Configure SBS Remote Desktop for one session ONLY, BUT not locking new connection attempts

[footswitch]

Hi there. I'm having this issue with a rather fresh-install of SBS 2003 (no Service Packs).
Before fresh-installing, i had this configured just as I wanted. But now, I can't seem to find my way through this.

Please, can anybody tell me: how can I limit AND/OR allow to choose which remote session to login to (since the same user can create two sessions+console session), when using remote desktop to access SBS 2003, BUT in a way that new connection attempts are still allowed (automatically replacing active connection(s))?

Basically I'm trying to configure in my server what would be the Windows XP behavior regarding Remote Desktop Connections.

This means I currently have two problems.

The server is allowing two concurrent connections. I tried to mess around with the Terminal Services Configuration to limit that, but that brought me a "hidden issue" that I didn't have in the past.

Consider the following scenario:
- You remote desktop into your server;
- Connection drops (due to an internet-related problem, for instance), and you eventually have to leave your current location, so you just close down the RDP window, expecting to finish your server mainteinance later;
- EDIT: or you just lock the session in some computer you were using, and suddenly had to leave in a hurry, forgetting to disconnect the remote session;
- When you try to remote desktop again at a later point, the connection is almost immediately refused (my laptop OS is in Portuguese, so I can't really tell what the precise message is, but it's something like:
"This computer couldn't establish a connection to the remote computer.

Try to connect later. If the problem persists, contact the remote computer owner or the network administrator.")


The behavior I'm looking for is something like:
- Server would accept new connections every time, "kicking" the currently active connections in the case of a successful login;
- Users would login to active sessions and not to new ones - this allows to continue the interrupted work.


Thank you in advance for your time and support. If you have any further questions, please feel free to ask.

Kind regards,
Luis Domingues
(footswitch)

I don't know how many admins you have?
Hopefully only one at a time logs into the server?

But if you use this as the command line for RDC
You will force it to login as the Console Session and you shouldn't have any
issues.
(And if someone is on the console they will get kicked)

%SystemRoot%\system32\mstsc.exe /console

Try that and see if that helps.

Russ


--

SBITS.Biz
Microsoft Gold Certified Partner
Microsoft Certified Small Business Specialist.
MCP, MCPS, MCNPS, (MCP-SBS)
World Wide Remote SBS2003 Support - http://www.SBITS.Biz
Information on Small Business Server 2008 - http://www.sbs2008.com
Information on Essentials Business Server - http://www.ebs2008.com



-

"footswitch" <footswitch.37kpzd@DoNotSpam.com> wrote in message
news:footswitch.37kpzd@DoNotSpam.com...
>
> Hi there. I'm having this issue with a rather *fresh-install of SBS 2003
> (no Service Packs)*.
> Before fresh-installing, i had this configured just as I wanted. But
> now, I can't seem to find my way through this.
>
> Please, can anybody tell me: how can I limit AND/OR allow to choose
> which remote session to login to (since the same user can create two
> sessions+console session), when using remote desktop to access SBS
> 2003, BUT in a way that new connection attempts are still allowed
> (automatically replacing active connection(s))?
>
> BASICALLY I'M TRYING TO CONFIGURE IN MY SERVER WHAT WOULD BE THE
> WINDOWS XP BEHAVIOR REGARDING REMOTE DESKTOP CONNECTIONS.
> This means I currently have two problems.
>
> The server is allowing two concurrent connections. I tried to mess
> around with the Terminal Services Configuration to limit that, but that
> brought me a "hidden issue" that I didn't have in the past.
>
> Consider the following scenario:
> - You remote desktop into your server;
> - Connection drops (due to an internet-related problem, for instance),
> and you eventually have to leave your current location, so you just
> close down the RDP window, expecting to finish your server mainteinance
> later;
> - *EDIT:* or you just lock the session in some computer you were using,
> and suddenly had to leave in a hurry, forgetting to disconnect the
> remote session;
> - When you try to remote desktop again at a later point, the connection
> is almost immediately refused (my laptop OS is in Portuguese, so I can't
> really tell what the precise message is, but it's something like:
> "This computer couldn't establish a connection to the remote computer.
>
> Try to connect later. If the problem persists, contact the remote
> computer owner or the network administrator.")
>
>
> *The behavior I'm looking for is something like:*
> - Server would accept new connections every time, "kicking" the
> currently active connections in the case of a successful login;
> - Users would login to active sessions and not to new ones - this
> allows to continue the interrupted work.
>
>
> Thank you in advance for your time and support. If you have any further
> questions, please feel free to ask.
>
> Kind regards,
> Luis Domingues
> (footswitch)
>
>
> --
> footswitch
> ------------------------------------------------------------------------
> footswitch's Profile: http://forums.techarena.in/members/38931.htm
> View this thread: Configure SBS Remote Desktop for one session ONLY, BUT not locking new connection attempts
>
> http://forums.techarena.in
>

footswitch wrote:
> Hi there. I'm having this issue with a rather *fresh-install of SBS
> 2003 (no Service Packs)*.
> Before fresh-installing, i had this configured just as I wanted. But
> now, I can't seem to find my way through this.
>
> Please, can anybody tell me: how can I limit AND/OR allow to choose
> which remote session to login to (since the same user can create two
> sessions+console session), when using remote desktop to access SBS
> 2003, BUT in a way that new connection attempts are still allowed
> (automatically replacing active connection(s))?
>
> BASICALLY I'M TRYING TO CONFIGURE IN MY SERVER WHAT WOULD BE THE
> WINDOWS XP BEHAVIOR REGARDING REMOTE DESKTOP CONNECTIONS.
> This means I currently have two problems.
>
> The server is allowing two concurrent connections. I tried to mess
> around with the Terminal Services Configuration to limit that, but
> that brought me a "hidden issue" that I didn't have in the past.
>
> Consider the following scenario:
> - You remote desktop into your server;
> - Connection drops (due to an internet-related problem, for instance),
> and you eventually have to leave your current location, so you just
> close down the RDP window, expecting to finish your server
> mainteinance later;
> - *EDIT:* or you just lock the session in some computer you were
> using, and suddenly had to leave in a hurry, forgetting to disconnect
> the remote session;
> - When you try to remote desktop again at a later point, the
> connection is almost immediately refused (my laptop OS is in
> Portuguese, so I can't really tell what the precise message is, but
> it's something like: "This computer couldn't establish a connection
> to the remote computer.
>
> Try to connect later. If the problem persists, contact the remote
> computer owner or the network administrator.")
>
>
> *The behavior I'm looking for is something like:*
> - Server would accept new connections every time, "kicking" the
> currently active connections in the case of a successful login;
> - Users would login to active sessions and not to new ones - this
> allows to continue the interrupted work.
>
>
> Thank you in advance for your time and support. If you have any
> further questions, please feel free to ask.
>
> Kind regards,
> Luis Domingues
> (footswitch)

Additional to Russ's post, you can also install the Windows 2003 admin tools
on an XP Pro workstation and remotely connect to terminal services mananger,
logging out or reseting orphaned sessions as needed.

You can limit admin sesssions to one, but IMHO this isn't a good idea. Use
the posted methods as described.

--
/kj

>
> Additional to Russ's post, you can also install the Windows 2003 admin
> tools on an XP Pro workstation and remotely connect to terminal services
> mananger, logging out or reseting orphaned sessions as needed.
>
> You can limit admin sesssions to one, but IMHO this isn't a good idea. Use
> the posted methods as described.
>
> --
> /kj
>

KJ is talking about this
http://www.microsoft.com/downloads/d...displaylang=en

However if you use my method you don't have to worry, you always kick the
other person out :)
And IMO you shouldn't have or need to have more than one person on the
server at a time. :)

Russ

Russ (SBITS.Biz) wrote:
>> Additional to Russ's post, you can also install the Windows 2003
>> admin tools on an XP Pro workstation and remotely connect to
>> terminal services mananger, logging out or reseting orphaned
>> sessions as needed. You can limit admin sesssions to one, but IMHO this
>> isn't a good
>> idea. Use the posted methods as described.
>>
>> --
>> /kj
>>
>
> KJ is talking about this
> http://www.microsoft.com/downloads/d...displaylang=en
>
> However if you use my method you don't have to worry, you always kick
> the other person out :)
> And IMO you shouldn't have or need to have more than one person on the
> server at a time. :)
>
> Russ

Never use TS Remote Control ?

--
/kj

Nah,

If I use the /console switch I get the Console and kick everyone anyway :)

I don't want anyone on the server while I'm on it anyway.
(Because I'm fixing things.)

:)

Russ

--

SBITS.Biz
Microsoft Gold Certified Partner
Microsoft Certified Small Business Specialist.
MCP, MCPS, MCNPS, (MCP-SBS)
World Wide Remote SBS2003 Support - http://www.SBITS.Biz
Information on Small Business Server 2008 - http://www.sbs2008.com
Information on Essentials Business Server - http://www.ebs2008.com



-

"kj [SBS MVP]" <KevinJ.SBS@SPAMFREE.gmail.com> wrote in message
news:OF%23lNJhmIHA.5692@TK2MSFTNGP03.phx.gbl...
> Russ (SBITS.Biz) wrote:
>>> Additional to Russ's post, you can also install the Windows 2003
>>> admin tools on an XP Pro workstation and remotely connect to
>>> terminal services mananger, logging out or reseting orphaned
>>> sessions as needed. You can limit admin sesssions to one, but IMHO this
>>> isn't a good
>>> idea. Use the posted methods as described.
>>>
>>> --
>>> /kj
>>>
>>
>> KJ is talking about this
>> http://www.microsoft.com/downloads/d...displaylang=en
>>
>> However if you use my method you don't have to worry, you always kick
>> the other person out :)
>> And IMO you shouldn't have or need to have more than one person on the
>> server at a time. :)
>>
>> Russ
>
> Never use TS Remote Control ?
>
> --
> /kj
>

[footswitch]

Thank you both for your kind replies.
Although I'm quite familiar with the /console switch, the server will instantly refuse connection (before even providing the logon screen) if two other connections are already in place.

Can you confirm this behavior? Is there a way to work around that?
(because it happens with me)

Before the fresh install, any new successful connection would automatically kick the previous one, if the user wouldn't stop it ("user xyz is trying to login bla bla bla, do you accept?", and it times out if there isn't a response). That's what I was looking for... I tried to change some settings in the Local Policy, unfortunately to no avail...

Thank you

If you use the /console switch it should connect
and using the tool KJ mentions you can kick the others off.

If you don't want to use these, then the person needs to make sure they LOG
Off..

How many Admins are in this server?
2 is max IMO

Anymore and you are going to ruin the soup...

Russ

--

SBITS.Biz
Microsoft Gold Certified Partner
Microsoft Certified Small Business Specialist.
MCP, MCPS, MCNPS, (MCP-SBS)
World Wide Remote SBS2003 Support - http://www.SBITS.Biz
Information on Small Business Server 2008 - http://www.sbs2008.com
Information on Essentials Business Server - http://www.ebs2008.com



-

"footswitch" <footswitch.37lhre@DoNotSpam.com> wrote in message
news:footswitch.37lhre@DoNotSpam.com...
>
> Thank you both for your kind replies.
> Although I'm quite familiar with the /console switch, the server will
> instantly refuse connection (before even providing the logon screen) if
> two other connections are already in place.
>
> Can you confirm this behavior? Is there a way to work around that?
> (because it happens with me)
>
> Before the fresh install, any new successful connection would
> automatically kick the previous one, if the user wouldn't stop it
> ("user xyz is trying to login bla bla bla, do you accept?", and it
> times out if there isn't a response). That's what I was looking for...
> I tried to change some settings in the Local Policy, unfortunately to
> no avail...
>
> Thank you
>
>
> --
> footswitch
> ------------------------------------------------------------------------
> footswitch's Profile: http://forums.techarena.in/members/38931.htm
> View this thread: Configure SBS Remote Desktop for one session ONLY, BUT not locking new connection attempts
>
> http://forums.techarena.in
>

[footswitch]

Sorry, Russ, but the /console switch only connects if the server doesn't have the two connections already "occupied" (active). It obeys to the same rules in terms of "connecting to a destination".

Besides me, there's only one admin.
But if you would like to take a look at this scenario:
- The other admin logs on to the server, from his workstation and, after performing the needed tasks, he leaves the session open in the background, just in case he forgot something and has to come back to it.
- I log on to my own session in the server, from another workstation, and I'm performing some tasks as well. Someone calls me from across the room, I quickly lock my station and go there to be informed that I need to go somewhere out of the office. I immediately follow the order, I just take my laptop and off I go.

Once at the remote site, I figure I need access to some data that I have in my server user desktop... so I try a remote connect with my laptop... and it fails... "the two connections limit!", so I call the other admin and ask him "would you please disconnect your session so I can log-on from here?", but he's not at the office right now! He basically did the same as I did! What now? Out of ideas... Well I'm certainly not going to ask someone from the office to force a power down in my workstation...

Well and I don't know how often this can happen, but it sure makes me feel useless when I don't have a solution for simple stuff like this... :/



For now, here's what I call a middle solution:

Edit, for instance, the Default Domain Controllers Policy:
- Computer Configuration
- Administrative Templates
- Windows Components
- Terminal Services

Set "Restrict Terminal Services users to a single remote session" to "Enabled".
This will reduce the possibility of reaching the two concurrent active connections limit (whenever you're able to connect with an already logged-on user, the current remote session for that user is "redirected" to the new connection - but the same user will still have the option of logging on to a different session: the console).

Also, in the "Sessions" sub-folder, there's the option "Sets a time limit for active but idle Terminal Services sessions", which has an advantage and a disadvantage:
- Although this option disconnects the session after a given time limit, but doesn't log it off, preserving unsaved work - which is a good thing;
- This will break our connections from time to time, and we'll have to reconnect (if I would configure this setting, I'd leave it with a 15 to 20min time limit, otherwise it wouldn't be useful enough).



If you have any other ideas, please let me know.
Thanks for your support, guys :)

P.S.: I'm also going to take a look at the admin tools (never really felt the need for it) - will they allow remote control of the server over the internet? who knows they'll allow the other admin to perform his tasks, making it unnecessary to use TS at all... Thanks for the advice so far

footswitch wrote:
> Sorry, Russ, but the /console switch only connects if the server
> *doesn't* have the two connections already "occupied" (active). It
> obeys to the same rules in terms of "connecting to a destination".
>
> Besides me, there's only one admin.
> But if you would like to take a look at this scenario:
> - The other admin logs on to the server, from his workstation and,
> after performing the needed tasks, he leaves the session open in the
> background, just in case he forgot something and has to come back to
> it.
> - I log on to my own session in the server, from another workstation,
> and I'm performing some tasks as well. Someone calls me from across
> the room, I quickly lock my station and go there to be informed that
> I need to go somewhere out of the office. I immediately follow the
> order, I just take my laptop and off I go.
>
> Once at the remote site, I figure I need access to some data that I
> have in my server user desktop... so I try a remote connect with my
> laptop... and it fails... "the two connections limit!", so I call the
> other admin and ask him "would you please disconnect your session so I
> can log-on from here?", but he's not at the office right now! He
> basically did the same as I did! What now? Out of ideas... Well I'm
> certainly not going to ask someone from the office to force a power
> down in my workstation...
>
> Well and I don't know how often this can happen, but it sure makes me
> feel useless when I don't have a solution for simple stuff like
> this... :/
> c

The solution is to use the terminal manager tools to connect to an orpaned
session or log it off freeing up a slot for you use. In remote cases though
you'd need to vpn or 'local' access to run the TSM mmc.

You can change the default timeout configuration so that abandon sessions
are logged off after a specified time of inactivity. That way abandon
sessions are automatically closed. Just don't make the timeout too short or
you could have other problems.

--
/kj

[footswitch]

Yes, kj, I might stick to that.

Steps provided in my previous post.

By the way: the admin tools are great for local network usage, thanks for pointing that out!

Thanks guys for all your ideas and support :)

"footswitch" <footswitch.37o1fc@DoNotSpam.com> wrote in message
news:footswitch.37o1fc@DoNotSpam.com...
>
> Yes, kj, I might stick to that.
>
> Steps provided in my previous post.
>
> By the way: the admin tools are great for local network usage, thanks
> for pointing that out!

Yes, they make a great backup. But don't forget the wizards as your primary
interface method.

....and for remote, you can install the tools on a local management
workstation and RWW into it and use it to deal with the SBS/TS session
lockout issues from there.


>
> Thanks guys for all your ideas and support :)
>
>
> --
> footswitch
> ------------------------------------------------------------------------
> footswitch's Profile: http://forums.techarena.in/members/38931.htm
> View this thread: Configure SBS Remote Desktop for one session ONLY, BUT not locking new connection attempts
>
> http://forums.techarena.in
>