Windows Server 2008 R2 : Supporting Remote Desktop Services

Using the Role Administration Tools

For the Remote Desktop Services role, a number of different role administration tools can be used to manage the role and its role services. When the role or role service is installed, its corresponding Role Administration Tool is also installed. However, in some cases, an administrator might want to manage a role service using a remote Windows Server 2008 R2 or Windows 7 machine. In these cases, using Server Manager, an administrator can install the Remote Server Administration Tools for the Remote Desktop Services role and all of its corresponding role services.

Using the Remote Desktop Services Manager

The Remote Desktop Services Manager (tsadmin.msc) can be used to manage sessions on a Remote Desktop Session Host server. Process and resource usage on the RD Session Host server can be monitored here on a server or per-user basis. Also when an administrator wants to remote control an existing Remote Desktop session, he or she can complete this task from within the Remote Desktop Services Manager. Lastly, this tool can also be used to send messages to active session users, disconnect, reset, or log off sessions.

Managing RDS Using the Command Line

In Windows Server 2008 R2, a number of command-line tools make Remote Desktop Services administrative tasks much more flexible and scriptable. For a complete listing of these commands, refer to the Windows Server 2008 R2 and the Windows Server 2008 online help. A few of the more useful commands are as follows:

• tskill.exe— This tool can be used to kill hung or stuck processes or applications in any active session without having to connect to the session using remote control.

• Shadow.exe— This tool initiates a shadow or remote control session from a command prompt or script.

• Query.exe {Process, Session, Termserver, User}— This tool allows the administrator to query a particular server to get a list of current active and inactive sessions and processes.

Remotely Managing a Remote Desktop Session

Remote Desktop users might require support for tasks such as mapping to a file share, installing a third-party printer driver, or just troubleshooting issues within the terminal session. While using the remote control features of Remote Desktop Services, an administrator can interact with users in active sessions with view-only access or complete remote control functionality. The amount of access given to an administrator during a remote control session can be set by the user, but it can be configured at the server level by the administrator.

An administrator can remotely control a user’s session only from within a separate Remote Desktop session. The remote control command can be initiated using Remote Desktop Services Manager or the command-line tool Shadow.exe.

Managing Remote Desktop Services with PowerShell

When the Remote Desktop Services role is installed, a PowerShell provider is also installed that allows administrators to manage Remote Desktop settings using PowerShell. Once installed, and a PowerShell console is opened, administrators can access the resulting RDS: drive to manage a number of different settings that are organized into the following directories:

• RDSConfiguration— Contains settings that apply to the RD Session Host role service

• Gateway— Contains settings that apply to the RD Gateway role service

• LicenseServer— Contains settings that apply to the RD Licensing role service

• ConnectionBroker— Contains settings that apply to the RD Connection Broker role service

• RemoteApps— Contains a list of published applications and their settings

• RDFarms— Contains settings that apply to RD Session Host server farms

Group Policy for RD Session Host Servers

Group Policy contains several Remote Desktop Services user and computer settings to configure Remote Desktop sessions. An administrator can modify existing group policies or create new group policies to manage Remote Desktop Services machine and user settings. These Group Policy Objects (GPOs) can then be applied to RD Session Host servers, virtual machines, or users located in an Active Directory site, domain, or organizational unit (OU) or based on a GPO filter.

Group Policy is the preferred method of standardizing Remote Desktop Services configurations throughout Active Directory because user and machine configurations can be centrally administered. Because so many Remote Desktop Services settings are available in Group Policy, the following list outlines where Remote Desktop Services settings can be found:

• Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment— User rights assignment can allow logon through Remote Desktop Services as well as deny logon through Remote Desktop Services, depending on the configuration setting.

• Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services— Almost all Remote Desktop Services settings can be configured here. Settings here override user or client configurations and also override settings made in the User Configuration section of Group Policy.

• User Configuration\Administrative Templates\Windows Components\Remote Desktop Services— User session settings can be configured in this section. Settings here override user or client configurations.

A simple and effective way to manage the GPOs for your RD Session Host servers is to create an OU for your RD Session Host servers and apply GPOs to the OU. Enabling the Computer Configuration\Administrative Templates\System\Group Policy\User Group Policy Loopback Processing mode is very important if you want the user-context GPO settings to take effect. The loopback processing can be set to either merge or replace. Merging allows existing domain-based GPOs to merge with the ones for Remote Desktop Services, whereas the replace option overrides all other settings and the Remote Desktop Service–specific settings are only applied.

Applying Service Packs and Updates

Applying service packs and updates on an RD Session Host server or virtual machine should follow the same strategy . Test all service packs and updates in an isolated lab environment prior to production release and always create a backup of the system first to allow for rollback, if necessary.

Performing Disaster Recovery

The steps for backing up and restoring an RD Session Host server or virtual machine should follow the same procedures as backing up and restoring a standalone server. Administrators must be sure to back up any local user data, including profiles, and back up the current server System State. The data and System State backup, accompanied with a server build document, are all that an administrator needs to recover the RD Session Host server or virtual machine.