Re: Using one Username to login to TS

comments inline.

compsosinc@xxxxxxxxx wrote on 20 feb 2008 in
microsoft.public.windows.terminal_services:

We have setup a Windows 2003 Terminal Server as a member server
in an SBS2000 domain. The client purchased (10) TS Device CALs
in addition to the (10) Windows Device CALs. There are (10) XP
Pro client machines on a shopfloor that need to connect to the
TS to use a data collection program and possibly one other
TS-based application (Solidworks Viewer).

We setup (10) unique AD user accounts/passwords (Shopfloor1,
Shopfloor2, etc) for these TS users. They login into the domain
with the same credentials they use to login to the TS. We made
these (10) users members of a their own/new Security Group. We
plan to implement the Group Policy for locking down the TS. All
works great.

Now the software vendor for the TS application is saying that we
need to login to the TS using the same username in order to run
the data collection program so that only (1) license for the
application is taken for these (10) users. They recommended TS
for this program/use but mentioned nothing of just using (1) TS
user account until we found the problem.

We have never setup a TS so that multiple users use the same TS
account and have been researching pro/cons, but do not really
have a complete picture of what settings we need to change here
and what the ramifications may be.

The biggest problem with this setup is profile corruption. All
users (read: persons using the same user account) will use the same
user profile. When they logon and logoff the profile will be save,
while others are still using it. This leads to profile corruption.
Therefore, you must make the profile read-only = mandatory.

Another problem wil be redirected local printers. You don't mention
them, but if you allow redirection of local printers, the default
printer for all users using this account will change every time a
new person logs on. Printer output can appear on the wrong client.

For these users, we did not plan to redirect any folders, etc.
They will be saving no data, etc other than from within the data
collection app (mainly using barcode scanners). They will need
to have mapped drives (1) with the TS and (1) to the SBS box for
reading Solidworks files.

As long as the drive mappings are the same for everyone, this
shouldn't be a problem. But redirection of the local drives will
not work properly (see comment about redirected printer).

1. What setting(s) do we change with regards to allowing a user
to login to the TS from multiple PCs concurrently?

Allow multiple connections per user. You can do that in Terminal
Services Configuration - Server settings, or in a GPO:

Computer Configuration - Administrative templates - Windows
Components - Terminal Services
"Restrict Terminal Services Users to a single remote session"
disable this setting.

2. The customer purchased/installed Per Device TS CALs & Per
Device Windows CALs. Do we have to have both of these changed to
Per User? If so, how do we change this??

No, you can keep the licensing as it is. The users will still
connect from 10 different clients. And they use the same user
account, but that doesn't mean that they are different users (=
persons).

3. Since the users need to have very restricted access to their
local desktops and the TS, is it going to be possible to
lockdown the local desktop with one domain user account?? Or do
we keep the (10) separate accounts for logging into the domain?

I would definitively keep the 10 different domain accounts for
logging on to the clients.

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
.

Relevant Pages

  • Re: Help with configuration
    ... option cleared on the RDP-tcp connection Client properties tab for "Use ... If I do NOT specify a roaming profile path, do I still need to enable ... Users should logon to the workstation using their domain account ... Your GPO settings do not apply to your Terminal Server. ...
    (microsoft.public.windows.terminal_services)
  • Re: Using EFS with Network Shares and SFU 3.5
    ... It does not take EFS into account. ... could again use the sharing server audit logs to see if success ... Read extended attribute and Read data, since the NFS client may ... Windows and *nix clients. ...
    (microsoft.public.windows.server.security)
  • Re: 2 notebooks 1 server. sbs domain or workgroup. fax forwarding. outlook sync.
    ... computer account on SBS for the client: ... we do no need to create share folder for user profile on SBS. ...
    (microsoft.public.windows.server.sbs)
  • Account Unknown User Profile
    ... see Help and Support Center at ... Windows cannot load the locally stored profile. ... the administrator account I get this following error: ...
    (microsoft.public.windowsxp.security_admin)
  • Re: User name assigned to a new profile!
    ... Windows explorer shows that my folders and files are still there, ... Windows cannot load the locally stored profile. ... Where is his account? ...
    (microsoft.public.windowsxp.general)