.png)
Single Sign-On for Terminal Services
Updated: January 12, 2009
Applies To: Windows Server 2008
Single sign-on is an authentication method that allows a user with a domain account to log on once by using a password, and then gain access to remote servers without being asked for their credentials again.
The key scenarios for single sign-on are:
- Line-of-business (LOB) applications deployment
- Centralized application deployment
Due to lower maintenance costs, many companies prefer to install their LOB applications on a terminal server and make these applications available through RemoteApps or Remote Desktop. Single sign-on makes it possible to give users a better experience by eliminating the need for users to enter credentials every time they initiate a remote session.
To implement single sign-on functionality in Terminal Services, ensure that you meet the following requirements:
- You can only use single sign-on for remote connections from a Windows Vista®-based computer to a Windows Server® 2008-based terminal server. You can also use single sign-on for remote connections from a Windows Server 2008-based server to a Windows Server 2008-based server.
- Make sure that the user accounts that are used for logging on have appropriate rights to log on to both the terminal server and the Windows Vista client.
- Your client computer and terminal server must be joined to a domain.
- You must use password-based authentication. Smart cards are not supported.
To configure the recommended settings for your terminal server, complete the following steps:
- Configure authentication on the terminal server.
- Configure the Windows Vista-based computer to allow default credentials to be used for logging on to the specified terminal servers.
-
Open Terminal Services Configuration. To open Terminal Services Configuration, click Start, click Run, type tsconfig.msc and then click OK.
-
Under Connections, right-click RDP-Tcp, and then click Properties.
-
In the Properties dialog box, on the General tab, verify that the Security Layer value is either Negotiate or SSL (TLS 1.0), and then click OK.
-
On the Windows Vista-based computer, open the Local Group Policy Editor. To open Local Group Policy Editor, click Start, and in the Start Search box, type gpedit.msc and then press ENTER.
-
In the left pane, expand the following: Computer Configuration, Administrative Templates, System, and then click Credentials Delegation.
-
Double-click Allow Delegating Default Credentials.
-
In the Properties dialog box, on the Setting tab, click Enabled, and then click Show.
-
In the Show Contents dialog box, click Add to add servers to the list.
-
In the Add Item dialog box, in the Enter the item to be added box, type the prefix termsrv/ followed by the name of the terminal server; for example, termsrv/Server1, and then click OK.
For information about other new features in Terminal Services, see What's New in Terminal Services for Windows Server 2008.
