Frequently Asked Questions About Terminal Services

A. For Windows 2000 Server, first read our Windows 2000 Terminal Services Capacity and Scaling white paper. Next, build out a server that you approximate to be correct, and refer to Terminal Server Capacity Planning Tools for capacity planning, and then Terminal Services Scaling Scripts and Utilities to validate your results.

If you are using Windows Server 2003, refer to our Windows Server 2003 Terminal Server Capacity and Scaling white paper, which includes testing methodologies, results, analysis, and sizing guidelines.

A. See What's New in Terminal Server and Technical Overview of Windows Server 2003 Terminal Services.

A. For Windows 2000 Server, see David Mackey's Securing Windows 2000 Terminal Services white paper.

For Windows Server 2003 and Windows XP, you can restrict what software users can run on the server. See Using Software Restriction Policies to Protect Against Unauthorized Software and Locking Down Windows Server 2003 Terminal Server Sessions.

A. Installation notes for recent versions:

• Office XP: Installs properly by using Add/Remove Programs.
• Office 2000: Requires a "transform" file to set up. There's more information in the Microsoft Knowledge Base article How to Install Office 2000 on Windows 2000 Terminal Server (Q224313).
• Office 97: Requires special instructions from the Microsoft Knowledge Base, including the use of application-compatibility scripts.

A. In the Windows 2000 and Windows Server 2003 operating systems, you can choose one of two security modes:

• Windows NT Server 4.0, Terminal Server Edition permissions compatibility mode (Relaxed Security)
• Windows 2000/Windows Server 2003 permissions mode (Full Security)

Relaxed Security mode gives users the level of access to system components that was allowed in Windows NT 4.0. This includes the ability to modify the SYSTEM32 directory where key operating system files are stored, and read/write access to system registry settings. In Windows 2000 and Windows Server 2003, user access to operating system areas was restricted to increase security, manageability, and stability. However, some earlier programs rely on the ability to store files or settings in these restricted areas and will not run for a standard user in Windows 2000 and Windows 2003 Server. The Relaxed Security setting enables Terminal Services to support these earlier applications without having to give the user Administrator permissions.

Note that using the Relaxed Security setting does compromise the system, allowing careless or malicious users to alter system files or settings. The Full Security setting should be used wherever possible. Use Relaxed Security mode only if your test results indicate that it is necessary.

A. Microsoft does not recommend this practice, as it compromises security on the domain controller. However, you can find information in Domain Controllers Require the "Log on Locally" Group Policy Object for Terminal Services Client Connections (Q247989) in the Microsoft Knowledge Base.

A.Service Pack 6 and the Security Rollup Package.

A. No.

A. This message can appear because a user trying to log on is not in the Remote Desktop Users group, or because an account has no password. Starting with Windows XP, accessing network resources such as Remote Desktop and file shares requires that you have a password associated with an account.

A. If you're using Windows Server 2003, see Session Directory and Load Balancing Using Terminal Server.

A. You must use the command prompt to activate install mode. At the prompt, type:
change user /install

This command performs the upgrade. When the upgrade is complete, type:
change user /execute

A. Yes. Terminal Server is working now for you because it is in the grace period. For the first 120 days after installation with Windows Server 2003, or 90 days after installation with Windows 2000), any unlicensed client can connect while the terminal server waits for you to install a licensing server. After the end of the grace period, if no licensing server is found, the terminal server will stop accepting unlicensed connections. For more information, please see the following:

• Windows Server 2003 Terminal Server Licensing
• Windows Server 2003 Terminal Server Licensing Issues and Requirements for Deployment
• Windows 2000 Terminal Services Licensing

A. Please see one of the following:

• HOW TO: Activate a License Server By Using Terminal Server Licensing in Windows Server 2003
• HOW TO: Activate a License Server by Using Terminal Services Licensing in Windows 2000

A. No, Microsoft desktop operating systems (including Windows XP and Windows 2000 Professional) do not have a built-in Terminal Services CAL.

For Windows 2000 Terminal Servers, the license server issues machines running Windows 2000/Windows XP Professional a "free" Terminal Services CAL from its built-in pool (and its use is permitted under the Windows 2000 Server EULA). Windows XP Professional is a successor to Windows 2000 Professional, and as a result does not need a Terminal Services CAL to access a Windows 2000 Server running Terminal Services. However, Windows XP Home Edition is not a successor to Windows 2000 Professional (rather, it is a successor to Windows Millennium Edition) and therefore does require a Terminal Services CAL in order to access Windows 2000 Terminal Services.

For Windows Server 2003 Terminal Servers, all clients need installed CALs assigned to them in order for them to connect to Windows Server Terminal Servers. (There is no "built-in" pool.) Owners of Windows XP Professional desktop licenses are eligible for free TS CALs, however. For more information, see Terminal Server Licensing Transition Plan.

A. For Windows 2000, see Terminal Services Licensing Enhancements (Q287687).

The enhancements are included in Windows Server 2003.

A. You need a Terminal Services CAL for each device; in addition, each server must have a Windows CAL for each connection. Because non?Microsoft products run on top of Terminal Services, you need the same licensing as always, plus any additional licensing for the third-party software.

A. For details, see one of the following:

• How to Override the License Server Discovery Process in Windows Server 2003
• Establishing Preferred Windows 2000 Terminal Services License Server

A. To move a Terminal Services CAL, see Knowledge Base article How to Transfer Terminal Services CAL from One Computer to Another (Q248430).

For information about how Terminal Services CALs can be automatically reissued, please see the Knowledge Base article describing the two licensing enhancements made for Windows 2000. These licensing enhancements are also in Windows Server 2003.

A. You should back up your Terminal Services Licensing server regularly by using the Windows Backup tool or something similar. Regular backups will help protect your licensing data from accidental loss if your system experiences hardware or storage failure.

When backing up a Terminal Server Licensing server, back up both the system state data and the folder in which the Terminal Server Licensing server is installed. This step ensures that data in both the registry and the Terminal Services licensing server database is backed up.

If you restore the system state data and the database to the original Terminal Services licensing server computer, any unissued licenses are restored correctly as long as you have not replaced the operating system on the computer. Otherwise, any unissued licenses are not restored, and an event will appear in the system log providing the unissued count.

You can still restore the unissued licenses by using the TS License Manager tool with the Telephone activation mechanism, and requesting the licenses back. You can switch to the Telephone mechanism by right clicking on the server in TS License Manager, and then selecting properties from the menu.

A. See MS01-052: Clients with an Expired Temporary License May Be Unable to Connect to Terminal Services (Q315404).

A. How the terminal server discovers the licensing server depends on the environment as follows.

For Windows Server 2003 Terminal Servers:

• First the terminal server checks for license servers listed in the registry (see How to Override the License Server Discovery Process in Windows Server 2003). If one of these license servers can be contacted, discovery ends.
• Otherwise, for a Windows 2000 or Windows Server 2003 domain the terminal server will check with Active Directory for any licensing servers in Enterprise mode, found in the same site. If one is found, and can be contacted, discovery ends. If not, the terminal server will enumerate the domain controllers (first on-site, then off-site), and check with each to see if it hosts a licensing server in Domain mode. The first one found will end the discovery process.
• Alternately, for a Windows NT 4.0 domain or workgroup, the terminal server will broadcast to the subnet, and any licensing server will respond. Note that this means that the terminal server can only discover licensing servers in the same subnet.

For Windows 2000 Terminal Servers:

• For a Windows 2000 domain the terminal server will enumerate the domain controllers, and check with each to see if it hosts a licensing server in Domain mode. It will then check with Active Directory for any licensing servers in Enterprise mode. The terminal server creates two lists, one for Domain and one for Enterprise. It will first try to connect to a Domain licensing server, or failing that, an Enterprise licensing server.
• Alternately, for a Windows NT 4.0 domain or workgroup, the terminal server will broadcast to the subnet, and any licensing server will respond. Note this means that the terminal server can only discover licensing servers in the same subnet.
• If you use the registry-key override, then the terminal will not use the licensing server names found in the discovery, it will speak directly to the licensing server listed in the registry key (see Q239107). The discovery process will still run, but the results will be ignored.
• Once the terminal server has compiled a list of available licensing servers, it will select one of these at random to use. It will ping that server once every two hours to ensure the licensing service is still running, and restart the discovery process if it is not. This is a very limited communication, requiring negligible bandwidth from the network, the terminal server or the licensing server. The poll period can be changed through registry entries.

See the Windows 2000 Terminal Services Licensing white paper for more information.

A. The recommended method to configure Terminal Services Licensing servers for high availability is to install at least two Terminal Services Licensing servers with available Terminal Services CALs. Each server will then advertise in Active Directory as enterprise license servers with regard to the following Lightweight Directory Access Protocol (LDAP):

//CN=TS-Enterprise-License-Server,CN=site name,CN=sites,CN=configuration-container

Each Terminal Services Licensing server should contain 50 percent of your CALs for load balancing within your environment. If a Terminal Services Licensing server does not have valid CALs, then that Terminal Services Licensing server will attempt to refer to other Terminal Services Licensing servers with valid CALs for license issuance. (This applies to both enterprise license servers and domain license servers.)

Please review the License Issuance matrix to see all possible high-availability scenarios concerning temporary and permanent license issuance.

Each client will begin a license request and upgrade 7 days before the license expiration date. This should allow sufficient time to address any issues with individual Terminal Services Licensing servers. If all Terminal Services Licensing servers are down at the same time, new clients or clients with expired licenses will be denied access. In addition, Terminal Services Licensing servers should be separated by network subnets to ensure that a network outage does not prevent users from connecting to a Terminal Services Licensing server.

Finally, administrators should use the Terminal Server Licensing Tool to ensure that at least 10 percent of their CALs are available on each licensing server. Conversely, if available licenses are limited to a single licensing server that suffers an outage, clients with expired licenses will be denied access immediately, and clients with licenses expiring within 7 days will be denied access as they meet their expiration dates.

A. For Windows Server 2003:

• Windows Server 2003 Terminal Server Licensing White Paper
• Licensing Terminal Server in Windows Server 2003
• Windows Server 2003 Terminal Server Licensing Issues and Requirements for Deployment

• The Terminal Services licensing FAQ.
• The Terminal Services licensing white paper.
• The KB article describing the two licensing enhancements for Windows 2000 (Post Logon License Token Issuance and Automatic License Token Re-issuance).

A. No, the Windows Server 2003 needs a new version of CALs. You need a Windows Server 2003 License Server, which can serve both Windows 2000 terminal servers and Windows Server 2003 terminal servers.

A. If you have more devices than users (for example with roaming users), choose Per User. If you have more users than devices, choose Per Device.

A. If you are running Remote Administration mode on Windows 2000 or Windows Server 2003, no more than two concurrent users are allowed and there is no way to increase this unless you change it to Application Server mode. Application Server mode requires client access licenses and a licensing server. If you are using Windows XP Professional this number is limited to 1 remote connection and there is no way to increase this number.

A. By default, RDP uses port 3389 for all of its traffic. There are instructions in the Microsoft Knowledge Base for how to change this port.

A. For Windows 2000, there is a third-party application available that does this. For more information, see thethin.net/r25b.zip.

For Windows Server 2003, set the Restrict each user to one session option to Yes in Terminal Services Configuration. Alternatively, set the Restrict Terminal Services users to a single remote session group policy to Enabled.

A. This typically occurs if there is a device between the client and the server that is receiving packets but not passing them on. One way around this problem is to change the MTU size for the network adapter that is being used as a terminal server connection to clients.

Ethernet uses a maximum MTU size of 1500. You can start with 500 and then slowly move up until you notice the problem to find the correct value to set.

A. Once you have the basics of Remote Desktop figured out, you need to consider your network topology. Are you behind a firewall? Are you behind a NAT device? Do you need to create a VPN connection into your network to access your computer?

These questions are crucial to establishing connectivity. You must be able to ping the remote machine if you want to create a Remote Desktop session. The keys are that you must have port 3389 open or forwarded and also port 80 if you are using the Remote Desktop Web Connection.

If you have firewall software, you must allow incoming connections on your firewall to port 3389.

If you are on a small local network, you must forward port 3389 (and 80 as well if downloading the Web applet) to the Windows XP system.

If you have a router, check out some of the documents at PracticallyNetworked.com for router setup help.

A. Try the following:

• If your client or server is behind a firewall, ensure that 3389 is open to RDP traffic.
• Make sure your terminal server is configured with an IP address that can be seen on your WAN or Internet, like your Web server has. Since the client computer connects to the terminal server independently from its connection to the Web server, merely being able to see the Web server will not ensure that you can see the terminal server.

A. Try the following:

Black hole routers may dump packets above a certain size when you are trying to traverse a path to a server. Here's a method for looking for a black hole router, and figuring out the size of the "bottleneck."

1. Try a normal ping of the server; this sends a "minimal" packet of 32 bytes.
2. If the remote system drops all ping requests (possible for some secured systems), do a traceroute, and start your ping with the next-to-last system. Make sure you have a "plain" ping working.
3. Now try pinging with fixed-size packets that are set to not fragment. Normally the largest size possible is 1472 bytes. This is done like this:
   ping -l [buffersize] -n [target-host]
   For example, to ping 169.3.65.254 with a packet size of 1472, do this:
   ping -l 1472 -n 169.3.65.254
4. If the largest packet is rejected, determine size by bisection. Drop to about 736; if that works, try about 1100 or so, until you find close to the largest size that will work.

A. Locale must be changed on the client computer, not the terminal server. See Cannot Change Input Locale to Australia or NZ on WTS Client (Q257964).

A. This usually occurs because the Web control cannot find the server you want to connect to. See VBScript Error When You Use Terminal Services Advanced Client (Q282128) for troubleshooting steps.

A. This is a known issue and troubleshooting steps are identified in Error Message: You Cannot Initiate a Remote Desktop Connection Because the Windows Logon Software on... (300470).

A. See Scripting the Terminal Services Advanced Client.

A. See How Can I Add a New RDP Listening Port to Windows 2000/2003 Terminal Server?

A. First you must install Remote Desktop Web Connection. The Installing Remote Desktop Web Connection in Windows XP (Q284931) step-by-step article shows you how.

You use the Remote Desktop Web Connection the same way you use the standard Remote Desktop Connection application. You enter in the blank field the name of the remote computer you want to connect to and then press the connect button.

To get to the page through Internet Explorer just enter http://yourwebserver/tsweb/ in the address field, where "yourwebserver" is the name of the computer on which you installed the Remote Desktop Connection.

A. See the Using Remote Desktop article on the Windows XP site.

A. The Remote Desktop Web Connection is documented in Remote Desktop ActiveX Control Interfaces.

A. This is a known issue with anti-virus software and is fixed in Windows XP Service Pack 1.

A. There is a resource kit tool called Driveshare that requires software to be installed in addition to the client software. This tool from the resource kit isn't compatible with Windows XP Remote Desktop or the Terminal Server component of Windows Server 2003; additionally, this software depends on NETBIOS name resolution and hence doesn't work when connecting over the Internet or when there is no trust relationship between client and server. Our recommendation is to consider a third-party add-on or wait to upgrade to the Terminal Server component of Windows Server 2003, where it is supported natively.

A. You may have upgraded to Windows XP SP1 or installed the Internet Explorer Cumulative Patch from August 22nd, 2002. For more information on how to resolve this see You Cannot Connect to Terminal Services from a Web Page (328002).

A. One way to do it is to use the tsweb client. You can modify the script to allow drive redirection only to a limited set of servers.

You can use also wrap the ActiveX control to get a more polished version of this solution. See Remote Desktop ActiveX Control Interfaces.

A. Yes. See Mactopia: Download: Remote Desktop Connection Client for Mac OS X.

A. Yes. If you have a Macintosh computer with dual processors, you must have Mac OS X version 10.2.3 or later installed on your computer to use Remote Desktop Connection Client for Mac.

A. Install the most recent version of the client. (If this isn't possible, see: Windows 2000 Terminal Services Does Not Redirect Network Printers (Q264039)M and 302361 - Multifunction Printers That Use DOT4 Ports Are Not Redirected By Using Remote Desktop.)

A. Print jobs created in a session are rendered entirely on the terminal server, using the server-installed printer driver, and raw print data is sent over the Remote Desktop connection to the client. Depending on what you are trying to print, the volume of raw data generated might be very large. How fast the data gets to the client is limited by the speed of the network between client and server. Over dial-up/WAN links, due to the limited amount of bandwidth available, printing might appear slow.

A. All of the Microsoft-supplied printer drivers are tested with Terminal Services and guaranteed to work. Before using a third-party printer driver, make sure it has been certified for Terminal Services. There is a Windows Hardware Quality Labs (WHQL) program for getting third-party printer drivers certified on Terminal Services. Please ask your printer driver vendor to secure such certification.

A. Automatic printer installation works very well when there is an exact match on the server for the client-side printer driver name. There are, however, several scenarios in which there may not be an exact match on the server for the client-side driver name-for example, when the client is Windows NT or Windows 9x or the client is using an OEM-supplied driver. In these scenarios, a custom INF file can be written to create the mapping between client- and server-side driver names.

A. After making the printer setting change, be sure to wait at least 60 seconds before logging off or disconnecting. See Terminal Services Printer Redirection Not Signaled on Change to Server-Side Device Settings Tab (243942). Also, be sure to wait for 60 seconds after the redirected printer is created (after logon) before making your setting changes.

A. Windows 2000 SP3 initially broke some printing functionality, and hot fix Q328020 was released. We later discovered that the hot fix caused a separate printing problem. After that problem was fixed, we re-released the hot fix. If you don't have the hot fix, download and apply it. If you do have it, but from shortly after SP3, uninstall it, download the updated version, and apply the new version of the hotfix. See the hot fix details for more information.