Licensing: Application AND Remote Desktop Administration

G

Guest

Guest
Archived from groups: microsoft.public.windowsnt.terminalserver.setup (More info?)

I am about to set up Terminal Server on Windows 2003.

I have one user who will need access to a single application (not a Desktop)
via his remote TS client.

There is one administrator (me) who will need remote access for the purposes
of server administration only.

Having searched high and low for a definitive answer, I can not find out
whether

1. I will need two TS CALs, one for the application user, one for myself as
administrator, both using Terminal Server

or

2. I will need one CAL for the application user using Terminal Server, while
I use Remote Desktop Administration

One book I've read suggests that option 2 is possible, whereas some Google
postings suggest that option 2 is logically impossible.

I'm confused because the implication is that as soon as TS is installed,
Remote Desktop Administration is no longer available and administrators are
required to pay for a CAL to perform server adminstration via a TS session.
 
G

Guest

Guest
Archived from groups: microsoft.public.windowsnt.terminalserver.setup (More info?)

As soon as you install Terminal Services, *all* connections need a
TS CAL. So you would need 2 TS CALs.

But: since Remote Desktop for Administration actually allows 3
remote sessions (2 normal sessions and one to the console), you
could consider running in RDfA. Then you need no TS CALs at all.
You would manually have to give the user the proper permissions on
the rdp-tcp connection, since RDfA is by default only allowed for
Administrators. Note that you do *not* have to make the user a
local Administrtaor on the TS!

--
Vera Noest
MCSE,CCEA, Microsoft MVP - Terminal Server
http://hem.fyristorg.com/vera/IT
*----------- Please reply in newsgroup -------------*

"John Smith" <1@2.3> wrote on 19 maj 2005:

> I am about to set up Terminal Server on Windows 2003.
>
> I have one user who will need access to a single application
> (not a Desktop) via his remote TS client.
>
> There is one administrator (me) who will need remote access for
> the purposes of server administration only.
>
> Having searched high and low for a definitive answer, I can not
> find out whether
>
> 1. I will need two TS CALs, one for the application user, one
> for myself as administrator, both using Terminal Server
>
> or
>
> 2. I will need one CAL for the application user using Terminal
> Server, while I use Remote Desktop Administration
>
> One book I've read suggests that option 2 is possible, whereas
> some Google postings suggest that option 2 is logically
> impossible.
>
> I'm confused because the implication is that as soon as TS is
> installed, Remote Desktop Administration is no longer available
> and administrators are required to pay for a CAL to perform
> server adminstration via a TS session.
 
G

Guest

Guest
Archived from groups: microsoft.public.windowsnt.terminalserver.setup (More info?)

Much obliged.

Just to make sure I have understood the RDfA option:

1. My user can have his own TS session using RDfA, without being an
Administrator?

2. I can have my own TS session using RDfA, with full Administrative rights?

3. My user and I will see have access to the same applications, only he will
not be able to use the ones that require Administrative rights?

Considering the alternative, ie installing TS and CALs, can I limit my
user's interface to just the one software application (rather than an entire
Desktop) and could you explain how this is done? Is this an option when
configuring TS or do I have to set the application to be the Windows shell?


"Vera Noest [MVP]" <Vera.Noest@remove-this.hem.utfors.se> wrote in message
news:Xns965BA15397124veranoesthemutforsse@207.46.248.16...
> As soon as you install Terminal Services, *all* connections need a
> TS CAL. So you would need 2 TS CALs.
>
> But: since Remote Desktop for Administration actually allows 3
> remote sessions (2 normal sessions and one to the console), you
> could consider running in RDfA. Then you need no TS CALs at all.
> You would manually have to give the user the proper permissions on
> the rdp-tcp connection, since RDfA is by default only allowed for
> Administrators. Note that you do *not* have to make the user a
> local Administrtaor on the TS!
>
> --
> Vera Noest
> MCSE,CCEA, Microsoft MVP - Terminal Server
> http://hem.fyristorg.com/vera/IT
> *----------- Please reply in newsgroup -------------*
>
> "John Smith" <1@2.3> wrote on 19 maj 2005:
>
>> I am about to set up Terminal Server on Windows 2003.
>>
>> I have one user who will need access to a single application
>> (not a Desktop) via his remote TS client.
>>
>> There is one administrator (me) who will need remote access for
>> the purposes of server administration only.
>>
>> Having searched high and low for a definitive answer, I can not
>> find out whether
>>
>> 1. I will need two TS CALs, one for the application user, one
>> for myself as administrator, both using Terminal Server
>>
>> or
>>
>> 2. I will need one CAL for the application user using Terminal
>> Server, while I use Remote Desktop Administration
>>
>> One book I've read suggests that option 2 is possible, whereas
>> some Google postings suggest that option 2 is logically
>> impossible.
>>
>> I'm confused because the implication is that as soon as TS is
>> installed, Remote Desktop Administration is no longer available
>> and administrators are required to pay for a CAL to perform
>> server adminstration via a TS session.
 
G

Guest

Guest
Archived from groups: microsoft.public.windowsnt.terminalserver.setup (More info?)

1,2 and 3: Yes.
The right to connect through an rdp session is not linked to the user
rights on the server which you have *inside* the session.
If you add your user to the Remote Desktop Users group on the server,
your user will be able to start a session.

You can configure the users rdp client so that this specific
application is defined as the starting application. That means that
he won't see the desktop, and his session will end automatically when
he quits the application. Note that you can do this irrespective of
the licensing situation.
You can also enforce this setting for the whole terminal server with
a Group Policy, and than make sure that this GPO does not apply to
Administrators (this is the preferred method with multiple users).

The biggest disadvantage of running in Remote Desktop for
Administration mode is that the server doesn't use any multi-user
functionality that normally come with full-blown Terminal Services.
No personalized ini files, registry keys, etc.
So if this is really a good solution is difficult to say. And if you
see the slightest possibility that you will have *more than one* user
in the future, then install Terminal Services! After all, 2 licenses
are not that expensive.

--
Vera Noest
MCSE,CCEA, Microsoft MVP - Terminal Server
http://hem.fyristorg.com/vera/IT
*----------- Please reply in newsgroup -------------*

"John Smith" <1@2.3> wrote on 20 maj 2005:

> Much obliged.
>
> Just to make sure I have understood the RDfA option:
>
> 1. My user can have his own TS session using RDfA, without being
> an Administrator?
>
> 2. I can have my own TS session using RDfA, with full
> Administrative rights?
>
> 3. My user and I will see have access to the same applications,
> only he will not be able to use the ones that require
> Administrative rights?
>
> Considering the alternative, ie installing TS and CALs, can I
> limit my user's interface to just the one software application
> (rather than an entire Desktop) and could you explain how this
> is done? Is this an option when configuring TS or do I have to
> set the application to be the Windows shell?
>
>
> "Vera Noest [MVP]" <Vera.Noest@remove-this.hem.utfors.se> wrote
> in message
> news:Xns965BA15397124veranoesthemutforsse@207.46.248.16...
>> As soon as you install Terminal Services, *all* connections
>> need a TS CAL. So you would need 2 TS CALs.
>>
>> But: since Remote Desktop for Administration actually allows 3
>> remote sessions (2 normal sessions and one to the console), you
>> could consider running in RDfA. Then you need no TS CALs at
>> all. You would manually have to give the user the proper
>> permissions on the rdp-tcp connection, since RDfA is by default
>> only allowed for Administrators. Note that you do *not* have to
>> make the user a local Administrtaor on the TS!
>>
>> --
>> Vera Noest
>> MCSE,CCEA, Microsoft MVP - Terminal Server
>> http://hem.fyristorg.com/vera/IT
>> *----------- Please reply in newsgroup -------------*
>>
>> "John Smith" <1@2.3> wrote on 19 maj 2005:
>>
>>> I am about to set up Terminal Server on Windows 2003.
>>>
>>> I have one user who will need access to a single application
>>> (not a Desktop) via his remote TS client.
>>>
>>> There is one administrator (me) who will need remote access
>>> for the purposes of server administration only.
>>>
>>> Having searched high and low for a definitive answer, I can
>>> not find out whether
>>>
>>> 1. I will need two TS CALs, one for the application user, one
>>> for myself as administrator, both using Terminal Server
>>>
>>> or
>>>
>>> 2. I will need one CAL for the application user using Terminal
>>> Server, while I use Remote Desktop Administration
>>>
>>> One book I've read suggests that option 2 is possible, whereas
>>> some Google postings suggest that option 2 is logically
>>> impossible.
>>>
>>> I'm confused because the implication is that as soon as TS is
>>> installed, Remote Desktop Administration is no longer
>>> available and administrators are required to pay for a CAL to
>>> perform server adminstration via a TS session.
 
G

Guest

Guest
Archived from groups: microsoft.public.windowsnt.terminalserver.setup (More info?)

You are quite right. There is a strong possibibility that we will want more
remote TS users in future.

For the small cost of a couple of CALs, TS is definitely the way to go.

Many thanks for explaining everything so clearly.

"Vera Noest [MVP]" <Vera.Noest@remove-this.hem.utfors.se> wrote in message
news:Xns965C74DF0BBAveranoesthemutforsse@207.46.248.16...
> 1,2 and 3: Yes.
> The right to connect through an rdp session is not linked to the user
> rights on the server which you have *inside* the session.
> If you add your user to the Remote Desktop Users group on the server,
> your user will be able to start a session.
>
> You can configure the users rdp client so that this specific
> application is defined as the starting application. That means that
> he won't see the desktop, and his session will end automatically when
> he quits the application. Note that you can do this irrespective of
> the licensing situation.
> You can also enforce this setting for the whole terminal server with
> a Group Policy, and than make sure that this GPO does not apply to
> Administrators (this is the preferred method with multiple users).
>
> The biggest disadvantage of running in Remote Desktop for
> Administration mode is that the server doesn't use any multi-user
> functionality that normally come with full-blown Terminal Services.
> No personalized ini files, registry keys, etc.
> So if this is really a good solution is difficult to say. And if you
> see the slightest possibility that you will have *more than one* user
> in the future, then install Terminal Services! After all, 2 licenses
> are not that expensive.
>
> --
> Vera Noest
> MCSE,CCEA, Microsoft MVP - Terminal Server
> http://hem.fyristorg.com/vera/IT
> *----------- Please reply in newsgroup -------------*
>
> "John Smith" <1@2.3> wrote on 20 maj 2005:
>
>> Much obliged.
>>
>> Just to make sure I have understood the RDfA option:
>>
>> 1. My user can have his own TS session using RDfA, without being
>> an Administrator?
>>
>> 2. I can have my own TS session using RDfA, with full
>> Administrative rights?
>>
>> 3. My user and I will see have access to the same applications,
>> only he will not be able to use the ones that require
>> Administrative rights?
>>
>> Considering the alternative, ie installing TS and CALs, can I
>> limit my user's interface to just the one software application
>> (rather than an entire Desktop) and could you explain how this
>> is done? Is this an option when configuring TS or do I have to
>> set the application to be the Windows shell?
>>
>>
>> "Vera Noest [MVP]" <Vera.Noest@remove-this.hem.utfors.se> wrote
>> in message
>> news:Xns965BA15397124veranoesthemutforsse@207.46.248.16...
>>> As soon as you install Terminal Services, *all* connections
>>> need a TS CAL. So you would need 2 TS CALs.
>>>
>>> But: since Remote Desktop for Administration actually allows 3
>>> remote sessions (2 normal sessions and one to the console), you
>>> could consider running in RDfA. Then you need no TS CALs at
>>> all. You would manually have to give the user the proper
>>> permissions on the rdp-tcp connection, since RDfA is by default
>>> only allowed for Administrators. Note that you do *not* have to
>>> make the user a local Administrtaor on the TS!
>>>
>>> --
>>> Vera Noest
>>> MCSE,CCEA, Microsoft MVP - Terminal Server
>>> http://hem.fyristorg.com/vera/IT
>>> *----------- Please reply in newsgroup -------------*
>>>
>>> "John Smith" <1@2.3> wrote on 19 maj 2005:
>>>
>>>> I am about to set up Terminal Server on Windows 2003.
>>>>
>>>> I have one user who will need access to a single application
>>>> (not a Desktop) via his remote TS client.
>>>>
>>>> There is one administrator (me) who will need remote access
>>>> for the purposes of server administration only.
>>>>
>>>> Having searched high and low for a definitive answer, I can
>>>> not find out whether
>>>>
>>>> 1. I will need two TS CALs, one for the application user, one
>>>> for myself as administrator, both using Terminal Server
>>>>
>>>> or
>>>>
>>>> 2. I will need one CAL for the application user using Terminal
>>>> Server, while I use Remote Desktop Administration
>>>>
>>>> One book I've read suggests that option 2 is possible, whereas
>>>> some Google postings suggest that option 2 is logically
>>>> impossible.
>>>>
>>>> I'm confused because the implication is that as soon as TS is
>>>> installed, Remote Desktop Administration is no longer
>>>> available and administrators are required to pay for a CAL to
>>>> perform server adminstration via a TS session.