The other steveb - Steve Banks' Blog on SBS, EBS, and other Small Business Technology Topics : Terminal Services

Terminal Server Access through RWW in EBS & SBS

steveb — Mon, 17 Aug 2009 19:06:00 GMT

Have had a few questions about Terminal Server through EBS and SBS RWW, so thought I would post a link over to the Microsoft KB on it and include the resolutions from the KB below. While not directly supported by design, here are the workarounds for both EBS 2008 and SBS 2008.

EBS 2008:

EBS 2008 does not support directly connecting to a Terminal Server through RWW. In larger environments, publishing a large number of connections through the Messaging Server's TS Gateway may cause a resource spike on the server.

In environments where it is desired to have connectivity through the RWW page, there are several workarounds available:

1. Publish the Terminal Server's RDP port (3389 by default) through TMG. See http://technet.microsoft.com/en-us/library/cc995085.aspx for more details.

2. Distribute .RDP files configured to use TS Gateway to end users.

3. Add a link for the Terminal Server in RWW. To do this, use the following steps:

Log on to the Messaging Server directly using an account with administrative rights.
Edit %ProgramFiles%\Windows Essential Business Server\Bin\webapp\Remote\App_Data\OrganizationLinks.XML in Notepad
Add a Link tag in the Gadget Section using the format:

<Link DisplayText="TS" Url=https://<REMOTEURL>/Remote/tsweb.aspx?targetMachine=<TSNAME> _locID="useTS" />

Where <REMOTEURL> is the FQDN of your RWW server and <TSNAME> is the host name of the internal Terminal Server you are trying to access. For example:

SBS 2008:

The Small Business Server 2008 (SBS 2008) version of RWW does support adding a registry key to reveal Terminal Servers in the domain (see http://technet.microsoft.com/en-us/library/cc527532(WS.10).aspx). This registry setting has no effect in EBS.

Example OrganizationalLinks.XML:

<?xml version="1.0"?>
<GadgetSection Name="Organizational" Enabled="true" DisplayText="">
  <_locDefinition>
    <_locDefault _loc="locNone"/>
    <_locTag _locAttrData="DisplayText">GadgetSection</_locTag>
    <_locTag _locAttrData="DisplayText">Link</_locTag>
  </_locDefinition>
  <Link DisplayText="How to use Remote Web Workplace" Url="http://go.microsoft.com/fwlink/?LinkId=115334" _locId="UseRWW"/>
  <Link DisplayText="How to configure Outlook to access your email over the Internet" Url="http://go.microsoft.com/fwlink/?LinkId=115339" _locId="ConfigureOutlook"/>
  <Link DisplayText="TS" Url=https://remote.contoso.com/Remote/tsweb.aspx?targetMachine=MyTS  _locID="useTS" />
</GadgetSection>

Run update from console session! - MS07-049: Vulnerability in Virtual PC and Virtual Server that could allow privilege elevation

steveb — Mon, 20 Aug 2007 18:06:00 GMT

If you prefer to run Microsoft Updates from a TS session, then make sure you run MS07-049 from a console session per the KB 937986 (http://support.microsoft.com/kb/937986).

Taken from the KB:

When the update 937986 is applied on a remote machine by using Terminal Services, the update does not replace the vulnerable files if the /console option is not used. To avoid this issue, you must use the /console option as shown in this example:

mstsc /console /v:<machine name>
-Steve

Lost TS/RDP after running updates?

steveb — Mon, 30 Jul 2007 08:40:00 GMT

After experiencing Terminal Services intermittently hanging after applying Microsoft Updates I've come across one way that gets the server back up and responsive most of the time and a backup plan for when it still doesn't.

First, to cover yourself, it is a good idea to run a system state backup at minimum of the server before applying updates in case you need to get yourself out of a challenge resulting from the update. Then what I've started doing (wasn't an original idea, got it from others in the community) is creating a restart.bat file that consists of shutdown -r -f and a hard return to bounce the server. I then create a one time scheduled task and set it for about 30 minutes out from when I figure the updates should have been applied and the server restarted and back online. Most of the time a restart will "jump start" the Terminal Services and get them running if they hang. If I don't have to use it, I go into Scheduled Tasks and set the time back a day to disable it until next time. The other trick I ran across was the result of a desperate attempt to get a box back online one night as I was applying updates from my Vista Tablet PC. I've since tried this from XP Pro and it does not work, so seems to be a Vista only trick.

If TS/RDP hangs on the server, as Microsoft is beginning to admit is a problem finally, attempt to VPN from your Vista computer to the remote network using the remote domain's administrator account (I've only tried this with Windows PPTP so no idea about IPSec or edge VPN devices such as SonicWALLs but I'm guessing it would fail since the reason this is working has to be because Vista is authenticating as the remote administrative account). Once you have established the Windows PPTP VPN from your Vista box, open a command prompt by selecting off of your start menu, "right clicking" and running as administrator. Once inside the command window, type shutdown -i and drop in the name or IP address of the remote server you are wanting to get back your Terminal Services from and do a restart in the graphical interface. I have had this work all but once or twice (hence the new addition of the scheduled task restart batch file). When the server comes back online TS is normally responsive and you can head off to bed versus getting in the car and taking off to a client site in the middle of the night!

Steve