top of page
Search
karriewaroyee

Logging on through Terminal Services on a Windows Server 2003 Domain Controller: Benefits and Challe



This becomes a bit more involved if you are trying to enable Remote Desktop access to domain controllers. Incidentally, this was also an issue in the previous version of Windows, although for a different reason. In Windows 2000, the Log on Locally user right was required for a terminal server session logon. This worked fine on member servers, where this right is granted to the local Users group (containing Domain Users). On domain controllers, however, only a few groups (Administrators and Server, Backup, and Account Operators) are permitted to log on interactively, which prevents everyone else from connecting via Terminal Server sessions. The problem surfaced more frequently in running Windows 2000 Terminal Services in application mode (because these are intended for regular users), but it could also confuse operators managing servers via Terminal Server in administration mode (in case they did not happen to belong to one of the privileged groups).


Remember that the Log on Locally right is no longer required to access a Windows Server 2003 server via a Remote Desktop session (in either mode). Nonetheless, if you're using default settings, the same issue persists on Windows Server 2003 domain controllers. To resolve the problem, modify the Default Domain Controllers Group Policy Object by enabling the Allow Logon through Terminal Services option (located under Computer Configuration\ Windows Settings\Security Settings\Local Policies\User Rights Assignments) and adding to it all accounts that you want to grant rights to run Remote Sessions on domain controllers. To explicitly deny access to Terminal Services for a specific user or group, use the Deny Logon through Terminal Services option.




Logging on through Terminal Services on a Windows Server 2003 Domain Controller




Keep in mind, however, that Microsoft added the extra step of modifying the Default Domain Controllers Group Policy Object for a reason. Granting direct logon access to domain controllers for nonprivileged accounts is bad practice from a security perspective. Using domain controllers as terminal servers is much worse (because doing so affects both security and performance). If you work for a smaller company and are forced to implement such solutions, however, make sure that you secure all affected servers. Otherwise, you greatly increase the risk of compromising Active Directory or incurring damage to the registry and file system.


The key server component of RDS is Terminal Server (termdd.sys), which listens on TCP port 3389. When a Remote Desktop Protocol (RDP) client connects to this port, it is tagged with a unique SessionID and associated with a freshly spawned console session (Session 0, keyboard, mouse and character mode UI only). The login subsystem (winlogon.exe) and the GDI graphics subsystem is then initiated, which handles the job of authenticating the user and presenting the GUI. These executables are loaded in a new session, rather than the console session. When creating the new session, the graphics and keyboard/mouse device drivers are replaced with RDP-specific drivers: RdpDD.sys and RdpWD.sys. The RdpDD.sys is the device driver and it captures the UI rendering calls into a format that is transmittable over RDP. RdpWD.sys acts as keyboard and mouse driver; it receives keyboard and mouse input over the TCP connection and presents them as keyboard or mouse inputs. It also allows creation of virtual channels, which allow other devices, such as disc, audio, printers, and COM ports to be redirected, i.e., the channels act as replacement for these devices. The channels connect to the client over the TCP connection; as the channels are accessed for data, the client is informed of the request, which is then transferred over the TCP connection to the application. This entire procedure is done by the terminal server and the client, with the RDP mediating the correct transfer, and is entirely transparent to the applications.[13] RDP communications are encrypted using 128-bit RC4 encryption. Windows Server 2003 onwards, it can use a FIPS 140 compliant encryption schemes.[6]


Once a client initiates a connection and is informed of a successful invocation of the terminal services stack at the server, it loads up the device as well as the keyboard/mouse drivers. The UI data received over RDP is decoded and rendered as UI, whereas the keyboard and mouse inputs to the Window hosting the UI is intercepted by the drivers, and transmitted over RDP to the server. It also creates the other virtual channels and sets up the redirection. RDP communication can be encrypted; using either low, medium or high encryption. With low encryption, user input (outgoing data) is encrypted using a weak (40-bit RC4) cipher. With medium encryption, UI packets (incoming data) are encrypted using this weak cipher as well. The setting "High encryption (Non-export)" uses 128-bit RC4 encryption and "High encryption (Export)" uses 40-bit RC4 encryption.[14]


Terminal Server is the server component of Terminal services. It handles the job of authenticating clients, as well as making the applications available remotely. It is also entrusted with the job of restricting the clients according to the level of access they have. The Terminal Server respects the configured software restriction policies, so as to restrict the availability of certain software to only a certain group of users. The remote session information is stored in specialized directories, called Session Directory which is stored at the server. Session directories are used to store state information about a session, and can be used to resume interrupted sessions. The terminal server also has to manage these directories. Terminal Servers can be used in a cluster as well.[6]


In Windows Server 2008, it has been significantly overhauled. While logging in, if the user logged on to the local system using a Windows Server Domain account, the credentials from the same sign-on can be used to authenticate the remote session. However, this requires Windows Server 2008 to be the terminal server OS, while the client OS is limited to Windows Server 2008, Windows Vista and Windows 7. In addition, the terminal server may be configured to allow connection to individual programs, rather than the entire desktop, by means of a feature named RemoteApp. Terminal Services Web Access (TS Web Access) makes a RemoteApp session invocable from the web browser. It includes the TS Web Access Web Part control which maintains the list of RemoteApps deployed on the server and keeps the list up to date. Terminal Server can also integrate with Windows System Resource Manager to throttle resource usage of remote applications.[4]


Remote Desktop Connection (RDC, also called Remote Desktop or just RD,[30][31] formerly Microsoft Terminal Services Client, mstsc or tsclient)[32][33] is the client application for RDS. It allows a user to remotely log into a networked computer running the terminal services server. RDC presents the desktop interface (or application GUI) of the remote system, as if it were accessed locally.[6] In addition to regular username/password for authorizing for the remote session, RDC also supports using smart cards for authorization.[6] With RDC 6.0, the resolution of a remote session can be set independently of the settings at the remote computer.


The service account defined in the IdentityIQ application that connects to IQService, is used for provisioning operations, aggregation (terminal services attributes/Skype attributes), and server-less binding.


Microsoft fine-tuned this release to boost performance and reduce the amount of required memory. This server OS was optimized to deliver services faster to users through its updated networking stack. Microsoft added more connectivity support for companies in a mixed environment with both Windows NT and NetWare servers to allow users to get services from each with a single credential.


Microsoft introduced the "Windows Server" brand with the release of Windows Server 2003 and touted its security improvements over Windows 2000. Microsoft hardened IIS, the web server feature, and disabled more default services to reduce exploit opportunities. 2ff7e9595c


0 views0 comments

Recent Posts

See All

Comments


bottom of page