Terminal Services mode

[crabby117]

I have a win2k3 DC running TS. Can I determine whether TS is in Administration mode or Application Server mode without having to go through add/remove windows components?

Also, when I go to the TS Licensing mmc, I see two line items under the licenses:

Existing Windows 2000 Server - Terminal Services CAL Token (per device) Type = built-in Total = unlimited Available = unlimited

and

Windows 2003 Server - Terminal Server per user CAL Token Type = open Total = 5 Available = 5

I'm not sure WHY the 5 per user CAL's are not being assigned, whether because the top line says "unlimited" or because the mode is in administrative mode not application server.

Thank you.

 

[ShackDaddy]

All you have to do is try logging on with a user who isn't a domain admin. If the user is allowed, it's in app mode.

No...wait....you are on a DC, so all bets are off. Normally non-admin accounts aren't allowed to log on to a DC, so you would have to go into the security policy and give Domain Users or some other group the rights to log on locally/interactively.

My point here is that you really don't want to set up TS in app mode on a DC. It's a big security risk, since you will be installing end-user apps on a domain controller and you don't have any of the benefits of being able to use local security groups to lock things down.

If you can't afford new hardware, at least consider installing VMWARE on the server and loading a new copy of Windows 2003 Standard virtually, join it to the domain, and set that up as a TS in app mode. That will create a good separation for you.

ShackDaddy
Shackelford Consulting