Professional Windows Server 1002003 Security A Technical Reference [Electronic resources]

Add a User to Remote Desktop Users Group

You can grant users the rights necessary for them to log on to WS2003 machines using Remote Desktop in two ways:

Add them to the Administrators group

This is not recommended as administrators have powerful rights, and membership in this group should therefore be restricted as much as possible.

Add them to the Remote Desktop Users group

This is the preferred method of granting users the right to remotely manage servers on which Remote Connections has been enabled.

You can add users to the Remote Desktop Users group using Local Users and Groups in Computer Management, or you can do the following:

Control Panel System Remote Select Remote Users Add select user or group

Enable Remote Connections

Control Panel System Remote select Allow users to connect remotely to your computer

Your server can now be remotely managed using Remote Desktop.

Install Remote Desktop Connection

Remote Desktop Connection is included in WS2003 and XP but needs to be installed in downlevel Windows platforms. Here are two ways to install a Terminal Services Client on a downlevel Windows machine:

From the Internet

Visit www.microsoft.com/downloads search for Remote Desktop Connection Software download and install appropriate client for your platform

From a shared folder on a WS2003 file server

First, log on to the file server and create a

Tsclient share:

Windows Explorer right-click on

\System32\Clients\Tsclient folder Sharing and Security Sharing Share this folder

Then log on to the downlevel Windows machine and do the following:

Start Run \\fileserver\Tsclient\Win32\Setup.exe follow prompts

Connect Using Remote Desktop Connection

From a WS2003 or XP machine

Start All Programs Accessories Communications Remote Desktop Connection specify IP address or DNS name of server on which Remote Desktop for Administration has been enabled Connect

From a downlevel Windows machine

Install the appropriate Terminal Services Client continue as above

Configure Remote Desktop Connection

Start All Programs Accessories Communications Remote Desktop Connection Options specify remote computer specify credentials specify display settings enable access to keyboard, sound, disks, printers, and ports optimize experience for best performance save connection settings in My Documents as

.rdp file for later use

Disconnect Without Terminating a Remote Session

Remote Desktop Connection window Start Shut Down Disconnect

Alternatively, simply click the close gadget on the Remote Desktop Connection window. The next time you connect to the remote computer, you will be reconnected to your session.

Terminate a Remote Session

Remote Desktop Connection window Start Shut Down Log Off

Install Remote Desktop Web Connection

Do the following on a WS2003 machine on which IIS has been installed:

Control Panel Add or Remote Programs Add/Remote Windows Components Application Server Details Internet Information Services Details World Wide Web Service Details Remote Desktop Web Connection

The ActiveX control for Remote Desktop Web Connection is now installed on the web server. To install the control on the client, do the following:

Internet Explorer http://webserver/tsweb/ enter IP address or name of remote server on which Remote Desktop for Administration has been enabled specify screen size and logon information Connect ActiveX control installs and you are connected to the remote machine

Connect to Console Session on Remote Server

A console session is a Remote Desktop session that mirrors the session of the locally logged-on user on the remote machine. For example, say you log on interactively to a server on which Remote Desktop for Administration has been enabled and open

msn.com using Internet Explorer. Then, you go to a second machine and remotely connect to the first machine using a console session. You will see Internet Explorer open and display

msn.com in your session window! If you then return to your first machine, you'll find that your session has been locked out. Press Ctrl+Alt+Delete to unlock the machine, go back to the second machine, and you'll find that your remote session has been disconnected! The moral of the story is that a WS2003 machine can have only one console session running at any time, whether a local console session or a remote one!

To open a remote console session, use the Remote Desktops Console in Administrative Tools:

Administrative Tools Remote Desktops Console right-click on Remote Desktops Add new connection specify name or IP address of remote server on which Remote Desktop for Administration has been enabled specify credentials for connecting remotely OK select new connection to open console session with remote server