Archive for the ‘Windows Server’ Category

Locking down terminal services

January 31, 2010 Leave a comment

This is the list of Group Policy and registry changes I like to make for terminal services environment:

GROUP POLICY CHANGES – to force, run GPUPDATE from command line, then log out and back in to test.
Computer Configuration
Administrative Templates
Windows Components
Terminal Services
Remove Windows Security Item from Start Menu – enabled
Remove Disconnect option from Shut Down dialog – enabled
Windows Update
Configure automatic updates – disabled
Windows Messenger
Do not start windows messenger initially – enabled
User Configuration
Administrative Templates
Start Menu and Taskbar
Add Logoff to the Start Menu – enabled
Remove and prevent access to the Shut Down command – enabled
Turn off personalized menus – enabled
Turn off notification area clenup – enabled
Do not display any custom toolbars in the taskbae – enabled
Remove Set Program Access and Defaults from Start Menu – enabled
Active Desktop
Enabled Active Desktop – enabled
Prohibit Changes – enabled
Active Desktop Wallpaper – path to wallpaper file, and style (e.g. C:\DELL\wallpaper.jpg, wallpaper style: stretch)
Remove Desktop Cleanup Wizard – enabled

Add following Value: NoDisconnect (REG_DWORD) 0x1 = Hide Disconnect menu item

Value: NoDisconnect (REG_DWORD) 0x1 = Hide Disconnect menu item
Categories: Windows Server

How to lock down a Windows 2003 or Windows 2000 Terminal Server

January 9, 2010 Leave a comment

Here is the Microsoft KB entry for terminal session security.

Categories: networking, Windows Server

Server 2003 – Terminal Server Client Access Licensing setup – eOpen

1. Find license on your eOpen website portal, noting especially the Authorization and License codes.

2. Install terminal services licensing server, preferably on a 2003 server that is not a domain controller or a terminal server.

3. Administrative Tools – terminal services licensing

4. Click on server name. Choose activate, and install licenses.

5. Choose license program: Open License

6. Enter your authorization number in the agreement number field.

7. Enter your license number in the unmarked field below it. Hit next and you should be good to go.

Categories: Software, Windows Server

IPP printing with Linux and Windows

June 19, 2007 Leave a comment

How to make Windows use CUPS IPP

This worked really well to get Windows Server 2003 to use a HP Laserjet printer local to a Ubuntu feisty machine. My OSX machine saw it right away once I turned on the printer sharing on in CUPS. Windows took a little more trickery.

Powered by ScribeFire.

Importing Contacts into Outlook

February 14, 2007 Leave a comment

Outlook handles individual vCards (2.1, not 3.0) just fine, but importing a batch can be a problem. Here is a procedure for getting an Apple Address Book into Outlook, via the Windows Address Book. This is tested with OSX 10.4.8 and Outlook XP on a terminal server session on Server 2003. Other versions are probably similar.

  1. Apple Address Book: Preferences > vCard Format> Click 2.1 format, and close the preferences window
  2. Highlight the contacts to export and choose File> Export vCard… Choose a location. It will export one combined file.
  3. Copy the file to the computer you’re importing from
  4. Go to Start: Program Files: Accessories: Address Book
  5. In Address Book, go to File > Import > Business Card (vCard)… and select your vCard 2.1 file. Address book will now import all the records from the file. You’ll have to OK each as it imports each one, but you can just sit hitting the ENTER key so it’s actually pretty quick.
  6. Fire up Outlook and pretend you’re importing addresses from Outlook Express. Go to File > Import and Export, choose “Import Internet Mail and Addresses” as the action, then “Outlook Express 4.x, 5.x, 6.x” as the source and untick “Import Mail” and “Import Rules”. Make sure you can view invisble files. Specify \\<computer>>\Documents and Settings\<<user>>\Application Data\Microsoft\Address Book\<<user>>.wab. Choose Outlook Contacts Folder as the destination and tell it what you want to do with duplicates. Click Finish and Outlook will automatically import all the address you imported into Address Book into your Outlook Contacts folder.
    (Detailed instructions here.).

This was adapted from an entry at

Categories: OSX, Software, Windows Server

Printing from DOS within a thin client session

November 14, 2006 Leave a comment

This assumes you are already able to print with your thin clients in Server 2003 terminal server sessions, and need to add printing for a DOS application. DOS will see the remote printer as LPT1.

  1.  Share the printer from the terminal server and give it a legal DOS name. (e.g. TEST1)
  2. Create a batch file in the user’s startup menu, startup folder. (e.g. DOSPRINT.CMD)
    NET USE LPT1: /delete

When the user logs in the printer should now be mapped every time. This worked perfectly for users with Okitdata dot matrix printers connected to the parallel ports of ThinStation computers connecting to Windows Server 2003 over the internet.

MS SQL Server local file backup problem resolved

June 7, 2006 Leave a comment

I recently ran across a problem twice with backup maintenance plans in Microsoft SQL Server (2000+). The following error started to appear when the file backup job started to run:

… – Message: The job failed. Unable to determine if the owner (DOMAIN\Administrator) of job DB Backup Job for DB Maintenance Plan 'DB Maintenance Plan1' has server access (reason: Could not obtain information about Windows NT group/user 'DOMAIN\Administrator'/ [SQLSTATE 42000] (Error 8198)).

There seemed to be lots of people with the same problem but no solutions offered. Here's the solution that worked for us:

  1. Go to Administrative Tools -> Services. Click on SQLSERVERAGENT and select Properties from the Action menu. Click on the Log On tab. Select Local System Account. Click on the General Tab. Select Startup Type: Automatic and hit OK.
  2. In Enterprise Manager, go to Maintenance, and click on SQL Server Agent. Select Properties from the Action menu. Click on the Connection. Select Use Windows Authentication and hit OK (You may need to stop and restart the SQL Server service at this point).
  3. In Enterprise Manager, click on the name of the local server and select Edit SQL Server Registration properties… Select Use SQL Server Authentication (we used sa), and hit OK
  4. Delete the existing database plan and create a new one.