Remote Desktop Services User Properties

You can configure Remote Desktop Services-specific user account properties by using the Local Users and Groups snap-in or the Active Directory Users and Computers snap-in.

The Remote Desktop Services Extension adds Remote Desktop Services-specific tabs to the Properties sheet of a user account in Local Users and Groups or Active Directory Users and Computers. The Remote Desktop Services-specific tabs are:

  • Remote Control

  • Remote Desktop Services Profile

  • Environment

  • Sessions

  • Personal Virtual Desktop

For more information about Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

Additional references

  • Add the Remote Desktop Services Extension

  • Configuring Remote Desktop Services User Properties

  • User Interface: Remote Desktop Services User Properties


Configuring Remote Desktop Services User Properties

This section provides information about configuring Remote Desktop Services-specific user account properties. The following topics are covered:

  • Understanding Remote Desktop Services User Properties

  • Add the Remote Desktop Services Extension

  • Using Group Policy Settings


Understanding Remote Desktop Services User Properties

You can configure Remote Desktop Services-specific user account properties by using the Local Users and Groups snap-in or the Active Directory Users and Computers snap-in. The Remote Desktop Services-specific user account properties that you can configure are the following:

  • Remote Control

  • Remote Desktop Services Profile

  • Environment

  • Sessions

  • Personal Virtual Desktop

You can also configure many of these Remote Desktop Services-specific properties by using either of the following:

  • Remote Desktop Session Host Configuration snap-in

  • Remote Desktop Services-specific Group Policy settings

You can use Remote Desktop Session Host Configuration to configure per-connection settings on a Remote Desktop Session Host (RD Session Host) server. You can configure the following settings by using Remote Desktop Session Host Configuration:

  • Remote Control

  • Environment

  • Sessions

Settings configured by using Remote Desktop Session Host Configuration will take precedence over the user account properties that have been configured in Local Users and Groups or Active Directory Users and Computers.

There are additional per-connection settings that can be configured by using Remote Desktop Session Host Configuration. For more information about configuring per-connection settings by using Remote Desktop Session Host Configuration, see the topic "Configuring Remote Desktop Services Connections" in the Remote Desktop Session Host Configuration Help in Windows Server 2008 R2.

For information about configuring Remote Desktop Services-specific properties by using Group Policy settings, see Using Group Policy Settings.

Additional references

  • Configuring Remote Desktop Services User Properties


Add the Remote Desktop Services Extension

The Remote Desktop Services Extension can be added to the Local Users and Groups snap-in or to the Active Directory Users and Computers snap-in.

The Remote Desktop Services Extension adds Remote Desktop Services-specific tabs to the Properties sheet of a user account. The Remote Desktop Services-specific tabs are:

  • Remote Control

  • Remote Desktop Services Profile

  • Environment

  • Sessions

  • Personal Virtual Desktop

Note

The Remote Desktop Services Extension is automatically installed when Remote Desktop Services is installed.

To add the Remote Desktop Services Extension to Local Users and Groups

  1. Open Microsoft Management Console. To open Microsoft Management Console, click Start, click Run, type mmc and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, in the Available snap-ins list, select Local Users and Groups, and then click Add.

  4. In the Choose Target Machine dialog box, select the computer that you want Local Users and Groups to manage, and then click Finish.

  5. In the Selected snap-ins list, select Local Users and Groups, and then click Edit Extensions.

  6. In the Extensions for Local Users and Groups dialog box, do one of the following:

    • Select Always enable all available extensions. This is the default setting. The Remote Desktop Services - Extension check box is automatically selected.

    • Select Enable only selected extensions, and then select the Remote Desktop Services - Extension check box.

  7. Click OK, and then click OK to close the Add or Remove Snap-ins dialog box.
To add the Remote Desktop Services Extension to Active Directory Users and Computers

  1. Open Microsoft Management Console. To open Microsoft Management Console, click Start, click Run, type mmc and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. In the Add or Remove Snap-ins dialog box, in the Available snap-ins list, select Active Directory Users and Computers, and then click Add.

  4. In the Selected snap-ins list, select Active Directory Users and Computers, and then click Edit Extensions.

  5. In the Extensions for Active Directory Users and Computers dialog box, do one of the following:

    • Select Always enable all available extensions. This is the default setting. The Remote Desktop Services - Extension check box is automatically selected.

    • Select Enable only selected extensions, and then select the Remote Desktop Services - Extension check box.

  6. Click OK, and then click OK to close the Add or Remove Snap-ins dialog box.

Additional references

  • Configuring Remote Desktop Services User Properties


Using Group Policy Settings

Remote Desktop Services-specific Group Policy settings can be used to automate the application of a standard configuration to one or more RD Session Host servers or to a group of users. Remote Desktop Services-specific Group Policy settings can be found in the following locations in either the Local Group Policy Editor or the Group Policy Management Console (GPMC):

  • Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services

  • User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services

Remote Desktop Services settings configured by using Group Policy take precedence over the following:

  • User account properties that have been configured in the Local Users and Groups snap-in or the Active Directory Users and Computers snap-in

  • Per-connection settings configured by using the Remote Desktop Session Host Configuration snap-in

The following is a list of some of the Remote Desktop Services-specific Group Policy settings that are related to the Remote Desktop Services settings that can be configured on a user account.

Group Policy setting name Group Policy setting location

Set RD User Home Directory

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles

Set path for RD Roaming User Profile

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles

Start a program on connection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment

User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment

Do not allow drive redirection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

Do not allow client printer redirection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection

Set time limit for disconnected sessions

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

Set time limit for active but idle RD Session Host Server sessions

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

Set time limit for active RD Session Host Server sessions

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

Terminate session when time limits are reached

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

Set rules for remote control of RD Session Host Server user sessions

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections

User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configuring Remote Desktop Services User Properties


User Interface: Remote Desktop Services User Properties

The Remote Desktop Services Extension adds the following tabs to the Properties sheet of a user account in the Local Users and Groups snap-in and the Active Directory Users and Computers snap-in:

  • <UserAccount> Properties: Remote Control Tab

  • <UserAccount> Properties: Remote Desktop Services Profile Tab

  • <UserAccount> Properties: Environment Tab

  • <UserAccount> Properties: Sessions Tab

  • <UserAccount> Properties: Personal Virtual Desktop Tab


<UserAccount> Properties: Remote Control Tab

The Remote Control tab allows you to configure the remote control settings for a user's Remote Desktop Services session.

Item | Details
Enable remote control | Select if you want to observe or actively control the user's Remote Desktop Services session. If you want to remotely control the user's session without the user's permission, clear the Require user's permission check box.
Level of control | Specify the level of control that you want to have over a user's session. If you select Interact with the session, you will be able to input keyboard and mouse actions to the session.

Additional considerations

  • Membership in the Administrators group, or equivalent, is the minimum required to configure the properties of a local user account.

  • Membership in the Account Operators group, or equivalent, is the minimum required to configure the properties of most domain user accounts. In some cases, membership in the Domain Admins group, or equivalent, is the minimum required.

  • Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

  • For more information about remotely controlling a user session on an RD Session Host server, see the topic "Remotely Control a User Session" in the Remote Desktop Services Manager Help in Windows Server 2008 R2.

  • You can use Remote Desktop Session Host Configuration to configure remote control settings on a per-connection basis on an RD Session Host server. Remote control settings configured by using Remote Desktop Session Host Configuration will take precedence over the remote control settings that have been configured for a specific user account.

  • For information about configuring remote control settings on a per-connection basis on an RD Session Host server by using Remote Desktop Session Host Configuration, see the topic "Configuring Remote Desktop Services Connections" in the Remote Desktop Session Host Configuration Help in Windows Server 2008 R2.

  • For information about configuring remote control settings by using Group Policy settings, see Using Group Policy Settings.

Additional references

  • User Interface: Remote Desktop Services User Properties

  • Remote Desktop Services User Properties


<UserAccount> Properties: Remote Desktop Services Profile Tab

The Remote Desktop Services Profile tab allows you to configure the user profile environment for when a user remotely connects to an RD Session Host server.

Item | Details
Profile Path | Specify the profile path assigned to the user when the user connects to an RD Session Host server. Assign the user a separate profile for Remote Desktop Services sessions. Many of the common options that are stored in profiles, such as screen savers and animated menu affects, are not desirable when using Remote Desktop Services.
Remote Desktop Services Home Folder | Specify a path to a home folder to be used for Remote Desktop Services sessions. The folder can be either a local folder or a network share.
Deny this user permissions to log on to RD Session Host | Specify if the user can connect to RD Session Host servers. Even if this check box is cleared, the user still needs to be given permission to connect to an RD Session Host server. The Remote Desktop Users group on the RD Session Host server is used to give users and groups permission to log on remotely to an RD Session Host server.

Additional considerations

  • Membership in the Administrators group, or equivalent, is the minimum required to configure the properties of a local user account.

  • Membership in the Account Operators group, or equivalent, is the minimum required to configure the properties of most domain user accounts. In some cases, membership in the Domain Admins group, or equivalent, is the minimum required.

  • Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

  • If you do not configure a profile path or a home folder on the Remote Desktop Services Profile tab, the settings configured on the Profile tab will be used, even for remote connections. If settings are configured on both tabs, the settings configured on the Remote Desktop Services Profile tab will take precedence over the settings configured on the Profile tab for remote connections.

  • For information about configuring profile settings by using Group Policy settings, see Using Group Policy Settings.

  • For more information about implementing user profiles for users connecting to an RD Session Host server, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkID=138055).

Additional references

  • User Interface: Remote Desktop Services User Properties

  • Remote Desktop Services User Properties


<UserAccount> Properties: Environment Tab

The Environment tab allows you to configure the startup environment for a Remote Desktop Services client.

Item Details

Starting program

Specify the program that opens whenever the user connects to an RD Session Host server. The program specified is the only program that can be used by the user in the Remote Desktop Services session. When the user closes the program, the connection to the RD Session Host server closes.

If you want to provide a working folder, specify the folder location in the Start in box.

Client devices

Specify whether the user's local drives and printers are available in the Remote Desktop Services session when a user connects to an RD Session Host server.

The Connect client drives at logon check box currently is not used by Windows Server Remote Desktop Services.

If the user has multiple local printers configured, you can direct print jobs in the Remote Desktop Services session to the default printer on the user's local computer by selecting Default to main client printer.

Additional considerations

  • Membership in the Administrators group, or equivalent, is the minimum required to configure the properties of a local user account.

  • Membership in the Account Operators group, or equivalent, is the minimum required to configure the properties of most domain user accounts. In some cases, membership in the Domain Admins group, or equivalent, is the minimum required.

  • Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

  • You can use Remote Desktop Session Host Configuration to configure environment settings on a per-connection basis on an RD Session Host server. Environment settings configured by using Remote Desktop Session Host Configuration will take precedence over the environment settings that have been configured for a specific user account.

  • For information about configuring environment settings on a per-connection basis on an RD Session Host server by using Remote Desktop Session Host Configuration, see the topic "Configuring Remote Desktop Session Host Configuration Connections" in the Remote Desktop Session Host Configuration Help in Windows Server 2008 R2.

  • For information about configuring environment settings by using Group Policy settings, see Using Group Policy Settings.

Additional references

  • User Interface: Remote Desktop Services User Properties

  • Remote Desktop Services User Properties


<UserAccount> Properties: Sessions Tab

The Sessions tab allows you to configure the timeout and reconnection settings for Remote Desktop Services sessions.

Item Details

End a disconnected session

Specify the maximum amount of time that a disconnected user session is kept active on the RD Session Host server. If you specify Never, the user's disconnected session is maintained for an unlimited time.

When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected.

Active session limit

Specify the maximum amount of time that the user's Remote Desktop Services session can be active before the session is automatically disconnected or ended.

The user receives a warning two minutes before the Remote Desktop Services session is disconnected or ended, which allows the user to save open files and close programs.

Idle session limit

Specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before the session is automatically disconnected or ended.

The user receives a warning two minutes before the session is disconnected or ended, which allows the user to press a key or move the mouse to keep the session active.

When a session limit is reached or connection is broken

Specify whether to disconnect or end the user's Remote Desktop Services session when an active session limit or an idle session limit is reached.

If the user's session is disconnected, the programs that the user is running are kept active even though the user is no longer actively connected.

If the user's session is ended, the user must establish a new Remote Desktop Services session with an RD Session Host server.

Allow reconnection

Specify whether the user can reconnect from any computer to a disconnected session on an RD Session Host server.

The From originating client only option currently is not used by Windows Server Remote Desktop Services.

Additional considerations

  • Membership in the Administrators group, or equivalent, is the minimum required to configure the properties of a local user account.

  • Membership in the Account Operators group, or equivalent, is the minimum required to configure the properties of most domain user accounts. In some cases, membership in the Domain Admins group, or equivalent, is the minimum required.

  • Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

  • You can use Remote Desktop Session Host Configuration to configure session timeout settings on a per-connection basis on an RD Session Host server. Session timeout settings configured by using Remote Desktop Session Host Configuration take precedence over the session timeout settings that have been configured for a specific user account.

  • For information about configuring timeout and reconnection settings on a per-connection basis on an RD Session Host server by using Remote Desktop Session Host Configuration, see the topic "Configuring Remote Desktop Services Connections" in the Remote Desktop Session Host Configuration Help in Windows Server 2008 R2.

  • For information about configuring timeout and reconnection settings by using Group Policy settings, see Using Group Policy Settings.

Additional references

  • User Interface: Remote Desktop Services User Properties

  • Remote Desktop Services User Properties


<UserAccount> Properties: Personal Virtual Desktop Tab

You can assign a user in Active Directory Domain Services (AD DS) a specific virtual machine to use as a personal virtual desktop, which the user can then access by using RemoteApp and Desktop Connection.

The following are important considerations when assigning a personal virtual desktop to a user in AD DS:

  • The user and the virtual machine must both be members of an Active Directory domain.

  • A user can be assigned only one personal virtual desktop at a time.

  • A computer can be assigned as a personal virtual desktop to only one user at a time.

  • The functional level of your Active Directory domain must be at least Windows Server 2008.

  • You must use the Active Directory Users and Computers tool from Windows Server 2008 R2.

To make personal virtual desktops available to users, you must use the Remote Desktop Connection Manager tool on the Remote Desktop Connection Broker (RD Connection Broker) server. For more information, see the Remote Desktop Connection Manager Help in Windows Server 2008 R2.

Use the following procedure to assign a personal virtual desktop to a user in AD DS.

Membership in the Account Operators group, or equivalent, is the minimum required to configure the properties of most domain user accounts. In some cases, membership in the Domain Admins group, or equivalent, is the minimum required. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To assign a personal virtual desktop to a user in AD DS

  1. Open Active Directory Users and Computers. To open Active Directory Users and Computers, log on to a computer where Active Directory Users and Computers has been installed (for example, on an Active Directory domain controller), click Start, click Run, type dsa.msc and then click OK.

  2. Locate the user account to which you want to assign a personal virtual desktop.

  3. Right-click the user account, and then click Properties.

  4. On the Personal Virtual Desktop tab, select the Assign a personal virtual desktop to this user check box.

  5. In the Computer Name box, type the fully qualified domain name (FQDN) of the computer to which you want to assign the user. To search for the name of the computer, click Browse, and then click Advanced to use the Select Computer dialog box to find the computer.

    Important

    The name of the virtual machine in the Hyper-V Manager tool must match the FQDN of the computer.

  6. Click OK to save your selections and close the Properties dialog box.

To remove an assignment, clear the Assign a personal virtual desktop to this user check box. You can also use the ADSI Edit tool to clear the value of the msTSPrimaryDesktop attribute in the properties of the user account.

Additional references

  • User Interface: Remote Desktop Services User Properties

  • Remote Desktop Services User Properties