Difference between revisions of "Configuring Windows Server 2008 Remote Desktop Administration"

Revision as of 16:13, 14 July 2008

Windows Server 2008 is, as the name suggests, a server operating system. In the real world this means that systems running Windows Server 2008 will most likely be located in large rack systems in a server room. As such, it is highly unlikely that system administrators are going to want to have to physically visit each of these servers to perform routine administrative tasks such as system configuration and monitoring. A far preferable scenario involves these administrators remotely logging into the servers from their own desktop systems to perform administrative tasks. Fortunately Windows Server 2008 provides precisely this functionality though Remote Desktop and the remote administration features of the Machine Management Console (MMC). In this chapter we will look at the steps necessary to remotely administer Windows Server 2008 systems using Remote Desktop. For details of remote administration refer to Windows Server 2008 Remote Administration using the MMC

What is Remote Desktop?

Remote Desktop allows the graphical interface of a remote Windows system to be displayed on a local system. In addition, keyboard and mouse events on the local system are transmitted to the remote system enabling the local user to perform tasks on the remote system as if they were physically sitting at the remote system. This remote control can be established in a number of ways, including over wide area networks (WAN), local area networks (LAN) or over the internet.

In the case of Windows Server 2008, this service is provided by Terminal Services running on the remote systems and the Remote Desktop Connection (RDC) client on the local system.

Terminal Services run in two different modes, Remote Desktop for Administration and Terminal Server. Remote Desktop for Administration provides full administration functionality to the remote administrator (including access to the console session and visibility of notification messages). Remote Desktop for Administration is the equivalent to working directly at the remote system's console. In Terminal Server mode the user is subject to some limitations such as the ability to install applications and view console notification messages.

Windows Server 2008 imposes some administrator logon restrictions. Specifically, a maximum of two administrators may be logged on at any one time, either two logged on remotely, or one local and one remote administrator. This assumes, however, that different accounts are being used to log on. In other words, the same user may not log on locally and remotely simultaneously.

Enabling Remote Desktop Administration on the Remote Server

As mentioned previously, remote desktop functionality on the server is provided by Terminal Services. It is important to note, however, that Terminal Services do not have to be explicitly enabled on the server in order to support Remote Desktop Administration. In fact, all that needs to be done is to enable Remote Desktop Administration. This is configured by opening the Control Panel from the Start menu and selecting the System icon (if the Control Panel is in Control Panel Home mode this is located under System and Maintenance). In the Task section in the top left hand corner of the System page select Remote settings to display the following properties window:

The Remote properties dialog provides a number of options. The default setting is to disallow remote connections to the computer system. The second option allows remote desktop connections from any version of the Remote Desktop client. The third, and most secure option, will only allow connections from Remote Desktop clients with Network Level Authentication support. This typically will only allow access to systems providing secure network authentication such as Windows Vista and Windows Server 2008.

If the Windows Firewall is active, the act of enabling Remote Desktop administration also results in the creation of a firewall exception allowing Remote Desktop Protocol (RDP) traffic to pass through on TCP port 3389. This default port can be changed by changing this setting in the Registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-tcp\PortNumber. The easist way to locate this registry key value is to execute regedit from the Run window or a command prompt, select Edit - > Find and enter RDP-tcp.

Controlling Remote Desktop Access

The default configuration for Remote Desktop is to allow all members of the Administration group to connect remotely. Active Directory also contains a Remote Desktop Users group to which users may be added to provide Remote Desktop access privileges. To provide users with remote desktop open the Control Panel -> System and Maintenance -> System -> Remote settings and click on the Select Users button to invoke the Remote Desktop Users dialog illustrated in the following figure:

Note that user sith administrative privileges do not not need to be added to this list, by default they already have Remote Desktop access. To add additional users click on the Add... button to display the Select Users dialog. Enter the name of the user in the text box entitled Enter object names to select and click on Check names to list names that match the name entered. Select the appropriate name from the list. The following example shows user Bill on server winserver-2:

Click on OK to apply the change. The new user will now appear in the list of users with Remote Desktop access on the remote users screen. Click OK to close this screen and click on Appy in the System Settings screen. The specified user will now have remote desktop access to the system.