RDP: Set up a Monitor Span for Non-Windows 7 Enterprise/Ultimate End Points

In order to get true multi-monitor client connections going both ends need to be Windows 7 Enterprise and/or Ultimate. Or, when connecting to Remote Desktop Services the client needs to be one of those client OSs.

To get around that for all other client OSs we can do the following:

1. Set up an SSL VPN connection (or PPTP).
• Disable the Use Remote Gateway setting for IPv4 and IPv6.
2. Start –> type: MSTSC [Enter]
• Machine.Domain.Local
• Full Screen
• Redirect needed resources.
• Do not change Gateway settings from default.
3. Save As onto the desktop.
4. Right click RDP file and Open With…
• C:\Windows\notepad.exe
5. Add the following line to the RDP file:
• span monitors:i:1
6. Save the RDP file.
7. Open the VPN connection.
8. Double click on the RDP Desktop file.
9. Log on to the desktop machine.

Users will need to get used to all dialogue boxes saddling the two monitors since that is where the “middle” of the spanned setup is.

The local monitor pair must be side-by-side and the same resolution.

We tested running the RDP file with a Remote Desktop Gateway setting and it seemed to only connect one monitor.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

What a TSGrinder Grind Against an SBS Looks Like

On some of our older SBS 2003 installs where we have no out-of-band remote management setup in place, we open up port 3389 on the router to the server to run our updates.

Once we are finished, we normally close the port back up. Now, this particular evening we had run a series of updates across more than half of the servers that we manage one Saturday.

It seems that one of the firewall ports did not get closed and someone took an interest in that particular server:

• Logon attempts: 3,282
• IP: 64.46.44.76

Now, the IP may not be relevant since the machine behind it may be a zombie.

Things were relatively quite until a few days later:

• Logon attempts: 5
• IP: 113.53.231.2

Then this one kept at it for a number of days:

• Logon attempts: 1,906
• IP: 84.53.64.91

The above IP kept after the server until this day:

• Logon attempts: 2,414
• IP: 84.53.64.91

And another shot of a report that was taken manually in the SBS Console not long after the above:

• Logon attempts: 4,545
• IP: 84.53.64.91

Note the different numbers between the automatically generated report and the one manually created by us. The disparity may be due to the fact that the TS service was being hammered so frequently.

While the grind was happening we could not log on to the server via a direct TS connection. We were almost instantly bumped out as soon as we saw the logon screen.

Fortunately, we could log onto RWW and TS via the RWW RDP connection that uses a proxy port of 4125. If that had failed, then we would have connected to a workstation and ran:

• mstsc /v:servername /admin

From there we would have had console access and could do what needed to be done which was to close the 3389 publishing rule in ISA.

TS Client help screenshot:

As a rule, we do not allow port 3389 to be opened to the Internet by default.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Windows 7 – Remote Desktop Multi-Monitor Goodness

The TS Gateway service allows us direct access to our desktops.

The new RDP version allows us to /mulitmon to use the two monitors we have connected to this workstation on the remote desktop:

Here is a list of the new RDP version’s command line switches:

Just remember that the TS Gateway service does allow for direct connections to any TS enabled system inside the SBS network. As a result, it would be a good idea to look at AuthAnvil by Scorpion Software to provide another level of authentication protection.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

Windows Live Writer

AuthAnvil – Want to See a Neat Security Demo Video?

With the advent of the TS Gateway service on SBS 2008, the only thing protecting our production SBS 2008 networks is a password.

Even  with a passphrase in place, there are some pretty sophisticated password dictionaries out there.

We will be looking to providing another layer of protection to our SBS 2008 networks.

That protection will be provided by Dana Epp’s (Security MVP blog link) AuthAnvil security product.

Check out the video that demonstrates AuthAnvil in action:

Scorpion Software: AuthAnvil Demonstration Video

Something to keep in mind is that TSGrinder (Live Search) has been reworked to now be able to attack the new TS setup on Windows Server 2008.

The video link: Scorpion Software: AuthAnvil Demonstration Video

Scorpion Software also offers a partner program: Scorpion Software Partner Program.

Much like Vlad’s OwnWebNow, Scropion Software is another reputable product vendor that delivers on a great business relationship and a great product set that is well supported.

Do check out Dana’s blog. It is a good read!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*All Mac on SBS posts will not be written on a Mac until we replace our now missing iMac! (previous blog post)

SBS 2008 and SPLA

We have not been pushing too hard to get things rolling in our SPLA program with an SBS focus as of yet.

The primary reason is that SBS 2008 will actually fit a lot better into a multiple user/company hosting setup.

The reasons:

1. Remote Web Workplace has the ability to setup the resource links on a per user basis.
2. SharePoint can be configured with a subsite that is linked in RWW for a given user only. This gives exclusivity to the sub site to specific users or groups of users.
3. Terminal Services Applications (formerly SoftGrid) can be published to the RWW site via a link.
4. Users can be assigned a specific desktop for RDC only ... so no more full list of computers.

Enrolled in the SBS 2008 beta yet?

If not, we suggest heading into it soon as it will have a direct impact on your SMB/SBS SPLA business.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

Remote Desktop Connection (TS Client 6.0) KB925876

It seems that there have been some connectivity issues with the new RDP 6.0 Client via SBS RWW.

Susan Bradley mentions it here, as does Dean Calvert here.

So far, we have seen a few TS 6.0 glitches.

One particular hiccup with the client that I have noticed though, is when connecting to a member server on the domain with MSTSC 6.0: if the client session is sitting long enough for the session to lock out, generally 15 minutes, the TS Client resets the "log on to" to the local machine instead of the domain.

It has happened pretty consistently.

When logging back into the server one is greeted with:


The first few times it happened, I thought I was making a typo since our passwords tend to be quite long.

But, that was not the case, as clicking the Options button reveals this:


One needed to change the log on location back to the domain from the local machine.

It has since become a habit, but it was a little annoying at first!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists