Troubleshooting Terminal Service Issues

After you set up the terminal server environment, you should have relatively few problems related to daily operation. However, some issues and resolutions are worth mentioning in this chapter.

Internet Explorer Enhanced Security Configuration

For terminal servers based on Windows Server 2003, you have to modify the Internet Explorer Enhanced Security Configuration on the server before terminal server users will be able to browse the Web from the terminal server. To change the configuration, open Add or Remove Programs from Control Panels; then click Add/Remove Windows Components. Select the Internet Explorer Enhanced Security Configuration item in the components list, click Details, and turn off the For All Other User Groups check box. Click OK; then click Next and click Finish to complete the changes.

Best Practice: Internet Explorer Enhanced Security Configuration and Administrators

Even though you will want to disable the Internet Explorer Enhanced Security Configuration for your users, you will still want to leave it enabled for administrators. Even though the terminal server is being used as a workstation, you will still want to protect it from as much malware as possible. Leaving the Internet Explorer Enhanced Security Configuration enabled for administrators is one step to helping keep the server and the rest of the network safer.

Terminal Server Missing from Remote Web Workplace

Occasionally when a terminal server is installed into an existing SBS network, the new terminal server will not show up on the RWW page. For a more in-depth look at how RWW interacts with remote desktops, including terminal servers, see Chapter 15, "Remote Web Workplace." This issue, however, is generally resolved by correcting one value in the Registry on the SBS server. Look in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SmallBusinessServer\RemoteUserPortal\KWLinks key for the AppTS value and make sure that it has been set to 1. The standard warning about making changes to the Registry applies, so get a backup of the Registry before you make any changes, if you need to make changes.

Users Unable to Log In to Terminal Server

If users are unable to log in to the terminal server and receive the message shown in Figure 8.4, the local Remote Desktop Users group may not have been set up correctly on the server during its configuration. To see what groups have been added to the Remote Desktop Users group on the Terminal Server, right-click on My Computer and select Manage. Then expand System Tools, Local Users and Groups, Groups; then right-click on Remote Desktop Users and select Properties. If the correct groups are not listed in the Members pane, click Add and add them to the list.

Figure 8.4. Access Denied error when logging in to the terminal server remotely.

Another reason users may not be able to access the terminal server relates to Terminal Server Licensing. If a user or workstation accessed the terminal server before the licensing service was configured and the TS CALs were installed, the user was granted a temporary token. This temporary token allows the user to access the terminal server for up to 90 days if a permanent license is not installed in the meantime. In some cases, the permanent license does not get installed correctly, and the user will start getting warnings that indicate that the Terminal Services temporary token will expire in a certain number of days. After the token expires, the workstation should request a permanent license and receive it from the TS Licensing server, provided a license is available. You may need to remove the temporary token from the workstation following the instructions in Microsoft KB article 187614 (http://support.microsoft.com/?kbid=187614), which also includes information on how to clear temporary tokens from Macintosh clients.