Using one Username to login to TS

[Guest compsosinc@gmail.com]

We have setup a Windows 2003 Terminal Server as a member server in an

SBS2000 domain. The client purchased (10) TS Device CALs in addition

to the (10) Windows Device CALs. There are (10) XP Pro client machines

on a shopfloor that need to connect to the TS to use a data collection

program and possibly one other TS-based application (Solidworks

Viewer).

 

We setup (10) unique AD user accounts/passwords (Shopfloor1,

Shopfloor2, etc) for these TS users. They login into the domain with

the same credentials they use to login to the TS. We made these (10)

users members of a their own/new Security Group. We plan to implement

the Group Policy for locking down the TS. All works great.

 

Now the software vendor for the TS application is saying that we need

to login to the TS using the same username in order to run the data

collection program so that only (1) license for the application is

taken for these (10) users. They recommended TS for this program/use

but mentioned nothing of just using (1) TS user account until we found

the problem.

 

We have never setup a TS so that multiple users use the same TS

account and have been researching pro/cons, but do not really have a

complete picture of what settings we need to change here and what the

ramifications may be.

 

For these users, we did not plan to redirect any folders, etc. They

will be saving no data, etc other than from within the data collection

app (mainly using barcode scanners). They will need to have mapped

drives (1) with the TS and (1) to the SBS box for reading Solidworks

files.

 

1. What setting(s) do we change with regards to allowing a user to

login to the TS from multiple PCs concurrently?

 

2. The customer purchased/installed Per Device TS CALs & Per Device

Windows CALs. Do we have to have both of these changed to Per User? If

so, how do we change this??

 

3. Since the users need to have very restricted access to their local

desktops and the TS, is it going to be possible to lockdown the local

desktop with one domain user account?? Or do we keep the (10) separate

accounts for logging into the domain?

 

Thanks!

[Guest Vera Noest [MVP]]

Re: Using one Username to login to TS

 

comments inline.

 

compsosinc@gmail.com wrote on 20 feb 2008 in

microsoft.public.windows.terminal_services:

> We have setup a Windows 2003 Terminal Server as a member server

> in an SBS2000 domain. The client purchased (10) TS Device CALs

> in addition to the (10) Windows Device CALs. There are (10) XP

> Pro client machines on a shopfloor that need to connect to the

> TS to use a data collection program and possibly one other

> TS-based application (Solidworks Viewer).

>

> We setup (10) unique AD user accounts/passwords (Shopfloor1,

> Shopfloor2, etc) for these TS users. They login into the domain

> with the same credentials they use to login to the TS. We made

> these (10) users members of a their own/new Security Group. We

> plan to implement the Group Policy for locking down the TS. All

> works great.

>

> Now the software vendor for the TS application is saying that we

> need to login to the TS using the same username in order to run

> the data collection program so that only (1) license for the

> application is taken for these (10) users. They recommended TS

> for this program/use but mentioned nothing of just using (1) TS

> user account until we found the problem.

>

> We have never setup a TS so that multiple users use the same TS

> account and have been researching pro/cons, but do not really

> have a complete picture of what settings we need to change here

> and what the ramifications may be.

 

The biggest problem with this setup is profile corruption. All

users (read: persons using the same user account) will use the same

user profile. When they logon and logoff the profile will be save,

while others are still using it. This leads to profile corruption.

Therefore, you must make the profile read-only = mandatory.

 

Another problem wil be redirected local printers. You don't mention

them, but if you allow redirection of local printers, the default

printer for all users using this account will change every time a

new person logs on. Printer output can appear on the wrong client.

> For these users, we did not plan to redirect any folders, etc.

> They will be saving no data, etc other than from within the data

> collection app (mainly using barcode scanners). They will need

> to have mapped drives (1) with the TS and (1) to the SBS box for

> reading Solidworks files.

 

As long as the drive mappings are the same for everyone, this

shouldn't be a problem. But redirection of the local drives will

not work properly (see comment about redirected printer).

> 1. What setting(s) do we change with regards to allowing a user

> to login to the TS from multiple PCs concurrently?

 

Allow multiple connections per user. You can do that in Terminal

Services Configuration - Server settings, or in a GPO:

 

Computer Configuration - Administrative templates - Windows

Components - Terminal Services

"Restrict Terminal Services Users to a single remote session"

disable this setting.

> 2. The customer purchased/installed Per Device TS CALs & Per

> Device Windows CALs. Do we have to have both of these changed to

> Per User? If so, how do we change this??

 

No, you can keep the licensing as it is. The users will still

connect from 10 different clients. And they use the same user

account, but that doesn't mean that they are different users (=

persons).

> 3. Since the users need to have very restricted access to their

> local desktops and the TS, is it going to be possible to

> lockdown the local desktop with one domain user account?? Or do

> we keep the (10) separate accounts for logging into the domain?

 

I would definitively keep the 10 different domain accounts for

logging on to the clients.

 

_________________________________________________________

Vera Noest

MCSE, CCEA, Microsoft MVP - Terminal Server

TS troubleshooting: http://ts.veranoest.net

___ please respond in newsgroup, NOT by private email ___