THE OFFICIAL BLOG OF THE SBS "DIVA"

For whatever reason, there is a document on the download site that goes over how to add a second server to a SBS 2008 box but doesn’t go into the details of how to make it a TS box… and then the TS section doesn’t go over the “hack” to make it exposed in RDP.  That’s in another section and not in the TS section of the Technet doc.  

But here’s … to the best of my ability (and written in a plane heading home from Seattle to Fresno so this post will be without screen shots… I’ll have do to that at another time)…. the pieces you need to stand up a second server and make it a TS box in SBS 2008.

Step one:  Buy SBS 2008 Premium.  (like duh).  Keeping in mind that you CAN use the premium sku and use one copy of the OS license to build a base to install the HyperV role and then you use your SBS 2008 media to build the box and then you install another copy of the same Windows 2008 standard to be the base for your TS box on that HyperV platform.  It is fully legal to do what’s called a “one-plus-one” license where the Windows 2008 standard is a base that you put your SBS and Win2k3 second server on top of in virtualized form.

Step two:  Buy TS cals.  Terminal server … or in the 2008 R2 era, Remote Desktop Services (sorry, it’s going to take me a LONG time to stop calling it TS), need to have cals over and above the Windows Server cals that SBS 2008 provides to you.   While you do not need Server cals for that second Win2k8 server as the cals are covered by the SBS box’s license eula, it does not cover TS cals and thus you need to have Server 2k8 cals to be legal… and for it to flat out work at all.  Of all the licensing engines that Microsoft has that go to the Arthur Anderson school of counting cals (which means they can’t count worth beans), TS licensing engine actually does work to count the access and if you don’t have the TS server properly licensed, it will hand out temporary access for a certain period of time (90 days or something like that?) and then it will stop working .

Step three:  I’m going to assume that you’ve already installed the SBS 2008 server and it’s working as you need it to do.  Talk your Windows 2008 server license and install the second server and give it a local admin username password just for installation purposes.  Join the second server manually to the domain.  
http://www.microsoft.com/downloads/details.aspx?FamilyID=ad0d5500-1fbd-459e-bc58-137b6f2a4cb5&DisplayLang=en

Note this document assumes you know how to manually join a server to the domain.  You can’t use http://connect to do so.  You may need to go to the SBS 2008 console, go into computers, and add the name of what you plan your Server name to be.  You may be asked for this computer name later on, and call it something descriptive so you know that It’s the member server in the domain.  Then  go  into the system console settings on the server you are joining to the SBS 2008 domain and click on change network settings. Click on Network Identification tab and click on the fact that this computer is joining a domain.  Indicate that you are joining a network with a domain and enter in the Admin account credentials, domain name and password .   Click next.   If it needs to know the computer name, supply it with the computer name you created from before.

Now you have to do two steps to move the Server into the right organizational unit and then to enable Remote Desktop on the second server so you can remote into it.  While this is done automagically for clients via the http://connect wizard, it is not done for Servers added to the domain.
All Group Policy settings for client computers are applied to the second server with the exception of the Small Business Server Update Services Client Computers Group Policy setting. You must manually move the second server to the SBSServer organizational unit (OU) by using the Users and Computers administrative tool in Active Directory Domain Services.

 To move the second server to the Servers category and apply the Group Policy settings for servers
1.    On the server that is running Windows SBS 2008, click Start, click Administrative Tools, and then click Active Directory Users and Computers.
2.    At the User Account Control prompt, click Continue.
3.    In the console tree, expand the root node, and then expand the node for your domain.
4.    Expand MyBusiness, expand Computers, and then click SBSComputers.
5.    In the details pane, right-click the name of the second server, and then click Move.
6.    In the Move dialog box, expand MyBusiness, and then expand Computers.
7.    Select SBSServers, and then click OK.

To enable the second server to connect from the server that is running Windows SBS 2008 or other clients using Terminal Services, you need to enable the remote desktop on the second server.
 To enable a remote desktop connection to the second server
1.    On the second server, click Start, right-click Computer, and then click Properties.
2.    In the System dialog box, under Tasks, click Remote Settings.
3.    At the User Account Control prompt, click Continue.
4.    On the Remote tab of the System Properties dialog box, select the appropriate remote desktop options to allow connections from other computers that are using the remote desktop. If you are uncertain about which options to select for your environment, click Help me choose.
5.    Click OK to exit the dialog box.
So now you should have the second server added to the domain.  IMPORTANT:  If you have not moved the second server into the right Organizational Unit the Terminal Server Role won’t be a happy camper and it will be blocked from working on the TS box.

The next step (s) of the doc was taken from these sections of TechNet:

·  Plan Server and Network Resources

·  Choose the Licensing Mode

·  Configure the Terminal Services Role

·  Configure Terminal Services Licensing

·  Deploy Windows Server 2008 Terminal Services RemoteApp

(At about this time in the flight I realized that the mhtml documents that I downloaded in the Seattle airport could not be viewed in IE and needed to be opened in Word, right mouse click and open in word allowed me to read them offline, in IE 8 on Win7 I had nothing on the page)

So first we need to plan and spec out the RAM needed for a TS box.  I am not the expert here as only a few folks come in via the TS box.  It would be best to ask on the SBS2k@yahoogroups.com listserve or your peers as to what they recommend  especially for heavy use.

·  Plan Server and Network Resources
So in the planning the server and network document it talks about how you need to spec that box accordingly and have enough ram PER expected user.    At one time the magical value on 2k3 era was 128 per person, and I would expect you’d want to bump that up these days.  
Now in the planning doc is a very nice exact way to join the second server to the domain… handy when I’m trying to do this from memory on a Win7 laptop…

To join the second server to the Windows SBS 2008 network
1.    On the second server, click Start, right-click Computer, and then click Properties.
2.    In the System window, in Computer name, domain, and workgroup settings, click Change settings.
3.    In the User Account Control dialog box, click Continue.  (My comment – if you are still using the original built in admin account on this second box, you won’t see a UAC prompt)
4.    In the System Properties dialog box, click Change.
5.    In the Computer Name/Domain Changes dialog box, type a new Computer name if needed, and then in Member of, click Domain, and then type the Domain name.
6.    Type the username and password for the user.
7.    Click OK to close the dialog boxes, and then restart the computer.

The doc also stresses again that the Server MUST MUST MUST be moved to the right OU otherwise the TS role install WILL FAIL.
If you do not move the server to the SBSServers OU in the Windows SBS 2008 network, the Terminal Services installation might fail.
To move the second server to the SBSServers OU and to apply Group Policy settings for servers to it, use the Users and Computers administrative tool in Microsoft® Active Directory® Domain Services, as follows:

To move the second server to the Server OU
1.    On the server that is running Windows SBS 2008, click Start, click Administrative Tools, and then click Active Directory Users and Computers.
2.    In the console tree, expand the root node, and then expand the node for your domain.
3.    Click to expand MyBusiness, click to expand Computers, and then click SBSComputers.
4.    In the details pane, right-click the second server, and then click Move.
5.    In the Move dialog box, click to expand MyBusiness, and then click to expand Computers.
6.    Click SBSServers, and then click OK.

It may take several minutes to refresh the Group Policy setting on the second server. To manually refresh the setting, do the following:
1.    On the second server, click Start, click Run, type cmd, and then click OK.
2.    At the command prompt, type gpupdate /force, and then press ENTER.
3.    Close the command prompt: Type exit, and then press ENTER.

Now we’re ready for the next step.

·  Choose the Licensing Mode

I won’t bore you with the details, you can read that doc there, but basically you need to have from Volume licensing, your favorite “disti”, a purchase of either user TS cals or device TS cals.  User cals follow along with the user, device follows along with the device.  From the VL purchase you will get an agreement number (bear with me I’m going from memory here) that you will use later on in the licensing window on the server.  If you are just using a “play” box, dig out of your action pack that piece of paper that has the sticker on it that is labeled Terminal Server cals.  That is like a ‘retail’ purchase and uses the same licensing window, but a different part of the wizard to activate the cals.

·  Configure the Terminal Services Role

The gotcha that may nail you at this step is if you forgot to move the Server to the Server OU and out of the computers OU on the SBS 2008 box.
On the server that is running Windows Server 2008 and that you plan to use as an additional server, configure the Terminal Services role.

To install the Terminal Services role
1.    Open Server Manager. To do this, click Start, click Administrative Tools, and then click Server Manager.
2.    In the User Account Control window, click Continue.
3.    In Roles Summary, click Add Roles. The Add Roles Wizard is displayed.
4.    On the Before You Begin page, click Next.
5.    On the Select Server Roles page, select the Terminal Services check box, and then click Next.
6.    On the Terminal Services page, click Next.
7.    On the Select Role Services page, select the Terminal Server check box, and then click Next.
8.    On the Uninstall and Reinstall Applications for Compatibility page, review the information, and then click Next.
9.    On the Specify Authentication Method for Terminal Server page, select the authentication method that you prefer, and then click Next.
10.    On the Specify Licensing Mode page, select the licensing mode that you prefer, and then click Next.
11.    On the Select User Groups Allowed Access To This Terminal Server page, add any users or groups that you want to add to the Remote Desktop Users group, and then click Next.
12.    On the Confirm Installation Selections page, confirm that you want to install the Terminal Services role service, and then click Install.
13.    On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then click Yes to restart the server.
14.    After the server restarts, the Resume Configuration Wizard completes the installation. When the Installation succeeded message appears on the Installation results page, click Close.

This part should ‘just work’.  If it doesn’t, bang yourself on your head for not reading that I wrote…what THREE TIMES now that you had to move the server into the right OU otherwise you were going to fail right here at this point.
Next up … get those TS cal documents out as you need them to enter in the licensing.

·  Configure Terminal Services Licensing

Do not install the TS Licensing role service on the server that is running Windows SBS 2008.
Install the Terminal Server Licensing role service

To install the Terminal Server Licensing role service
1.    Open Server Manager. To do this, click Start, click Administrative Tools, and then click Server Manager.
2.    In the User Account Control window, click Continue.
3.    In the console pane, click Roles, and then click Terminal Services.
4.    In the console pane, in Role Services, click Add Role Services. The Add Role Services Wizard begins.
5.    On the Select Role Services page, select the TS Licensing check box.
6.    On the Configure Discovery Scope for TS Licensing page, specify the discovery scope for TS Licensing. To do this, click This domain, and then click Next.
7.    On the Confirm Installation Selections page, confirm that you want to install the TS Licensing role service, and then click Install.
8.    On the Installation Results page, confirm that the TS Licensing role service is successfully installed, and then click Close.

Activate the license server
The Terminal Services license server must be activated in order to certify the server and to allow the license server to issue permanent Terminal Services client access licenses (TS CALs). You can activate a license server by using the Activate Server Wizard in the TS Licensing Manager tool. If a license server is not activated, the license server can issue only temporary TS Per Device CALs, which are valid for 90 days, or temporary TS Per User CALs.

 Note
There are other ways that you can activate a Terminal Services licensing server. For more information, see “Activating a Terminal Services License Server” at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=131675 ).
 Important

To activate the license server, you must be a member of the local Administrators group or equivalent on the license server.
To activate the license server
1.    Click Start, click Administrative Tools, click Terminal Services, and then, in Advanced Tools, click TS Licensing Manager.
2.    Right-click the license server that you want to activate, and then click Activate Server. The Activate Server Wizard opens.
3.    Click Next.
4.    On the Connection Method page, in the Connection Method list, click Automatic connection (recommended), and then click Next.
5.    Optional: Specify any other information that you want, such as e-mail and company addresses.
6.    Click Next. The license server is activated.
7.    On the Completing the Activate Server Wizard page, do one of the following:
•    To install TS CALs on you license server, ensure that the Start Install Licenses Wizard now check box is selected, click Next, and then follow the instructions.
•    To install TS CALs later, clear the Start Install Licenses Wizard now check box, and then click Finish.
Add client licenses to the license server
After you activate your Terminal Services license server, you can install TS CALs on it. You need a license code to install the CALs. A license code is provided when you purchase your TS CALs. For more information, see “Purchase client access licenses” at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkID=81077).
 Note
There are other ways that you can install TS CALs. For more information, see “Installing Terminal Services Client Access Licenses” at the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=13168 0).
 Important
To add client licenses to the license server, you must be a member of the local Administrators group or equivalent on the license server.
To add client licenses to the license server
1.    Click Start, click Administrative Tools, click Terminal Services, and then click TS Licensing Manager.
2.    Right-click the license server on which you want to install TS CALs, and then click Properties.
3.    On the Connection Method tab, verify that the connection method for the Terminal Services license server is set to Automatic connection (recommended), and then click OK.
4.    In the console tree, right-click the Terminal Services license server on which you want to install the TS CALs, click Install Licenses to open the Install Licenses Wizard, and then click Next.
5.    On the License Program page, select the program through which you purchased your TS CALs, and then click Next.

THIS IS THE FUN PART – if it’s a VL license you wonder at first WHAT STUPID NUMBER THEY WANT!!!!!  I think I finally figured out it was the License and agreement number which you should be able to see from your eopen.microsoft.com licensing window.  The first time I did this I had to call up the licensing desk and they had to walk me through this part.  It was not the most intuitive process the first time I did this.

The license program that you select determines what information you need to provide on the next page. In most cases, this includes either a license code or an agreement number. For more information, see the documentation provided when you purchased your TS CALs.
6.    Enter the license program information, and then click Next.
7.    On the Product Version and License Type page, select the appropriate product version, license type, and quantity of TS CALs for your environment, based on your TS CAL purchase agreement, and then click Next. The TS CALs are automatically installed onto the license server.
8.    On the Completing the Install Licenses Wizard page, click Finish.

Now that the box is “licensed” now comes the fun part.

·  Deploy Windows Server 2008 Terminal Services RemoteApp

That doc does a pretty good job of giving the right info so I won’t reprint it here…(not to mention this blog post will be long enough as it is)  Charlie Russel will be going over TS Remote Apps coolness in a presentation on Killer Win2k8 features at SMBNation in Las Vegas.  So for those that are planning to attend, check out his session.

Last but certainly not least … this one is also a must have.  Now interestingly enough on the TechNet pages, it’s not listed in the TS section of the web site but in the RWW section, so I always forgot where it was until I put a notation at the bottom of Technet.  Anyone can add community content to the bottom of technet documentation, but please, do not consider them replacements for newsgroups and forums.  I’ve see questions posted on the pages, and that’s not what that community annotation section is for.

So the final step is to put the registry key in place to get the TS box to show up in RWW.  Yes, it doesn’t natively occur.  Why?  Dunno.  But the good news is that SBS DOES do this whereas EBS does not expose this ability.  They have to use TSgateway and TSremote apps and publish and RDP short cut on their RWW page whereas SBS at least has the ability to expose it.

To do so follow the following instructions:

To add a Terminal Services server in Application mode to the Select Computer drop-down list in Remote Web Workplace

Open Registry Editor.
Open the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer\RemoteUserPortal
 
Note   If the RemoteUserPortal key does not exist, create it.

Create the following multi-string (REG_MULTI_SZ) key:
TsServerNames

Type the name of your terminal services server. Type one name per line.

Verify that the name is exactly the same as the server. If a server key already exists, modify its value. If the type isn’t correct, remove it first, and then recreate it.
Click OK.

To create a new registry key that shows all computers
Open Registry Editor. To do this, click Start, in the search field type regedit, and then press ENTER.
In the User Account Control window, click Continue.
Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer.
Right-click SmallBusinessServer, click New, and then click Key.
Name the key BusinessProductivity.
Right-click BusinessProductivity, click New, and then click DWORD (32-bit) Value.
Name the new value ShowAllComputers.
Double-click ShowAllComputers, and then, in the Value data text box, type 1.
Click OK, and then close Registry Editor.

In addition to this setting there is a value to extend the time out amount in the Remote Web Workplace session .  I forgot to grab that page before I got on the plane in Seattle but when I get back on the ground and on an Internet connection I’ll grab that info and put it up in a follow up blog post.

Edit -- Back in Fresno -- the way to edit this value is here:  http://blogs.technet.com/sbs/archive/2009/06/15/how-to-configure-the-rww-timeout.aspx 

Now for another follow up blog post… I’ll post up the instructions for how to ensure that Quickbooks runs on a TS box in a 64 bit environment.  We’ve had mixed results getting the native PDF printer to work nicely. I’ve blogged some posts previously about how to do it and some folks say it worked for them, some folks say it did not.  Some folks have used the “go around it and find some other equivalent app that works nicer in the form of CutePDF as the native PDF writer.

Also if you have a fax in the SBS 2008 network and want TS users to be able to fax you have to add the Fax server role ON the TS box as well as the TS role.  If you want to use the Outlook Address Book with fax, the user needs to have an Outlook profile configured with the Fax Mail Transport added. (Thanks to ChrisP for that tip)

If you want to try out Office 2007 on your TS box you MUST have volume license version of Office 2007, most action pack folks do not get a version of Office that will allow it to be installed on a TS box.  I’ve heard that in Germany (don’t quote me email your MS rep to confirm) that in Germany partners can request a VL media kit for Office for action pack subscribers.  I need to confirm if that is true, I just read a partner posting that in one of the partner forums.

So hopefully that organizes a bit better all of the Terminal server install info into one blog post and not to mention kept me entertained during the flight back home.  The plane is starting to get close to  Fresno, so it’s time for me to shut down the laptop as well.

(now back home and editing up the post... word is not the greatest of blog editor.. lemme tell ya)