Terminal Services

[LiLAmy]

Windows 2000 server running in terminal server application mode (sp3) with Windows 2000 clients.

2 issues:

Sometimes, when a user logs into TS it will not update most of the icons (ie the My Documents icon will be a generic Windows 2000 unresolved icon) for quite sometime..

When the users goes to log off of the terminal session, the server states that it can not kill the "explorer.exe" application and prompts the user to "END NOW" or "CANCEL".

This happens frequently and consistently on many different remote clients, from different locations, and has been happening for quite sometime.

The process will ultimately shutdown, but only after waiting for several minutes. Usually, users tend to just reboot their client machines instead of waiting. Ultimately making the server more unstable than it already is.

The 2 issues are not necessarily concurrent, but do sometimes both happen in the same session.

Any insight??? Thanks!

 

[GiaBetiu]

Hi,

It looks that your users have profiles defined, and you didn't apply notssid.inf incremental security template.
WIthout that template your users will all be seen by the system as only one user (TSInternet User).

And, also check if you have these problem when you are tryingto log on with that user name on a machine not via ts servies. Gia Betiu
giabetiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[LiLAmy]

I have never heard of "notssid.inf incremental security template". Can you elaborate on this?

I will investigate as to whether or not in happens when logging on locally to the Terminal Server... is that what you meant?

Thanks...

 

[GlenJohnson]

How long has this been going on? Did this start after installing sp3, or have you always had sp3? Can you create new disks for creating sessions, and create a new session with the new disks? Glen A. Johnson
Johnson Computer Consulting
MCP W2K
glen@johnsoncomputers.us



"Imagination is more important than knowledge."
Albert Einstein (1879 - 1955) Physicist and mathematician.

 

[LiLAmy]

It's been going on as long as I've been involved with this network. I put SP3 on a while back, and as far as I know it had never been reliable. As far as creating new disks, I have installed the latest version of Remote Desktop on the clients from Microsoft's website. I do not use the client connection creation wizard from the server. Is that what you meant?

Again, the main problem is that SOMETIMES when a user goes to log off they are prompted that the program "explorer.exe" can not end. And they are either to END NOW or CANCEL. Either way, it hangs the log off process for several minutes.

 

[GlenJohnson]

I do not use the client connection creation wizard from the server. Is that what you meant?

I use that and have NEVER had a problem. Give it a try.
Glen A. Johnson
Johnson Computer Consulting
MCP W2K
glen@johnsoncomputers.us



"Don't ever take a fence down until you know the reason why it was put up."
Gilbert Keith Chesterton (1874-1936); English writer.

 

[LiLAmy]

umm.. as far as I know.. all that it does is create a terminal services client disk.. i don't see why that would change anything.. or am i missing something here?

 

[GiaBetiu]

LilAmy,

the file that i'm talking about is in :
\\%windir%\security\template

You have to apply this security template.
How?
1. launch mmc
2. add remove snapin, choose "Security Configuration and Analysis"
3. Right click / Open a database. Choose a name.
4. It will ask you for an inf file. Go to the path from above (you already should be there)
5. Click "Configure Computer Now"

Success! Gia Betiu
giabetiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[LiLAmy]

http://support.microsoft.com/default.aspx?scid=KB;en-us;q238965

According to that article applying the .inf file you are referring to will remove additional permissions that are normally granted to terminal services users and they will then have the same default permissions as a standard windows 2000 user.

Can you PLEASE explain how that would resolve my issue at hand?

You said "It looks as if your users have profiles defined."
Don't all users have profiles defined by default? What do you mean by this?

 

[GiaBetiu]

They will not have as a standard user. They will have the rights of the TSInternetUser.

If you have set rights to NTFS to the users that will log on via terminal services, imagine how the things are working when instead of user SID it will be TSInternetUSer SID.

Your issue can be linked with this. And, anyway, if you want your users to be recognized by their SID you have to do this. Gia Betiu
giabetiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k