Understanding Terminal Services Operating Modes

In the 2003 series of server products, Terminal Services features are provided in one of two modes: Remote Administration and Application. Remote Administration provides two remote desktop connections to a server for administration purposes. Application mode allows users to connect to run shared applications. But there are more differences than that, and they are detailed in the following two sections.

Remote Administration Mode

Almost all Windows 2003 servers support Remote Administration mode for remote access to the server console. A maximum of two simultaneous connections is allowed, and only members of the Domain Admins group can make a remote connection to the server when this mode is enabled.

When connecting to a server in Remote Administration mode, the administrator account has full access to the server as if she had logged on to the server console directly. The key thing to remember, however, is that you have not logged on to the server console directly unless you jump through a few hoops first.

Connecting to and Shadowing the Server Console

If you use the Remote Desktop Connection tool (mstsc.exe) or the Connect to Server Computers link from the Remote Web Workplace (RWW), you are connecting to one of the two remote administration sessions allowed in this mode. You can gain control of the actual console session in one of two ways, however.

First, if you are using the RDC tool, you would type mstsc /console to launch the remote connection and tell it to use the Console session instead of one of the two remote sessions.

Second, you could create a remote session and use the shadow command to control the existing console session. There are a few steps that you must take before you will be able to use the shadow 0 command to control the existing console session. This information is documented in Microsoft KB article 278845 (http://support.microsoft.com/kb/278845).

By default, the SBS server is preconfigured with remote administration access enabled. You do not have to do any manual configuration to allow remote access to the server from inside the network. You need to enable Terminal Services access through the SBS firewall in the Connect to the Internet Wizard (CEICW) if you want to get access to the server desktop from outside the local network.

Application Mode

Terminal Services in Application mode is what most people think of when they think about a terminal server. When in this mode, a number of users can log in to the terminal server, run applications, and save data just as if they were logged in on a "normal" PC. There are a number of licensing restrictions regarding Terminal Services, more than can be appropriately addressed in this book. However, the section "Configuring Terminal Services Licensing Service" later in the chapter covers how to install appropriate Terminal Services licensing so that users can connect to the terminal server.

Before that can happen, however, a server has to become a terminal server first, and that involves installing Terminal Services in Application mode. Before you do this installation, consider a few items:

• Server PerformanceMake sure that the server you plan to use as a terminal server has enough horsepower to handle the number of users and types of applications you plan to provide. Review the Microsoft whitepaper "Windows 2003 Terminal Server Capacity and Planning" (http://www.microsoft.com/windowsserver2003/techinfo/overview/tsscaling.mspx) for additional hardware guidelines.

• Domain controllerDo not plan on installing Terminal Services in Application mode on a domain controller. If you can demote the domain controller to a member server without impacting its other functions on the network, this might suffice; otherwise, look to a different server box that can maintain its role as a member server.

• Server licensingMake sure that you understand your terminal server licensing needs. If you will be converting an existing Windows 2000 server (that's not a domain controller) into a terminal server, you will not need any additional TS CALs to connect Windows workstations. If your terminal server is based on Windows 2003 server, you will need to acquire TS CALs separate from the SBS CALs to provide licensed access to the server. Review Microsoft KB article 823313 (http://support.microsoft.com/kb/823313) and the Windows Server 2003 Terminal Server Licensing whitepaper (http://www.microsoft.com/windowsserver2003/techinfo/overview/termservlic.mspx) for more information.