Connections

Allow users to connect remotely using Terminal Services

This policy setting allows you to configure remote access to computers by using Terminal Services.

If you enable this policy setting, users who are members of the Remote Desktop Users group on the target computer can connect remotely to the target computer by using Terminal Services.

If you disable this policy setting, users cannot connect remotely to the target computer by using Terminal Services. The target computer will maintain any current connections, but will not accept any new incoming connections.

If you do not configure this policy setting, Terminal Services uses the Remote Desktop setting on the target computer to determine whether remote connection is allowed. This setting is found on the Remote tab in System Properties. By default, remote connection is not allowed.

Note

You can limit which clients are able to connect remotely by using Terminal Services by configuring the Require user authentication for remote connections by using Network Level Authentication policy setting located in Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security. You can limit the number of users who can connect simultaneously by configuring the Limit number of connections policy setting located in Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections, or by configuring the Maximum Connections option on the Network Adapter tab in the Terminal Services Configuration tool.

At least Windows XP Professional or Windows Server 2003

Configure keep-alive connection interval

This policy setting allows you to enter a keep-alive interval to ensure that the session state on the terminal server is consistent with the client state.

After a terminal server client loses the connection to a terminal server, the session on the terminal server might remain active instead of changing to a disconnected state, even if the client is physically disconnected from the terminal server. If the client logs on to the same terminal server again, a new session might be established (if Terminal Services is configured to allow multiple sessions), and the original session might still be active.

If you enable this policy setting, you must enter a keep-alive interval. The keep-alive interval determines how often, in minutes, the server checks the session state. The range of values that you can enter is 1 to 999,999.

If you disable or do not configure this policy setting, a keep-alive interval is not set and the server will not check the session state.

At least Windows Server 2003

Limit number of connections

This policy setting allows you to specify whether Terminal Services limits the number of simultaneous connections to the server.

You can use this policy setting to restrict the number of remote sessions that can be active on a server. If this number is exceeded, additional users who try to connect receive an error message telling them that the server is busy and to try again later. Restricting the number of sessions improves performance because fewer sessions are demanding system resources. By default, terminal servers allow an unlimited number of remote sessions, and Remote Desktop for Administration allows two remote sessions.

To use this setting, enter the number of connections that you want to specify as the maximum for the server. To specify an unlimited number of connections, type 999999.

If you enable this policy setting, the maximum number of connections is limited to the specified number consistent with the version of Windows and the mode of Terminal Services running on the server.

If you disable or do not configure this policy setting, limits to the number of connections are not enforced at the Group Policy level.

At least Windows Server 2003

Set rules for remote control of Terminal Services user sessions

This policy setting allows you to specify the level of remote control permitted in a Terminal Services session.

You can use this policy setting to select one of two levels of remote control: View Session or Full Control. View Session permits the remote control user to watch a session. Full Control permits the administrator to interact with the session. Remote control can be established with or without the user's permission.

If you enable this policy setting, administrators can remotely interact with a user's Terminal Services session according to the specified rules. To set these rules, select the desired level of control and permission in the Options list. To disable remote control, select No remote control allowed.

If you disable or do not configure this policy setting, remote control rules are determined by the setting on the Remote Control tab in the Terminal Services Configuration tool. By default, remote control users have full control of the session with the user's permission.

At least Windows XP Professional or Windows Server 2003