[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 287
  • Last Modified:

Terminal Services Policy Question

Okay, I'm pretty new to terminal services and I am trying to grasp a hold on how  security polices work and where they should be applied. Here is my setup,

SBS2003 server that is running as the domain controller and terminal server licensing services.
I also have a windows 2000 server machine that everyone is connecting to through terminal server.
This server has one application that the whole office uses.

Because the SBS2003 server is basically running the show, do I apply policy to terminal services on the sbs or on the windows 2000 server.

Also, if your apply it to sbs, would you just simply apply local policy to further lock it down?
0
dakeys
Asked:
dakeys
  • 6
  • 6
2 Solutions
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
First, you don't really need to be running a licensing server for Win2K Terminal Server since separate TS CALs are not required (they are for Win2K3 Termainal Server -- and the paper referenced below does mention the licensing server... but if you only have xp and w2k clients you're fine).

You should definitely review this guide about how to add and manage a Win2k Terminal Server in an SBS environment.  http://sbsurl.com/tss2k

For more information about locking down your TS, please see
http://support.microsoft.com/kb/278295

Jeff
TechSoEasy
0
 
juanferminCommented:
Actually, you don't need TS Licensing for NT4, You do however, need licensing for anything other than Win2K Clients.
http://www.microsoft.com/technet/prodtechnol/win2kts/evaluate/featfunc/tslicens.mspx
WinXP Clients will not connect to a Win2K TS without a license server, nor will any other windows product. (after the initial 90 day grace period in Application Server Mode)
http://www.microsoft.com/windowsserver2003/howtobuy/licensing/tscaltransfaq.mspx

Now as for the first question, I'm assuming that you've joined the TS to the Domain, if not then that would be your first step, once this is done, your GP can be set on either server, it doesn't matter.
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
juanfermin, you are not correct.  WinXP and Win2K have built-in Terminal Server Clients for a WINDOWS 2000 TERMINAL SERVER.  You are referencing a Windows 2003 Terminal Server which has a completely different licensing model.

Jeff
TechSoEasy
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
juanferminCommented:
Hey, I'm just quoting MS, I'm not making this up... If you look at the link above last Q & A:

Q. Why aren't Windows 2000 Professional desktops included in the transition plan to receive complimentary TS CALs?
      
A.Under the old licensing model with desktop operating system equivalency, only operating systems with the same version number (or later version number) of the corresponding version of server operating system qualified to be the equivalent of a TS CAL—for example, a Windows NT 4.0 workstation connecting to a Windows NT 4.0 Terminal Server, or a Windows 2000 Professional desktop connecting to a Windows 2000 Terminal Server. Even if desktop equivalency had not been removed for Windows Server 2003, Windows 2000 Professional desktops would still have to have had a Windows Server 2003 TS CAL to connect to a Windows Server 2003 Terminal Server, and as such, the transition plan focuses on Windows XP Professional licensees.

Look Carefully, it says, "under the OLD licensing Model"
Under the old licensing model with desktop operating system equivalency, only operating systems with the same version number (or later version number) of the corresponding version of server operating system qualified to be the equivalent of a TS CAL—for example, a Windows NT 4.0 workstation connecting to a Windows NT 4.0 Terminal Server, or a Windows 2000 Professional desktop connecting to a Windows 2000 Terminal Server.

Keep in mind that SEVERAL of my customers use TS EXCLUSIVELY to manage their businesses, so I've deployed quite a few of them, so I think I know a bit about this.
0
 
juanferminCommented:
OK, this I don't get, because me & Jeff, were on opposite sides of the fence, so how can we both be right?
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
That question you quoted is ONLY about transition plan complimentary licenses.  It has NOTHING to do with client licenses for Windows 2000 Terminal Servers.  

I think you may know a lot about terminal services... but unfortunately you are not correct about this issue.

Jeff
TechSoEasy
0
 
juanferminCommented:
That is correct, it's about the Transition Licenses, but it also says;
Under the old Licensing Model, ... only operating systems with the same version number were licensed to be used with it.  Just like you HAD to buy a license for a Win98 Machine, but not a Win2K for a Win2K TS, you would also need to have a license for a WinXP machine.  

If this isn't the case, as you say, then why did one of my customers call me recently to tell me that a WinXP machine, couldn't connect to their Win2K TS Server.  It was saying that the "Trial Period" was past 90 days and couldn't find a licensing Server?  If it didn't need a license, they why didn't it let the XP machine Connect?  We had to install a TS license Server on domain server to allow it to connect.  Granted, maybe it's because the Domain Conroller for this domain is a Win2003 Server, but that's the same case we have here.
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
CAL licensing terms are not based on the CLIENT, but the SERVER.  Also, remember that we're talking about connecting a TS to a SBS here... but that aside, all that has to be activated is the licensing server.  The CALs are still free for Win2K server clients.

Please see the LAST item in this comparison so you will understand:
http://www.brianmadden.com/content/content.asp?ID=490

Jeff
TechSoEasy
0
 
juanferminCommented:
That may well be their policy, but if my customer is calling me up to tell me that he's having problems, and it goes away after I installed a license Server, then maybe I need to call MS and get my money back, because it's not working that way.

Also, I think you're missing part of the point.  If you want to run TS in Application Server Mode, (you know so you can log on more than 2 administrators) You MUST have a license Server, which is ONLY sold with a 5PK license Minimum.  OK, so they can log in their WinXP clients without using a license, but they STILL need the license server, otherwise it simply shuts down, with the error, "There is No license server to Authenticate Users".  No matter what version of TS you have, once the Grace period runs out, (90 days for win2K, 120 for Win2003), that is IT, no more Application mode, if you don't have a license server.
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
Again, that's not true.  SBS will run a TS license server.

Jeff
TechSoEasy
0
 
juanferminCommented:
I didn't say that SBS won't run a TS License Server, but you still have to purchase it.  Don't you?
0
 
Jeffrey Kane - TechSoEasyPrincipal ConsultantCommented:
No, you don't... you just go to add/remove programs > Windows Components > Terminal Server Licensing Server

Install it and you're good to go.

Jeff
TechSoEasy
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

  • 6
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now