In-Depth
Windows Management from Afar
Windows Server 2003 offers significant upgrades over Windows 2000 in the area of remote connectivity.
One of the coolest new features introduced in Windows 2000 was Terminal
Services Remote Admin mode. Thanks to Terminal Services’ integration into
the base operating system, up to two administrators can remotely control
any Win2K server in their enterprise, making single-seat administration
more realistic and without the need for third-party utilities like pcAnywhere.
Of course, there are some drawbacks. In particular is Terminal Services’
lack of support for file copying to and from the remote machine, a feature
long available in Symantec’s pcAnywhere, Citrix WinFrame and other products.
Windows Server 2003 still includes the Terminal Services
technologies but deploys them differently. You might be surprised, for
example, to find that your newly installed Windows 2003 computers not
only don’t have remote control as a default option, but that there doesn’t
seem to be any way to install Terminal Services in Remote Admin mode!
Don’t panic—Windows 2003 not only includes a replacement for Remote Admin
mode but offers some much needed improvements.
Language Lesson
You’ll need to become accustomed to new terminology when it comes to Windows
2003 and Terminal Services. Remote Admin mode is gone, replaced with Remote
Desktop. Functionally, this is a one-for-one replacement for Remote Admin
mode. Remote Desktop is installed in the OS by default and can’t be removed.
If you’ve used Windows XP’s Remote Desktop, then you’re familiar with
Windows 2003’s Remote Desktop, because they work almost exactly the same.
Terminal Server is a new term that refers to
a Windows 2003 computer with Terminal Services installed, in what was
called Application Server mode. Making Windows 2003 into a Terminal Server
is what allows multiple users to log in and remotely use the server. You’ll
still need a Terminal Services Licensing server somewhere on your network
in order to use a Terminal Server.
Remote Desktop Connection (RDC) is the new
name for the Terminal Services client. It looks and feels pretty much
the same and still uses Microsoft’s Remote Desktop Protocol (RDP) to connect
to Terminal Services. Windows 2003 supports RDP 5.1, which enables some
cool new features discussed later. The RDC client included with Windows
XP and newer editions of Windows CE-powered devices are RDP 5.1-compatible;
older RDP 5.0 clients can still connect to Windows 2003 but can’t take
advantage of the new features.
Terminal Services 2000 vs. 2003
While the functionality of Terminal Services hasn't changed a great
deal in Windows Server 2003, the terminology has. Here's a summary
of the new terms and new feature, compared to Windows 2000 Terminal
Services. |
| Windows
2000 Server |
Windows
Server 2003 |
| Remote Admin Mode installation
option |
Remote Desktop always installed |
| Application Mode installation
option |
Terminal Server installation
option |
| Web client (Terminal Services
Advanced Client, or TSAC) |
Web client included with IIS
6.09 but not installed by default |
| 32-bit clients: Terminal Services client
|
32-bit clients: Remote Desktop Connection
and Remote Desktops console |
| Resource map-back: mainly printers |
Resource map-back: sound, disk drives, printers |
| Server must have copy of all printer drivers
used by clients for map-back to work |
Server uses Plug and Play to automatically
get printer drivers from NT-based clients |
| Maximum of two admin connections in Remote
Admin mode |
Max. two admin connections to Remote Desktop. |
| Only local admins have Remote Admin capability |
Remote Desktop access is configurable |
|
|
Enabling Remote Desktop
For security reasons, Windows 2003 disables Remote Desktop by default.
The software is completely installed by default—and, in fact, can’t be
removed—but turned off in keeping with Windows 2003’s “more secure out
of the box” philosophy. Turning it on is easy: Open the properties for
My Computer, click the Remote tab, and select the checkbox to allow users
to connect remotely (see Figure 1).
 |
| Figure 1. Remote Desktop is disabled by default.
Enable it through this screen. (Click image to view larger version.) |
By default, all members of the local Administrators group will have the
ability to connect to Remote Desktop, and Windows 2003 supports up to
two simultaneous remote sessions. Before enabling Remote Desktop, review
the membership of your server’s local Administrators group and any other
user groups to which you choose to grant Remote Desktop access. Remote
Desktop provides unrestricted access to the server’s desktop, so you don’t
want any untrusted users accidentally finding their way in!
Note: You don’t need to enable Remote Assistance
in order to use Remote Desktop. While the two features both use Terminal
Services technology, they’re independent. I don’t generally recommend
enabling Remote Assistance on a server, as it could lead to unauthorized
users having access to the server’s desktop.
Utilizing RDP 5.1 Features
As mentioned earlier, RDP 5.1 has some cool new features that can make
Remote Desktop a more effective administration tool. One of the biggest
complaints about Win2K Terminal Services Remote Admin mode was that there
was no way to easily copy files to and from the remote server over the
RDP connection. RDP 5.1 corrects this problem by adding the ability to
map client computer drives to the remote server to which you’re connected.
To enable this feature, open the RDC client software and configure a
new connection. On the Resources tab (see Figure 2), check the Disk drives
checkbox. Keep in mind that this feature is only available on RDP 5.1
clients—it won’t work with older RDP 5.0 servers like Win2K.
 |
| Figure 2. The ability to connect to disk drives
on the remote server is available only to RDP 5.1 clients. (Click
image to view larger version.) |
Once the connection’s activated, look at My Computer on the remote server.
You’ll find several network drives, starting with drive Z: and working
backward through the alphabet. These network drives represent the drives
on your client computer, making it easy to copy files to and from the
client and server without using additional protocols. This allows you
to completely manage the server right over RDP’s TCP port 3389, without
having to use Windows file sharing or FTP to move files back and forth.
Bear in mind that the RDP traffic is encrypted, as it always has been,
which helps to protect the confidentiality of any files you copy to and
from the remote machine.
RDP:
Under the Hood |
| Ever wonder how RDP and Terminal Services
really work? You’re probably familiar with products like
Symantec’s pcAnywhere, which essentially copy compressed
bitmaps of the server’s screen back to your client computer.
They detect screen changes and send back just the portion
of the screen that’s been altered, which improves performance.
Terminal Services is quite different. Citrix, the company
that originally created the Terminal Services technology
that Microsoft now uses, was a licensee of the Windows
NT 3.51 source code. That gave them the ability to integrate
remote control with the operating system at a very deep
level; Microsoft eventually licensed and added these
enhancements to Windows NT Server 4.0 Terminal Services
edition and then the Win2K base code.
In Windows, all screen drawing—windows, buttons, graphics,
and whatever—are accomplished by the Graphical Device
Interface (GDI), a special layer of the operating system.
When an application needs a window or checkbox drawn,
it asks GDI to do so. Terminal Services plugs into the
GDI, intercepting the GDI commands directly. These commands
are then retransmitted to the remote client, which “replays”
them. GDI commands are pretty small, even though some
of them—like redrawing the whole screen—can have a large
effect. And GDI isn’t immune to having to copy bitmaps,
such as desktop wallpaper, from time to time. Still,
by transmitting the GDI commands, RDP is able to optimize
performance over slower connections.
Although this explanation is a bit of an oversimplification,
you can see how RDP’s technique is more efficient than
bitmap-based products like pcAnywhere. And keep in mind
that Microsoft didn’t invent this technique: Citrix’
ICA protocol does exactly the same thing.
—Don Jones |
|
|
RDP 5.1’s resource redirection isn’t limited to disk drives. You can
configure it to redirect sounds made on the remote computer to the client.
RDP 5.0 allowed client printers to show up on the remote computer, which
is a useful feature. RDP 5.1 extends resource redirection capability to
serial ports and disk drives, allowing the client’s resources to appear
on the remote computer. For example, a client’s C: drive might show up
on a Terminal Server as the Z: drive, making it easy to copy files between
the server and client.
Windows 2003 also extends printer Plug and Play capabilities to RDP 5.1
clients. Imagine that your users are running Windows XP and connecting
to a Windows 2003 Terminal Server. Plug and Play allows the server to
detect users’ locally connected printers and automatically set them up
for use within the Terminal Services session. As with all things Plug
and Play, however, you’ll need to test that behavior in your environment.
If things don’t seem to be working correctly in your tests, check out
the System and Application event logs on the server, as Terminal Services
will usually add reasonably useful entries when printer mapping fails.
Remote Desktop Console: A Better RDP
Most RDC clients (including Windows XP) allow open multiple instances
of the software, which makes it possible to open multiple RDP connections.
I do that all the time in a busy environment; it’s not unusual for me
to have open four or five RDC windows, each connected to a different remote
server.
Keeping track of all those windows can be a pain, though, and Windows
2003 has a better solution: The Remote Desktops console (Figure 3). This
is a standard MMC snap-in with a list of remote servers in the left-hand
tree. The details pane on the right shows the selected server’s remote
desktop. You can easily switch between remote servers in the left-hand
list, effectively managing multiple remote connections from a single window
To add a new server to the Remote Desktops console, right-click Remote
Desktops and select Add Connection from the context menu. To connect to
a remote server, just select its connection name in the console (or right-click
and select Connect).
 |
| Figure 3. The Remote Desktops MMC snap-in can
be used to track multiple open server sessions (Click image to view
larger version.) |
To configure advanced properties for a connection, right-click the connection
name and select Properties from the context menu. You can configure the
following options:
Server’s name or IP address or the connection name.
Logon credentials.
Size of the remote desktop window. By default, it will fill the right-hand
pane of the MMC, but a custom size can be configured.
Redirecting local drives to the remote server, provided the remote server
supports RDP 5.1.
Keep in mind that the Remote Desktops console will connect not only to
Windows 2003 servers, but also to Win2K servers and even Windows XP Professional
clients that have Remote Desktop enabled. You can even connect to Windows
NT 4.0 Terminal Servers. Remote Desktops is a full RDP 5.1 client, allowing
mapping of client disk drives to the server for easier file management.
Making a Terminal Server
If you want to use Windows 2003 Terminal Services as a true Terminal Server
(formerly called Application Mode), you’ll need to open the Control Panel,
open Add/Remove Programs, and click the Add/Remove Windows Components
button. Select the Terminal Server option (Figure 4). This installs Terminal
Services’ application server capabilities.
 |
| Figure 4. To use Windows 2003 Terminal Services,
you first have to install it. (Click image to view larger version.) |
Note: Don’t get confused and accidentally select
the Application Server Windows component, as that installs IIS and some
other bits unrelated to Terminal Services.
Terminal
Services
vs. MetaFrame |
With the improvements in RDP 5.1—especially
the drive map-back capability—you may wonder why
anyone would buy Citrix MetaFrame, which adds capabilities
and Citrix’ ICA protocol to Terminal Services.
In fact, if you’re just using Terminal Services
for remote administration, you probably don’t
need MetaFrame. But that’s not why Citrix wants
you to buy it, anyway!
MetaFrame’s ICA protocol opens Terminal Services
to a wider array of clients, including Unix, handheld
devices, Java clients, and more. For now, RDP is officially
only available on Windows and Mac OS X, directly from
Microsoft. Of course, open-source RDP clients are available
for Unix, Linux, and the Palm OS, so the gap between
RDP and ICA is closing on the client end. MetaFrame
also offers load balancing and the ability for clients
to reconnect a disconnected session back to the same
server in a server farm. Terminal Services’ new
session directory, along with Network Load Balancing,
now provides a similar capability in Windows 2003.
The major features between Terminal Services and MetaFrame
are becoming more parallel. MetaFrame still offers a
variety of unique functionality, but it’s definitely
worth your time to see investigate those capabilities.
Many environments are discovering that Windows 2003’s
Terminal Services offer everything they need without
the extra expense.
—Don Jones |
|
|
As in Win2K, making a server into a Terminal Server changes its behavior
a bit. First, you’ll still need a Terminal Server Licensing Server on
your network somewhere. You’ll also need to take special steps to install
applications on the Terminal Server so they’ll be available to multiple
concurrent users. You’ll have the familiar Terminal Services Configuration
and Terminal Services Manager MMC consoles available to configure and
manage user connections, perform shadowing of user connections, and so
on—see Windows 2003’s Online Help and Support Center for details.
A Better Way to Reach Out and Touch Someone
Windows 2003’s Remote Desktop feature provides all the features and functionality
of Win2K Terminal Services Remote Admin mode—and then some! It’s installed
by default and can’t be uninstalled. But it’s installed in a disabled
configuration, making Windows 2003 more secure by default than previous
versions of Windows. Windows 2003 also includes a new Remote Desktops
console, an improved multi-connection RDP client that makes managing multiple
remote servers a breeze. All in all, Windows 2003’s evolution of Terminal
Services technology is a welcome addition to anyadministrator’s arsenal
of management tools.