 | sna40cli.cmd
Microsoft SNA Server 4.0 | sna40srv.cmd
Microsoft Visual Studio 6.0 | msvs6.cmd

Note

  • It is not necessary to use application compatibility scripts if Terminal Services was installed in remote administration mode.


How to...

  • Install a program using Add/Remove Programs
  • Install a program using the change user command


Install a program using Add/Remove Programs

To install a program using Add/Remove Programs

  1. Log on to the Terminal server as administrator and close all programs.
  2. Open Add/Remove Programs in Control Panel.
  3. In Add/Remove Programs, click Add New Programs.
  4. Select the method to install the program and follow the instructions in the wizard.
  5. The installation wizard will guide you through the rest of the installation process. For security purposes, the program should be installed on a formatted NTFS file system partition.
  6. If applicable, edit and run the program installation script.

Notes

  • If you are prompted to restart the computer to finish the installation, click Finish in Add/Remove Programs before accepting the prompt to restart the computer. It might be necessary to logon as the same user once the server has been rebooted in order to finish the application installation properly. Do not allow other users to logon before this step has been completed.

Related Topics


Install a program using the change user command

To install a program using the change user command

  1. Log on to the Terminal server as an administrator and close all applications.
  2. Click Start, point to Programs, point to Accessories, and then click Command Prompt. The Command Prompt window appears.
  3. Type change user /install and press ENTER.
  4. Install the program on a local NTFS file system formatted drive as directed by the installation program.
  5. At the command prompt, type change user /execute when installation is complete.
  6. If applicable, edit and run the program installation script.

Notes

  • If prompted by a program to install an additional program, you can leave your initial program running.
  • You can type change user /query at the Command Prompt to see whether execute mode is enabled and .ini file mapping is on.

Related Topics


Installing programs for use with Terminal Services in application server mode

This section provides general information about installing programs for multisession use on a Terminal server in application server mode. The multisession capabilities of Terminal Services require that programs be installed in a way that provides each session the ability to run a program on the server without disrupting the server or other sessions.

  • Program considerations
  • Installing programs
  • Program compatibility

Note

  • Terminal Services remote administration mode does not require any special program installation.


Program considerations

Several things should be considered before selecting and installing programs on Terminal Services in application server mode. This section covers:

  • Assigned and published programs
  • 16-bit Vs. 32-bit programs
  • System resource considerations
  • Programs starting programs


Assigned and published programs

Windows 2000 provides Windows Installer for deploying programs within your organization. You can assign a program to either computers or users, or publish programs to users. For more information, see Understanding Software Installation.

Because Terminal Services is able to provide multisession access to programs, additional consideration is needed before deploying applications in environments that contain Terminal servers.

Applications are installed on a per-computer basis for Terminal Services, meaning they are available to any user with access to the Terminal server. Terminal Services cannot accept published programs because they are published on a per-user basis. Additionally, assigned programs must be assigned on a per-computer basis, rather than on a per-user basis.

When installing assigned programs, anyone with administrative privileges on the Terminal server can install the program from either the console or from a remote session.

Caution

  • Program installation often requires a system reboot. Always ensure that there are no users logged on to the Terminal server before starting any program installation.
  • If the program is installed from a remote session, the session is disconnected or reset if the program installation requires rebooting the server. When the server reboots, your session is reset and you need to again log on to the Terminal server to ensure that the program is correctly installed.
  • Whenever possible, install programs from the console.

Deploying Windows Installer-based programs on Terminal servers

Windows Installer installs programs at different levels, depending on how the .msi package was created. Many .msi packages require minimal installation where only a small number of program bits get installed. When a user first invokes the program, there are enough bits installed for Windows Installer to know where to find the remainder of the bits and install the program. For Terminal Services in application server mode, users cannot invoke a Windows Installer installation. Therefore, it is important to install these programs locally when the program is first installed. To do this, a transform file (.mst) can be used. Transform files appear as modifications to .msi packages and tell Windows Installer which bits to install locally. Since transform files might not be available for all programs, you can either ensure that all necessary components are fully installed during installation yourself, or create a transform file. For more information about transform files, see Work with package modifications.

Legacy programs can also be repackaged as Windows Installer programs, using tools that capture the changes made to the system when the program is installed. These changes are then used to create an .msi package for the legacy program. This method allows you to continue using programs developed specifically for your organization.


16-bit Vs. 32-bit programs

Terminal Services in application server mode supports 16-bit and 32-bit Windows-based programs. Running 16-bit programs can reduce the number of users a processor supports by 40 percent and increase the memory required for each user by 50 percent. In addition, some 16-bit programs must be able to write to the directory where the program .ini file is stored. Most 32-bit programs use the registry to read and write program settings and need only to write to specific registry values. For both performance and security reasons, 32-bit programs are recommended whenever possible.


System resource considerations

In application server mode, Terminal Services is available for multisession use. Programs that require large amounts of system resources should be limited. This can be done by restricting user or group access to certain program types, disabling unnecessary features that require the most resources, or installing programs on separate servers.

Check system requirements for each program carefully and remember that RAM and CPU requirements increase according to the number of sessions expected to be running at any given time. While there is not a true one-to-one correlation between these, it gives you a basis for projecting program performance.

For more information, see System planning.


Programs starting programs

Some programs enable users to start other programs. For example, Microsoft Access has a toolbar that can be used to start other Microsoft Office programs. In this situation, you can disable toolbar access to other programs.

Many Microsoft products include the Microsoft System Information (Msinfo.exe) program. There is the potential that users can breach security or gather system information, such as server hardware configuration, with this program. Set file permissions on the Microsoft System Information program to allow only administrators to execute it so that it can be used to gather system configuration information, aid in problem resolution, and start programs by the appropriate users.


Installing programs

This section covers:

  • Getting ready to install programs
  • Starting the installation
  • Testing the installation


Getting ready to install programs

It is recommended that you install programs before providing client access to the server. This ensures that you can test the program before it is accessed, reducing the time it takes to perform program tuning.

If you are installing a program after clients have been granted access, be certain that there are no users logged onto the server during installation. You can send clients a message detailing the time and duration of the installation and then disable all connections before starting.

For more information about currently connected sessions, see Terminal Services Manager overview.

For more information about sending messages to users, see To send a message to a user.

For more information about disabling a connection, see To disable a connection.

Note

  • You should be logged on using an administrator account when installing programs.


Starting the installation

Use either of the following methods to install programs for multisession application server access:

  • Use Add/Remove Programs in Control Panel.
  • Use the change user command at the command prompt before and after installing the program.

One of the primary functions of the change user command is to ensure that program files are installed to the systemroot rather than the windows subdirectory of the user's home directory (%homepath%\windows). This makes the programs available for multisession access.

Before the program is installed, change user /install places the system in install mode and turns off .ini file mapping. The system then records how the setup APIs initially install the program.

After the program is installed, change user /execute returns the system to execute mode, restores .ini file mapping, and redirects user-specific data to the user's home directory.

When the user opens the program, user-specific registry setting files (.ini, .dll, .ocx, and so on) are automatically propagated as needed to the user's home directory.

Add/Remove Programs, which automatically runs the change user command, is the preferred method. Enter change user at the command prompt only when you install a program by another method and want to ensure multisession access. For example, when Internet Explorer 5 prompts you to install an add-on program, use change user at the command prompt to ensure that the program is installed for multisession access.

Important

  • Some programs need tuning in order to work correctly for a multisession environment. Before installing a program, check Application compatibility scripts for a list of programs that require scripts and information about how to use them.

For more information, see To install a program using Add/Remove Programs.

Notes

  • Do not copy program files from one directory to another or manually edit the registry during installation.
  • Install programs on the Terminal server local drive rather than on a file server. This improves program performance.
  • Install programs on NTFS file system formatted drives rather than on FAT formatted drives. You can only set file permissions on NTFS drives.


Testing the installation

Some programs installed using change user might not work at first because of the locked-down state of the system. Some 16-bit programs must be able to write to the directory where the program .ini file is stored. Some 32-bit programs create registry entries that are needed for proper operation.

Enable event logging and then log onto the server using a temporary user account created to mimic the user or users that will be accessing the program. Start the program and go through the basic procedures for using it. Then, use Event Viewer to determine which files or directories need Write access and which registry keys require Read access by the user for proper operation.

You might want to create two user accounts and test each before proceeding. This allows you to make changes to program preferences and templates, while ensuring that those changes do not affect other users of the same group.

Keep track of all files and any issues that arise. For information about how to tune programs for multisession use, see Program compatibility.


Program compatibility

Many programs, particularly older ones, were not designed for multisession use. As a result, some programs need to be tuned before they can run on a Terminal server.

Microsoft provides installation scripts for some programs with known installation issues. Scripts should be run after the application installation process is complete and before running the application for the first time.

For other programs, this section describes issues and procedures for tuning programs to run in the Terminal Services multisession environment.

  • Registry settings
  • File and directory issues
  • Program compatibility flags


Registry settings

Programs store configuration information in a system database called the registry. In this application, the two most important sections of the registry are labeled HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER.

Information that pertains to the entire system should be stored in HKEY_LOCAL_MACHINE. For example, a program might store the following information in this section:

  • Which components of a program were installed.
  • The path used to load program components.
  • The path to a shared database. For example, a point-of-sale program where all users reference the same database.

Programs store user-specific information in the HKEY_CURRENT_USER section, which is part of the user profile. When a user logs on, a profile is loaded into the system registry where it becomes HKEY_CURRENT_USER. When the user logs off, any changes to HKEY_CURRENT_USER are written back to the user profile. A program might store the following types of information in this section:

  • Paths to custom dictionaries, mailboxes, configuration files, and temporary directories. Per-user paths are particularly important for multiuser operation.
  • Per-user preference settings. For example, some users might want to enable background spell checking while others might want to disable it.

Per-user data in HKEY_LOCAL_MACHINE

Problems arise if programs store per-user data in HKEY_LOCAL_MACHINE instead of HKEY_CURRENT_USER. If a program stores personal preferences, such as color and font size, in HKEY_LOCAL_MACHINE, users are not able to specify custom preferences.

Settings created when a program is run

A program might create HKEY_CURRENT_USER registry settings the first time a user runs the program, rather than during installation. If the person who installs the program does not run it while install mode is still active, the HKEY_CURRENT_USER settings are not copied to HKEY_LOCAL_MACHINE. The first time each user runs the program, HKEY_CURRENT_USER is loaded with the default settings. Depending on the program, this might or might not be appropriate. If the default settings are not sufficient, they need to be corrected for each user individually.

Another way to solve this problem is to run the program once before exiting install mode. Before clicking Finish in Add\Remove Programs (or before running change user /execute), the administrator can run the program, causing the program to create the necessary registry settings.

If the you have already left install mode and have not run the program, re-enter install mode with change user /install and run the program. If you have already run the program while in execute mode, create another administrator account, log on with this new account, run change user /install, run the program, and then run change user /execute to leave install mode.


File and directory issues

The files and directories a program creates and uses might present problems if the program was not originally designed for a multiuser environment.

Files that store per-user data

A program might use a single path for a file that contains per-user data. In some cases, this can mean that if one user updates this file, it affects all users. More severe problems include preventing multiple users from running the program simultaneously and corruption of the file, which can cause the program to fail for all users.

It is important to note that most files do not contain per-user data and are safe to share. Some files can be classified either way, depending on the system administrator's preference. For instance, document template files can be made read-only and safely shared. Or, users can have their own set of template files that they can update as desired.

If you have difficulty finding the shared file, you can use file auditing to track successful write operations.

Another path issue arises when programs store files in public directories such as the systemroot. Some public directories have read-only permission for nonadministrative users which prevents accidental modification of common files. However, if a program attempts to write a file into one of these shared directories, it will fail.

This type of problem frequently manifests itself as a program that can be successfully executed by an administrative user, but fails for a nonadministrative user. To help track down this type of problem, you can use file auditing to log all write operations that fail.

Some programs use temporary directories to store information that relates to a current user. The program might not create a separate directory for each user, causing the program to store temporary data for multiple users in a single location. If the program is not intelligent about handling this data, one user can delete data that is still needed by another user.

Updating the path

When you identify a file that stores per-user data, update the path so that a copy of the file resides in each user's home directory.

Programs can store a file path in several places, including:

  • HKEY_LOCAL_MACHINE
  • HKEY_CURRENT_USERS
  • A configuration file
  • Hard-coded within the program itself

Some per-user files are automatically generated by the program. Other per-user files, such as document templates, must be provided for the user by copying them into the user's home directory. If you specified the path as a subdirectory of the user's home directory, you might need to create the subdirectory as well.

Per-user tasks can be performed in a script, run during logon. The script checks the user's home directory to determine whether the files or directories in question already exist. If not, it can copy them from a master. Using a script allows you both to update current users with a new program and automatically set up new users you might want to add later.

Permissions and accessibility

Another path-related issue arises when a program cannot locate files in or below the systemroot when it is run by a user, but can find them when run by an administrator.

This problem occurs with some programs that use the GetWindowsDirectory() function to determine the name of the directory where Terminal Services was installed. Programs that use this function benefit from an automatic remapping. For users, the function returns the Windows subdirectory of their home directory.

Administrators, on the other hand, have the systemroot directory, which automatically converts a shared file into a per-user file. It will not, however, be located under the user's home directory.

This automatic remapping can be disabled with a program compatibility flag. This is appropriate if the files under systemroot are only being used for read access. For more information about compatibility flags, see Program compatibility flags.


Program compatibility flags

Program compatibility flags are registry entries that provide the system with information about compatibility issues for particular programs. Some of these entries are created by default. Administrators can create new entries or change existing entries to alleviate many program compatibility issues.

Following is a list of compatibility flags that can be stored under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Terminal Server\ Compatibility\Applications\app_name

The keys are created using the program's executable name and the flag is stored as a DWORD value.

Value | Description
0x00000001 | MS-DOS-based program
0x00000002 | OS/2-based program
0x00000004 | Windows-based 16-bit program
0x00000008 | Windows-based 32-bit program
0x0000000C | Windows-based 16-bit and 32-bit program
0x0000000F | Any version of a program
0x00000010 | Return user name instead of computer name for GetComputerName.
0x00000020 | Return Terminal server build number instead of Windows 2000 build number for GetVersion.
0x00000040 | Synchronize user .ini file to system version.1
0x00000080 | Do not substitute user \Windows directory.2
0x00000100 | Disable registry mapping for program or registry key.
0x00000200 | Per-object user/system global mapping
0x00000400 | Return system \Windows directory instead of user \Windows directory for GetWindowsDir.
0x00000800 | Limit the reported physical memory for GlobalMemoryStatus.
0x00001000 | Log object creation to file.
0x20000000 | Do not put program to sleep on unsuccessful keyboard polling (Windows-based 16-bit programs only).

1 This setting adds new entries from the system version of the .ini file to the user's version, but does not delete any existing entries in the user's .ini file. By default the user's .ini file is deleted when it is out of date with the system version.

2 This setting requires that the user's \Windows directory is not substituted for the system root directory for any paths inside the .ini file when the system version of the .ini file is copied to the user's \Windows directory. This substitution should be done so that the program uses the user's \Windows directory for all of the modifications it makes to data or .ini files.


How to...

  • Enable Terminal Services in remote administration mode
  • Enable Terminal Services in application server mode
  • Configure Terminal Services connections
  • Manage Terminal Services connections
  • Configure server settings


Enable Terminal Services in remote administration mode

To enable Terminal Services in remote administration mode

  1. Open Add/Remove Programs in Control Panel.
  2. Click Add/Remove Windows Components to open the Windows Components wizard.
  3. In Windows Components, select Terminal Services, and then click Next.
  4. In Terminal Services Setup, click Remote administration mode.

    5. The required files are copied to your hard disk, and server software can be used after restarting the system.

Notes

  • You do not need to enable Terminal Services Licensing when enabling Terminal Services in remote administration mode.
  • Certain Windows components require configuration before thay can be used. If you installed one or more of these components, but did not configure them, when you click Add/Remove Windows Components, a list of components that need to be configured is displayed. To start the Windows Components wizard, click Components.


Enable Terminal Services in application server mode

To enable Terminal Services in application server mode

  1. Open Add/Remove Programs in Control Panel.
  2. Click Add/Remove Windows Components to open the Windows Components wizard.
  3. In Windows Components, select the Terminal Services check box, and then click Next.

    Terminal Services Licensing is a required component that licenses clients on a Terminal server in application server mode. It is recommended that you do not enable Terminal Services Licensing on the same computer with Terminal Services.

  4. In Terminal Services Setup, click Application server mode.
  5. In Terminal Services Setup, you may see programs listed that will not work properly when Terminal Services is enabled. You need to reinstall these programs for multisession access using Add/Remove Programs after Terminal Services is enabled.
  6. In the next screen, specify whether you want permissions to be compatible with Windows 2000 Users or with Terminal Server 4.0 Users. Select Permissions compatible with Windows 2000 Users for the most secure environment in which to run applications.
  7. In Terminal Services Licensing Setup, specify whether you want the license server to serve your entire enterprise or your domain/workgroup, and then provide the directory location for the database. Click Next, and then click Finish.

    8. The required files are copied to your hard disk, and server software can be used after restarting the system.

Notes

  • Terminal Services and Terminal Services Licensing can also be enabled when Windows 2000 Server Setup is run.
  • Certain Windows components require configuration before thay can be used. If you installed one or more of these components, but did not configure them, when you click Add/Remove Windows Components, a list of components that need to be configured is displayed. To start the Windows Components wizard, click Components.


Configure Terminal Services connections

  • Make a new connection
  • Specify a maximum number of sessions that can connect to the server
  • Change the level of encryption
  • Specify a program to start automatically when a user logs on
  • Allow a user to log on to the server automatically
  • Manage remote control
  • Configure time-out and reconnection settings
  • Manage client settings
  • Manage connection permissions


Make a new connection

To make a new connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. On the Action menu, click Create New Connection.
  4. The Terminal Services Connection wizard appears. Follow the instructions on your screen to configure the connection.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • Only one Remote Desktop Protocol (RDP) connection can be configured for each network adapter in a Terminal server. Typically, the RDP connection that is configured automatically when Terminal Services is installed is the only connection needed. You can configure additional connections using RDP if you install a network adapter for each connection on your computer.

Related Topics


Specify a maximum number of sessions that can connect to the server

To specify a maximum number of sessions that can connect to the server

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to specify a maximum number of sessions, and then click Properties.
  4. On the Network Adapter tab, click Maximum connections, type the maximum number of sessions that can connect to the server, and then click Apply.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • By default, the connection is configured to allow an unlimited number of sessions to connect to the server.
  • Restricting the number of sessions improves performance since fewer sessions are demanding system resources.

Related Topics


Change the level of encryption

To change the level of encryption

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection you want to modify, and then click Properties.

  4. On the General tab, in Encryption level, select the appropriate level for your organization. You can select from these levels of encryption:

    The Low level encrypts data sent from the client to the server by using either a 40-bit or 56-bit key. A Windows 2000 Terminal server uses a 56-bit key when Windows 2000 clients connect to it and a 40-bit key when earlier versions of the client connect to it. This input-only encryption is used to protect sensitive data, such as a user password.

    The Medium level encrypts data sent from client to server and from server to client by using either a 40-bit or a 56-bit key. A Windows 2000 Terminal server uses a 56-bit key when Windows 2000 clients connect to it and a 40-bit key when earlier versions of the client connect. Use medium encryption to secure sensitive data as it travels over the network for display on remote clients.

    If you are located in the United States or Canada, you have the option to select the High level, which encrypts data sent from client to server and from server to client by using strong 128-bit encryption.

  5. If you want the connection to default to the standard Windows authentication when another authentication package has been installed on the server, select the Use standard Windows authentication check box.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • All levels use the standard RSA RC4 encryption.

Related Topics


Specify a program to start automatically when a user logs on

To specify a program to start automatically when a user logs on

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to specify an initial program, and then click Properties.
  4. On the Environment tab, under Initial program, select the Override settings from user profile and Client Connection Manager wizard check box.

    This enables you to configure an initial program for the connection.

  5. In Program path and file name, type the path and file name of the program that you want to start when the user logs on to the Terminal server.
  6. In Start in, type the working directory path for the program.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.

Related Topics


Allow a user to log on to the server automatically

To allow a user to log on to the server automatically

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection through which you want to allow a user to log on automatically, and then click Properties.
  4. On the Logon Settings tab, click Always use the following logon information.

    This enables you to configure logon information for a user.

  5. In User name, type the name of the user you want to allow to log on to the server automatically.
  6. In Domain, type the name of the domain to which the user's computer belongs.
  7. In both Password and Confirm password, type the user's password.
  8. Click Always prompt for password to specify that the user is always prompted for a password before logging on to the server.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.

Related Topics


Manage remote control

  • Configure remote control settings
  • Disable remote control


Configure remote control settings

To configure remote control settings

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to configure remote control, and then click Properties.
  4. On the Remote Control tab, click Use remote control with the following settings to configure remote control for the connection.
  5. To display a message on the client, asking permission to view or take part in the session, select the Require user's permission check box.
  6. Under Level of control, click View the session to specify that the user's session can be viewed only, or click Interact with the session to specify that the user's session can be actively controlled with your keyboard and mouse.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • You initiate remote control on another user's session from Terminal Services Manager. For more information about using remote control, see Related Topics.
  • Configuring remote control on a per-connection basis affects all sessions that use the connection. You can configure remote control on a per-user basis using the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.

Related Topics


Disable remote control

To disable remote control

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to disable remote control, and then click Properties.
  4. On the Remote Control tab, click Do not allow remote control.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.

Related Topics


Configure time-out and reconnection settings

  • Set time-out settings for disconnected, active, and idle sessions
  • Change settings for when a session limit is reached or connection is broken
  • Change settings for reconnecting disconnected sessions


Set time-out settings for disconnected, active, and idle sessions

To set time-out settings for disconnected, active, and idle sessions

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to modify time-out settings, and then click Properties.
  4. On the Sessions tab, above End a disconnected session, select the Override user settings check box.

    This allows you to configure time-out settings for the connection.

  5. Configure the following time-out settings as appropriate:
    • In End a disconnected session, select the maximum amount of time that a disconnected session remains on the server. When the time limit is reached, the disconnected session ends. When a session ends, it is permanently deleted from the server. Select Never to allow disconnected sessions to remain on the server indefinitely.
    • In Active session limit, select the maximum amount of time that a user's session can remain active on the server. When the time limit is reached, either the user is disconnected from the session or the session ends. When a session ends, it is permanently deleted from the server. Select Never to allow the session to continue indefinitely.
    • In Idle session limit, select the maximum amount of time that an idle session (session without client activity) remains on the server. When the time limit is reached, either the user is disconnected from the session or the session ends. When a session ends, it is permanently deleted from the server. Select Never to allow idle sessions to remain on the server indefinitely.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • These settings affect every client that uses the connection to connect to a Terminal server. To define settings on a per-user basis, use the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.

Related Topics


Change settings for when a session limit is reached or connection is broken

To change settings for when a session limit is reached or connection is broken

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection you want to modify, and then click Properties.
  4. On the Sessions tab, above When session limit is reached or connection is broken, select the Override user settings check box.

    This allows you to configure these settings for the connection.

  5. Under When session limit is reached or connection is broken, do one of the following:
    • Click Disconnect from session to disconnect the user from the session, allowing the session to be reconnected.
    • Click End session to end the session. When a session ends, it is permanently deleted from the server. Any running applications are forced to shut down, which can result in loss of data at the client.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • A connection to the server can be broken for any reason, including by request, connection error, idle time-out, or connection time-out.
  • These settings affect every client that uses the connection to connect to a Terminal server. To define settings on a per-user basis, use the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.

Related Topics


Change settings for reconnecting disconnected sessions

To change settings for reconnecting disconnected sessions

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection you want to modify, and then click Properties.
  4. On the Sessions tab, above Allow reconnection, select the Override user settings check box.

    This allows you to configure reconnection settings for the connection.

  5. Under Allow reconnection, do one of the following:
    • Click From any client to allow the user to reconnect to a disconnected session from any computer.
    • Click From previous client to allow the user to reconnect to a disconnected session from only the client computer where the session originated.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • This option is supported only for Citrix ICA-based clients.
  • By default, you can reconnect to a disconnected session from any computer.

Related Topics


Manage client settings

  • Connect client drives and printers at logon
  • Configure settings for mapping client devices


Connect client drives and printers while logging on

To connect client drives and printers while logging on

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection to which you want to connect client drives and printers, and then click Properties.
  4. On the Client Settings tab, under Connection, clear the Use connection settings from user settings check box.

    This allows you to configure these settings for the connection.

  5. Choose from the following options:
    • Select the Connect client drives at logon check box to automatically reconnect to all mapped client drives while logging on. This option is supported only for Citrix ICA-based clients.
    • Select the Connect client printers at logon check box to automatically reconnect to all mapped local client printers while logging on.
    • Select the Default to main client printer check box to automatically print to the default printer of the client. Otherwise, the default printer of the server is used as the default printer for all client sessions.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • Be aware that automatically reconnecting to client drives and printers affects all clients that use the connection to log on to a Terminal server. If you want to define settings on a per-user basis, use the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.

Related Topics


Configure settings for mapping client devices

To configure settings for mapping client devices

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to configure client device mappings, and then click Properties.
  4. On the Client Settings tab, under Disable the following, select the appropriate check boxes:
    • Drive mapping to disable client drive mapping. By default, this option is enabled. This option is supported only for Citrix ICA-based clients.
    • Windows printer mapping to disable client Windows printer mapping. By default, this feature is enabled. When enabled, clients are able to map Windows printers and all client printer queues are automatically reconnected at logon. However, when both LPT and COM port mappings are disabled, you will be unable to manually create printers. When disabled, clients are unable to map Windows printers and client printer queues are not reconnected at logon. However, you will be able to manually reconnect printers if LPT port mapping or COM port mapping is enabled.
    • LPT port mapping to disable client LPT port mapping. By default, this feature is enabled. When enabled, client LPT ports are automatically mapped for printing and are available in the port list of the Add Printer wizard. You need to manually create the printer to the LPT port using the Add Printer wizard. When disabled, client LPT ports are not automatically mapped. You will be unable to manually create printers using LPT ports.
    • COM port mapping to disable client COM port mapping. By default, this feature is disabled. When enabled, client COM ports are automatically mapped for printing and are available in the port list of the Add Printer wizard. You will need to manually create the printer to the COM port using the Add Printer wizard. When disabled, client COM ports are not automatically mapped. You will be unable to manually create printers to COM ports.
    • Clipboard mapping to disable client clipboard mapping. By default, this feature is enabled.
    • Audio mapping to disable client audio mapping. By default, this feature is disabled. This option is supported only for Citrix ICA-based clients.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.

Related Topics


Manage connection permissions

  • Add users and groups to permissions lists
  • Change the permissions a user or group has to a connection
  • Remove a user or group from permission lists


Add users and groups to permission lists

To add users and groups to permission lists

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to configure permissions, and then click Properties.
  4. On the Permissions tab, click Add to open Users, Computers, or Groups.
  5. Under Name, select from the list of objects, and then click Add.
  6. Click OK. The object you selected is displayed in Name.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • Once you add a user or group, default permissions are applied. To change permissions, see Related Topics.

Related Topics


Change the permissions a user or group has to a connection

To change the permissions a user or group has to a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to change permissions, and then click Properties.
  4. On the Permissions tab, click Advanced to open the Access Control Settings dialog box.
  5. In Permission Entries, select the user or group for which you want to change permissions, and then click View/Edit to open the Permission Entry dialog box.
  6. In Permissions, select or clear, as appropriate, the Allow or Deny check boxes next to the permissions you want to set for the group.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.

Related Topics


Remove a user or group from permission lists

To remove a user or group from permission lists

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection for which you want to change permissions, and then click Properties.
  4. On the Permissions tab, in Name, select the user or group you want to remove, and then click Remove.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.

Related Topics


Manage Terminal Services connections

  • Disable a connection
  • Enable a connection
  • Rename a connection
  • Delete a connection


Disable a connection

To disable a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.

  3. In the details pane, right-click the connection you want to disable, point to All Tasks, and then click Disable Connection.

    Click Yes to confirm that you want to disable the connection. If there are active sessions on the server, you are warned that these sessions will end if you disable the connection. Ending an active session without warning can result in loss of data at the user's session.

  4. The connection is disabled and no users can log on to the server using the connection until it is re-enabled.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • It is recommended that you disable all connections while you install new applications. This prevents users from logging on to the server during installation.


Enable a connection

To enable a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.

  3. In the details pane, right-click the connection you want to enable, point to All Tasks, and then click Enable Connection.

    The connection is enabled and users can log on to the Terminal server using the connection.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.


Rename a connection

To rename a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.
  3. In the details pane, right-click the connection you want to rename, point to All Tasks, and then click Rename Connection.
  4. In New name, type a new name for the connection.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.


Delete a connection

To delete a connection

  1. Open Terminal Services Configuration.
  2. In the console tree, click Connections.

  3. In the details pane, right-click the connection you want to delete, and then click Delete.

    Click Yes to confirm that you want to delete the connection. If there are active sessions on the server, you are warned that these sessions will end if you delete the connection. Ending an active session without warning can result in loss of data at the user's session.

  4. The connection is permanently deleted from the server.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.


Configure server settings

  • View Terminal server mode
  • Delete or retain temporary folders when exiting
  • Use separate temporary folders for each session
  • Enable or disable Internet Connector licensing
  • Disable Active Desktop
  • Switch default permissions for application compatibility


View Terminal server mode

To view Terminal server mode

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.

  3. In the details pane, right-click Terminal server mode, and then click Properties.

    A dialog box opens and displays information about the mode in which Terminal Services is currently running.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.

Related Topics


Delete or retain temporary folders when exiting

To delete or retain temporary folders when exiting

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Delete temporary folders on exit, and then click Properties.
  4. Click Yes to automatically delete temporary folders when a user logs off from a session, or No to retain temporary folders.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.

Related Topics


Use separate temporary folders for each session

To use separate temporary folders for each session

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Use temporary folders per session, and then click Properties.
  4. Click Yes to create a separate temporary folder for each new session.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • Click No if you do not want to create temporary folders per session.

Related Topics


Enable or disable Internet Connector licensing

To enable or disable Internet Connector licensing

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Internet Connector Licensing, and then click Properties.
  4. Under Internet Connector Licensing, click Enable or Disable depending on which setting you require. By default, Internet Connector licensing is disabled.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.

Related Topics


Disable Active Desktop

To disable Active Desktop

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Active Desktop, and then click Properties.
  4. Select the Disable Active Desktop check box.

Note

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.


Switch default permissions for application compatibility

To switch default permissions for application compatibility

  1. Open Terminal Services Configuration.
  2. In the console tree, click Server Settings.
  3. In the details pane, right-click Permission Compatibility, and then click Properties.
  4. Select Permissions compatible with Windows 2000 Users to provide the most secure environment, or select Permissions compatible with Terminal Server 4.0 Users to provide an environment that is compatible with most legacy applications.

Notes

  • To open Terminal Services Configuration, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Configuration.
  • You can configure this option only when Terminal Services is in application server mode.
  • If you select Permissions compatible with Windows 2000 Users, Terminal Server Users will have the same permissions as members of the Users group and may not be able to run many legacy applications.
  • If you select Permissions compatible with Terminal Server 4.0 Users, all Users will have full access to critical registry and file system locations. This is necessary in order to run many legacy applications.


Concepts

This section provides information about configuring Terminal Services connections.

  • Terminal Services Configuration overview
  • Using Terminal Services Configuration


Terminal Services Configuration overview

A Terminal Services connection provides the link clients use to log on to a session on the server. A TCP/IP connection is automatically configured when Terminal Services is enabled on Windows 2000 Server. Using Terminal Services Configuration, you can change the default properties of the connection or add new connections.

Terminal Services Configuration

When you open Terminal Services Configuration, you will see that a connection has already been configured. This is called the RDP-TCP connection. Typically, this is the only connection that needs to be configured for clients to use the Terminal server. For Terminal servers, only one RDP (Remote Desktop Protocol) connection can be configured for each network adapter. If you want to configure additional RDP connections, you must install additional network adapters.

With Terminal Services Configuration, you can reconfigure the properties of the RDP-TCP connection, which includes limiting the amount of time client sessions can remain active on the server, setting protection levels for encryption, and selecting which permissions you want users and groups to have. Some connection properties can also be configured on a per-user basis with the Terminal Services extension to Local Users and Groups. For example, you can set different session time limits for each user when you use the Terminal Services extension to Local Users and Groups. Using Terminal Services Configuration, you can only set session time limits on a per-connection basis, which means the same time limit applies to all users who log on to the server using the connection.

In addition to configuring connections, you can use Terminal Services Configuration to configure settings that apply to the Terminal server. These include settings for temporary folders, default connection security, and enabling/disabling Internet Connector licensing. For more information, see Configuring server settings

Citrix ICA-based client

Terminal Services Configuration is also used to configure connections for Citrix ICA-based clients. These connections can be configured using TCP/IP, asynchronous, IPX/SPX, or NetBIOS transport protocols when the Citrix ICA protocol and Citrix ICA-based client software are added to the system.


Using Terminal Services Configuration

This section covers:

  • Determining the level of encryption
  • Using remote control
  • Configuring session limits
  • Managing permissions on connections
  • Managing drive, printer, and device mappings for clients
  • Configuring server settings


Determining the level of encryption

For Terminal Services connections, data encryption can protect your data by encrypting it on the communications link between the client and the server. Enable encryption whenever there is a risk of unauthorized transmission interception on the link between server and client. Terminal Services provides multilevel encryption support, before setting the level of encryption for a connection, determine the appropriate level of security for your organization. All levels use the standard RSA RC4 encryption.

There are three levels of encryption available:

Level of encryption | Description
Low | This level secures all data sent from the client to the server by using either a 56-bit or 40-bit key. A Windows 2000 Terminal server uses a 56-bit key when Windows 2000 clients connect to it, and a 40-bit key when earlier versions of the client connect. This input-only encryption is used to protect sensitive data, such as a user password.
Medium | This level secures data sent in both directions (from the client to the server and from the server to the client) by using either a 56-bit or a 40-bit key. A Windows 2000 Terminal server uses a 56-bit key when Windows 2000 clients connect to it, and a 40-bit key when earlier versions of the client connect. Use medium encryption to secure sensitive data as it travels over the network to display on remote clients.
High | If you are located in the United States or Canada, you have the option to select the high level. High encryption affects all data sent in both directions, but encrypts using the non-exportable 128-bit key.


Using remote control

You can monitor the actions of a client logged on to a Terminal server by remotely controlling the user's session from another session. Remote control allows you to either observe or actively control another session. If you choose to actively control a session, you will be able to input keyboard and mouse actions to the session. A message can be displayed on the client session asking permission to view or take part in the session before the session is remotely controlled. Use Terminal Services Configuration to configure remote control settings for a connection and Terminal Services Manager to initiate remote control on a client session. For instructions on configuring remote control, see To configure remote control settings. For instructions on using remote control, see To remotely control a session.

Notes

  • Remote control can also be configured on a per-user basis using the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.
  • The console session cannot remotely control another session, and a client session cannot remotely control the console session.
  • The computer used for your session must be capable of supporting the video resolution used at the remotely controlled client session. Otherwise, the operation fails.


Configuring session limits

For a Terminal Services connection, you can limit the amount of time active, disconnected, and idle (session without client activity) sessions remain on the server. This is useful because sessions that remain running indefinitely on the server consume valuable system resources. When a session limit is reached for active or idle sessions, you can select to either disconnect the user from the session or end the session. A user who is disconnected from a session can reconnect to the same session at a later time. When a session ends, it is permanently deleted from the server and any running applications are forced to shut down, which can result in loss of data at the client. When a session limit is reached for a disconnected session, the session ends, which permanently deletes it from the server. Sessions can also be allowed to continue indefinitely.

Session limits configured in Terminal Services Configuration apply to all sessions using the connection to log on to the server. Session limits can also be configured on a per-user basis using the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.

Broken connections

A connection is considered broken when any of the following occurs: by request, connection error, or the active or idle session limit is reached.

Reconnecting to a disconnected session

By default, a Terminal server allows you to reconnect to a disconnected session from any computer. However, you can restrict users and allow them to only reconnect from the computer where the session originated. This option is supported only for clients that provide a serial number when connecting, such as Citrix ICA-based clients.


Managing permissions on connections

Permissions define how users and groups can access a Terminal server, allowing you to secure the server. The TCP/IP connection automatically installed with Terminal Services comes with a set of default permissions. You can modify these default permissions by setting different permissions for different users or groups, adjusting them to fit the requirements of your organization. You must have administrative privileges to manage connection permissions.

The default permissions on Terminal Services objects are as follows:

Group | Permission
Administrators | Full Control
SYSTEM | Full Control
Users | User Access
Guests | Guest Access

For information about managing permissions for users and groups, see Adding users and groups.

For information about the types of permissions used to control access to Terminal Services, see Controlling connection access.


Controlling connection access

Use the permissions provided for Terminal Services to control how users and groups access the server. You can alter the default permissions to restrict individual users and groups from performing certain tasks, such as logging off a user from a session or ending sessions. You manage permissions from Terminal Services Configuration. You must have administrative privileges to set permissions.

By default, there are three types of permissions: Full Control, User Access, and Guest Access.

You can configure these by setting permissions for which users or groups can use a specific task. You can set the following permissions.
Permission | Allows you to
Query Information | Query sessions and servers for information.
Set Information | Configure connection properties.
Reset | End a session. Be aware that ending a session without warning can result in loss of data at the client.
Remote Control | View or actively control another user's session.
Logon | Log on to a session on the server.
Logoff | Log off a user from a session. Be aware that logging off a user without warning can result in loss of data at the client.
Message | Send a message to another user's sessions.
Connect | Connect to another session.
Disconnect | Disconnect a session.
Virtual Channels | Use virtual channels.


Adding users and groups

You control how users and groups access a Terminal server by setting permissions. The permissions you assign should reflect the level of access you want to permit them to have. Before adding users and groups to permissions lists, consider what types of access are required for each individual user or group. For information on types of permissions, see Controlling connection access.

You can add any user, group, or computer in your network to permissions lists. If your server belongs to a domain, you can also add user accounts and global groups from both the local domain and trusted domains. Local groups in some domains can also be added.


Full control

Full control allows users to:

  • Query information about a session.
  • Modify connection parameters.
  • Reset (or end) a session.
  • Remotely control another user's session.
  • Log on to a session on the server.
  • Log off a user from a session.
  • Send a message to another user's session.
  • Connect to another session.
  • Disconnect a session.
  • Use virtual channels, which provides access from a server program to client devices.


User access

User access allows users to:

  • Log on to a session on the server.
  • Query information about a session.
  • Send messages to other user sessions.
  • Connect to another session.


Guest access

Guest access allows users to:

  • Log on to a session on the server.


Managing drive, printer, and device mappings for clients

Because client sessions can establish multiple data channels between client and server, users can map to local devices, such as drives and printers. By default, drive and printer mappings that a user sets in a client session are temporary and are not available the next time the user logs on to the server. However, using Terminal Services Configuration, you can specify that client mappings are automatically restored whenever the user logs on. In addition, you can disable specific client devices so that a user cannot map the device. Users can map the following devices:

  • Drives (this option is supported only for Citrix ICA-based clients)
  • Windows printers
  • LPT ports
  • COM ports
  • Clipboard
  • Audio (this option is supported only for Citrix ICA-based clients)

Note

  • Settings for client drive, printer, and device mappings configured in Terminal Services Configuration apply to all client sessions on the server. If you want to specify client settings on a per-user basis, use the Terminal Services extensions to Local Users and Groups or Active Directory Users and Computers.


Using temporary folders with Terminal servers

By default, a Terminal server creates a separate temporary folder for each new session on the server, enabling each user to store individual temporary files. To save free disk space, these temporary folders are automatically deleted when the user logs off from a session. If you want to change these default settings for a Terminal server, use Terminal Services Configuration to modify them. For more information, see To delete or retain temporary folders when exiting or To use separate temporary folders for each session


Terminal server mode

Terminal Services can be deployed on the server in either application server or remote administration mode. As an application server, Terminal Services delivers the Windows 2000 desktop and the most current Windows-based applications to computers that might not normally be able to run Windows. When used for remote administration, Terminal Services provides remote access for administering your server from virtually anywhere on your network.


Windows 2000 Terminal Services Internet Connector license

This license is purchased separately as an add-on license to Terminal Services, allowing a maximum of 200 concurrent users to connect anonymously to a Terminal server over the Internet. It is useful for organizations that want to demonstrate Windows-based software to Internet users without rewriting Windows-based applications as Web-based applications. All users who access a Terminal server with this license must be non-employees.

This license is not offered when Windows 2000 is purchased through retail channels.

This license can be enabled and disabled using Terminal Services Configuration. For more information, see To enable or disable Internet Connector licensing


Managing users and clients

This topic covers information about managing Terminal Services users and clients. The following topics are included:

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


How to...

  • Create and install clients
  • Use the Terminal Services Client
  • Use the Client Connection Manager
  • Manage Terminal Services user accounts


Create and install clients

  • Create client disks
  • Create a connection file
  • Install the 16-bit Terminal Services Client
  • Install the 32-bit Terminal Services Client
  • Remove the Terminal Services Client


Create client disks

To create client disks

  1. Click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Client Creator.
  2. In Network client or service, click the Terminal Services Client you want to create.
  3. Insert a disk, and click OK.

Related Topics


Create a connection file

To create a connection file

  1. Install Terminal Services Client onto the server.
  2. Click Start, point to Programs, point to Terminal Services Client, and then click Client Connection Manager.
  3. On the File menu, click New Connection.

    Follow the directions in the wizard to create a new connection as you want it to appear to the client.

  4. Click the connection, and on the File menu, click Export.

    Or, if you have more than one connection and you want to export all of them, click Export All.

  5. Specify a location at which to save the connection file. Save the .cns file to the client installation disk (for 16-bit clients, place the file on disk #1) or to the folder where the installation files are shared on the network. This exports the connections to a .cns file.

Note

  • If you export to an existing file, the connections are appended to the file. Exporting to an existing file does not automatically overwrite the contents of the file.

Related Topics


Install the 16-bit Terminal Services Client

To install the 16-bit Terminal Services Client

  1. At a command prompt, type drive:setup (where drive is the letter of the drive containing the Terminal Services Client disk or path to shared installation files), and press ENTER.

    2. The Terminal Services Client Setup dialog box appears.

  2. Close all applications, and then click OK.
  3. In Name, type your full name. In Organization, type the name of your organization.
  4. In the License Agreement dialog box, read the agreement and, if you accept the license agreement, click I Agree.
  5. In the Terminal Services Client Setup dialog box, begin installation, and then click the large button.
  6. In the Choose Program Group dialog box, select a Program Group from the list, or type the name of a new Program Group, and then click Continue.
  7. In the Terminal Services Client Setup dialog box, click OK to complete the installation.

Related Topics


Install the 32-bit Terminal Services Client

To install the 32-bit Terminal Services Client

  1. At a command prompt, type drive:setup (where drive is the letter of the drive containing the Terminal Services Client disk or path to shared installation files), and press ENTER.

    2. The Welcome to the Terminal Services Client installation program dialog box appears.

  2. Read the information, and then click Continue.
  3. In Name, type your full name. In Organization, type the name of your organization.
  4. In the Terminal Services Client Setup dialog box, note the product ID number, and then click OK.
  5. In the License Agreement dialog box, read the agreement and, if you accept the license agreement, click I Agree.
  6. In the Terminal Services Client Setup dialog box, begin installation, and then click the large button.
  7. To install client software for all users, click Yes. To install the client only for the current user, click No.
  8. In the Terminal Services Client Setup dialog box, click OK to complete the installation.

Related Topics


Remove the Terminal Services Client

To remove the Terminal Services Client

  1. In the Terminal Services Client group, click Uninstall.
  2. In the Terminal Services Client Setup dialog box, click Remove All to remove all Terminal Services Client files from your client computer.
  3. Click Yes to confirm the removal.
  4. In the Terminal Services Client - Restart Windows dialog box, click Restart Windows to complete.

Note

  • If you installed the client from a floppy disk, you must place the installation disk in the drive during this procedure. Placing the disk in the drive during uninstall reactivates the disk so that it can be used to install the client for another user.

Related Topics


Use the Terminal Services Client

  • Connect to a Terminal server from a 32-bit client
  • Connect to a Terminal server from a 16-bit Windows for Workgroups 3.11 client
  • Use Terminal server shortcut keys
  • Check the version number of a 16-bit Windows for Workgroups 3.11 client
  • Check the version number of a 32-bit client
  • Disconnect without ending a session
  • Log off and end the session


Connect to a Terminal server from a 32-bit client

To connect to a Terminal server from a 32-bit client

  1. Click Start, point to Programs, point to Terminal Services Client, and then click Terminal Services Client.

    The Terminal Services Client dialog box appears.

  2. In Server, type a Terminal server name or TCP\IP address. You can also select a server from Available servers.

  3. In Screen area, click a Terminal Services Client window size.

  4. Click Connect.

    The Logon Information dialog box appears.

  5. Type your user name, password, and domain (if required), and then click OK.

Related Topics


Connect to a Terminal server from a 16-bit Windows for Workgroups 3.11 client

To connect to a Terminal server from a 16-bit Windows for Workgroups 3.11 client

  1. In Program Manager, double-click TSClient.

  2. In the TSClient window, double-click TSClient.

    The Terminal Services Client dialog box appears.

  3. In Server, type a Terminal server name or TCP\IP address. You can also select a server from Available Servers.

  4. In Resolution, click a Terminal Services Client window size.

  5. Click Connect.

    The Logon Information dialog box appears.

  6. Type your user name, password, and domain (if required), and click OK.

Note

  • If you previously disconnected from a Terminal server without ending the session, Terminal Services Client automatically reconnects to that session (if the connection is configured for reconnection of disconnected sessions).

Related Topics


Use Terminal server shortcut keys

Shortcut key | Description
ALT+PAGE UP | Switches between programs from left to right.
ALT+PAGE DOWN | Switches between programs from right to left.
ALT+INSERT | Cycles through the programs in the order they were started.
ALT+HOME | Displays the Start menu.
CTRL+ALT+BREAK | Switches the client between a window and full screen.
CTRL+ALT+END | Brings up the Windows 2000 Security dialog box.
ALT+DELETE | Displays the Windows menu.
CTRL+ALT+Minus (-) symbol on the numeric keypad | Places a snapshot of the active window, within the client, on the Terminal server clipboard (provides the same functionality as pressing PrintScrn on a local computer.)
CTRL+ALT+Plus (+) symbol on the numeric keypad | Places a snapshot of the entire client window area on the Terminal server clipboard (provides the same functionality as pressing ALT+PrintScrn on a local computer.)

Note

  • On an NEC98, these shortcut keys are different in two cases:
    • CTRL+ALT+BREAK is replaced by F12.
    • CTRL+ALT+END is replaced by F15.

Related Topics


Check the version number of a 16-bit Windows for Workgroups 3.11 client

To check the version number of a 16-bit Windows for Workgroups 3.11 client

  1. In Program Manager, double-click Terminal Services Client.

  2. In the Terminal Services Client program group, double-click Terminal Services Client.

    The Terminal Services Client dialog box appears.

  3. Click About.

Related Topics


Check the version number of a 32-bit client

To check the version number of a 32-bit client

  1. Click Start, point to Programs, point to Terminal Services Client, and then click Terminal Services Client.

    The Terminal Services Client dialog box appears.

  2. Click About.

Related Topics


Disconnect without ending a session

To disconnect without ending a session

  1. In the Terminal Services Client window, click Start, and then click Disconnect.

    The Disconnect Windows 2000 Session dialog box appears.

Note

  • The Terminal Services Client automatically reconnects to this session the next time you connect to this Terminal server (if the connection is configured for reconnection of disconnected sessions).

Related Topics


Log off and end the session

To log off and end the session

  1. In the Terminal Services Client window, click Start, and then click Shut Down.

    The Shut Down Windows dialog box appears.

  2. Click Log Off, and then click OK.

Related Topics


Use the Client Connection Manager

  • Create a new connection
  • Change the server to which to connect
  • Change logon information
  • Change client screen area
  • Open the connection full screen
  • Use data compression
  • Cache bitmaps to disk
  • Change the starting program
  • Change the connection icon
  • Change the program group
  • Delete a connection
  • Export a connection to a file
  • Export all connections to a file
  • Import connections from a file


Create a new connection

To create a new connection

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. On the File menu, click New Connection and follow the instructions provided in the wizard.

Note

  • If you do not select Automatic logon, you are prompted for your user name, password, and domain before connecting.

Related Topics


Change the server to which to connect

To change the server to which to connect

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be changed.
  4. On the File menu, click Properties.
  5. On the General tab, in Server name or IP address, type the name or TCP/IP address of the server, and then click OK. Click Browse to look for a server

Related Topics


Change logon information

To change logon information

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be changed.
  4. On the File menu, click Properties.
  5. On the General tab, under Logon information, type a new user name, password, and domain name, and then click OK.

Related Topics


Change client screen area

To change client screen area

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be changed.
  4. On the File menu, click Properties.
  5. On the Connection Options tab, under Screen area, click the size to use for the client window, and click OK.

Related Topics


Open the connection full screen

To open the connection full screen

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be changed.
  4. On the File menu, click Properties.
  5. On the Connection Options tab, under Connection startup, click Full screen, and then click OK.


Use data compression

To use data compression

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be changed.
  4. On the File menu, click Properties.
  5. On the Connection Options tab, select Use data compression, and click OK.

Related Topics


Cache bitmaps to disk

To cache bitmaps to disk

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be changed.
  4. On the File menu, click Properties.
  5. On the Connection Options tab, under Bitmap caching, click Cache bitmaps to disk, and then click OK.

Related Topics


Change the starting program

To change the starting program

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be changed.
  4. On the File menu, click Properties.
  5. On the Program tab, click Start the following program and type the program path and file name. If you do not specify a program to start, the connection will start at the Windows 2000 desktop.

Related Topics


Change the connection icon

To change the connection icon

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be changed.
  4. On the File menu, click Properties.
  5. On the Program tab, click Change Icon.
  6. Click Use Default if you want to use the default icon associated with the program, or click Browse to look for a new icon.
  7. In Change icon, click the new icon, and then click OK.


Change the program group

To change the program group

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be changed.
  4. On the File menu, click Properties.
  5. On the Program tab, in Program group, you can either type a new name or select a program group from the list, and click OK.

Related Topics


Delete a connection

To delete a connection

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection to be deleted.
  4. On the File menu, click Delete.

Related Topics


Export a connection to a file

To export a connection to a file

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. Click the connection you want to export and then, on the File menu, click Export. The Export As dialog box appears.
  4. Select the file to which you want to export the connections, and then click Save.

Note

  • If you export to an existing file, the connections are appended to the file. Exporting to an existing file does not automatically overwrite the contents of the file.

Related Topics


Export all connections to a file

To export all connections to a file

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. On the File menu, click Export All. The Export As dialog box appears.
  4. Specify the file to which you want to export the connections and click Save.

Notes

  • If you export to an existing file, the connections are appended to the file. Exporting to an existing file does not automatically overwrite the contents of the file.
  • Terminal Services Client, in the program group where you installed the client software, is a default connection. When you use this connection to access a server, the information you supply (server name, resolution, user name, and domain) is saved by this default connection. The Terminal Services Client connection does not appear in Client Connection Manager, but is exported with all of the connections listed in Client Connection Manager if you select Export All. When this connection is imported, it overwrites the existing default connection and might transfer undesired information to another computer.

Related Topics


Import connections from a file

To import connections from a file

  1. Click Start, point to Programs, point to Terminal Services Client.

    Or, for the 16-bit client, in Program Manager, double-click Terminal Services Client.

  2. In Terminal Services Client, double-click Client Connection Manager.
  3. On the File menu, click Import. The Import From dialog box appears.
  4. Select the file to import and click Open.

Related Topics


Manage Terminal Services user accounts

  • Add the Terminal Services Extension to Local Users and Groups
  • Create a Terminal Services user
  • Delete a Terminal Services user
  • Change a user's Terminal Services profile path
  • Change the path to a user's home directory
  • Allow a user to log on to Terminal Services
  • Set the maximum duration of an active session
  • Set the maximum time a disconnected session remains active
  • Set the maximum idle time for a session
  • Change settings for when a session limit is reached or a connection is broken
  • Change settings for reconnecting disconnected sessions
  • Specify a program to start on session connection
  • Connect client drives at logon (for Citrix ICA clients only)
  • Connect client printers at logon
  • Default to the client's main printer
  • Enable remote control
  • Require user's permission to observe or control sessions
  • Set the level of control over a user's sessions


Add the Terminal Services Extension to Local Users and Groups

To add the Terminal Services Extension to Local Users and Groups

  1. Click Start, and then click Run.
  2. In Open, type MMC, and then click OK. A new Microsoft Management Console (MMC) appears.
  3. On the Console menu, click Add/Remove Snap-in. The Add/Remove Snap-in dialog box appears.
  4. Click Add. The Add Standalone Snap-in dialog box appears.
  5. Select Local Users and Groups, and then click Add. The Choose Target Machine dialog box appears.
  6. Select the computer to which to add this console, and then click Finish.
  7. In the Add Standalone Snap-in dialog box, click Close.
  8. In the Add/Remove Snap-in dialog box, click the Extensions tab.
  9. Click Terminal Services - Extension, and then click OK.
  10. On the Console menu, click Save. The Save dialog box appears.
  11. Enter a file name and path to be used to store the console, and then click Save.

Note

  • The Terminal Services extension is already included in Local Users and Groups if Terminal Services is enabled on the server.

Related Topics


Create a Terminal Services user

To create a Terminal Services user

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. On the Action menu, point to New, and then click User.
  3. In First name, Last name, and User Logon name, type the appropriate information, and then click Next.
  4. In Password and Confirm password, type the appropriate information, click Next, and then click Finish.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Delete a Terminal Services user

To delete a Terminal Services user

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Click the user you want to delete.
  3. On the Action menu, click Delete.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Change a user's Terminal Services profile path

To change a user's Terminal Services profile path

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user whose profile path you want to change.
  3. On the Terminal Services Profile tab, under User Profile, type the new path to the user's profile, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Change the path to a user's home directory

To change the path to a user's home directory

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user whose home directory you want to change.
  3. On the Terminal Services Profile tab, do one of the following:
    • If the Terminal Services home directory is on the local server, click Local path, and then type the path to the profile.
    • If the Terminal Services home directory is on a network share, click Connect, select a drive to connect, and then type the network path.
  4. Click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Allow a user to log on to Terminal Services

To allow a user to log on to Terminal Services

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to change settings.
  3. On the Terminal Services Profile tab, select the Allow logon to terminal server check box, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Set the maximum duration of an active session

To set the maximum duration of an active session

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user that you want to change.
  3. On the Sessions tab, in Active session limit, select the amount of time to wait before the connection is timed out, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Set the maximum time a disconnected session remains active

To set the maximum time a disconnected session remains active

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to change settings.
  3. On the Sessions tab, in End a disconnected session, select the amount of time you want to elapse before the disconnected session is reset, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Set the maximum idle time for a session

To set the maximum idle time for a session

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to change settings.
  3. On the Sessions tab, in Idle session limit, select the amount of time you want to elapse before the idle session is timed out, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Change settings for when a session limit is reached or a connection is broken

To change settings for when a session limit is reached or a connection is broken

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to change settings.
  3. On the Sessions tab, under When a session limit is reached or connection is broken, click Disconnect from session to allow the session to be reconnected.

    Or, click End session to end the session.

  4. Click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Change settings for reconnecting disconnected sessions

To change settings for reconnecting disconnected sessions

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to change settings.
  3. On the Sessions tab, under Allow reconnection, click From any client to allow connection to that session from any client computer.

    Or, click From originating client only to allow only the client computer where the session was created to reconnect to that session. This option is only supported for Citrix ICA clients.

  4. Click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Specify a program to start on session connection

To specify a program to start on session connection

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to change the Starting program.
  3. On the Environment tab, under Starting program, select the Start the following program at logon check box.
  4. In Program file name, type the name of the program to start when the user logs on. You can also specify a working directory by typing the path in Start in.
  5. Click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.

Related Topics


Connect client drives at logon (for Citrix ICA clients only)

To connect client drives at logon (for Citrix ICA clients only)

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to connect client drives.
  3. On the Environment tab, under Client devices, select the Connect client drives at logon check box, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Connect client printers at logon

To connect client printers at logon

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to connect client printers.
  3. On the Environment tab, under Client devices, select the Connect client printers at logon check box, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.
  • Only local printers are connected.

Related Topics


Default to the client's main printer

To default to the client's main printer

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to change the printer default.
  3. On the Environment tab, under Client devices, select the Default to main client printer, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Enable remote control

To enable remote control

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to enable remote control.
  3. On the Remote control tab, select the Enable remote control check box, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Require user's permission to observe or control sessions

To require user's permission to observe or control sessions

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user whose permission you want to require.
  3. On the Remote control tab, select the Require user's permission check box, and then click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Set the level of control over a user's sessions

To set the level of control over a user's sessions

  1. Choose from the following:
    • For a domain user account, open Active Directory Users and Computers.

      In the console tree, expand the domain node, and then click the folder in which users are located.

    • For a local user account, open Computer Management (Local).

      In the console tree, click Users.

      Where?

      • Computer Management
      • System Tools
      • Local Users and Groups
      • Users
  2. Double-click the user for which you want to set the level of control.
  3. On the Remote control tab, under Level of control, click View the user's session to allow only session observation.

    Or, click Interact with the session to allow full remote control of the session.

  4. Click Apply.

Notes

  • To open Active Directory Users and Computers, click Start, point to Settings, and then click Control Panel. Double-click Administrative Tools, and then double-click Active Directory Users and Computers.

Related Topics


Concepts

This section covers:

  • Best practices
  • Terminal Services user accounts
  • Terminal Services Client overview
  • Providing client software
  • Client Creator overview
  • Bitmap caching
  • Shared clipboard
  • Providing client access to local printers
  • Log off or disconnect
  • Managing Terminal Services user connections
  • Using a dial-up connection to access a Terminal server


Best practices

  • Use Terminal Services specific groups
    Create User Groups that are specifically for Terminal Services users. Maintaining users through groups is much easier and less time consuming than managing users individually.
  • Use Terminal Services specific profiles
    Assign a separate profile for logging onto Terminal Services. Many of the common options, such as screen savers and animated menu affects, that are stored in profiles are not desirable when using Terminal Services. Assigning a specific profile allows users to get the most out of the system they are working with without expending additional server resources. For information about assigning a Terminal Services specific profile, see To change a user's Terminal Services profile path.
  • Use mandatory profiles
    Use a mandatory Terminal Services profile that is created to suit the needs of all of the different types of clients and that provides the best server performance. Be aware that 16-bit computers and Windows-based Terminals might not support some screen resolutions.
  • Set time limits
    Setting limits on the duration of client connections can improve server performance. You can set the limits on how long a session lasts, how long a disconnected session is allowed to remain active on the server, and the time allowed for a session to remain connected, yet idle. For information about setting session limits, see Sessions.
  • Use Starting program
    If you have users who need access to only one application on the Terminal server, use the Starting program option to restrict users to the application. This can be done for all users through Terminal Services Configuration or on a per-user basis using either the Terminal Services Extension to Local Users and Groups or Active Directory Users and Computers. For information about using Starting program, see To specify a program to start on session connection.
  • Create pre-configured connections for users or groups of users
    To make connecting to Terminal Services easier, you can supply users with pre-configured connections. Collections of connections can also be made either for different departments within your organization or for different job titles. Pre-configured connections are created using Client Connection Manager. For more information, see Managing Terminal Services user connections.


Terminal Services user accounts

Each user who logs on to a Terminal server must have a user account either on the server or in a domain on the network. The Terminal Services user account contains additional information about the user that determines when users log on, under what conditions, and how specific desktop settings are stored.

You can set up Terminal Services user accounts either for a specific computer using Local Users and Groups or for a domain of computers using Active Directory Users and Computers.

The following topics are covered in this section:

  • Environment
  • Sessions
  • Remote control
  • Terminal Services Profile


Environment

The Environment tab contains settings for creating the client working environment.

Starting program

If a starting program is specified, it opens automatically whenever the user connects to a Terminal server. It is the only application that can be used by the user. When the application is closed, the connection to the Terminal server closes.

You can also specify an initial application through Terminal Services Configuration, but this application will be the only application available to all users. For more information about setting the initial application on a connection basis, see To specify a program to start automatically when a user logs on.

Client devices

Terminal Services can automatically connect local client printers at logon. When the client logs on to the server, the local printer is detected and the appropriate printer driver is installed on the Terminal server. If multiple printers are connected, you can also default all print jobs to the main client printer. For more information, see To connect client printers at logon or Providing client access to local printers.

Note

  • Client drives can only be connected at logon for Citrix ICA clients. The Connect client drives at logon option is not currently supported for RDP clients.


Sessions

The Sessions tab of the Terminal Services extension provides settings for limiting the time length of sessions based on their current state (active, idle, or disconnected). You can also specify what action to take when a session has reached a time limit.

Time-out setting | Description
End a disconnected session | Specifies the maximum duration that a disconnected session is retained. The session will be reset and can no longer be reconnected once the time limit has expired. For more information, see To set the maximum time a disconnected session remains active.
Active session limit | Specifies the maximum connection duration. When the time limit is reached, the session will either be disconnected, leaving the session active on the server, or reset. To set the maximum duration of an active session.
Idle session limit | Specifies the maximum idle time (time without connection activity) allowed before the session is disconnected or reset. The session is disconnected or reset when the interval elapses without any activity at the connection. To set the maximum idle time for a session.

Note

  • If Never is selected, the timer is disabled.

When the connection to the server is broken for any reason, including a request, a connection error, or an idle or active limit is reached, you can either place a client session into the disconnected state or reset the session. A session that is reset can no longer be activated by a user and is closed. A disconnected session is left active on the server and is available for reconnection. For more information, see To change settings for when a session limit is reached or a connection is broken.

Disconnected sessions

By default, a Terminal server allows you to reconnect to a disconnected session from any computer. However, to allow only the original client computer to reconnect the session, you can specify that a user can only reconnect to a disconnected session from the computer where the session originated. This option is supported only for Citrix ICA clients that provide a serial number when connecting.


Remote control

You can monitor the actions of a client logged on to a Terminal server by using remote control from another session. Remote control allows you to either observe or actively control a client session. If you choose to actively control a client session, you will be able to input keyboard and mouse actions to the session. You can warn a client that you want to remotely control their session by choosing to display a message on the client that asks permission to view or take part in the session. You can use either Local Users and Groups (for local users) or Active Directory Users and Computers (for domain users) to enable Remote control for a user account. For more information, see To enable remote control.

Notes

  • A client session cannot remotely control the system console, and the system console cannot remotely control a client session.
  • Your session computer must be capable of supporting the video resolution used at the remotely controlled client session. Otherwise, the operation fails.
  • To end remote control, press CTRL+ASTERISK (*). You can define another hot key to perform this function.


Terminal Services Profile

Terminal Services Profile

With the Terminal Services Profile, you can assign a profile to a user to apply to Terminal sessions. Administrators can then create user profiles tailored to the Terminal Services environment.

The Terminal Services profile can be used to restrict access to applications by removing them from the user's Start menu. Administrators can also create and store network connections to printers and other resources for use during user sessions.

For more information about profiles, see User profiles.

Terminal Services home directory

You can specify a path to a home directory to be used for Terminal sessions. This directory can either be a local directory or a network share.

Allow logon to Terminal Services

You can specify on a per-user basis whether users have access to Terminal Services. If this option is left disabled, the user is not allowed to log onto any Terminal servers.


Terminal Services Client overview

The Terminal Services Client is a "thin client" that delivers 32-bit Windows 2000 functionality to a wide range of legacy desktop hardware devices. The client displays as a window within the local desktop environment and contains only the minimum amount of software necessary to establish a connection to the server and present the user interface. All other operating system functions, as well as applications, run on the server. The client can be run on a range of desktop hardware:

  • Windows-based Terminal devices (embedded).
  • Intel computers running Windows 95, Windows 98, Windows NT 3.51, Windows NT 4.0, and Intel-based computers running Windows 2000.
  • Computers running Windows for Workgroups 3.11.


Providing client software

There are several ways to provide users with client software. Terminal Services Client Creator can create disks that contain client software. For information about how to use the Terminal Services Client Creator, see Create and install clients.

You can also share the client directory as a network share. For information on how to make the client software available from a network share, see To create a connection file.


Client Creator overview

Client Creator can be used to create disks for installing the client software on a user's computer. You can use these disks to distribute the appropriate Terminal Services Client to each user. Each computer on which the Terminal Services Client is installed should have its own floppy disk or set of disks for installing Terminal Services Client.

Notes

  • If you want to supply clients with shortcuts to predefined connections, you can create a file and save it to the client installation disk. This file is imported into Client Connection Manager when the client is installed. These connections then appear in the clients Start menu and in Client Connection Manager.
  • A copy of the client installation files is also in a directory on the server that can be shared. The folder is located on the server at \\%systemroot%\System32\Clients\Tsclient\Net. Client computers should connect to the share and select the drive letter of the share for installation.
  • Before installing Terminal Services Client, the client computer must be properly configured and connected to the network. If you are installing the 16-bit client on a computer running Windows for Workgroups 3.11, you might also need to install TCP/IP if it is not already installed.

For more information, see Use the Client Connection Manager


Bitmap caching

Bitmap caching places commonly used bitmaps, like the one used to display the Start button, in a file on the client computer. This improves performance by minimizing the amount of display information that must be passed over a connection.

Bitmap caching is enabled on a per-session basis from the client software and requires 10MB of free hard-drive space on the client computer.

For more information, see To cache bitmaps to disk


Shared clipboard

Windows 2000 Terminal Services provides seamless clipboard sharing, making clipboard contents available to applications locally on a user computer and within a Terminal Services session.

The shared clipboard synchronizes its contents with the local clipboard and can be viewed using the Windows Clipbook Viewer (clipbrd.exe). For example, you can now copy text from a document within a session, and paste it into a document on your local computer. You cannot, however, copy and paste files or folders. The shared clipboard is intended only for data such as text and graphics.

Clipboard sharing can be disabled on a per-connection basis using Terminal Services Configuration. For more information, see Managing drive, printer, and device mappings for clients.

For more information about the Windows 2000 Clipbook Viewer, see Clipboard Viewer overview


Providing client access to local printers

Terminal Services provides printer redirection which routes printing jobs from the Terminal server to a printer attached to the local computer of the client.

Print redirection can be disabled on a per-connection basis using Terminal Services Configuration, see To connect client drives and printers at logon. Or, on a per-user basis using Active Directory Users and Computers or Local Users and Computers, see To connect client printers at logon.

There are two ways to provide client access to local printers:

  • Automatic printer redirection - for 32-bit Terminal Services clients that are included in Windows 2000.
  • Manual printer redirection - for 16-bit clients, Windows-based Terminals, and local printers that require drivers other than those shipped with Windows 2000 Server.

Notes

  • Bidirectional printing is not supported.
  • Redirected printers are available for use with applications running on the server. Redirected printers appear in the Printers folder in Control Panel and are named in this format: Client printer name/Client computer name/Session number.
  • Clients see only their own redirected printers in the Printers dialog box.

Automatic printer redirection

For 32-bit Windows 2000 Terminal Services clients, printer redirection is automatic when the local printer uses a driver that is installed on the Windows 2000 server.

When a client logs on to Terminal Services, local printers attached to LPT, COM, and USB ports that are installed on the client computer are automatically detected and a local queue is created on the server. The client computer printer settings for the default printer and some properties (such as printing on both sides of the page) are used by the server.

When a client disconnects or ends the session, the printer queue is deleted and any incomplete or pending print jobs are lost. Information about the client's local printers and settings are saved on the client computer. On subsequent logons, the printer queue is created using the information stored on the client computer.

If a printer driver is not found on the server, an event is logged and the client printer is not created. To make the printer available, the driver must be manually installed on the server.

Manual printer redirection

Printers attached to LPT and COM ports on the client's local computer can be manually redirected for use with Terminal Services clients.

Note

  • Manual redirection of printers connected through USB ports is not supported.

To manually redirect a client printer, contact your administrator and provide the name of your computer (or IP address for a Windows-based Terminal). The client must be connected to the Terminal server during manual redirection.

The administrator uses Add Printers in Printers in Control Panel to manually add the printer. The administrator uses the client computer name to select the printer port from the list of available ports in Add Printer. Ports for all clients currently connected to the server appear in the Port list. Terminal Services client ports are listed as follows:

Port | Description
TS | computername:PortX (where Port is the type of port and X is the port number)

When a client disconnects or ends the session, the printer queue is deleted and any incomplete or pending print jobs are lost. Information about client local printers and settings are saved on the client computer. On subsequent logons, the printer queue is created using the information stored on the client computer.

Notes

  • When automatic redirection for 32-bit client printers fails, an event is logged. This event in the log should contain information about the reason for redirection failure and, if applicable, which server-side driver is missing.
  • When the client disconnects or logs off, the printer queue is deleted, and incomplete or pending print jobs are lost.
  • After the initial manual redirection, printers are automatically redirected during subsequent logons.


Log off or disconnect

Terminal Services provides two options when closing a client, you can either disconnect or log off.

Disconnect leaves the session running on the server. You can reconnect to the server and resume the session. If you are running a task on the server, such as running a time consuming query on a database, you can start the task and disconnect from the session. Later, you can log back onto the server, reenter the session, and either resume the task or check results. This is especially helpful when operating over a remote access connection on a long-distance toll line.

Network administrators can limit the amount of time a disconnected session is allowed to be left on the server. Check with your administrator for information about limits to the length of sessions.

Ending the session is known as logging off. Log off ends the session running on the server. Any applications running within the session will be closed and unsaved changes made to open files will be lost. The next time you log onto the server a new session is created.


Managing Terminal Services user connections

Client Connection Manager is part of the Terminal Services Client software, allowing administrators and users to set up predefined connections to one or several servers for single program or full desktop access. This tool creates an icon that is placed on the client desktop for single-click connectivity to one or more Terminal servers. This way, an administrator who wants to provide a single line-of-business program across the computing environment can create the connection, save the icon, and distribute that connection using the Terminal Services Client software to all desktops.

If you want to supply clients with shortcuts to predefined connections, you can create a file that will be imported into Client Connection Manager when the client is installed. These connections then appear in both the client Start menu and in Client Connection Manager.

The Terminal Services Client connection in the program group where you installed the client software, is a default connection. When you use this connection to access a server, the information you supply (server name, resolution, user name, and domain) is saved by this default connection. The Terminal Services Client connection does not appear in Client Connection Manager but is exported with all of the connections listed in Client Connection Manager if you select Export All. Be aware that when this connection is imported it overwrites the existing default connection and might transfer undesired information to another computer.

During client installation, the setup program automatically searches for all .cns files in the installation directory, imports them into Client Connection Manager, and adds them to the Start menu. For more information, see Client Connection Manager Help.

For information on how to use the Client Connection Manager, see Use the Client Connection Manager.


Using a dial-up connection to access a Terminal server

If a user has remote access to a network that contains Terminal servers, they can use the connection to access a Terminal server from a remote location.

To use remote access to connect to a Terminal server, you must first install Network and Dial-Up Connections on your computer. After installing remote networking, users can connect to the network where the Terminal server resides and start Terminal Services Client. They can then log on to the Terminal server normally.

Administrators can grant users the ability to reconnect to a session if your connection is broken, such as if a phone connection is interrupted. For more information, see To set time-out settings for disconnected, active, and idle sessions to allow reconnection on a per-connection basis or To change settings for when a session limit is reached or connection is broken on a per-user basis.


Administering Terminal Services

Administrators use Terminal Services Manager to view information about Terminal servers in trusted domains. This information includes all sessions, users, and processes for each Terminal server. This utility can also be used to perform assorted actions to manage the server.

  • For help with specific tasks, see How to.
  • For general background information, see Concepts.


How to...

  • Manage users, sessions, and processes
  • Work with Terminal servers


Manage users, sessions, and processes

  • Connect to another session
  • Disconnect from a session
  • Log off a user from a session
  • Send a message to a user
  • Reset a session
  • View status information for a session
  • Remotely control a session
  • End a process


Connect to another session

To connect to another session

  1. Open Terminal Services Manager.

  2. Right-click the session to which you want to connect, and then click Connect.

    You are connected to the new session and disconnected from your previous session.

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • You can always connect to a session in which you are logged on with the same user account. To connect to another user's session, you must have either Full Control or User Access permission.
  • You can only connect to another session from a session. You must open Terminal Services Manager, or use the tscon command, from inside of a session to be able to connect to another session.
  • You can only connect to a session in either an active or disconnected state.
  • You cannot connect to another session from the console session.

Related Topics


Disconnect from a session

To disconnect from a session

  1. Open Terminal Services Manager.
  2. Right-click the session you want to disconnect, and then click Disconnect.

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • You can always disconnect from your own sessions, but you must have Full Control permission to disconnect a session belonging to another user.
  • When you disconnect a session, the session remains attached to the Terminal server in the disconnected state and any applications that are running continue to run. The applications remain running when the session is reconnected, with no loss of data.
  • Users are automatically reconnected to the same session from which they disconnected. If a user has logged on using more than one session on the server, a list of all sessions is displayed from which the user can choose for reconnection.
  • You can also use the tsdiscon command to disconnect a session.
  • You can reset a session that is in the disconnected state, deleting the session from the server. You must have Full Control permission to do this.

Related Topics


Log off a user from a session

To log off a user from a session

  1. Open Terminal Services Manager.
  2. On the Users tab, right-click the user you want to log off from a session, and then click Log Off.

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • You can always log off from your own sessions, but you must have Full Control permission to log off another user from a session.
  • Logging off a user from a session without warning can result in loss of data at the user's session. You should send a message to the user using Send Message on the Actions menu to warn the user before taking this action.
  • When you log off a user, all processes end and the session is deleted from the server.
  • You can also use the logoff command to log off a user from a session.
  • You cannot log off a user from the console session.

Related Topics


Send a message to a user

To send a message to a user

  1. Open Terminal Services Manager.

  2. Right-click the session or user to which you want to send a message, and then click Send Message.

    The Send Message dialog box appears.

  3. In Message title, type the title of the message.
  4. In Message, type the information you want to send to the user. To start a new paragraph, press CTRL+ENTER.
  5. To send the message, click OK.

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • You must have either User Access or Full Control permission to send a message to a user.
  • Use this feature to notify users of impending disconnection, server status, or other system information.
  • You can send messages only to users whose sessions are in the active or connected state, including the console session. Sending a message to a connected session can be useful to warn users before they log on that the server will be rebooted shortly.
  • You can also use the msg command to send messages to users.

Related Topics


Reset a session

To reset a session

  1. Open Terminal Services Manager.

  2. Right-click the session you want to reset, and then click Reset.

    The session is immediately deleted from the server.

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • You can always reset your own sessions, but you must have Full Control permission to reset a session belonging to another user.
  • Be aware that resetting a user's session without warning can result in loss of data at the session.
  • You should reset a session only when it malfunctions or appears to have stopped responding.
  • If you reset a listener session, all sessions using the connection will be reset.
  • You can also use the reset session command to reset a session.

Related Topics


View status information for a session

To view status information for a session

  1. Open Terminal Services Manager.

  2. Right-click the session for which you want status information, and then click Status.

    The session's Status information about counters related to the session is displayed.

  3. To refresh this information, click Refresh Now.

    To reset counters, click Reset Counters.

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • You can always view status information for your own sessions, but you must have either Full Control or User Access permission to view status information for a session belonging to another user.
  • You cannot view status information for the console or listener sessions.

Related Topics


Remotely control a session

To remotely control a session

  1. Open Terminal Services Manager.

  2. Right-click the session you want to monitor, and then click Remote Control.

    The Remote Control dialog box appears.

  3. In Hot key, select the keys you want to use to end a remote control session, and then click OK. The default hot key is CTRL+* (using * from the numeric keypad only).

    When you want to end remote control, press CTRL+* (or whatever hot key you have defined).

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • You must have Full Control permission to remotely control another session.
  • To configure remote control settings for a connection, use Terminal Services Configuration. Remote control can also be configured on a per-user basis using the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers.
  • Before monitoring begins, the server warns the user that the session is about to be remotely controlled, unless this warning is disabled. Your session might appear to be frozen for a few seconds while it waits for a response from the user.
  • When you enter the remote control session, your current session shares every input and output with the session you are monitoring.
  • Your session must be capable of supporting the video resolution used at the session you are remotely controlling or the operation fails.
  • The console session can neither remotely control another session nor can it be remotely controlled by another session.
  • You can also use the shadow command to remotely control another session.

Related Topics


End a process

To end a process

  1. Open Terminal Services Manager.
  2. On the Processes tab, under the User column, right-click the process you want to end, and then click End Process.

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • Be aware that ending a process without warning can result in loss of data at the user's session.
  • You might need to end a process because the application is not responding.
  • You can also use the tskill command to end a process.

Related Topics


Work with Terminal servers

  • Connect to a Terminal server or Terminal servers
  • Disconnect from a Terminal server or Terminal servers
  • Find all Terminal servers in a domain


Connect to a Terminal server or Terminal servers

To connect to a Terminal server or Terminal servers

  1. Open Terminal Services Manager.
  2. Expand the domain containing the servers to which you want to connect.
  3. Do one of the following:
    • To connect to a specific Terminal server, right-click the server, and then click Connect.
    • To connect to all Terminal servers in the domain, right-click the domain, and then click Connect to All Servers in Domain.

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • It is recommended that you connect only to one Terminal server at a time. When a server is connected, Terminal Services Manager starts querying the server for information about its sessions and processes. Connecting to more than one server at a time can overload system resources.
  • To connect to all servers in all domains in your network, right-click All Listed Servers and then click Connect to All Servers.

Related Topics


Disconnect from a Terminal server or Terminal servers

To disconnect from a Terminal server or Terminal servers

  1. Open Terminal Services Manager.
  2. Expand the domain containing the servers from which you want to disconnect.
  3. Do one of the following:
    • To disconnect from a specific Terminal server, right-click the server, and then click Disconnect.
    • To disconnect from all Terminal servers in the domain, right-click the domain, and then click Disconnect from All Servers in Domain.

Notes

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.
  • To disconnect from all servers in all domains in your network, right-click All Listed Servers, and then click Disconnect from All Servers.

Related Topics


Find all Terminal servers in a domain

To find all Terminal servers in a domain

  1. Open Terminal Services Manager.
  2. Right-click the domain whose Terminal servers you want to find, and then click Find Servers in Domain.

Note

  • To open Terminal Services Manager, click Start, point to Programs, point to Administrative Tools, and then click Terminal Services Manager.

Related Topics


Concepts

This section provides background information on administering Terminal servers.

  • Terminal Services Manager overview
  • Using Terminal Services Manager
  • The Terminal Services Manager window


Terminal Services Manager overview

Administrators use Terminal Services Manager to view information about Terminal servers in trusted domains. This utility is used to monitor users, sessions, and applications on each Terminal server, and allows you to carry out assorted actions to manage the server.

When a user creates a session by connecting to the Terminal server from a client computer, the session appears in the Session list in Terminal Services Manager. In addition, the name of the user who logs on using the session appears in the Users list. Any applications run at the user's session can be monitored on the Processes list. Therefore, you can oversee all users, sessions, and processes on a Terminal server from one location.

Terminal Services Manager also allows you to manage a Terminal server using the commands on the Actions menu. For more information, see Using Terminal Services Manager.

Console session

In Terminal Services Manager, the system console session automatically appears in the Session list when you connect to a Terminal server. Console is defined as the keyboard, mouse, and video monitor of the computer on which the Terminal server is installed. You can log on to a Terminal server using the console session just as you would from a client session. You can send a message to the console session, however, you cannot perform any of the other administrative actions on it.

Listener sessions

Listener sessions are different from regular sessions. These types of sessions listen for and accept new RDP client connections, creating new sessions for the client requests. If you have configured more than one connection in Terminal Services Configuration, you will notice several listener sessions.

You have the option to reset a listener session, however, this is not recommended because doing so resets all sessions using the same Terminal Services connection. Resetting a user's session without warning results in loss of data at the client.

Idle sessions

To optimize the performance of a Terminal server, idle sessions are automatically initialized by the server before client connections are made. These sessions are available to clients for connection. Two idle sessions are created by default.


Using Terminal Services Manager

Terminal Services Manager is used to monitor the sessions, users, and processes of Terminal servers in trusted domains. In addition to monitoring, you can manage a Terminal server using the actions provided by Terminal Services Manager. Actions are found on the Actions menu and are described below. Most require special privileges to perform them.

Action | Description | Permission Level Required
Connect | Enables a user to connect to another session. Be aware that connecting to a session that is currently being used by another user might result in loss of data for the user. When you connect to another session, you are disconnected from your previous session. If you have created more than one session on a server, you can use this option to switch between these sessions. You cannot connect to another session from the system console. For more information, see To connect to another session. | User Access or Full Control
Disconnect | Disconnects a user from a session. The session remains attached to the Terminal server in the disconnected state and currently running applications continue to run. When you attempt to reconnect to the server, you are reconnected using the same session from which you disconnected, even if you are reconnecting from a different computer. Applications that were left open when you disconnected remain running when you reconnect to the session, with no loss of data. This is very useful if you change locations often (for example, from work to home). For more information, see To disconnect from a session. | Full Control
Send Message | Enables a user to send a message to another user's session. For example, an administrator might want to send a message to a user before disconnecting or logging off the user from a session. For more information, see To send a message to a user. | User Access or Full Control
Remote Control | Enables a user to observe or remotely control another user's session, allowing you to monitor the activities at the session and interact with it as needed. A user whose session you want to monitor can be warned before monitoring begins. Remote control is configured either with Terminal Services Configuration or, on a per-user basis, with the Terminal Services Extension to Local Users and Groups and Active Directory Users and Computers. You cannot remotely control another session from the console. For more background information, see Using remote control. For instructions on using remote control, see To remotely control a session. | Full Control
Reset | Enables you to delete a session instantly. Be aware that resetting a user's session without warning can result in loss of data at that session. You should reset a session only when it malfunctions or appears to have stopped responding. Resetting a listener session resets all sessions using the connection. For more information, see To reset a session. | Full Control
Status | Enables you to monitor session-related counters, such as incoming and outgoing bytes and frames. Status information for console and listener sessions cannot be displayed. For more information, see To view status information for a session. | User Access or Full Control
Log Off | Enables you to log off a user from a session on the server. Be aware that logging off a user without warning can result in loss of data at the user's session. When you log off a user, all processes end and the session is deleted from the server. For more information, see To log off a user from a session. | Full Control
End Process | Enables you to end a process that is running at a user's session. This is useful when an application has stopped responding. Be aware that ending a process without warning can result in loss of data at the user's session. For more information, see To end a process. | Full Control


The Terminal Services Manager window

The Terminal Services Manager window has a two-pane view. The navigation pane displays the domains, the Terminal servers, and the sessions on the network. The tabs in the details pane display the results of the item selected in the navigation pane. For example, when you click a server in the navigation pane, a series of tabs appear in the details pane displaying lists of users, sessions, and processes associated with that server.

In general, you perform tasks by selecting an item in the navigation pane and then taking action on that item in the details pane, using shortcut menus and toolbars.

For information about monitoring Terminal servers, click the following:

  • Viewing the users on a server or domain
  • Viewing the sessions associated with a server or domain
  • Viewing the processes associated with a server or domain
  • Viewing the processes associated with a session
  • Viewing client information
  • Session states


Viewing the users on a server or domain

With Terminal Services Manager, you can view information about the user's session, the state of the session, and other properties for each user on a Terminal server. To view user information on a Terminal server, click the server or domain in the navigation pane, and then click the Users tab.

Each field on the Users tab is described in the following table.

Field | Description
Server | Displays the servers to which users are logged on. This field is shown only when you click a domain in the navigation pane.
User | Displays all users associated with the server or domain.
Session | Displays the sessions associated with a server or all servers in the domain. All sessions are displayed regardless of status.
ID | Displays the numeric ID that identifies the session to the server.
State | Displays the current status of a session. Session states include active, conn, connq, shadow, listen, disc, idle, down, and init. For more information, see Session states.
Idle Time | Displays the number of minutes that have elapsed since the last keyboard or mouse input from a session.
Logon Time | The time at which the user logged on, if applicable.


Viewing the sessions associated with a server or domain

With Terminal Services Manager, you can view information about the user, state, and other properties of each session on a Terminal server. To view a session on a Terminal server, click the server or domain in the navigation pane, and then click the Sessions tab.

Each field on the Sessions tab is described in the following table.

Field | Description
Server | Displays the servers with which the sessions are associated. This field is shown only when you click a domain in the navigation pane.
Session | Displays the sessions associated with a server. All sessions are displayed regardless of status.
User | Displays the users associated with the server or domain.
ID | Displays the numeric ID that identifies the session to the server.
State | Displays the current status of a session. Session states include active, conn, connq, shadow, listen, disc, idle, down, and init. For more information, see Session states.
Type | Specifies the type of client using the session or whether the session is the system console.
Client Name | Specifies the name of the client computer using the session, if applicable.
Idle Time | Displays the number of minutes that have elapsed since the last keyboard or mouse input from a session.
Logon Time | The time at which the user logged on, if applicable.
Comment | Provides additional information about the session, such as its location. This field is optional.


Viewing the processes associated with a server or domain

With Terminal Services Manager, you can view current information about all processes on a Terminal server. To view the processes, click the server or domain in the navigation pane, and then click the Processes tab.

Each field on the Processes tab is described in the following table.

Field | Description
Server | Displays the servers with which the processes are associated. This field is shown only when you click a domain in the navigation pane.
User | Displays the users associated with the processes.
Session | Displays the sessions associated with the processes. All sessions are displayed regardless of status.
ID | Displays the numeric ID that identifies the session to the server.
PID | Displays the numeric ID that identifies the process to the server.
Image | Specifies the executable program that created the process.


Viewing the processes associated with a session

With Terminal Services Manager, you can view current information about all processes associated with a particular session. To view the processes, click the session in the navigation pane, and then click the Processes tab.

Each field on the Processes tab is described in the following table.

Field | Description
ID | Displays the numeric ID that identifies the session to the server.
PID | Displays the numeric ID that identifies the process to the server.
Image | Specifies the executable program that created the process.


Viewing client information

With Terminal Services Manager, you can view client information about a particular session. To view client information, click the session in the navigation pane, and then click the Information tab.

The information shown includes:

  • User name
  • Client name
  • Client build number
  • Client directory
  • Client product ID
  • Client hardware ID
  • Client address
  • Server buffers
  • Client buffers
  • Client color depth
  • Client resolution
  • Modem name, if applicable
  • Encryption level
  • Client licenses


Session states

The following table describes each possible state of a session.

Session state | Description
Active | The session is connected, and a user is logged on to the server.
Connected | The session is connected, but there is no user logged on to the server.
ConnectQuery | The session is in the process of connecting. If this state continues, it indicates a problem with the connection.
RemoteControl | The session is in the process of remotely controlling another session.
Listen | The session is ready to accept a client connection.
Disconnected | The user is disconnected from the session, but the session is still attached to the server and can be reconnected at any time.
Idle | The session is initialized and ready to accept a connection. To optimize the performance of a server, two default (idle) sessions are automatically initialized before any client connections are made.
Down | The session failed to initialize correctly or could not be terminated, and is not available. If this state continues, it indicates a problem with the connection of the session.
Init | The session is in the process of initializing.


Terminal Services command reference

You can invoke many Terminal Services administrative utilities from the command prompt. The following table lists these utilities.

Command | Function
change logon | Disables, temporarily, logons to a Terminal server.
change port | Changes COM port mappings for MS-DOS program compatibility.
change user | Changes the .ini file mapping for the current user.
cprofile | Removes user-specific file associations from a user profile.
dbgtrace | Enables or disables debug tracing.
flattemp | Enables or disables flat temporary directories.
logoff | Logs off a user from a session and deletes the session from the server.
msg | Sends a message to a user or group of users.
query process | Displays information about processes running on a Terminal server.
query session | Displays information about sessions on a Terminal server.
query termserver | Displays a list of all Terminal servers on the network.
query user | Displays information about user sessions on a Terminal server.
register | Registers applications to execute in a global context on the system.
reset session | Resets a session to known initial values.
shadow | Monitors another user's session.
tscon | Connects to another existing Terminal server session.
tsdiscon | Disconnects a client from a Terminal server session.
tskill | Ends a process.
tsprof | Copies user configuration and changes profile path.
tsshutdn | Shuts down a Terminal server.


Change logon

Enables or disables logons from client sessions, or displays current logon status. This utility is useful for system maintenance.

change logon {/enable | /disable | /query}

Parameters

/enable

Enables logons from client sessions, but not from the console.

/disable

Disables subsequent logons from client sessions, but not from the console. Currently logged on users are not affected.

/query

Displays the current logon status, whether enabled or disabled.

Security restrictions

Only administrators can use the change logon command.

Note

  • Logons are re-enabled when you restart the system. If you are connected to the Terminal server from a client session and disable logons, and then log off before re-enabling logons, you will not be able to reconnect from your session. Log on at the console in order to re-enable logons from client sessions.


Change port

Changes the COM port mappings to be compatible with MS-DOS applications.

change port [portx=porty | /d portx | /query]

Parameters

portx=porty

Maps COM port x to port y.

/d portx

Deletes the mapping for COM port x.

/query

Displays the current port mappings.

Notes

  • Most MS-DOS applications support only COM1 through COM4 serial ports. The change port command maps a serial port to a different port number, allowing applications that do not support high-numbered COM ports to access the serial port. For example, to map COM12 to COM1 for use by an MS-DOS-based application, type change port com12=com1. Remapping works only for the current session and is not retained if you log off from a session and then log on again.
  • Use change port without any parameters to display the available COM ports and their current mappings.


Change user

Changes the setting for .ini file mapping.

change user {/execute | /install | /query}

Parameters

/execute

Enables .ini file mapping to the home directory. This is the default setting.

/install

Disables .ini file mapping to the home directory. All .ini files are read and written to the system directory. You must disable .ini file mapping when installing applications on a Terminal server.

/query

Displays the current setting for .ini file mapping.

Notes

  • Use change user /install before installing an application to create .ini files for the application in the system directory. These files are used as master copies for user-specific .ini files. After installing the application, use change user /execute to revert to standard .ini file mapping.
  • The first time you run the application, it searches the home directory for its .ini files. If the .ini files are not found in the home directory, but are found in the system directory, Terminal Services copies the .ini files to the home directory, ensuring that each user has a unique copy of the application .ini files. Any new .ini files are created in the home directory.
  • Each user should have a unique copy of the .ini files for an application. This prevents instances where different users may have incompatible application setups, for example, different default directories or screen resolutions.
  • When the system is in install mode (change user /install), several things occur. All registry entries that are created are shadowed under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TerminalServer\Install. Keys added to HKEY_CURRENT_USER are copied under the \SOFTWARE key, and keys added to HKEY_LOCAL_MACHINE are copied under \MACHINE. If the application queries the Windows directory using system calls, such as GetWindowsDirectory, the Terminal server returns the systemroot directory. If any .ini file entries are added using system calls, such as WritePrivateProfileString, they are added to the .ini files under the systemroot directory.
  • When the system returns to execution mode (change user /execute), and the application tries to read a registry entry under HKEY_CURRENT_USER that does not exist, Terminal Services checks to see whether a copy of the key exists under the \TerminalServer\Install key. If it does, the keys are copied to the appropriate location under HKEY_CURRENT_USER. If the application tries to read from an .ini file that does not exist, Terminal Services searches for that .ini file under the system root. If the .ini file is in the system root, it is copied to the \Windows subdirectory of the user's home directory. If the application queries the Windows directory, the Terminal server returns the \Windows subdirectory of the user's home directory.
  • When you log on, Terminal Services checks whether its system .ini files are newer than the .ini files on your computer. If the system version is newer, your .ini file is either replaced or merged with the newer version. This depends on whether or not the INISYNC bit, 0x40, is set for this .ini file. Your previous version of the .ini file is renamed as Inifile.ctx. If the system registry values under the \TerminalServer\Install key are newer than your version under HKEY_CURRENT_USER, then your version of the keys is deleted and replaced with the new keys from under \TerminalServer\Install.

For more information about installing programs, see Installing programs for use with Terminal Services in application server mode.


Cprofile

Cleans specified profiles of wasted space and, if user-specific file associations are disabled, removes these associations from the registry. Profiles that are currently in use are not modified.

cprofile [/l] [/i] [/v] [filelist]

cprofile [/i] [/v] filelist

Parameters

/l

Cleans all local profiles. You can also specify a list of additional profiles in the filelist parameter.

/i

Interactively prompts the user with each profile.

/v

Displays information about the actions being performed.

filelist

A list of files from which you want to remove user-specific file associations. Separate each file in the list with a space. File names can contain wildcard characters.

Notes

  • Only administrators can run cprofile.
  • A Terminal server uses file associations to determine which application to use to access files of various types. File types are registered using Windows Explorer.
  • Per-user file associations allow each user to have a different application associated with a specific file type. For example, one user could have .doc files associated with Microsoft Word and another user could have .doc files associated with Windows WordPad.
  • User-specific file associations are enabled or disabled by the peruser command. If user-specific file associations are enabled, cprofile only removes the unused space from the user profile. If user-specific file associations are disabled, cprofile also removes the corresponding registry entries.


Dbgtrace

Enables and disables debug tracing.

dbgtrace [name | id | /system] [/all | /c:class /e:type] [/d] [/t] [/o:string] [/?]

Parameters

name

Specifies the name of the target session on which to run tracing.

id

Specifies the ID of the target session on which to run tracing.

/system

Runs tracing on all sessions. When this parameter is used, name and id are not required.

/all

Runs tracing for all classes and types. When this parameter is used, /c and /e parameters are not required.

/c:class

Specifies a class value for the trace.

/e:type

Specifies a type value for the trace.

/d

Specifies that trace results are debugged.

/t

Runs tracing until interrupted.

/o:string

Specifies the driver options that you can use to limit tracing.

Notes

  • You must specify either /all or both /c:class and /e:type to run tracing.
  • Used without /all, /c:class and /e:type parameters, dbgtrace disables tracing.


Flattemp

Use flattemp to enable or disable flat temporary folders. The default method for creating temporary folders for multiple users (usually pointed to by the TEMP and TMP environment variables) is to create subfolders in the \Temp folder, using the logonID as the subfolder name. For example, if the TEMP environment variable points to C:\Temp, the temporary folder assigned to the user logonID 4 is C:\Temp\4. Using flattemp, you can point directly to the \Temp folder and prevent subfolders from forming. This is useful when you want the user temporary folders to be contained in home directories, whether on a Terminal server local drive or on a network share drive. You should use this command only when each user has a separate temporary folder. For instructions on using temporary folders per-session, see To use separate temporary folders for each session.

Once each user has a unique temporary directory, use flattemp /enable to enable flat temporary directories.

flattemp {/query | /enable | /disable}

Parameters

/query

Queries the current setting.

/enable

Enables flat temporary directories.

/disable

Disables flat temporary directories.

Notes

  • Only administrators can run flattemp.
  • You might encounter application errors if the user's temporary directory is on a network drive. This occurs when the network share becomes momentarily inaccessible on the network. Because the temporary files of the application are either inaccessible or out of synchronization, it responds as if the disk has stopped. Moving the temporary directory to a network drive is not recommended. The default is to keep temporary directories on the local hard disk. If you experience unexpected behavior or disk-corruption errors with certain applications, stabilize your network or move the temporary directories back to the local hard disk.
  • Flattemp settings are ignored if you disable using separate temporary folders per-session. This option is set in Terminal Services Configuration.


Logoff

Logs off a user from a session and deletes the session from the server.

logoff [sessionid | sessionname] [/server:servername] [/v]

Parameters

sessionid

The numeric ID which identifies the session to the server.

sessionname

The name of the session.

/server:servername

Specifies the Terminal server containing the session whose user you want to log off. If unspecified, the server on which you are currently active is used.

/v

Displays information about the actions being performed.

Examples

To log off a user from the current session, type:

logoff

To log off a user from a session using the session's ID, for example session 12, type:

logoff 12

To log off a user from a session using the name of the session and server, for example session TERM04 on server WF12, type:

logoff TERM04 /server:WF12

Notes

  • You can always log off from the session to which you are currently logged on. You must, however, have Full Control permission to log off users from other sessions.
  • Logging off a user from a session without warning can result in loss of data at the user's session. You should send a message to the user using the msg command to warn the user before taking this action.
  • If no ID or name for the session is specified, using logoff will log off the user from the current session. If you specify a session name, it must be an active one.
  • When you log off a user, all processes end and the session is deleted from the server.
  • You cannot log off a user from the console session.


Msg

Sends a message to a user.

msg {username | sessionname | sessionid | @filename | *} [/server:servername] [/time:seconds] [/v] [/w] [message]

Parameters

username

The name of the user you want to receive the message.

sessionname

The name of the session you want to receive the message.

sessionid

The numeric ID of the session whose user you want to receive a message.

@filename

Identifies a file containing a list of user names, session names, and session IDs that you want to receive the message.

*

Sends the message to all user names on the system.

/server:servername

Specifies the Terminal server whose session or user you want to receive the message. If unspecified, the server where you are currently logged on is used.

/time:seconds

Specifies the amount of time the message you sent is displayed on the user's screen. Once the time limit is reached, the message disappears. If no time limit is set, the message remains on the user's screen until the user sees the message and clicks OK.

/v

Displays information about the actions being performed.

/w

Waits for an acknowledgement from the user that the message has been received. Use this parameter with /time:seconds to avoid a possible long delay if the user does not immediately respond. Using this parameter with /v is also helpful.

message

The text of the message you want to send. If no message is typed, you are prompted for it or standard input (STDIN) is read for the message. To send a message that is contained in a file, type the less than (>) symbol followed by the file name.

Examples

To send the message entitled Let's meet at 1PM today to all sessions for user MIKES, type:

msg MIKES Let's meet at 1PM today

To send the same message to session MODEM02, type:

msg modem02 Let's meet at 1PM today

To send the message to session 12, type:

msg 12 Let's meet at 1PM today

To send the message to all sessions contained in the file USERLIST, type:

msg @userlist Let's meet at 1PM today

To send the message to all users who are logged on, type:

msg * Let's meet at 1PM today

To send the message to all users, with an acknowledgment time-out (for example, 10 seconds), type:

msg * /TIME:10 Let's meet at 1PM today

Notes

  • If you do not specify a name for the user or session, msg displays an error message. When specifying the name of a session, it must be an active one.
  • The user must have send message access permission to send a message.


Query process

Displays information about processes running on a Terminal server. You can use this command to find out which programs a specific user is running, and also which users are running a specific program.

query process [ * | processid | username | sessionname | /id:nn | programname] [/server:servername] [/system]

Parameters

*

Lists the processes for all sessions.

processid

The numeric ID identifying the process you want to query.

username

The name of the user whose processes you want to list.

sessionname

The name of the session whose processes you want to list.

/ID:sessionID

The ID of the session whose processes you want to list.

programname

The name of the program whose processes you want to query. The .exe extension is required.

/server:servername

Specifies the Terminal server whose processes you want to list. If unspecified, the server where you are currently logged on is used.

/system

Specifies that current information about system processes is displayed. If you do not want system processes to be displayed, do not use this parameter.

Notes

  • Administrators have full access to all query process functions.
  • If you do not specify the username, sessionname, /ID:sessionID, programname, or * parameters, query process displays only the processes belonging to the current user.
  • If a session is specified, it must identify an active session. You can use wildcards to identify the process.
  • Query process returns the following information:
    • The user who owns the process
    • The session that owns the process
    • The ID of the session
    • The name of the process
    • The state of the process
    • The ID of the process
  • When query process returns information, a less than (>) symbol is displayed before each process belonging to the current session.


Query session

Displays information about sessions on a Terminal server. The list includes information not only about active sessions but about other sessions that the server runs.

query session [sessionname | username | sessionid] [/server:servername] [/mode] [/flow] [/connect] [/counter]

Parameters

sessionname

The name of the session you want to query.

username

The name of the user whose sessions you want to query.

sessionid

The ID of the session you want to query.

/server:servername

Identifies the Terminal server to query. The default is the current server.

/mode

Displays current line settings.

/flow

Displays current flow-control settings.

/connect

Displays current connect settings.

/counter

Displays current counters information, including the total number of sessions created, disconnected, and reconnected.

Examples

To display information about all active sessions on server SERVER2, type:

query session /server:SERVER2

To display information about active session MODEM02, type:

query session MODEM02

Sample output for query session is as follows:

C:\>query session
 SESSIONNAME    USERNAME       ID STATE  TYPE   DEVICE
>console        administrator   0 active wdcon
 rdp-tcp#1      client1         1 active wdtshare
 rdp-tcp                        2 listen wdtshare
                                4 idle
                                5 idle

The less than (>) symbol indicates the current session. SESSIONNAME specifies the name assigned to the session. USERNAME indicates the user name of the user connected to the session. STATE provides information about the current state of the session. For more information, see Session states. TYPE indicates the session type. DEVICE, which is not present for the console or network-connected sessions, is the device name assigned to the session. The comment following session information is from the session profile.

Any sessions in which the initial state is configured as DISABLED do not show up in the query session list until they are enabled.

Notes

  • A user can always query the session to which the user is currently logged on. To query other sessions, the user must have Query Information access permission.
  • If you do not specify a session using sessionname, username, or sessionid, query session displays information about all active sessions in the system.
  • When query session returns information, a less than (>) symbol is displayed before the current session.


Query termserver

Displays a list of all Terminal servers on the network. Query termserver searches the network for all attached Terminal servers and returns the following information:

  • The name of the server.
  • The network (and node address if the /address option is used).

query termserver [servername] [/domain:domain] [/address] [/continue]

Parameters

servername

The name identifying the Terminal server.

/domain:domain

Specifies the domain to query for Terminal servers. You do not need to specify a domain if you are querying the domain in which you are currently working.

/address

Displays the network and node addresses for each server.

/continue

Prevents pausing after each screen of information is displayed.

Examples

To display information about all Terminal servers on the network, type:

query termserver

To display information about the Terminal server named server3, type:

query termserver server3

To display information about all Terminal servers in domain SYSTEM, type:

query termserver /domain:system

To display the network and node address for the Terminal server named server3, type:

query termserver server3 /address


Query user

Displays information about user sessions on a Terminal server. You can use this command to find out if a specific user is logged on to a specific Terminal server. Query user returns the following information:

  • The name of the user
  • The name of the session on the Terminal server
  • The session ID
  • The state of the session (active or disconnected)
  • The idle time (the number of minutes since the last keystroke or mouse movement at the session)
  • The time the user logged on

query user [username | sessionname | sessionid] [/server:servername]

Parameters

username

Specifies the logon name of the user you want to query.

sessionname

Specifies the name of the session you want to query.

sessionID

Specifies the ID of the session you want to query.

/server:servername

Specifies the Terminal server you want to query. Otherwise, the current Terminal server is used.

Examples

To display information about all users logged on the system, type:

query user

To display information about the user USER1 on server SERVER1, type:

query user USER1 /server:SERVER1

Notes

  • To use query user, you must have Full Control permission or Query Information special access permission.
  • If you use query user without specifying a user name, session name, or session ID, you will receive a list of all users who are logged on to the server. Alternatively, you can also use Query session to display a list of all sessions on a server.
  • When query user returns information, a less than (>) symbol is displayed before the current session.
  • The /server parameter is required only if you use query user from a remote server.


Register

Registers a program so that it has special execution characteristics.

register filename [/system | /user] [/v]

Parameters

filename

The name of the file you want to register.

/system

Registers filename as a system global resource.

/user

Registers filename as a user global resource.

/v

Displays additional information.

Notes

  • Only administrators can use register.
  • Some complex applications and subsystems need to execute in a system global context to establish resources that are common to more than one logon.
  • Registration data for a program is recognized only when the program is installed. If you issue a register command for a program that is already installed, the changes take effect the next time the program is installed.


Reset session

Allows you to reset (delete) a session from the Terminal server.

reset session {sessionname | sessionid} [/server:servername] [/v]

Parameters

sessionname

The name of the session you want to reset. To determine the name of the session, use the Query session command.

sessionid

The ID of the session to reset.

/server:servername

Specifies the Terminal server containing the session you want to reset. Otherwise, the current Terminal server is used.

/v

Displays information about the actions being performed.

Notes

  • You can always reset your own sessions, but you must have Full Control access permission to reset another user's session.
  • Be aware that resetting a user's session without warning can result in loss of data at the session.
  • You should reset a session only when it malfunctions or appears to have stopped responding.
  • The /server parameter is required only if you use reset session from a remote server.


Shadow

Allows you to remotely control an active session of another user. You can either view or actively control the session. If you choose to actively control a user's session, you will be able to input keyboard and mouse actions to the session.

shadow {sessionname | sessionid} [/server:servername] [/v]

Parameters

sessionname

The name of the session you want to remotely control.

sessionid

The ID of the session you want to remotely control. Use query user to display the list of sessions and their session IDs.

/server:servername

Specifies the Terminal server containing the session you want to remotely control. By default, the current Terminal server is used.

/v

Displays information about the actions being performed.

Examples

To shadow session 93, type:

shadow 93

To shadow the session ACCTG01, type:

shadow ACCTG01

Notes

  • You can always remotely control your own sessions (except the current session), but you must have Full Control access permission to remotely control another session.
  • You can also initiate remote control using Terminal Services Manager. For more information, see To remotely control a session.
  • Before monitoring begins, the server warns the user that the session is about to be remotely controlled, unless this warning is disabled. Your session might appear to be frozen for a few seconds while it waits for a response from the user. To configure remote control for users and sessions, use Terminal Services Configuration or the Terminal Services extensions to Local Users and Groups and Active Directory for Users and Computers.
  • Your session must be capable of supporting the video resolution used at the session you are remotely controlling or the operation fails.
  • The console session can neither remotely control another session nor can it be remotely controlled by another session.
  • When you want to end remote control (shadowing), press CTRL+* (using * from the numeric keypad only), or whatever hot key you have defined. You define the hot key in Terminal Services Manager.


Tscon

Connects to another session.

tscon {sessionID | sessionname} [/server:servername] [/dest:sessionname] [/password:password] [/v]

Parameters

sessionID

The ID of the session to which you want to connect. If you use the optional /dest:sessionname parameter, this is the ID of the session to which you want to connect.

sessionname

The name of the session to which you want to connect.

/server:servername

Specifies the Terminal server containing the session to which you want to connect. By default, the current Terminal server is used.

/dest:sessionname

Specifies the name of the current session. This session will disconnect when you connect to the new session.

/password:password

The password of the user who owns the session to which you want to connect. This password is required when the connecting user does not own the session.

/v

Displays information about the actions being performed.

Examples

To connect to session 12 on the current Terminal server and disconnect the current session, type:

tscon 12

To connect to session 23 on the current Terminal server, using the password mypass, and disconnect the current session, type:

tscon 23 /password:mypass

To connect the session named TERM03 to the session named TERM05, and then disconnect session TERM05, if it is connected, type:

tscon TERM03 /v /dest:TERM05

Notes

  • You must have Full Control access permission or Connect special access permission to connect to another session.
  • The /dest:sessionname parameter allows you to connect the session of another user to a different session.
  • If you do not specify a password in the password parameter, and the target session belongs to a user other than the current one, tscon fails.
  • You cannot connect to the console session.


Tsdiscon

Disconnects a session from a Terminal server.

tsdiscon [sessionid | sessionname] [/server:servername] [/v]

Parameters

sessionid

The ID of the session to disconnect.

sessionname

The name of the session to disconnect.

/server:servername

Specifies the Terminal server containing the session you want to disconnect. Otherwise, the current Terminal server is used.

/v

Displays information about the actions being performed.

Examples

To disconnect the current session, type:

tsdiscon

To disconnect session 10, type:

tsdiscon 10

To disconnect the session named TERM04, type:

tsdiscon TERM04

Notes

  • You must have Full Control permission to disconnect another user from a session.
  • If no session ID or session name is specified, tsdiscon disconnects the current session.
  • Any applications that were running when you disconnected the session are automatically running when you reconnect to that session with no loss of data. Use Reset session to end the running applications of the disconnected session, but be aware that this might result in loss of data at the session.
  • The /server parameter is required only if you use tsdiscon from a remote server.
  • The console session cannot be disconnected.


Tskill

Ends a process.

tskill {processid | processname} [/server:servername] [/id:sessionid | /a] [/v]

Parameters

processid

The ID of the process you want to end.

processname

The name of the process you want to end. You can use wildcards to specify this parameter.

/server:servername

Specifies the Terminal server containing the process you want to end. Otherwise, the current Terminal server is used.

/id:sessionid

Ends the process running in the specified session.

/a

Ends the process running in all sessions.

/v

Displays information about the actions being performed.

Notes

  • You can use tskill to end only those processes belonging to you, unless you are an administrator. Administrators have full access to all tskill functions and can end processes running in other user sessions.
  • When all processes running in a session end, the session also ends.


Tsprof

Copies the user configuration information (displayed in the Terminal Services extensions to Local Users and Groups and Active Directory Users and Computers) from one user to another. Tsprof can also set the profile path for a user.

tsprof /update {/domain:domainname | /local} /profile:profilepath username

tsprof /copy {/domain:domainname | /local}[/profile:profilepath] src_usr dest_usr

tsprof /q {/domain:domainname | /local} username

Parameters

username

The name of the user for whom you want to update or query the server profile path.

srcusername

The name of the user from whom you want to copy the user configuration information.

destusername

The name of the user to whom you want to copy the user configuration information.

/domain:domainname

The name of the domain in which the operation is applied.

/local

Applies the operation only to local user accounts.

/profile:profilepath

The profile path as displayed in the Terminal Services extensions in Local Users and Groups and Active Directory Users and Computers.

/update

Updates profile path information for username in domain domainname to profilepath.

/copy

Copies user configuration information from src_usr to dest_usr and updates the profile path information for dest_usr to profilepath. Both src_usr and dest_usr must either be local or must be in domain domainname.

/q

Displays the current profile path of the user for whom you want to query the server profile path.

Security restrictions

Only administrators can run tsprof.


Tsshutdn

Allows an administrator to remotely shut down or reboot a Terminal server. You can also choose to power off the server if the computer supports software control of AC power.

tsshutdn [wait_time] [/server:servername] [/reboot] [/powerdown] [/delay:logoffdelay] [/v]

Parameters

wait_time

After notifying users, specifies an amount of time (in seconds) to wait before logging off all users from their sessions. The default is 60 seconds.

/server:servername

Specifies the Terminal server to shut down. If unspecified, the current Terminal server is shut down.

/reboot

Reboots the Terminal server after user sessions are ended.

/powerdown

Turns off the Terminal server if the computer supports software control of AC power.

/delay:logoffdelay

After logging off users from their sessions, specifies the amount of time to wait before ending all processes and shutting down the Terminal server. The default is 30 seconds.

/v

Displays information about the actions being performed.

Notes

  • Only administrators can run tsshutdn.
  • Using Shut Down on the Start menu is not recommended for shutting down a Terminal server. This method does not notify users before ending their sessions.
  • All connected sessions are notified that they are going to be shut down. Sessions that have applications with open files prompt the user to save the files. After initiating the logoff command, tsshutdn waits a specified interval (the default is 30 seconds; set by /delay), before ending all processes.
  • Tsshutdn does not reboot the Terminal server unless the /reboot option is specified.


Troubleshooting

What problem are you having?

The connection will not automatically logon to the server. I am prompted for my User name and Password on connection.

Cause: Due to encryption enhancements for Windows 2000, the Windows NT 4.0 version of Terminal Services Client will not recognize the User name and Password in the automatic logon portion of the connection file.

Solution: From the Windows NT 4.0 version of Client Connection Manager, right-click on the connection and select Properties. On the General tab, check Automatic logon and type the User name, Password, and Domain.

See also: To change logon information.

Installation of an .msi package fails from a remote Terminal Services session.

Cause: You must have administrative privileges to install .msi packages for Terminal Services from a remote session.

Solution: From the console, use Add/Remove Programs in Control Panel to install .msi packages.

See also: To install a program using Add/Remove Programs.

Installed program does not work properly.

Cause: The program was installed before Terminal Services was enabled in application server mode.

Solution: Uninstall the program, and reinstall using either Add/Remove Programs or the change user command.

See also: Starting the installation.

Cause: The program was installed using change user /execute rather than change user /install.

Solution: Uninstall the program, and reinstall using either Add/Remove Programs or the change user /install command.

See also: Starting the installation.

Cause: Program compatibility scripts were not run properly.

Solution: Run the program scripts again.

See also: Program compatibility.