Thursday, April 27, 2006
Monday, April 24, 2006
CTX: MetaframeEvents - Printer Management - Event ID 1106
Error:
Event Type: Error
Event Source: MetaframeEvents
Event Category: Printer Management
Event ID: 1106
Date: 2/6/2006
Time: 11:48:37 AM
User: N/A
Computer: COMPUTER1
Description: Client printer auto-creation failed. The driver could not be installed. Possible reasons for the failure: The driver is not in the list of drivers on the server. The driver cannot be located. The driver has not been mapped. Client name: (COMPUTER1) Printer: (Client\COMPUTER1#\HP LaserJet 2300L PCL 6) Printer driver: (HP LaserJet 2300L PCL 6)
Solution #1:
What you can do is, Under the Printer Management Section of the CMC you can specify what drivers you wish the Citrix Servers will use. But the Citrix Universal Driver would be fine to use in your environment, as the LaserJet 4 Driver is only PCL4 Compliant. So you can do this a number of ways but simply you can do this
1. Open your CMC Console
2. Right Click -> Printer Management
3. Click on Drivers Tab
4. Select Universal Driver Only
(This will map all client printers to the Universal Driver, which is PCL4 / LaserJet 4 Compliant)
Note - A pre-requisite for this to function correctly you must have already replicated the driver to all Citrix servers within your Farm, either by using the Driver Replication options of Metaframe or by installing the driver locally on the servers themselves.
Solution #2:
1. Open you CMC Console
2. Expand Printer Management
3. Right Click on Drivers -> Compatibility
4. Compatibility list options -> (Allow only drivers in the list.)
5. Click on Add -> Select the driver you wish to enable on the Farm
6. Click on OK
7. Click on OK Again to save the Changes
8. Right Click on Drivers -> Mapping
9. Click on Add -> Enter the Client Driver Name Eg. HP LaserJet 2300L PCL 6
10. Select the Pre-Installed Server Driver (HP LaserJet 4) or install the correct driver (then replicate to all Citrix servers) and choose the HP LaserJet 2300 Series PCL 6
11. Continue to do this for the remainder of the client printers.
P.S. You can get the client driver name from the Application log when the Metaframe server cannot find a compatible driver to assign.
Source: MetaframeEvents
Category: Printer Management
Event ID: 1106
Type: Error
Description: Client Printer auto-creation failed. The driver could not be installed.
-- In this section look for the following line...> Printer driver: (HP LaserJet 2300L PCL 6)
Remove the Brackets and you have your client driver name..>
The solution #2 is useful if have any errors related with PDF printers (Adobe PDF Converter, AdobePS Acrobat Distiller, Jaws PDF Creator, PrimoPDF, SolidPDF XChange, etc). You can follow the instructions from the solution #2 and map the PDF printer to Citrix Universal Printer.
Event Type: Error
Event Source: MetaframeEvents
Event Category: Printer Management
Event ID: 1106
Date: 2/6/2006
Time: 11:48:37 AM
User: N/A
Computer: COMPUTER1
Description: Client printer auto-creation failed. The driver could not be installed. Possible reasons for the failure: The driver is not in the list of drivers on the server. The driver cannot be located. The driver has not been mapped. Client name: (COMPUTER1) Printer: (Client\COMPUTER1#\HP LaserJet 2300L PCL 6) Printer driver: (HP LaserJet 2300L PCL 6)
Solution #1:
What you can do is, Under the Printer Management Section of the CMC you can specify what drivers you wish the Citrix Servers will use. But the Citrix Universal Driver would be fine to use in your environment, as the LaserJet 4 Driver is only PCL4 Compliant. So you can do this a number of ways but simply you can do this
1. Open your CMC Console
2. Right Click -> Printer Management
3. Click on Drivers Tab
4. Select Universal Driver Only
(This will map all client printers to the Universal Driver, which is PCL4 / LaserJet 4 Compliant)
Note - A pre-requisite for this to function correctly you must have already replicated the driver to all Citrix servers within your Farm, either by using the Driver Replication options of Metaframe or by installing the driver locally on the servers themselves.
Solution #2:
1. Open you CMC Console
2. Expand Printer Management
3. Right Click on Drivers -> Compatibility
4. Compatibility list options -> (Allow only drivers in the list.)
5. Click on Add -> Select the driver you wish to enable on the Farm
6. Click on OK
7. Click on OK Again to save the Changes
8. Right Click on Drivers -> Mapping
9. Click on Add -> Enter the Client Driver Name Eg. HP LaserJet 2300L PCL 6
10. Select the Pre-Installed Server Driver (HP LaserJet 4) or install the correct driver (then replicate to all Citrix servers) and choose the HP LaserJet 2300 Series PCL 6
11. Continue to do this for the remainder of the client printers.
P.S. You can get the client driver name from the Application log when the Metaframe server cannot find a compatible driver to assign.
Source: MetaframeEvents
Category: Printer Management
Event ID: 1106
Type: Error
Description: Client Printer auto-creation failed. The driver could not be installed.
-- In this section look for the following line...> Printer driver: (HP LaserJet 2300L PCL 6)
Remove the Brackets and you have your client driver name..>
The solution #2 is useful if have any errors related with PDF printers (Adobe PDF Converter, AdobePS Acrobat Distiller, Jaws PDF Creator, PrimoPDF, SolidPDF XChange, etc). You can follow the instructions from the solution #2 and map the PDF printer to Citrix Universal Printer.
Saturday, April 22, 2006
BETA: Microsoft Vista Build 5365 released today.
Microsoft Vista Build 5365 has been released to testers.According to Microsoft, this is another "refresher" build, with bug fixes rather than new features.
This build is quite a bit larger than its predecessor, with the x64 build being over 4 gigabytes.
Build details:
x86 Edition: vista_5365.8.060419-1800_winmain_idx05_x86fre_client-staged-dvd-LB2CFRE_EN_DVD.iso, 3,097.83 MB
x64 Edition: vista_5365.8.060419-1800_winmain_idx05_x64fre_client-staged-dvd-LB2CxFRE_EN_DVD.iso, 4,039.84 MB
Build 5365 is only available in English and only the x86 and x64 Ultimate editions are being released (not longhorn server included).
I tested this build and the speed of the OS is faster then previous builds. The installation changed and now is easy to install in VMware and Virtual Server.
This build is quite a bit larger than its predecessor, with the x64 build being over 4 gigabytes.
Build details:
x86 Edition: vista_5365.8.060419-1800_winmain_idx05_x86fre_client-staged-dvd-LB2CFRE_EN_DVD.iso, 3,097.83 MB
x64 Edition: vista_5365.8.060419-1800_winmain_idx05_x64fre_client-staged-dvd-LB2CxFRE_EN_DVD.iso, 4,039.84 MB
Build 5365 is only available in English and only the x86 and x64 Ultimate editions are being released (not longhorn server included).
I tested this build and the speed of the OS is faster then previous builds. The installation changed and now is easy to install in VMware and Virtual Server.
Friday, April 21, 2006
MS: Printer was deleted warning. Event 3 Print.
If you get this error:
Event Type: Warning
Event Source: Print
Event Category: None
Event ID: 3
Date: 20/04/2006
Time: 23:01:45
User: NT AUTHORITY\SYSTEM
Computer: SERVER1
Description:
Printer PRINTER1 on SERVER1 (from COMPUTER1) in session 1 was deleted.
To stop logging this warning event
In Control Panel, open Printers and Faxes.
On the File menu, click Server Properties.
On the Advanced tab, clear the Log spooler warning events check box.
Thursday, April 20, 2006
MS: Network Load Balancing (NLB): Configuration Best Practices for Windows 2000 and Windows Server 2003
General Considerations
• Some routers require a static ARP entry because they do not support the resolution of unicast IP addresses to multicast media access control addresses. For example, Cisco routers require an ARP (address resolution protocol) entry for every virtual IP address. While Network Load Balancing uses Level 2 Multicast for the delivery of packets, Cisco's interpretation of the RFCs is that Multicast is for IP Multicast. So, when the router doesn't see a Multicast IP address, it does not automatically create an ARP entry, and one has to manually have to add it on the router.
• Network Load Balancing can operate in two modes: unicast and multicast. Unicast support is enabled by default, which ensures that it operates properly with all routers. You might elect to enable multicast mode so that a second network adapter is not required for communications within the cluster. If Network Load Balancing clients access a cluster (configured for multicast mode) through a router, be sure that the router accepts an Address Resolution Protocol (ARP) reply for the cluster's (unicast) IP addresses with a multicast media access control address in the payload of the ARP structure. ARP is a TCP/IP protocol that uses limited broadcast to the local network to resolve a logically assigned IP address. Verify that all cluster hosts are operating in unicast or multicast mode, one or the other, but not both.
• If the cluster is operating in unicast mode (default setting), Network Load Balancing cannot distinguish between single adapters on each host. Therefore, any communication among cluster hosts is not possible unless each cluster host has at least two network adapters.
• You can configure Network Load Balancing on more than one network adapter. However, if you do bind NLB to a second network adapter ensure that you are configuring them correctly.
• Use only the TCP/IP network protocol on the adapter NLB is enabled for. Do not add any other protocols (for example, IPX) to this adapter.
• Enable Network Load Balancing Manager logging. You can configure Network Load Balancing manager to log each Network Load Balancing Manager event. This log can be very useful in troubleshooting problems or errors when using Network Load Balancing Manager. Enable Network Load Balancing Manager logging by clicking Log Settings in the Network Load Balancing Manager Options menu. Check the Enable logging box and specify a name and location for the log file.
• Verify that the following is true for cluster parameters, port rules, and host parameters:
• Cluster parameters and port rules are set identically on all cluster hosts.
• Port rules are set for all ports used by the load-balanced application. For example, FTP uses port 20, port 21, and ports 102465535).
• Always click Add after setting a port rule. Otherwise, the port rule will not appear in the list of rules, and the rule will not take effect.
• Ensure that the dedicated IP address is unique and the cluster IP address is added to each cluster host.
• Verify that any given load-balanced application is started on all cluster hosts on which the application is installed. Network Load Balancing is not aware higher level applications and does not start or stop applications.
• Verify that the following is true for the dedicated IP address and the cluster IP address:
• Except in the case of a virtual private network (VPN), both the dedicated IP address and the cluster IP address must be entered during setup in the Network Load Balancing Properties dialog box and also in the Internet Protocol (TCP/IP) Properties dialog box. Make sure that the addresses are the same in both places.
• When configuring a VPN load balancing cluster, you should not configure the dedicated IP address. On a VPN, only the cluster IP address should be present on each of the cluster hosts because clients running Windows 95, Windows 98, or Windows NT 4.0 may be unable to connect to the cluster if the dedicated IP address is configured on the Network Load Balancing cluster hosts. If you omit this step, the cluster will converge and appear to be working properly, but the cluster host will not accept and handle cluster traffic.
• Ensure that the dedicated IP address is always listed first (before the cluster IP address) in the Internet Protocol (TCP/IP) Properties dialog box. This will ensure that responses to connections originating from a host will return to the same host.
• Both the dedicated IP address and the cluster IP address must be static IP addresses. They cannot be DHCP addresses.
• Ensure that all hosts in a cluster belong to the same subnet and that the cluster's clients are able to access this subnet.
• No special cluster interconnect is used by Network Load Balancing. NLB uses the same network interface to maintain cluster state awareness.
• Do not enable Network Load Balancing on a computer that is part of a server-cluster cluster. Microsoft does not support this configuration.
Security and Manageability
• Use Network Load Balancing Manager to configure NLB clusters. You can configure many Network Load Balancing options through either Network Load Balancing Manager or the Network Load Balancing Properties dialog box accessed through Network Connections. However, Network Load Balancing Manager is the preferred method. Using both Network Load Balancing Manager and Network Connections together to change Network Load Balancing properties can lead to unpredictable results. Only Windows Server 2003 NLB clusters can be configured by NLB manager. You can however manage clusters that contain both Windows Server 2003 and Windows 2000 or NT 4.0 servers.
• Ensure that applications that are load balanced are properly secured. The NLB security domain does not extend to applications. As such NLB will be totally unaware if security at the applications level is compromised.
• Use two or more network adapters in each cluster host if you would like to separate management functions from regular operations. Two network adapters, is not however a default requirement.
• Command line tool for managing NLB is "nlb.exe". NLB.exe exposes a mechanism for setting up NLB configuration parameters thru the command line. There are 2 additional configuration points not exposed but can be useful for monitoring NLB state. They are queryport and params Nlb.exe queryport retrieves the state of a given port rule using the same syntax as the enable/disable/drain command line options... the information returned includes the state of the port rule, enabled, disabled or draining if the port rule is found or an indication that the port rule was not found... if found, it also returns a count of packets accepted and dropped on that port rule. Nlb.exe - params retrieves the NLB configuration just the same as "nlb display", but rather than retrieving it from the registry, it queries it directly from the kernel-mode driver - this is the CURRENT state of NLB (the registry shows what the NEXT state of NLB would be if a reload or some other operation causing the driver to read the registry was performed - the registry MAY or MAY NOT be the current state of NLB)
• Enabling remote control has security implications and the user must ensure that the NLB cluster is secure (behind a firewall) if remote control is enables. The remote control mechanism uses the UDP protocol and is assigned port 2504. Remote control datagrams are sent to the clusters primary IP address. Since the Network Load Balancing driver on each cluster host handles them, these datagrams must be routed to the cluster subnet (instead of to a back-end subnet to which the cluster is attached). When remote control commands are issued from within the cluster, they are broadcast on the local subnet. This ensures that all cluster hosts receive them even if the cluster runs in unicast mode. As such the subnet the NLB clusters are hosted on should be secure. If remote control is enabled users can use nlb.exe to remotely manage their clusters.
High Availability
• Network Adapters and NIC teaming: Most vendors today offer redundant or fault tolerant adapters i.e. adapter teaming or adapter fault tolerance (AFT). These are supported with NLB, however refer to KB article 278431 for more information.
• Fault Tolerant/Load balancing Switches: Redundancy at the switch layer can easily be provided by striping the NLB cluster hosts across multiple switches and inter-connecting all the switches that contain a single NLB cluster. Additionally, to prevent switch flooding, only the ports connected to the Primary IP address (where all inbound traffic is sent) can be made hosts of a single VLAN.
• Fault tolerant Routers: Redundant routers are the most easily overcome using a VRP (virtual router protocol) or HSRP (hot router standby protocol). This allows the router to map the cluster's primary IP address and other multi-homed addresses to the corresponding media access control address. If your router does not meet this requirement, you can create a static ARP entry in the router or you can use Network Load balancing in its default unicast mode.
• Multiple NICs in cluster nodes
Windows 2000
• If you have 2 NICs on different subnets then the NIC to which NLB is bound should have default gateway and the routing tables need to be reconfigured to make all traffic go thru the NLB NIC. Default gateway setting on the other NIC should be blank.
• If you have 2 NICs on the same subnet you will need to configure the NIC to which NLB is bound with the default gateway. The other NIC should not have a default gateway configured. No need to hack routing tables.
• Recommendation is to use one NIC in each node unless there is a business need for 2 NICs
Windows Server 2003
• If you have 2 NICs different subnets you can choose to bind NLB to either or both NICs without any issues. All traffic will go thru the correct NIC (subnet)
• If you have 2 NICs on the same subnet traffic will be routed accordingly.
Troubleshooting
• The following tools can be used to troubleshoot NLB clusters:
• Event Viewer.
• NLB.exe Display & Query Commands.
• Ping.exe.
• Network Monitor.
• Network Monitor parser for NLB (part of Windows 2000 Server Resource Kit)
Refer to KB article 280503 for more information.
• Performance Monitor
• CPU Load
• Network Interface: packets/sec
• Web Service: connection attempts/sec.
• Some routers require a static ARP entry because they do not support the resolution of unicast IP addresses to multicast media access control addresses. For example, Cisco routers require an ARP (address resolution protocol) entry for every virtual IP address. While Network Load Balancing uses Level 2 Multicast for the delivery of packets, Cisco's interpretation of the RFCs is that Multicast is for IP Multicast. So, when the router doesn't see a Multicast IP address, it does not automatically create an ARP entry, and one has to manually have to add it on the router.
• Network Load Balancing can operate in two modes: unicast and multicast. Unicast support is enabled by default, which ensures that it operates properly with all routers. You might elect to enable multicast mode so that a second network adapter is not required for communications within the cluster. If Network Load Balancing clients access a cluster (configured for multicast mode) through a router, be sure that the router accepts an Address Resolution Protocol (ARP) reply for the cluster's (unicast) IP addresses with a multicast media access control address in the payload of the ARP structure. ARP is a TCP/IP protocol that uses limited broadcast to the local network to resolve a logically assigned IP address. Verify that all cluster hosts are operating in unicast or multicast mode, one or the other, but not both.
• If the cluster is operating in unicast mode (default setting), Network Load Balancing cannot distinguish between single adapters on each host. Therefore, any communication among cluster hosts is not possible unless each cluster host has at least two network adapters.
• You can configure Network Load Balancing on more than one network adapter. However, if you do bind NLB to a second network adapter ensure that you are configuring them correctly.
• Use only the TCP/IP network protocol on the adapter NLB is enabled for. Do not add any other protocols (for example, IPX) to this adapter.
• Enable Network Load Balancing Manager logging. You can configure Network Load Balancing manager to log each Network Load Balancing Manager event. This log can be very useful in troubleshooting problems or errors when using Network Load Balancing Manager. Enable Network Load Balancing Manager logging by clicking Log Settings in the Network Load Balancing Manager Options menu. Check the Enable logging box and specify a name and location for the log file.
• Verify that the following is true for cluster parameters, port rules, and host parameters:
• Cluster parameters and port rules are set identically on all cluster hosts.
• Port rules are set for all ports used by the load-balanced application. For example, FTP uses port 20, port 21, and ports 102465535).
• Always click Add after setting a port rule. Otherwise, the port rule will not appear in the list of rules, and the rule will not take effect.
• Ensure that the dedicated IP address is unique and the cluster IP address is added to each cluster host.
• Verify that any given load-balanced application is started on all cluster hosts on which the application is installed. Network Load Balancing is not aware higher level applications and does not start or stop applications.
• Verify that the following is true for the dedicated IP address and the cluster IP address:
• Except in the case of a virtual private network (VPN), both the dedicated IP address and the cluster IP address must be entered during setup in the Network Load Balancing Properties dialog box and also in the Internet Protocol (TCP/IP) Properties dialog box. Make sure that the addresses are the same in both places.
• When configuring a VPN load balancing cluster, you should not configure the dedicated IP address. On a VPN, only the cluster IP address should be present on each of the cluster hosts because clients running Windows 95, Windows 98, or Windows NT 4.0 may be unable to connect to the cluster if the dedicated IP address is configured on the Network Load Balancing cluster hosts. If you omit this step, the cluster will converge and appear to be working properly, but the cluster host will not accept and handle cluster traffic.
• Ensure that the dedicated IP address is always listed first (before the cluster IP address) in the Internet Protocol (TCP/IP) Properties dialog box. This will ensure that responses to connections originating from a host will return to the same host.
• Both the dedicated IP address and the cluster IP address must be static IP addresses. They cannot be DHCP addresses.
• Ensure that all hosts in a cluster belong to the same subnet and that the cluster's clients are able to access this subnet.
• No special cluster interconnect is used by Network Load Balancing. NLB uses the same network interface to maintain cluster state awareness.
• Do not enable Network Load Balancing on a computer that is part of a server-cluster cluster. Microsoft does not support this configuration.
Security and Manageability
• Use Network Load Balancing Manager to configure NLB clusters. You can configure many Network Load Balancing options through either Network Load Balancing Manager or the Network Load Balancing Properties dialog box accessed through Network Connections. However, Network Load Balancing Manager is the preferred method. Using both Network Load Balancing Manager and Network Connections together to change Network Load Balancing properties can lead to unpredictable results. Only Windows Server 2003 NLB clusters can be configured by NLB manager. You can however manage clusters that contain both Windows Server 2003 and Windows 2000 or NT 4.0 servers.
• Ensure that applications that are load balanced are properly secured. The NLB security domain does not extend to applications. As such NLB will be totally unaware if security at the applications level is compromised.
• Use two or more network adapters in each cluster host if you would like to separate management functions from regular operations. Two network adapters, is not however a default requirement.
• Command line tool for managing NLB is "nlb.exe". NLB.exe exposes a mechanism for setting up NLB configuration parameters thru the command line. There are 2 additional configuration points not exposed but can be useful for monitoring NLB state. They are queryport and params Nlb.exe queryport retrieves the state of a given port rule using the same syntax as the enable/disable/drain command line options... the information returned includes the state of the port rule, enabled, disabled or draining if the port rule is found or an indication that the port rule was not found... if found, it also returns a count of packets accepted and dropped on that port rule. Nlb.exe - params retrieves the NLB configuration just the same as "nlb display", but rather than retrieving it from the registry, it queries it directly from the kernel-mode driver - this is the CURRENT state of NLB (the registry shows what the NEXT state of NLB would be if a reload or some other operation causing the driver to read the registry was performed - the registry MAY or MAY NOT be the current state of NLB)
• Enabling remote control has security implications and the user must ensure that the NLB cluster is secure (behind a firewall) if remote control is enables. The remote control mechanism uses the UDP protocol and is assigned port 2504. Remote control datagrams are sent to the clusters primary IP address. Since the Network Load Balancing driver on each cluster host handles them, these datagrams must be routed to the cluster subnet (instead of to a back-end subnet to which the cluster is attached). When remote control commands are issued from within the cluster, they are broadcast on the local subnet. This ensures that all cluster hosts receive them even if the cluster runs in unicast mode. As such the subnet the NLB clusters are hosted on should be secure. If remote control is enabled users can use nlb.exe to remotely manage their clusters.
High Availability
• Network Adapters and NIC teaming: Most vendors today offer redundant or fault tolerant adapters i.e. adapter teaming or adapter fault tolerance (AFT). These are supported with NLB, however refer to KB article 278431 for more information.
• Fault Tolerant/Load balancing Switches: Redundancy at the switch layer can easily be provided by striping the NLB cluster hosts across multiple switches and inter-connecting all the switches that contain a single NLB cluster. Additionally, to prevent switch flooding, only the ports connected to the Primary IP address (where all inbound traffic is sent) can be made hosts of a single VLAN.
• Fault tolerant Routers: Redundant routers are the most easily overcome using a VRP (virtual router protocol) or HSRP (hot router standby protocol). This allows the router to map the cluster's primary IP address and other multi-homed addresses to the corresponding media access control address. If your router does not meet this requirement, you can create a static ARP entry in the router or you can use Network Load balancing in its default unicast mode.
• Multiple NICs in cluster nodes
Windows 2000
• If you have 2 NICs on different subnets then the NIC to which NLB is bound should have default gateway and the routing tables need to be reconfigured to make all traffic go thru the NLB NIC. Default gateway setting on the other NIC should be blank.
• If you have 2 NICs on the same subnet you will need to configure the NIC to which NLB is bound with the default gateway. The other NIC should not have a default gateway configured. No need to hack routing tables.
• Recommendation is to use one NIC in each node unless there is a business need for 2 NICs
Windows Server 2003
• If you have 2 NICs different subnets you can choose to bind NLB to either or both NICs without any issues. All traffic will go thru the correct NIC (subnet)
• If you have 2 NICs on the same subnet traffic will be routed accordingly.
Troubleshooting
• The following tools can be used to troubleshoot NLB clusters:
• Event Viewer.
• NLB.exe Display & Query Commands.
• Ping.exe.
• Network Monitor.
• Network Monitor parser for NLB (part of Windows 2000 Server Resource Kit)
Refer to KB article 280503 for more information.
• Performance Monitor
• CPU Load
• Network Interface: packets/sec
• Web Service: connection attempts/sec.
TOOLS: Unlocker
Unlocker is an explorer extension that allows you with a simple right-click of the mouse on a file or folder to get rid of error message such as error deleting file or folder, cannot delete folder: it is used by another person or program.
Ever had such an annoying message given by Windows?
Cannot delete file: Access is denied
There has been a sharing violation.
The source or destination file may be in use.
The file is in use by another program or user.
Make sure the disk is not full or write-protected and that the file is not currently in use.
Unlocker is the solution.
http://ccollomb.free.fr/unlocker/
Ever had such an annoying message given by Windows?
Cannot delete file: Access is denied
There has been a sharing violation.
The source or destination file may be in use.
The file is in use by another program or user.
Make sure the disk is not full or write-protected and that the file is not currently in use.
Unlocker is the solution.
http://ccollomb.free.fr/unlocker/
Terminal Server Web Resources (Links)
Microsoft
Microsoft Windows Server 2003 Terminal Services site
http://www.microsoft.com/windowsserver2003/technologies/terminalservices
Microsoft Support
http://support.microsoft.com/
Automated Deployment Service
http://www.microsoft.com/windowsserver2003/techinfo/overview/ads.mspx
TechNet
http://www.microsoft.com/technet/
Windows System Resource Management
http://www.microsoft.com/windowsserver2003/downloads/wsrm.mspx
Microsoft Press
http://www.microsoft.com/mspress
Citrix
Citrix Knowledge Base
http://knowledgebase.citrix.com/
Portal/License Activation
http://www.citrix.com/mycitrix
Rick Dehlinger’s TweakCitrix
http://www.tweakcitrix.com
Client Solutions
Tarantella
http://www.tarantella.com
New Moon
http://www.newmoon.com
Hob Soft
http://www.hobsoft.com/www_us/home.htm
UNIX RDP Client Rdesktop
http://www.rdesktop.org
WinConnect
http://www.thinsoftinc.com
Installation
InstallShield
http://www.installshield.com
NetSupport
http://www.netsupport.com
OnDemand WinInstall
http://www.wininstall.com
Wise Solutions
http://www.wise.com
Desktop Management
AppSense
http://www.appsense.com
AppLauncher
http://www.applauncher.com
TriCerat
http://www.tricerat.com
Softricity
http://www.softricity.com
Real Enterprise Solutions
http://www.respowerfuse.com
Emergent OnLine
http://www.go-eol.com
Load Tests
Mercury Interactive
http://www.mercuryinteractive.com
Tevron
http://www.tevron.com
Scapa Technologies
http://www.scapatech.com
Macro and Script Tools
KiXtart
http://www.kixtart.org
Insight Software Solution
http://www.macroexpress.com
Pitrinec Software
http://www.pitrinec.com
Wilson WindoWare
http://www.winbatch.com
TaskWare
http://www.wintask.com
Hiddensoft
http://www.hiddensoft.com/autoit
Script Horizon
http://www.scripthorizon.com
Universal Printer Drivers
ThinPrint
http://www.thinprint.com
UniPrint
http://www.uniprint.net
TriCerat
http://www.tricerat.com
Emergent OnLine
http://www.go-eol.com
Application Access Portals
visionapp
http://www.visionapp.com
Panther
http://www.pantherpowered.com
Information
Brian Madden
http://www.brianmadden.com/
WTS Technologies
http://www.wtstek.com
Technical Remote Computing
http://dev.remotenetworktechnology.com
SBC Hardcore User Page
http://www.xs4all.nl/~soundtcr
SysInternals
http://www.sysinternals.com
TheThin
http://www.thethin.net
Thin-world.com
http://thin-world.com/
Daves Thinplace
http://www.thinplace.de/
Thin Planet
http://www.thinplanet.com/
SBC-Technet
http://www.sbc-technet.com/
Terminal Server Product Guide
http://www.winntmag.com/Techware/InteractiveProduct/TerminalServer/
Labmice.net
http://www.labmice.net/terminalsrvcs/default.htm
Microsoft Windows Server 2003 Terminal Services site
http://www.microsoft.com/windowsserver2003/technologies/terminalservices
Microsoft Support
http://support.microsoft.com/
Automated Deployment Service
http://www.microsoft.com/windowsserver2003/techinfo/overview/ads.mspx
TechNet
http://www.microsoft.com/technet/
Windows System Resource Management
http://www.microsoft.com/windowsserver2003/downloads/wsrm.mspx
Microsoft Press
http://www.microsoft.com/mspress
Citrix
Citrix Knowledge Base
http://knowledgebase.citrix.com/
Portal/License Activation
http://www.citrix.com/mycitrix
Rick Dehlinger’s TweakCitrix
http://www.tweakcitrix.com
Client Solutions
Tarantella
http://www.tarantella.com
New Moon
http://www.newmoon.com
Hob Soft
http://www.hobsoft.com/www_us/home.htm
UNIX RDP Client Rdesktop
http://www.rdesktop.org
WinConnect
http://www.thinsoftinc.com
Installation
InstallShield
http://www.installshield.com
NetSupport
http://www.netsupport.com
OnDemand WinInstall
http://www.wininstall.com
Wise Solutions
http://www.wise.com
Desktop Management
AppSense
http://www.appsense.com
AppLauncher
http://www.applauncher.com
TriCerat
http://www.tricerat.com
Softricity
http://www.softricity.com
Real Enterprise Solutions
http://www.respowerfuse.com
Emergent OnLine
http://www.go-eol.com
Load Tests
Mercury Interactive
http://www.mercuryinteractive.com
Tevron
http://www.tevron.com
Scapa Technologies
http://www.scapatech.com
Macro and Script Tools
KiXtart
http://www.kixtart.org
Insight Software Solution
http://www.macroexpress.com
Pitrinec Software
http://www.pitrinec.com
Wilson WindoWare
http://www.winbatch.com
TaskWare
http://www.wintask.com
Hiddensoft
http://www.hiddensoft.com/autoit
Script Horizon
http://www.scripthorizon.com
Universal Printer Drivers
ThinPrint
http://www.thinprint.com
UniPrint
http://www.uniprint.net
TriCerat
http://www.tricerat.com
Emergent OnLine
http://www.go-eol.com
Application Access Portals
visionapp
http://www.visionapp.com
Panther
http://www.pantherpowered.com
Information
Brian Madden
http://www.brianmadden.com/
WTS Technologies
http://www.wtstek.com
Technical Remote Computing
http://dev.remotenetworktechnology.com
SBC Hardcore User Page
http://www.xs4all.nl/~soundtcr
SysInternals
http://www.sysinternals.com
TheThin
http://www.thethin.net
Thin-world.com
http://thin-world.com/
Daves Thinplace
http://www.thinplace.de/
Thin Planet
http://www.thinplanet.com/
SBC-Technet
http://www.sbc-technet.com/
Terminal Server Product Guide
http://www.winntmag.com/Techware/InteractiveProduct/TerminalServer/
Labmice.net
http://www.labmice.net/terminalsrvcs/default.htm
TOOLS: Filemon
FileMon monitors and displays file system activity on a system in real-time. Its advanced capabilities make it a powerful tool for exploring the way Windows works, seeing how applications use the files and DLLs, or tracking down problems in system or application file configurations.
http://www.sysinternals.com/Utilities/Filemon.html
http://www.sysinternals.com/Utilities/Filemon.html
MS: Terminal Services Commands
Change logon
Uses the following parameters to enable or disable client session logons and displays the current logon status. This utility is useful for system administration. The abbreviation for this command is Chlogon.
/enable: Enables user logon from clients, but not from the console (default setting).
/disable: Disables subsequent logons from clients. Does not affect users who are already logged on.
/query: Displays the current logon status.
Change port
Changes the mapping logic for serial ports to be compatible with MS- DOS applications. The abbreviation for this command is Chgport.
Change user
Uses the following parameters to change the mapping of .ini files and the registry for the current user during application installation. The abbreviation for this command is Chguser.
/execute: Enables the mapping of .ini files to the home directory (default setting).
/install: Disables the mapping of .ini files to the home directory during application installation.
/query: Displays the current setting.
Flattemp
Enables or disables a common (flat) temporary folder (temp mapping).
/enable: Enables common temporary folders.
/disable: Disables common temporary folders.
/query: Displays the current setting.
Logoff
Terminates a user session.
Msg
Sends a message to one or more users.
Query process
Displays information about the processes of all user sessions on a terminal server. This command includes parameters for further specification of the desired information, such as process ID, user name, session name, session ID, program, or server name.
Query session
Displays information about the sessions running on a terminal server. This command includes parameters for further specification of the desired information, such as user name, session name, session ID, program, or server name.
Query termserver
Lists all terminal servers running on the network. This command includes parameters for further specification of the desired information, such as server name or domain.
Query user
Displays information about the users logged on to a terminal server. This command includes parameters for further specification of the desired information, such as user name, session name, session ID, program, or server name.
Query winsta
Same as the Query session command.
Reset session
Resets a user session to initial values. This command includes parameters for further specification of the desired information, such as session name, session ID, or server name.
Rwinsta
Same as the Reset session command.
Shadow
Allows the monitoring of the terminal server session of another user. This command includes parameters for further specification of the desired information, such as session name, session ID, or server name. All information displayed on the shadowed computer session is also displayed on the target computer.
Tscon
Attaches the client or user to an existing terminal server session.
Tsdiscon
Disconnects the client or user session from the terminal server.
Tskill
Terminates a selected process using its process ID or its name in combination with the server name and the session ID. Administrators can use this command for all processes; users can use it only for their own processes.
Tsprof
Copies the configuration information of a Terminal Services user to the configuration data of another user. You can also use the Tsprof command to update a user's profile path.
Tsshutdn
Allows an administrator to shut down the terminal server in a controlled manner. After starting Tsshutdn, no programs can be executed anymore. The session of the user who started Tsshutdn is still active, but all session information will have read-only permissions.
In particular, commands starting with Query are able to transfer many functions of the Terminal Services Administration graphical tool to the command line. (See Chapter 4.)
Uses the following parameters to enable or disable client session logons and displays the current logon status. This utility is useful for system administration. The abbreviation for this command is Chlogon.
/enable: Enables user logon from clients, but not from the console (default setting).
/disable: Disables subsequent logons from clients. Does not affect users who are already logged on.
/query: Displays the current logon status.
Change port
Changes the mapping logic for serial ports to be compatible with MS- DOS applications. The abbreviation for this command is Chgport.
Change user
Uses the following parameters to change the mapping of .ini files and the registry for the current user during application installation. The abbreviation for this command is Chguser.
/execute: Enables the mapping of .ini files to the home directory (default setting).
/install: Disables the mapping of .ini files to the home directory during application installation.
/query: Displays the current setting.
Flattemp
Enables or disables a common (flat) temporary folder (temp mapping).
/enable: Enables common temporary folders.
/disable: Disables common temporary folders.
/query: Displays the current setting.
Logoff
Terminates a user session.
Msg
Sends a message to one or more users.
Query process
Displays information about the processes of all user sessions on a terminal server. This command includes parameters for further specification of the desired information, such as process ID, user name, session name, session ID, program, or server name.
Query session
Displays information about the sessions running on a terminal server. This command includes parameters for further specification of the desired information, such as user name, session name, session ID, program, or server name.
Query termserver
Lists all terminal servers running on the network. This command includes parameters for further specification of the desired information, such as server name or domain.
Query user
Displays information about the users logged on to a terminal server. This command includes parameters for further specification of the desired information, such as user name, session name, session ID, program, or server name.
Query winsta
Same as the Query session command.
Reset session
Resets a user session to initial values. This command includes parameters for further specification of the desired information, such as session name, session ID, or server name.
Rwinsta
Same as the Reset session command.
Shadow
Allows the monitoring of the terminal server session of another user. This command includes parameters for further specification of the desired information, such as session name, session ID, or server name. All information displayed on the shadowed computer session is also displayed on the target computer.
Tscon
Attaches the client or user to an existing terminal server session.
Tsdiscon
Disconnects the client or user session from the terminal server.
Tskill
Terminates a selected process using its process ID or its name in combination with the server name and the session ID. Administrators can use this command for all processes; users can use it only for their own processes.
Tsprof
Copies the configuration information of a Terminal Services user to the configuration data of another user. You can also use the Tsprof command to update a user's profile path.
Tsshutdn
Allows an administrator to shut down the terminal server in a controlled manner. After starting Tsshutdn, no programs can be executed anymore. The session of the user who started Tsshutdn is still active, but all session information will have read-only permissions.
In particular, commands starting with Query are able to transfer many functions of the Terminal Services Administration graphical tool to the command line. (See Chapter 4.)
MS: Locking Down Windows Server 2003 Terminal Server Sessions
In certain deployments, it might be necessary to restrict user activity to a predefined set of applications or Windows operating system functionality.
This White Paper explains how you can use the features of Active Directory to restrict user sessions on the Terminal Server to only the applications and desktop functionality that the administrator deems necessary. Certain group policies are highlighted here with brief explanations of their benefits. Not all of the settings are necessary because they can create a highly restricted user interface. Use this paper as a guide to configure Terminal Server for your environment.
This White Paper explains how you can use the features of Active Directory to restrict user sessions on the Terminal Server to only the applications and desktop functionality that the administrator deems necessary. Certain group policies are highlighted here with brief explanations of their benefits. Not all of the settings are necessary because they can create a highly restricted user interface. Use this paper as a guide to configure Terminal Server for your environment.
Subscribe to:
Posts (Atom)