This manual

Next

Home

This Manual: build 189.9 (9 Sep 2021)

This manual is applicable to AADS Build 189.9 (9 Sep 2021)

This manual can be downloaded: AADS Terminal Server Small Manual . The file format is a CHM-file (Compressed Help File).

This manual applies to:

  • AADS Small Terminal Server - Windows 10 - 32 bits - 5 user - v10.0
  • AADS Small Terminal Server - Windows 10 - 32 bits - 10 user - v10.0
  • AADS Small Terminal Server - Windows 10 - 32 bits - no user limit - v10.0
  • AADS Small Terminal Server - Windows 10 - 64 bits - 5 user - v10.1
  • AADS Small Terminal Server - Windows 10 - 64 bits - 10 user - v10.1
  • AADS Small Terminal Server - Windows 10 - 64 bits - no user limit - v10.1
  • AADS Small Terminal Server - Windows 8.x - 32 bits - 5 user - v8.0
  • AADS Small Terminal Server - Windows 8.x - 32 bits - 10 user - v8.0
  • AADS Small Terminal Server - Windows 8.x - 32 bits - no user limit - v8.0
  • AADS Small Terminal Server - Windows 8.x - 64 bits - 5 user - v8.1
  • AADS Small Terminal Server - Windows 8.x - 64 bits - 10 user - v8.1
  • AADS Small Terminal Server - Windows 8.x - 64 bits - no user limit - v8.1
  • AADS Small Terminal Server - Windows 7 - 32 bits - 5 user - v7.0
  • AADS Small Terminal Server - Windows 7 - 32 bits - 10 user - v7.0
  • AADS Small Terminal Server - Windows 7 - 32 bits - no user limit - v7.0
  • AADS Small Terminal Server - Windows 7 - 64 bits - 5 user - v7.1
  • AADS Small Terminal Server - Windows 7 - 64 bits - 10 user - v7.1
  • AADS Small Terminal Server - Windows 7 - 64 bits - no user limit - v7.1
  • AADS Small Terminal Server - Windows Vista - 32 bits - 5 user - v4.0
  • AADS Small Terminal Server - Windows Vista - 32 bits - 10 user - v4.0
  • AADS Small Terminal Server - Windows Vista - 32 bits - no user limit - v4.0
  • AADS Small Terminal Server - Windows Vista - 64 bits - 5 user - v4.01
  • AADS Small Terminal Server - Windows Vista - 64 bits - 10 user - v4.1
  • AADS Small Terminal Server - Windows Vista - 64 bits - no user limit - v4.1
  • AADS Small Terminal Server - Windows XP Prof SP2 or higher - 32 bits - 5 user - v1.9
  • AADS Small Terminal Server - Windows XP Prof SP2 or higher - 32 bits - 10 user - v1.9
  • AADS Small Terminal Server - Windows XP Prof SP2 or higher - 32 bits - no user limit - v1.9

AADSetup tells you which build of AADS is about to be installed:

AADS Maintenance Control tells you which build of AADS is installed:

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Next

Home


About CHM Files...

About Manuals in CHM format...

Windows and CHM

  • Every Windows version is able to view the contents of a CHM-file, provided that the file is located on a local disk.
  • CHM-files which are located on a network-drive are not viewable in Windows.
  • Security settings on Windows, or Policy Settings, or Anti Virus software might prevent you from opening a CHM file:

    Using Windows Explorer, properties of the CHM file:

    Select "unblock":

    Microsoft: some .CHM files may not render properly on Windows

OSX and CHM

The App-store for OSX offers various readers for CHM-files.

Linux and CHM

On Linux you can use the package xCHM for viewing CHM-files.

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall


Installation

Installation

Setup program name

The AADS Terminal Server Setup program is either call AADServer**Demo.exe or AADServer**Full.exe. The ** denotes the AADS Terminal Server version you are installing.

Administrator

Only an user with Elevated Administrator access on the system can install the AADS Terminal Server software.

Installation Procedure

Select Language

Select the desired language. AADS will be installed with the selected language.
The selected language will also be included when generating a Client Build for RDP.

Demo version

In the first screen of the “Demo Version” you are requested to read the License Terms of Use and acknowledge them. The Demo version also contains a "Check for Update" button in the first screen:

Before your proceed with the installation of AADS Terminal Server Demo, be sure to check that you are installing the latest version.

AADS Terminal Server Demo will run for 60 days. After 60 days it is not possible any more to login using a Remote Desktop Session; login is only possible using the console of the AADS Terminal Server.

Full, Paid version

In the first screen of the "Paid, Full version" you are requested to enter your license code. The AADS License Numbers has 2 formats:

  • 12 positions in the range A..Z and 0..9. Example: 12AB 34CD 56EF (this is not a valid number)
  • 18 positions, containing only letters A..Z. Example: EKOHIGJZ-TTMJKDFG-EWPLKAQR (this is also not a valid number, just an example)

When you are installing AADS Full, you will need to enter the License Number in the 12 position format.
After the installation of AADS Terminal Server Full, AADS Maintenance Control will show you the License Number in the 18 position format.

When you are installing AADS Demo, there is no need for entering a License Number.
After the installation of AADS Terminal Server Demo, AADS Maintenance Control will show you "Demo" as the License Number.

You are also requested to read the terms of use and acknowledge them.

After entering you license code and the acknowledgement of the Terms of Use, the Next-button becomes available.

HTTP(S) Port 80/443

A HTTP(s)-request and reply is sent to our License Servers in order to validate your license. AADS Terminal Server Setup behaves like a browser when contacting the License Servers.

  • First a HTTPS request on port 443 is attempted.
  • If the HTTPS request fails, a HTTP-request on port 80 is attempted.

HTTP(S) Proxy

Optional you can specify a IPv4 HTTP(S)-Proxy server (IPv6 Proxy is not supported...)
The proxy server is used for sending the License Request.

  • Enter the IPA or DNS address of the HTTP(S) proxy server.
  • Enter the portnumber of the HTTP(S) proxy server.

Checking system requirements

The AADS Terminal Server Setup program checks whether or not the installation of AADS Terminal Server is possible:

No Domain Users

When the Setup program detects that this Windows System is part of a Domain, it will remove it from the Domain. AADS Small can only be used on stand-alone servers.
AADS Enterprise can handle Domains.

Install AADS

In case it is possible, you can click on Next in order to install AADS Terminal Server.
If you click on Exit now, nothing will be installed.

The AADS Terminal Server software is installed In a couple of steps.

Result of the Installation Procedure

The software is installed:

You are one reboot away from using your AADS Terminal Server.

RDP FireWall

Default setting for the built-in RDP FireWall is that RDP connections from public IP Addresses to the AADS Terminal Server are blocked. However, because the Administrator is busy with installing and configuring AADS, it might be required to temporary allow RDP Connections from Public IP Addresses. Default it is possible to access the AADS Terminal Server from public IP Addresses for 1 hour after the reboot. The Administrator who is installing AADS can change this to a maximum for the next 48 hours.

Maintenance AADServer

A program entry will be made in the Administrative section of the Start menu of the system.


What is installed Where

What is installed Where...

Administrator

Maintenance AADServer

A program entry will be made in the Administrative section of the Start menu of the system.

Allow Temporary RDP Connections from Public IP Addresses

Described here

Logging Folder

There are no differences between the 32 and 64 bits versions of AADS Terminal Server, except where some files are installed on drive C:
Example:

The 32 bits version of AADS Terminal Server stores the logging in the folder:
c:\program files\aadserver\logging

The 64 bits version of AADS Terminal Server stores the logging in the folder:
c:\programdata\aadserver\logging

Users

Screen Saver settings

An entry is created in the "Accessories" menu for "Screen Saver Settings":

Default Screen Saver settings for Windows Server are as follows:

These default Windows Server Screen Saver settings are applied in case AADS is used on any version of Windows.

Taskbar settings

For reasons unknown it is not always possible to do "Taskbar Settings" by doing a right-click-mouse on the Taskbar (applicable to Windows 10 and Server 2016...),
a tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:

Calculator

The new UWP calculator in Windows 10 and Server 2016 is not everybody's favorite calculator.
A "classic" version of Microsoft Calculator is installed, and shortcut is placed in the "Accessories" menu:

Allow Temporary RDP Connections from Public IP Addresses

Described here

DockDesktop

Described here

ViewUsers

Described here

Panels and Tiles Manual for the Users

c:\program files\aadserver\UserManualStartMenu.chm


Virtualization

Virtualization

AADS works OK when running inside a VM (Virtual Machine). We do most test-work using Virtualization.
We have a FAQ about AADS and Virtualization .

When using Virtualization to run Windows and AADS, do make sure that you apply "reasonable" VM-settings:

  • Assign enough memory to the VM.
    4 GB for Windows 7 or Windows 10 is the "minimum".

  • Assign at least 2 cores / cpu's to the VM. Modern versions of Windows do not run very smooth any more on only 1 cpu / core.


Additional steps before using AADS Terminal Server

Additional steps before using AADS Terminal Server

After the installation of the AADS Terminal Server software, and after the reboot of the system, you need to perform a couple of steps in order to use the AADS Terminal Server:

  • Create users that can login using a Remote Desktop Session. If your Windows system has only one user, you will hardly use the benefits of the AADS Terminal Server product.
  • Make sure that all users have a password. It is not possible to have a Remote Desktop Session with an user ID that has no password. This is simply to unsafe.
  • Make sure that all users are member of the group "Remote desktop users". If an user is not a member of the group "Remote desktop users", this user will not be allowed to have a Remote Desktop Session. You can also use our
  • Maintenance Program to give any verified user access to the AADS Terminal Server. A verified user is an user who has entered his username and password.
  • Open your firewall for Remote Desktop Sessions. The port that needs to be open is TCP port 3389. Default this port is closed, so your Windows system does not allow you to have any remote desktop session.

Important: Sometimes you might turn off the Windows Firewall because you are testing a system and while doing such you are not "interested" in the protection as offered by the Windows Firewall. It does happen that the firewall is turned on again, without informing you. An example of this behaviour is joining or un-joining a Windows system from a domain. After the (un)join, the Windows Firewall is turned on again.

Please visit our website, specific the FAQ Support-pages. You will find detailed examples and howto's between our FAQ's which describes how you can perform these steps.


Setup problems

Setup problems

Example 1

The AADS Terminal Server Setup program does a checking of the system for requirements. In case the requirements are not met, you will be informed what the problem is.
AADS Terminal Server can not be used on Windows Home.

Example 2

Problem: There seems to be another software installation that is waiting for a reboot

The installation of the software requires 1 reboot of the server in order to complete the installation of the software. A reboot of a Windows system in order to complete the installation of software is quite normal. Therefore, other software companies might also require a reboot to complete their installation of the software.
To prevent problems and conflicts, AADS Terminal Server Setup program will not install when another piece of software requires a reboot to complete its installation.

Sometimes, our Setup program keeps on saying "There seems to be another software installation that is waiting for a reboot" because every time the system is running, for some reason a piece of software put itself in the Registry of the PC, specific the location where Setup-programs can finalize their installation. Some viruses and trojan horses abuse the Registry, specific this setup-location, in order to install itself again every time the PC is restarted.
In case the Setup program keeps on telling you the message "There seems to be another software installation that is waiting for a reboot", you are advised to check your PC for viruses, spyware or trojan horses.

If you are sure that no viruses are running on your PC, you can execute the following Registry File. It will clear the settings in the Registry that are blocking the installation of the Software. The procedure is as follows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\]
"PendingFileRenameOperations"=-

  • Create the Registry-file as shown here above. Create it for example on your desktop and call it "pending.reg".
  • Be sure that the Registry-file has the extension ".reg". Because Windows does default not shown the extensions, and the file you just created might have the extension ".txt".
  • Double click on the Registry file. The setting will be "merged" in the Registry.
  • Continue the installation of the Software.

Final screen in case of AADS Terminal Server Setup problems

In case the Setup program decides that installation is not possible, it will finish as shown.

If you need support on the problem, you are requested to supply us with the Support-ZIP-file. This will assist us with analyzing the problem. You can use the ZIP-button to create the ZIP-file. It will be placed on your desktop.


Upgrade / Re-install of AADS Terminal Server

Upgrade / Re-install of AADS Terminal Server

The AADS Terminal Server Setup program always behaves as if it is doing an upgrade. This implies that it will respect the settings that are already done.

An upgrade from the Demo version to a Full version is therefore quite simple:

  • Buy the Full version,
  • Run the Setup of the Full version,

and that's it.

The Upgrade behavior does apply to:

  • An upgrade from AADS Small version to AADS Enterprise,
  • An upgrade from Demo to the Full version,
  • An upgrade from an old version 1.2.3 to a new version 1.2.4.

and it applies to:

  • A downgrade from version 3.2.1 to version 1.2.3

It is possible to downgrade AADS Terminal Server, although we would not know why you would want to do that. If you downgrade from Full version to Demo version, the result will be that your Server is again limited to 3 users.

If you do not want the Setup program to do an upgrade of your current AADS Terminal Server, you must first uninstall the current AADS Terminal Server software, and after the uninstall, run the AADS Terminal Server Setup program.
After uninstalling AADS, all AADS Settings are lost and you will need to configure everything on your AADS Terminal Server.

Fixing problems by re-installing AADS Terminal Server

Sometimes you can fix problems with a re-install of AADS Terminal Server. It does unfortunately happen that, for example, Windows Update or some kind of anti-virus software update, does revert settings that are relevant for AADS Terminal Server. Usually Windows is a single user, single desktop, single login operating system, offering only 1 Remote Desktop Session, and those updates might not expect or understand the multi-user, multi-desktop, multi-login, multiple concurrent Remote Desktop Sessions as made available by AADS Terminal Server.
When there is an issue, do not uninstall AADS Terminal Server. Only re-install AADS Terminal Server on top of the current installation.

Firewall

It is required to configure both the AADS built-in RDP Firewall and the Windows Firewall.

  • AADS built-in RDP Firewall
  • Windows Firewall

Don't be tempted to disable the Window Firewall or the AADS built-in RDP Firewall. Too often we receive ZIP Support Files with loglines indicating many hack-attempts because of a disabled AADS RDP Firewall or no Firewall.


From DEMO to FULL

From DEMO to FULL

The AADS Terminal Server Setup program always behaves as if it is doing an upgrade. This implies that it will respect the settings that are already done.

An upgrade from the Demo version to a Full version is therefore quite simple:

  • Buy AADS Full.
  • Download AADS Full Setup using the download links that are send to you by email.
  • Run AADS Full Setup, and enter the License Number.

How it does not work...

  • It is not possible somehow to enter the License Number into AADS Demo.
  • Only AADS Full Setup has the option to enter the License Number.

How it does work...

  • Entering the AADS License number can only be done by running AADS Full Setup.

AADS Full Setup

AADS Full Setup can be used to enter the AADS License Number.

AADS Demo Setup

AADS Demo can not be used to enter the AADS License Number.


Upgrade from XPUnlimited

Upgrade from XPUnlimited

The AADS Terminal Server Setup program always behaves as if it is doing an upgrade. This implies that it will respect the XPUnlimited settings that are already done.
Do not un-install XPUnlimited, but install AADS Terminal Server Setup on top of XPUnlimited.

When AADS Terminal Server Setup detects old XPUnlimited files and settings, the following specific actions will happen:

  • All XPUnlimited settings will be migrated to AADS settings, including:
    • Application Control settings
    • Webserver
    • PDF printer
  • XPUnlimited executable files will be deleted
  • XPUnlimited logging and, if applicable, the www-folder, will be backup-ed in the folder:
    \ProgramData\It_is_OK_to_delete_old_xpunlimited_folder    (x64 versions of Windows)
    \Program Files\It_is_OK_to_delete_old_xpunlimited_folder  (x32 versions of Windows)

Firewall

AADS has been changed and improved compared to XPUnlimited. It will be required to configure both the AADS built-in RDP Firewall and the Windows Firewall.

  • AADS built-in RDP Firewall
  • Windows Firewall

Don't be tempted to disable the Window Firewall or the AADS built-in RDP Firewall. Too often we receive ZIP Support Files with loglines indicating many hack-attempts because of a disabled AADS RDP Firewall or no Firewall at all......


Operation

Operation

The Operation of AADS Terminal Server can be monitored and controlled using our Maintenance tool. It can be found in the Administrative Tools of the Control Panel:

The initial screen of AADS Terminal Server Maintenance tools is as follows:


Control

Control

Running Mode

  • Default Running Mode is that all users can login and work with a Remote Desktop Session.

There are 2 other optional Running Modes, which can be used when the Administrator needs to do some maintenance, software update, etc.

  • No Remote Desktop Sessions are allowed. Only the Console login is allowed.
  • Remote Desktop Sessions are only allowed for Administrators. The Console login is also allowed.

Message

Prior to changing the Running mode, or for example prior to rebooting the server, the Administrator can send a Message to all users.

Logoff

After sending the Message to all users (and giving them some time...) the Administrator can forcefully logoff all users.

See also ViewUsers

Reboot, ShutDown

The Administrator can Reboot or ShutDown the Server.

Connections

As shown in the example above, AADS Demo can handle 3 sessions, and currently there is 1 sessions.

Boot Time

The Boot time and Uptime of the AADServer is shown.

About Reboot and ShutDown

Reboot or Shutdown does always not work

Unfortunately Shutdown or Reboot on Windows does not always work, because:

  • New hardware, old Windows...
  • New Windows, old hardware...

For all kind of reasons, hardware vendors, together with Microsoft and other software companies, do define new specifications for hardware, power, bios, etc.

UEFI is an example of a specification which is related to this problem. Older hardware might not adhere to the latest UEFI specifications, while a modern version of Windows do expects this.

The reverse is also applicable: an old version of Windows, for example Windows XP or Windows 7, might not have the drivers suitable for a modern piece of hardware including modern ACPI, UEFI, modern bios, etc, with the result that this "old" Windows is not able to shutdown or reboot the server properly.

Behind the AADS buttons "Reboot" and "Shutdown" is some logic that attempts to do the Reboot / Shutdown job in 3 different ways. In total this might take up to 90 seconds.

A proper Shutdown / Reboot is important

It is still (very much) desirable to do a proper Reboot / Shutdown when working with Windows, because otherwise files, disk, registry, etc, might get damaged if Windows is not shutdown / rebooted in a proper way.

If your default Windows buttons / menu for Reboot or Shutdown do not work properly, use the AADS buttons in AADS Control for Reboot / Shutdown, and see if the AADS buttons do work OK and do indeed Reboot / Shutdown the server. Again, it might take up to 90 seconds before AADS has found a way to Reboot or Shutdown the server properly.

Virtualization

Virtualization attempts to mimic virtual hardware, including the same details as mentioned here above: ACPI, UEFI, bios, etc.

Virtualization can bring the benefit that you might be able to choose between:

  • Mimic old hardware suitable to old Windows
  • Mimic new hardware suitable to most recent Windows

Please consult the manual and / or website of the Virtualization software on how to handle this issue.

Example:

When running Windows 10 inside a VM, using an "old" Virtualbox host, it might be required to choose "Minimal" for the Paravirtualization interface. Otherwise Windows 10 will not boot.


License

License

The License tabpage shows the License type and License Number. The AADS License Numbers has 2 formats:

  • 12 positions in the range A..Z and 0..9. Example: 12AB 34CD 56EF (this is not a valid number)
  • 18 positions, containing only letters A..Z. Example: EKOHIGJZ-TTMJKDFG-EWPLKAQR (this is also not a valid number)

AADS Maintenance Control Full, will show you the License Number in the 18 position format.

AADS Maintenance Control Demo, will show you "Demo" as the License Number.

Offline License Type

The Full, Paid version of AADS Terminal Server can use both an "Offline" and "Online License Type".
In case an "Offline License Type" is being used, it is shown as follows:

The Offline License Type does not need Internet access and does not need to be re-newed.

Online License Type

In the example above, a Demo License is shown, which is always of the "Online License Type".
A Demo License is valid for 60 days. The End-date is shown.

Automatic License Update, Online License Type

Approximately once a week the Online License will be renewed.
Default updating the "Online License" is done automatically.

Automatic License Re-Install, Online License Type

In case the Server changes, the License needs to be re-installed. In case an Online License is used, the re-install of the AADS License can be done automatically.

When NOT to use Automatic License Re-Install, Online License Type

  • VM's are copied "all the time" and are started on random PC's, for example a Test-PC of an Administrator.
    • It is so easy to copy and clone and run VM's...so why not do that...
  • When the VM-copy is started, AADS sees that it is used on a different Server.
  • The AADS License will be re-installed and associated with this random PC/Server.
  • The AADS License on the real Production Server will be invalidated automatically, because:
    • 1 Server, 1 License. This is our main License Term (and business).
  • The Production Server will stop working...

When to use Automatic License Re-Install, Online License Type

  • VM-copies are made.
  • The VM-copy is started on some other Production Server, because the current Production Server or the current AADS-VM has a problem and is stopped.
  • VM-copies are not randomly started on random PC's.

HTTP(S) Proxy

Optional you can specify a IPv4 HTTP(S)-Proxy server (IPv6 Proxy is not supported...)
The proxy server is used for sending the License Request.

  • Enter the IPA or DNS address of the HTTP(S) proxy server.
  • Enter the portnumber of the HTTP(S) proxy server.

Manual License Re-New, Online License Type

In case it is preferred not to connect the AADServer to the Internet, it is possible to use a browser for the re-newing of the "Online License".
The AADServer can be disconnected from the Internet.

In such a case,

  • de-select Automatic License Update,
  • de-select Automatic License Re-Install,

and click on the Apply-button.

And when the AADServer needs to re-new the temporary Online License, it will be shown as follows:

When the "Online License" needs to be re-newed, a "LIC REQUEST" will be shown.

Copy-and-paste the complete "LIC REQUEST" in to a browser, into the "License Request" procedure on our website:

https://www.aads-worldwide.ae/admin15.html

Click on the "submit-button", and after a few seconds, a "LIC REPLY" is shown:

Copy the whole "LIC Reply" into AADS Control, and click on the "Set License" button:

Click on the "Set License" button.

After a few minutes, the "LIC Reply" is processed by the AADServer, and such is shown as follows:

Notifications

Be sure to read the paragraph about Notifications . When Notifications are enabled, the AADServer will sent an email to the Administrator when the Manual License Re-New procedure needs to be done.

    The Administrator can expect 1 email once a week.


Support

Support

The Support tabpage shows all AADS files, and informs you if they are OK or not.

Due to "over-active anti virus" software, it might happen 1 or more AADS programs gets deleted. AADS Maintenance and Control (if it is not deleted by some "over-active anti virus" software... ) will tell you about the problem:

Restoring the deleted programs might be possible using some kind of "restore" function of the "over-active" anti virus software. Be sure to "re-configure" the "over-active" anti virus, such that it does not delete anymore AADS files.

If the "over-active" anti virus software does not have a proper "restore" function, it will be required to proceed as follows:

  • See the FAQs about AADS and "over-active" anti virus .
  • Do attempt to re-configure the "over-active" anti virus, such that it does not delete anymore AADS files.
  • After the re-configuring of the "over-active" anti virus, re-install AADS.
    • Do not un-install AADS.
    • Re-install AADS on top of the current installation.
  • After the re-installation of AADS, all files should be shown OK again...

ZIP Support Button

When asking us support, please mail us the Support-ZIP-file. This ZIP-file will be placed on your desktop, and it will contain all the information we need to analyze the problem.

Important: when creating a Support-ZIP-file, be sure to login on the AADS Terminal Server as an Administrator. Otherwise information might not show up in the log file.

Uninstall

Prior to uninstalling this notification is shown.

Uninstall does not solve AADS problems

Before you consider to uninstall AADS Terminal Server, you should know that uninstall AADS Terminal Server does not solve any problem.
Uninstall AADS Terminal Server does only do:

  • uninstall:
    • delete all AADS files.
    • delete all AADS settings.
    • restore default Windows single logon, single desktop settings.

If you want to fix some kind of AADS Terminal Server problem, all you have to do is re-install AADS Terminal Server. Do not uninstall AADS Terminal Server. Re-install AADS Terminal Server on top of the current installation.

No other users should be active while uninstalling

Be sure that nobody is logged in except for the Administrator. In case other users are logged in, system files and settings are locked and can not be restored by AADS Terminal Server uninstall.

Do not manually remove AADS Program Files

In case there is some "other problem" with an AADS Terminal Server, and because of this you want to Uninstall AADS, you might be tempted to delete AADS Program Files, hoping that this will also remove AADS and fix this "other problem". It is not recommended to delete AADS Program Files. AADS is part of the Operating System, and deleting AADS Program Files will not solve any problem, but cause more problems.

If you want to Uninstall AADS Terminal Server, it can always be done as follows:

  • Boot Windows into Save Mode.
  • While running Windows in Save Mode, use AADS Maintenance Control, the Uninstall button, for Uninstalling AADS Terminal Server.

Manual activity after uninstall

After the uninstall of AADS Terminal Server you should perform the following actions:

  • Configure your Firewall in such a way that remote desktop sessions are not possible.
  • Remove all users form the group Remote Desktop users.


Update

Update

Check for Update

The Update-check button opens a website-page of our AADS Worldwide website.
The webpage will inform you whether or not you are running the most recent version of AADS Terminal Server, or an old version.

Download and install updates

The option "Download and install updates" requires that the AADS License is an Online License type.

When the license type is an Online License type, once a week it will be checked if there is an update available. In the event that we have published an update of AADS, the update will be downloaded and installed. After a reboot, the update will be applied.

Please note: the update will be downloaded and installed, but will be active only after a reboot. An automatic, forced reboot is not done as part of the update. The users can continue to work and the Administrator can decide when to do a reboot.


Notifications

Notifications

Notifications are emails sent to the Administrator (or someone else.....) of the AADServer.

  • Enter the appropriate settings, and click on the Apply-button.
  • After clicking on the Apply-button, it is possible to send a Test-email.
  • Optional all sent-emails and trace-files are saved. In case of smtp-related-trouble, the trace-files might be useful for analyzing the smtp-related-trouble.

Name in SSL Certificate

When the option "Name in SSL Certificate" is selected, the mailserver is expected to have a SSL certificate containing the name as entered. The AADServer checks if this name is found in the SSL certificate of the mailserver.

SMTP UserID and Password

If required by the mailserver, enter the UserID and password for connecting to the mailserver.

Send From

Enter the email address as defined in the mailserver for the AADServer.

Send To

The email address which will receive all notfications / emails.

SMTP Hostname (FQDN)

Wether or not a FQDN is required, is not an AADS-issue. It depends on the mailserver. In the example above, the mailserver is "mail.company.com". The Administrator of this mailserver will tell you if a FQDN for this AADServer is required, and what the FQDN should be.

When to send a Notification

The second tabpage shows the various "when" to send a Notification:

Notification: An Update is available

The Notification for "Update" is about AADS updates. It is not about Windows or other updates.

Notification: Problem with Online License

About this Notification: it is send when there is "some problem" with the renewal & verification of the Online License. For example, the problem can be that the internet connection of the AADServer is temporarily failing.

When this email is send, that does not imply that the AADServer stops functioning. An AADServer continues to function properly for at least 1 week, up to 2 weeks, in case there is a problem with the renewal & verification of the Online License. This implies that, when you receive a Notification about "some problem" with the renewal & verification of the Online License, you have at least 1 week to fix whatever needs to be fixed. If required, we will assist you.
And possible the problem goes away within a few hours or the next day, when for example, the internet connection of the AADServer starts to work again so the retries as done by the AADServer for the renewal & verification of the Online License are successful.


Terminal Services

Terminal Services

Settings

Advanced settings using Microsoft Management Console

The initial screen of the Advanced Settings is as follows:

  • You can set and configure Policies for this AADS Terminal Server.
    • You can configure advanced Remote Desktop Settings.
  • You can add / remove local users and groups on the AADS Terminal Server.
  • You can view the Windows Eventlog.

Please note: initial it might take a few seconds to show this screen.

Advanced Remote Desktop Settings

You can do some fine-tuning, but you are advised to be carefully with changing the default settings. You might render your system unusable.

When you click on an option, extra text will appear that explains this option. You are advised to read this text carefully prior to changing an option.

Please note: not all Remote Desktop options are implemented. Several Remote Desktop options are displayed because AADS Terminal Server delivers 1 solution for various Windows versions.

Reboot required

Changing an Advanced Setting of the AADS Terminal Server will require a reboot of the Windows System; the change will be in effect after a reboot.

Users and Groups

Select Users in the left panel. Use the right mouse button on the “white space” in the right panel. A sub-menu will be shown, including New User...

Use the right mouse on a user. The sub-menu that is shown contains the option for giving the user a password.
Users without a password can not have a remote desktop session. This is to unsafe.

Select Groups in the left panel. Use the right mouse on the group Remote Desktop Users. The sub-menu that is shown contains the option for adding an user to the group.

Removing a user's membership of the group Remote Desktop Users is also done using the “Add to Group” menu options. When clicking on the sub-menu “Add to Group”, a dialog is shown that can be used for both adding and removing users.

Only users who belong to the group Remote Desktop Users can have a remote session.

Control Panel

The "Control Panel" button shows the Windows Control Panel, with direct links to every setting that is possible with the Windows Control Panel:

Temp Folder

AADS changes the default Windows Temp folder for the users, because the default Windows Temp folder is not always suitable in case non-western languages like Thai, Japanese, Chinese, Arabic, etc, are used.
The Administrator can choose to use Default Windows Temp folders. For western languages the default Windows Temp folder will usually be OK.

Require membership of the group Remote Desktop Users

Default only users who are member of the group Remote Desktop Users can login. You can remove this requirement by selecting "verified users". A verified user is an user who has a valid username and password defined locally in Windows, or in the Domain.

Note: members of the group Administrators can login, independent of this setting.

Block logins if Windows is reaching a resource limit

AADS Terminal Server contains a thread that detects generic problems. One of those generic problems is an UNDER-sized or UNDER-powered server.

When this thread needs, for example 30 seconds, it indicates that there has been a moment where the cpu was 100% busy with something for this amount of time.
In those 30 seconds, nobody could login, nobody got a moving mouse, maybe tcp/ip connections are dropped because of time-outs, time-outs while writing data to disk, etc.
This implies a failing server. This implies failing basic functionality of Windows.

This "snap time" is something that is build into AADS Terminal Server. It is not really about AADS Terminal Server itself, but we get support emails about it.
There are also events in the Window logging from AADS Terminal Server stating

Windows is exceeding a resource limit

If that happens to often, with no particular cause, then the server is UNDER sized.
If that happens once, for instance because the virusscanner is doing a scan at 02:00, then it can be considered as OK.

Please be advised to check the Windows Event log for warnings and errors.

When you check the option "Block logins if Windows is reaching a resource limit", new logins on this AADS Terminal Server are blocked as long as the server has a "to-high" cpu utilization.

Audit Logfiles

If required, the AADServer can generate monthly Logfiles containing user activity.

'21 Mar 2020 7:40:03','REMOTE DISCONNECT','WIN10X64I100\luser001'
'21 Mar 2020 7:40:03','SESSION LOCK','WIN10X64I100\luser001'
'21 Mar 2020 7:52:42','CONSOLE DISCONNECT','WIN10X64I100\testuser'
'21 Mar 2020 7:52:42','SESSION LOCK','WIN10X64I100\testuser'
'21 Mar 2020 7:53:01','SESSION LOGOFF','WIN10X64I100\luser001'
'21 Mar 2020 7:53:47','SESSION LOGON','WIN10X64I100\luser001'
'21 Mar 2020 8:01:09','SESSION LOGOFF','WIN10X64I100\luser001'
'21 Mar 2020 8:01:31','SERVER START','WIN10X64I100'
'21 Mar 2020 8:01:34','SESSION LOGON','WIN10X64I100\testuser'
'21 Mar 2020 8:02:07','SESSION LOGON','WIN10X64I100\luser001'
'21 Mar 2020 8:04:34','SESSION LOCK','WIN10X64I100\luser001'
'21 Mar 2020 8:04:49','SESSION UNLOCK','WIN10X64I100\luser001'
'21 Mar 2020 8:14:58','SESSION LOCK','WIN10X64I100\luser001'
'21 Mar 2020 8:21:31','SESSION LOCK','WIN10X64I100\testuser'
'21 Mar 2020 8:21:35','SESSION UNLOCK','WIN10X64I100\testuser'
'21 Mar 2020 8:22:02','SESSION LOGON','WIN10X64I100\luser002'
'21 Mar 2020 8:24:11','SESSION LOGOFF','WIN10X64I100\testuser'
'21 Mar 2020 8:24:13','SESSION LOGOFF','WIN10X64I100\luser001'
'21 Mar 2020 8:24:14','SESSION LOGOFF','WIN10X64I100\luser002'
'21 Mar 2020 8:24:39','SERVER START','WIN10X64I100'
'21 Mar 2020 8:24:46','SESSION LOGON','WIN10X64I100\testuser'
'21 Mar 2020 8:25:51','SESSION LOGON','IPC\domain002'

The logfiles can found in:

Windows x32 | C:\Program Files\AADServer\logging
Windows x64 | C:\ProgramData\AADServer\logging

DATE/TIME Ordering

Usually the loglines are ordered by DATE/TIME. However, it is possible that "newer" loglines appear before "older" loglines. This might happen in case 2 or more users logon on almost the exact same moment. Therefore when using or viewing the Audit Logfiles, one should not assume that all loglines are ordered by DATE/TIME.

Timeout "Signing out" message

When an user does a Session Logoff, the user is presented with the message "Signing out". And while this message is shown to the user, the Server stops all user processes, close files, closes applications, close the session, etc, etc.

Since Windows 10 build 1903 it can take 10 seconds before Windows has closed and cleaned up a session. System software like AntiVirus software can also be a reason why it take a long time before the Session is closed and Logged off.
This implies that it can take 10 (very long...) seconds that the user is looking at the message "Signing out", or for 10 (very long...) seconds is looking at a black screen.

AADS offers a Time Out setting. If the Time Out is set to 3 seconds, the user will see the "Signing out" message for 3 seconds.
It might take longer before the session is indeed cleaned-up by Windows, but the user does not have to wait for this; after the short time-out the session is disconnected and the user can continue to work on his/her Client PC.

In case the short timeout for the "Signing out" message does result in problems, choose (system default) and wait for the Session Logoff to finish as long as it is needed...while the Client PC / MAC shows the message "Signing out" or shows a black screen...


RDP Client Build

RDP Client Build

An AADServer can be accessed using any modern RDP client running on Windows, OSX, Linux, iOS, Android, etc.
For Windows, the users might prefer to use the AADS Client Software for accessing the Terminal Server(s).

The Administrator can create a "RDP Client Build", which can be installed on the Windows Client PC's. The Client Setup build will be placed on the desktop of the Administrator. From there it can be distributed to the user(s).

Optional you can password-protect the Client Setup build. The user who wishes to install the Client Setup build on his client PC, will be requested for the password while installing the Client Setup build on his client PC.

See Client Software on HowTo use the AADS Client Software.


Disconnect / Logoff

Disconnect / Logoff

Using our program "ViewUsers" it is possible to Disconnect or Logoff other users. Default this ability is only possible for Administrators.

AADS has now a new setting. The IT-Administrator can define a group, on the local AADServer, and members of this group can be allowed to Disconnect or Logoff other users.

Define a new group and make 1 or more users member of this group.

Members of the group "DisconnectLogoff" are allowed to use the tool ViewUsers , and Disconnect or Logoff other users.

Search

The searchbox can be used to search for a Local group.


Optimize

Optimize

"Optimize" is available in AADS for:

  • Windows 10

Other AADS version for other Windows version do have the similar function Default Applications and Sets .

"Optimize" is as an easy wizard for default Application Control settings, resulting in better response and performance of the Terminal Server.

The objective of "Optimize" is to disable some Windows functions and settings and replace the Window Start Menu with an AADS Start Menu. These Windows functions and settings are not always needed on a Terminal Server, and do consume a lot of CPU and Memory. When these Windows functions are disabled, the response and performance of the Server will be noticeable better, certainly with 10, 20 or more concurrent users.

  • Click on the "Optimize" button
  • ...wait a few seconds...
  • Optional enable or disable some of the selections "Optimize Windows". It is recommended to enable all "Optimizations", such to get the best response and performance.
  • Click on Apply.
  • Some "Optimizations" require a reboot. If the "Reboot" button becomes enabled, a reboot is required. Click on the "Reboot" button as the last step.

About Disable Edge

  • Disable Edge is about the "first" Edge browser that was included in Windows 10 / Server 2016 / Server 2019. It would always be running (...consuming memory and cpu cycles...)
  • Disable Edge is not about the "second" Microsoft Edge browser (availability date: Januari 2020) . This "second" Edge Browser is a clone / derivative of the Chromium browser.

Office and Browsers

  • In case Microsoft Office is installed, a Set for Microsoft Office will be created
  • In case Libre Office is installed, a Set for Libre Office will be created
  • In case one for the following browsers is installed, the browser will appear on in the Set "Internet Browsers"
    • Microsoft Internet Explorer
    • Mozilla Firefox
    • Google Chrome (Enterprise Installation, not a single user installation)
    • Chromium (Enterprise Installation, not a single user installation)
    • Apple Safari
    • Opera
    • Vivaldi
    • Seamonkey
    • Microsoft Edge (Chrome-based browser)
    • Brave (Chrome-based browser)

Relaxed Application Control

The objective of "Optimize" is to improve the response and performance of the Terminal Server and give a similar user-experience as default Windows. Because of this objective, "Optimize" does not apply Restrict Application Control, but does apply Relaxed Application Control:

It is certainly possible to change this settings, and apply Restrict Application Control .

Default Desktop for the Users: Windows 10 Look and Feel

When "Optimize" is used for disabling the default Windows Start Menu, all Users will be presented with an AADS Start Menu.

The details and settings of the AADS Start Menu can be changed and adjusted by the Administrator with Application Control.

Disable Start Menu with Tiles

When the option "Disable Start Menu with Tiles" has been set, no user will see the default Windows Start Menu with Tiles. It is expected that all users will get a Start Menu based on Application Control settings.

Should it happen that an user does not have any assigned Applications thru Application Control settings, the user gets a small default AADS Start Menu:

AADS Application Control has a special directive for assigning the default Windows Menu to an user or group. When the directive $aad Windows Menu is used, and "Disable Start Menu with Tiles" has been set, the directive $aad Windows Menu shows the small AADS Start Menu, and does not show the default Windows Start Menu with Tiles.

Suppress Windows Update during office hours

We have has learned that Windows Update for Windows 10 can cause trouble. Therefore AADS can suppress Windows Update during office hours.

  • This is available for Windows 10.
  • This is not available for other versions of Windows.

Windows 10 does have Policies for Windows Update, but those Policies do not really stop Windows Update, and those policies do not differentiate between the day-of-the-week's:

The objective of these settings is to suppress Windows Update during Office hours.

  • Let Windows Update run during "evening / night hours".
  • Do a fresh reboot prior to the start of the workday. A fresh reboot of Windows can be a good remedy against all kind of trouble...


Un-Optimize aka Default Windows

Un-Optimize aka Default Windows

Click on the button "Default Windows" and all the Optimize settings will be reverted back to, indeed, Default Windows.


Default Applications and Sets

Default Applications and Sets

"Default Applications and Sets" is available in AADS for:

  • Windows Server 2008-R2, SBS 2008, SBS 2011
  • Windows Server 2008
  • Windows Server 2003
  • Windows 7
  • Windows Vista
  • Windows XP Prof SP2 or higher

Other AADS version for other Windows version do have the similar function Optimize.

Generate

"Default Applications and Sets" is an easy "wizard" which generates default Applications and Sets. This can be used, for example, when working with AADS Demo and if you want to start with "exploring" what AADS Application Control can do for you:

  • Click on the "Generate" button
  • ...wait a few seconds...
  • the result will be shown in Users, Groups and Applications

Office and Browsers

  • In case Microsoft Office is installed, a Set for Microsoft Office will be created
  • In case Libre Office is installed, a Set for Libre Office will be created
  • In case one for the following browsers is installed, the browser will appear on in the Set "Internet Browsers"
    • Microsoft Internet Explorer
    • Mozilla Firefox
    • Google Chrome (Enterprise Installation, not a single user installation)
    • Chromium (Enterprise Installation, not a single user installation)
    • Apple Safari
    • Opera
    • Vivaldi
    • Seamonkey
    • Microsoft Edge (Chrome-based browser)
    • Brave (Chrome-based browser)

Relaxed Application Control

"Default Applications and Sets" does not apply Restrict Application Control, but does apply Relaxed Application Control:

It is certainly possible to change this settings, and apply Restrict Application Control .

"Default Applications and Sets" Result

When "Default Applications and Sets" is used for disabling the default Windows Start Menu, all Users will be presented with an AADS Start Menu.

The details and settings of the AADS Start Menu can be changed and adjusted by the Administrator with Application Control.

Other Look and Feel's are possible.


Default Windows

Default Windows

If you do not want to use AADS Application Control any more, and wants to go back to "Default Windows", select

  • No application control, Users always see a complete desktop

followed by the "Save" button.


Application Control

Application Control

The purpose of AADS Application Control is limit the desktop of the users such that they can do "create problems". The users should only have a limited desktop with only those few applications that they need for their work.

Availability

AADS Application Control is available as follows:

 | Desktop Applications (win32 applications) | Metro Applications / Immersive Shell | Continuum Applications / Universal Windows Platform (UWP)
Windows 10 | Can be controlled | n/a | Can not be controlled
Windows 8.x | Can not be controlled | Can not be controlled | n/a
Windows 7 | Can be controlled | n/a | n/a
Windows Vista | Can be controlled | n/a | n/a
Windows XP | Can be controlled | n/a | n/a

Initial Screen

The initial screen is as follows:

When Optimize or Default Applications and Sets has been used, the initial screen is as follows:

The objective of "Optimize" is to improve the response and performance of the Terminal Server and give a similar user-experience as default Windows. Because of this objective, "Optimize" does not apply Restrict Application Control, but does apply Relaxed Application Control.


Mode and Type

Application control mode and type

Application control mode

Application Control has 3 different modes op operation:

The default mode is “No Application Control”. Every remote user always sees a complete, default Windows desktop.

The second and third option turns on the Application Control. The difference between the second and third option is what a user sees in case no applications are available for the user. The second option will give the user a complete desktop without any restriction. The third option will show the remote user a message that the Administrator has not made any application available for the user. The remote user is not able to continue to work:

Application control type

Strict Application control implies that the user is not allowed to start any other application then those which are assigned to him by AADS Application Control.
Default this is the best, most secure choice.

However, it might happen that some applications do need to start other (sub-) applications. For example, an Office suite that starts the Write-program, or the Spreadsheet program.
The Administrator might not always be able to figure out how many other (sub-) applications are needed to be started by the user. And if the Administrator does not know exactly what the user will be starting, then the Administrator can also not assign those (sub-)applications to the user.
This might be a circumstance where "Relaxed Application control" can be considered.

Please note: when Relaxed Application Control is applied, assigned applications can / are allowed to start other, not-assigned applications. Examples:

  • The Office program can start the separate Help-program when the user presses F1.
    • This is an OK situation.
  • The Browser can start its own separate Updater-program. It will do this when it detects that an update is available for download.
    • This can be OK. However, the Administrator might not want that users or programs do decide for themselves when to install updates.

Administrator and Application Control

Application Control does not apply to the user Administrator. It is important that the user Administrator can not be restricted using Application Control, because if he gets restricted, he can not start the Maintenance program any more in order to fix his restrictions......

Failing Authorization

Which Applications are available to an user can depend on the Group-membership of the user. In the event of problems related to a Failing Authorization, for example because Windows is failing, or some third party Credential Provider is failing, the AADServer is not able to determine what the Group-membership of the user is. In such an event, it is possible to block all users, except the Administrator, such to prevent that the users do access "the wrong applications". The Administrator must fix the problems related to the Failing Authorization, and after this is fixed, the users can access their assigned applications again.

Local Console and Application Control

  • If the Application Control settings are not mandatory for all users; if some users can still have the default Windows Start Menu,
    then a session on the local console of the AADServer will always show the default Windows Start Menu.

The reason behind this, is that the local console of the AADServer is commonly used, not by end-users, but by an Administrator, and in such a case, when working on the local console, presumable the Administrator wants the default Windows Start Menu.


Start Menu Title

Start Menu Title

It is possible to change the Title of the Start Menu as presented to the user:

2 text-lines can be edited. It is possible to enter some text in each of the 2 lines, whatever you want.

Within the text you can enter "environment variables". If you want to see which "environment variables" are available on an AADServer, open a DOS-BOX and enter the command "set":

Show date/time

It is possible to show the date/time in the Start Menu of the user, using the custom-line of test %DT= xxxx%

The format of the date/time as shown, can be edited as follows:

c | Displays the date using the format given by the ShortDateFormat global variable, followed by the time using the format given by the LongTimeFormat global variable. The time is not displayed if the fractional part of the DateTime value is zero
d | Displays the day as a number without a leading zero (1-31).
dd | Displays the day as a number with a leading zero (01-31).
ddd | Displays the day as an abbreviation (Sun-Sat) using the strings given by the ShortDayNames global variable.
dddd | Displays the day as a full name (Sunday-Saturday) using the strings given by the LongDayNames global variable.
ddddd | Displays the date using the format given by the ShortDateFormat global variable.
dddddd | Displays the date using the format given by the LongDateFormat global variable.
m | Displays the month as a number without a leading zero (1-12). If the m specifier immediately follows an h or hh specifier, the minute rather than the month is displayed.
mm | Displays the month as a number with a leading zero (01-12). If the mm specifier immediately follows an h or hh specifier, the minute rather than the month is displayed.
mmm | Displays the month as an abbreviation (Jan-Dec) using the strings given by the ShortMonthNames global variable.
mmmm | Displays the month as a full name (January-December) using the strings given by the LongMonthNames global variable.
yy | Displays the year as a two-digit number (00-99).
yyyy | Displays the year as a four-digit number (0000-9999).
h | Displays the hour without a leading zero (0-23).
hh | Displays the hour with a leading zero (00-23).
n | Displays the minute without a leading zero (0-59).
nn | Displays the minute with a leading zero (00-59).
s | Displays the second without a leading zero (0-59).
ss | Displays the second with a leading zero (00-59).
t | Displays the time using the format given by the ShortTimeFormat global variable.
tt | Displays the time using the format given by the LongTimeFormat global variable.
am/pm | Uses the 12-hour clock for the preceding h or hh specifier, and displays 'am' for any hour before noon, and 'pm' for any hour after noon. The am/pm specifier can use lower, upper, or mixed case, and the result is displayed accordingly.
a/p | Uses the 12-hour clock for the preceding h or hh specifier, and displays 'a' for any hour before noon, and 'p' for any hour after noon. The a/p specifier can use lower, upper, or mixed case, and the result is displayed accordingly.
ampm | Uses the 12-hour clock for the preceding h or hh specifier, and displays the contents of the TimeAMString global variable for any hour before noon, and the contents of the TimePMString global variable for any hour after noon.
/ | Displays the date separator character given by the DateSeparator global variable.
: | Displays the time separator character given by the TimeSeparator global variable.
'xx'/"xx" | Characters enclosed in single or double quotes are displayed as-is, and do not affect formatting.

The Menu as shown to user can have 3 different "size" formats. See Special Application Control Directives for more information.

$aad Show Small Menu

On the desktop of the user, when he starts a Remote Desktop Session, the result will be as follows:

Only the 1st of the 2 text-lines is shown. The 2th text-line is not shown in case of a Small Start Menu.

$aad Show Medium / Large Menu

In case of Medium or Large Start Menu, both text-lines are shown:


Users and Groups, Sets and Applications

Users and Groups, Sets and Applications

Application Control is done in 3 steps:

  1. Define Applications.
  2. Define Sets, and assign Applications to Sets.
  3. Assign Sets and / or Applications to Users and / or Groups.

Pre-defined configuration with Applications and Sets

When Optimize or Default Applications and Sets is used, a pre-defined configuration with Applications and Sets will be applied.

It might be convenient to start with either Optimize or Default Applications and Sets , because it will pre-fill in a lot of Applications and Sets:

  • In case Microsoft Office is installed, a Set for Microsoft Office will be created when using Optimize or Default Applications and Sets
  • In case Libre Office is installed, a Set for Libre Office will be created when using Optimize or Default Applications and Sets
  • In case one for the following browsers is installed, the browser will appear on in the Set "Internet Browsers"
    • Microsoft Internet Explorer
    • Mozilla Firefox
    • Google Chrome (Enterprise Installation, not a single user installation)
    • Chromium (Enterprise Installation, not a single user installation)
    • Apple Safari
    • Opera
    • Vavaldi
    • Seamonkey

Example:

This example shows the result of Optimize or Default Applications and Sets :

  • The Group "Administrators" have a minimal menu.
  • The Group "Remote Desktop Users" have several Applications and Sets applied.

From here, the Administrator can change and edit the assigned Applications and Sets.

Read and Save

The button "Read" loads all settings. If some changes are done, but those changes are not wanted or needed, the "Read" button will load the settings again.

The button "Save" saves all settings.

Un- do and Re-do

Using the "un-do" and "re-do" buttons it is possible to un-do or re-do changes while editing.

Layout

The "Layout" buttons changes the Layout of the screen:

Either the Applications are besides the Sets, or below the Sets.

Search Icons

Both Sets and Applications can have a custom Icon assigned. In order to facilitate the selection of customs icons, AADS creates and maintains a folder on the Terminal Server in which it places a copy of all icons it finds on the Terminal Server:

AADServer will automatically scan for Icons once a week.

If it is needed to update this icon-folder now, because some Applications has been installed and those icons from those Applications should also appear in the Icon-folder, use the button "Search Icons".


Applications

Applications

Navigation

  • Use the Cursor-keys or Tab-key to navigate thru the Applications.

Selecting

Use Keyboard

  • When the cursor is in the Icon-column, use the Space-key for selecting / de-selecting an Application.

Use Mouse

  • Using the mouse, click on the App-X number for selecting / de-selecting an Application.
  • Right-click on the App-X number for a Popup-menu, for selecting / de-selecting all Applications:

Searching

  • Enter a string in the Searchbox. Appearances of the Search-string will be highlighted:

Use Keyboard

  • While the cursor is inside the Search-box, use the Enter-key to jump to the next occurrence of the Search-string.

Use Mouse

  • Use the Search-Up and Down buttons to jump to the next / previous occurrence of the Search-string.

Zoom-in, Zoom out

  • Use the Zoom button to toggle between Zoom-in / Zoom-out:

Assign 1 or more Applications to a Set

Use Keyboard and / or Mouse to assign Applications

  • Select the Set.
  • Select 1 or more Applications.
  • Use the Assign-button or Drag-and-Drop to assign the Application(s) to the Set.

  • The result will be as follows:

Assign 1 or more Applications to an User or Group

Use Keyboard and / or Mouse to assign Applications

  • Select an User or a Group:

  • Select 1 or more Application(s):

  • Click on the Assign-button. The selected Application(s) will be assigned to the selected User / Group.

Use Drag-and-Drop to assign Applications

  • Select 1 or more Application(s)
  • Drag-and-drop the selected Application(s) to the User or Group:

Note:

  • Applications can be assigned to 1 or more Sets.
  • Applications can be assigned to 1 or more Users.
  • Applications can be assigned to 1 or more Groups.

Add new Application(s)

Use Keyboard and / or Mouse to add new, empty Rows

  • Select an Application:

  • Use the Insert-key or click on the Insert-button. A new empty row will appear that can be used for entering the details of the new Application:

  • Use the Down-key or Tab-key repeatedly, beyond the last Application.
    1 or more new, empty row(s) will appear which can be used for entering the details of the new Application(s):

  • Use the Add-Row button. A new empty row will be added that can be used for entering the details of the new Application.

Use Drag-and-Drop to add Applications from Explorer

  • Select the Programs in Explorer that you want to Add.
  • Drag-and-drop the Programs from Explorer to the List of Applications:

  • The "Dropped" Applications will be inserted at the drop-location:

Delete Application(s)

  • Select 1 or more Application(s):

  • Use the "Delete Application" button for deleting the selected Application(s):
  • The Application(s) will be deleted from the list of Applications.
  • The Application(s) will be deleted from Sets.
  • The Application(s) will be deleted from Users and / or Groups.

Sorting Application(s)

Sorting Applications is relevant, because the Sort Order as shown here, will be the same order as the Applications do appear in the Start Menu of the User. The User can not sort the Applications as they are shown in the Start Menu.

Use Drag-and-Drop to Sort

  • Select 1 Application:

  • Drag the Application where it should be:

Use Keyboard and / or Mouse to Sort

  • Select 1 or more Application(s)
  • Use the Sort-Up and Down-buttons to sort the selected Application(s).

Executing an Application

  • Right-click on the Program Name, or use the "Execute" button.
  • The Popup Menu has an option to execute the Program:

  • The selected Application will be Executed. This can be convenient just for some testing...
  • AADS Application Control is used by an Administrator. Therefore the selected Application will be executed under the rights of current logged-in Administrator.

Application Properties

Applications do have 6 properties.

Property: Icon

When no custom Icon is assigned to the Application, the default Icon of the Application will be shown and used in the Start Menu of the user.

Customizing the Icon

  • Double-click on the Icon, or,
  • Select the Icon and use the Enter-key or F3-key, or,
  • Use the Browse-button
  • Select a custom Icon.

Deleting the custom Icon

Deleting the Icon implies that the custom Icon will not be used anymore, and that the default Icon of the application will be shown and used in the Start Menu of the user.

  • Select the Icon, using the mouse or cursor-keys.
  • Use the Delete-key, or select "Delete Custom Icon" in the popupmenu:

    When the Custom Icon is deleted, the default Icon for the Application will be used.

Property: Display Name

Editing the Display Name

  • Double click the Display Name, or,
  • Use the Enter-key for editing the Display Name, or,
  • Use the Edit-button:

Special Application Control Directives

  • Use the Right-mouse, or,
  • Use the F3 or Menu-key:

    A Popup-Menu with Special Application Control Directives will be shown.

Hidden Display Name $

When a Display Name starts with $, the Program is "Hidden" and will not appear in the Start Menu of the User. However, the User is allowed to use the program; the User can use the program.

Hidden Programs and Restricted Application Control

When Restricted Application Control is applied, the User can only start Applications that are explicitly assigned to the User by the Administrator. However, It might happen that an User needs to be able to use some additional Applications.

Example Hidden Program: Libre Office QuickStarter

Libre Office comes with a TrayIcon-quickstart utility. This Program does not have to appear in the Start Menu of the User, but the User might want to be able to run it and use it. This is where "Hidden" can be used. By defining and assigning a "Hidden" program to an User, the "Hidden" program will not appear in the Start Menu of the User. But the "Hidden" program can be started and used by the User.

Note:

  • Hidden means that the Application is hidden from the Start Menu / is not shown in the Start Menu of the User.
  • The Application is available to the user and running as usual.

Property: Program Name

Editing the Program Name

  • Double click the Program Name, or,
  • Use the Enter-key for editing the Program Name, or,
  • Use the Edit-button for editing the Program Name:

Browse for a Program

  • Select the Program in the column Program Name.
  • Use the F3-key for Browsing, or,
  • Use the Browse-button for Browsing:

Multiple Select

The browse-popup Windows has the option to show checkboxes with each programs. By selecting multiple programs, multiple programs can be added to Application Control in 1 go:

Popup Menu

  • Use the Right-mouse, or,
  • Use the Menu-key to show a Popup-Menu:
  • Browse for the Program/Executable.
  • Execute the Program/Executable. AADS Application Control is used by an Administrator. Therefore the selected Application will be executed under the rights of current logged-in Administrator.

Property: Startup Folder

Usually the contents of the Startup Folder depends on the Program.

  • The Startup Folder can be left empty.
  • The Startup Folder can be a full-qualified folder on drive C: or on some network-drive.
  • The Startup Folder can contain Environment Variables:

Editing the Startup Folder

  • Double click the Startup Folder, or,
  • Use the Enter-key for editing the Startup Folder, or,
  • Use the Edit-button:

Browse for a Startup Folder:

  • Use the F3-key for Browsing, or,
  • Use the Browse-button for Browsing:

Property: Command Line

Usually the contents of the Command Line depends on the Program.

Editing the Command Line

  • Double click the Command Line, or,
  • Use the Enter-key for editing the Command Line, or,
  • Use the Edit-button:

Property: Startup

An Application can be started as follows:

AutoRun | The Application will be started directly after the login of the user. Multiple Applications can be flagged as AutoRun.
Maximize | When started, the Application will be initially shown Maximized. The user is able to Restore or Minimize the Application.
Minimize | When started, the Application will be initially shown Minimized. The user is able to Restore or Minimize the Application.
Visible | Default all Applications are shown Visible. The User can interact with the Application. An Application can be flagged as “not shown Visible” or “Hidden”. An user can not interact with a Hidden Application. This option can be useful, for example, for starting CMD-files which will start another Application. In combination with Autorun, you can start some kind of Hidden Service application for the user, without showing it. For instance, you might use it to start some Anti Virus client software without showing it to the user.
Elevated | The Application will be started "Elevated".

Editing the Startup-options

  • Use the mouse to select / de-select the Startup-options.

Example Elevated Application

In the example below, WordPad is marked for Elevation:

On the client, one can expect the following:

Environment variables and Escape Character &

Environment variables can be used in:

  • Program Name
  • Startup Folder
  • Command Line

Example:

The Administrator can open a DosBox, using the command Set, and see all the Environment Variables that do exist.
Those Environment Variables can be used while defining Applications for the Users.

The Benefit of this can be, for example, that a Backup / Restore of AADS Application Control Settings is more usable. When restoring an AADS Backup to a different Server, to a new Server, with a different Windows version, by using Environment Variables the defined Applications in Application Control are usable and OK on this other Server.

Examples how to use Environment variables

 | Result for user domain003
C:\documents\%username% | C:\documents\domain003
%userprofile%\some folder | C:\Documents and Settings\domain003\some folder

Escape character &

The & character can be used for special character in the range $01 .. $FF (hexadecimal between 1 and 255).
The & character is used as a so called escape character. Examples:

 | Result for user domain003
C:\documents\&25username&25 | C:\documents\%username%
C:\documents\&26username&26 | C:\documents\&username&
C:\documents\&22username&22 %username% | C:\documents\”username” domain003
“C:\documents\username” %username% | “C:\documents\username” domain003

Take a good look at the last 2 examples: the first occurrence of username is not considered to be an environment variable because it is not enclosed in %. In the third example it is enclosed in &22. This is the hex-value of the character “, so result will be “username”.
The second occurrence of username is considered as an environment variable because it is enclosed in %. Therefore it is replaced with domain003 in this example.

The &XX appearance will always be translated to a character:

Command line parameter or Startup Folder | Result for user domain003
C:\documents\&25username&25 | C:\documents\%username%
“C:\documents\&25username&25” | “C:\documents\%username%”
“C:\documents\&26username” | “C:\documents\&username”


Sets

Sets

Navigation

  • Use the Cursor-keys or Tab-key to navigate thru the Sets.

$aad Common Programs

The set "$aad Common Programs" is created as a collection with default programs. This set can not be assigned to an user or a group.

Selecting

Use Keyboard

  • When the cursor is in the Icon-column, use the Space-key for selecting / de-selecting a Set.

Use Mouse

  • Using the mouse, click on the Set-X number for selecting / de-selecting a Set.
  • Right-click on the Set-X number for a Popup-menu, for selecting / de-selecting all Sets:

Expand / Collapse

Each Set or all Sets can shown be Expanded / Collapsed.

Use Mouse

  • Use the Popup-Menu for Expanding / Collapsing all Sets.
  • Click on the Expand/Collapse arrow for expanding / collapsing a Set.

Use Keyboard

  • Use Shift-Left for expanding a Set.
  • Use Shift-Right for collapsing a Set.

Searching

  • Enter a string in the Searchbox. Appearances of the Search-string will be highlighted.

Use Keyboard

  • While the cursor is inside the Search-box, use the Enter-key to jump to the next occurrence of the Search-string.

Use Mouse

  • Use the Search-Up and Down buttons to jump to the next / previous occurrence of the Search-string.

Zoom-in, Zoom out

  • Use the Zoom button to toggle between Zoom-in / Zoom-out:

Export 1 or more Sets with Applications

  • Select 1 or more Sets
  • Save the selected Sets in an INI-file:

Import 1 or more Sets with Applications

  • Use the "Import Set" button to select a previous saved INI-file with Set(s):

  • The Set(s) and assigned Applications, will be merged with the current Sets and Applications.

Assign 1 or more Sets to an User or Group

Use Keyboard and / or Mouse to assign Applications

  • Select an User or a Group.
  • Select 1 or more Set(s):

  • Click on the Assign-button. The selected Set(s) will be assigned to the selected User / Group:

Use Drag-and-Drop to assign Sets

  • Select 1 or more Set(s)
  • Drag-and-drop the selected Set(s) to the User or Group:

  • The selected Set(s) will be assigned to the selected User / Group

Note:

  • Sets can be assigned to 1 or more Users.
  • Sets can be assigned to 1 or more Groups.
  • Sets can be assigned to 1 or more Sets, as a sub-Set. At maximum Sets can be assigned up to 5 levels deep.

Example Sub-Sets:

  • The result for the User is as follows:

Add new Set(s)

Use Keyboard and / or Mouse to add new, empty Rows

  • Select an Set:

  • Use the Insert-key or click on the Insert-button. A new empty row will appear that can be used for entering the details of the new Set:

  • Use the Down-key or Tab-key repeatedly, beyond the last Set.
    1 or more new, empty row(s) will appear which can be used for entering the details of the new Set(s).
  • Use the Add-Row button. A new empty row will be added that can be used for entering the details of the new Set:

Delete Set(s)

  • Select 1 or more Set(s)
  • When the Set(s) contain assigned Applications, deleting the Set implies that all assigned Applications will be removed from the Set(s). The Set itself is not deleted.

    Use the "Delete Set" button:

  • The Set(s) will be made empty, as in, all assigned Applications will be removed from the Set(s)
  • The Set(s) will be deleted from Users and / or Groups.
  • When the Set(s) contain no Applications, deleting the Set implies that the Set(s) will be deleted:

    Use the "Delete Set" button, again:

Sorting Set(s)

Use Drag-and-Drop to Sort

  • Select 1 Set:

  • Drag the Set where it should be:

Use Keyboard and / or Mouse to Sort

  • Select 1 or more Set(s)
  • Use the Sort-Up and Down-buttons to sort the selected Set(s).

Set Properties

Sets do have 2 properties.

Property: Icon

When no custom Icon is assigned to the Set, the default Icon of for Sets will be shown and used in the Start Menu of the user.

Customizing the Icon

  • Double-click on the Icon, or,
  • Select the Icon and use the Enter-key or F3-key, or,
  • Use the Browse-button
  • Select a custom Icon:

Deleting the custom Icon

Deleting the Icon implies that the custom Icon will not be used anymore, and that the default Icon for Sets will be shown and used in the Start Menu of the user.

  • Select the Icon, using the mouse or cursor-keys:

  • Use the Delete-key:

Property: Display Name

Editing the Display Name

  • Double click the Display Name, or,
  • Use the Enter-key for editing the Display Name, or,
  • Use the Edit-button:

Hidden Display Name $

  • When a Display Name starts with $, the Set is created by AADServer, or by the Administrator, for administrative purposes.
    Such a Set can contain applications, can be exported and imported, but can not be assigned to a User, Group or Set.

Execute an Application

  • Select an Application and click on the Execute button:


Users and Groups

Users and Groups

Navigation

  • Use the Cursor-keys to navigate.
  • Use Shift-Left to collapse.
  • Use Shift-Right to expand.
  • Use a key between A and Z to jump to the next entry that starts with this letter.

Searching

  • Enter a string in the Searchbox.

Use Keyboard

  • While the cursor is inside the Search-box, use the Enter-key to jump to the next occurrence of the Search-string.

Use Mouse

  • Use the Search-Down buttons to jump to the next occurrence of the Search-string.

Delete Assigned Applications and / or Sets

Delete an Application

  • Select the Application:

  • Use the Delete-key or the "Delete" button for deleting the assigned Application:

Delete a Set

  • Select the Set:

  • Use the Delete-key or the "Delete" button for deleting the assigned Set.
    In case the deleted Set contains assigned sub-Sets, those will also be deleted.

Delete everything from an User or a Group

  • Select the User or Group.
  • Use the Delete-key or the "Delete" button.
  • Everything that is assigned to the User or Group will be deleted.

Execute an Application

  • Select an Application and click on the Execute button:


Demo Nag screen

Demo Nag screen

The demo version of AADS Terminal Server shows a "nag" screen after a login, in case Application Control is used:

This "nag" screen is not shown when using the Full, Paid version of AADS Terminal Server.

Besides the "nag" popup and the 3 user limit, AADS Demo is fully functional and identical to the Full, Paid version of AADS.


Application Control and Explorer / Desktop

Application Control and Explorer / Desktop

Assign Explorer.exe

In the following example the User is allowed to start Explorer.exe:

  • Whenever an User has Explorer.exe in it's list of allowed applications, it will always be started. It is not required to select the Autostart-option. Explorer.exe will be auto started anyway.
  • Whenever an User has Explorer.exe in it's list of allowed applications, a desktop and taskbar is shown.

Explorer.exe is always "Auto Started"

It might be desirable to start Explorer.exe optionally, or start “explorer.exe” with a command-line parameter containing c:\my documents. This is possible.

However, when an user is assigned Explorer.exe, it will always be auto started, because when Explorer.exe is started for the first time, it will always create and show a desktop. This is build in Explorer.exe; this is how Explorer.exe is made by Microsoft. Therefore it is not possible to show the user his documents-folder and not having a desktop with a taskbar, etc.

Windows Start Menu of the desktop is replaced by AADS Start Menu

When the User has Explorer as an Application, there will always be a Taskbar.

Although a Taskbar is shown, including the well known Start button, the default Windows Start menu can replaced by an AADS Start menu.

Explorer as an AADS menu item

Visible menu item for Explorer

Explorer.exe is visible in the menu of an user:

This menu-item results in opening the default Home-folder of the User:

Hidden menu item for Explorer

Explorer.exe is not visible in the menu of an user:

When the menu-item for Explorer is hidden, it will not appear on the Start Menu of the user:

Hidden menu item for Explorer

Explorer.exe is not visible in the menu of an user:

When the menu-item for Explorer is hidden, it will not appear on the Start Menu of the user:

Start Menu position on the Desktop

In this example the Start Menu position is "Bottom Right".

  • However, when Explorer is started on the Desktop, there will always a Taskbar. And because of that, the position of the Start Menu is depending on the position of the Taskbar.

The User can change the position of the Taskbar by "drag-and-dropping" the Taskbar where he/she wants to have the Taskbar.
It is also possible to use a Taskbar Settings tool that is available when installing AADServer:

  • A tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:


Applications and Policies

Applications and Policies

After you have configured Application Control on your AADS Terminal Server, you can do some fine-tuning with Policies. The initial screen for setting Policies is available thru the "Advanced" button:

Which policies are shown can be different. It depends on your Windows-type and version, and which Service Packs are installed.

Do not test it in a production environment

You should test the Policies first on a separate Test environment before trying it in production. For instance, if you apply to many policies or to many restrictions, you might restrict yourself and you might not be able any more to reverse the restrictions. In such case, a reboot of the AADS Terminal Server in Safe Mode is required for attempts to fix the situation. This is a problem you want to avoid in a production environment.


Special Application Control Directives

Special Application Control Directives

AADS Terminal Server does offer Special Application Control Directives for additional control of the User Desktop.

Format

  • Special Application Control Directives start with $aad
  • It is OK to use spaces in the name of an Application Control Directive.
    Example:

    $aad Show Limited Menu
    $aadShowLimitedMenu
  • It is OK to append some extra free format text behind an Application Control Directive.
    Example:

    $aad Limited Menu Office users some extra text

Right click with the mouse in the Display Name column, or use the AppMenu key on the keyboard, or use the F3 key:


Run Program [runprogram:]

Run Program

The Special Directive "Run Program" has a similar functionality as it is known from default Windows:

If "Run Program" is made available for the Users, the Start Menu will show it:

"Run Program" as offered by the AADS Menu, has 2 extra options:

  • It is possible to start the program with "Run As" aka "Elevated".
  • It is possible to delete the History-list, which contains the list of commands / programs that have been entered and executed before.


Start Menu Settings (AADServer) [startmenusettings:]

Start Menu Settings (AADServer)

The directive "Start Menu Settings" enables it for the user to change some Look and Feel aspects of the Start Menu.

If the Administrator does not give the user the directive "Start Menu Settings", then the user can not change the Look and Feel of the Start Menu. The Look and Feel of the Start Menu will be as configured by the Administrator.

AADServer Theme

When "Start Menu Settings" is combined with the Look and Feel AADServer theme, the user has the following options for changing the Look and Feel :

  • Show Small, Medium or Large Icons in the Start Menu
  • Show the Start Menu either Solid or a bit Transparent
  • Show all Items in 1 Row or show the Start Menu with Sub Menus.

When clicking on Default, the Start Menu will revert back to the Default Settings as set by the Administrator.

Example

Windows 7 Theme

When "Start Menu Settings" is combined with the Look and Feel Windows 7 theme, the user has the following options for changing the Look and Feel :

  • Show Small, Medium or Large Icons in the Start Menu
  • Show the Start Menu either Solid or a bit Transparent
  • Show all Items in 1 Row or show the Start Menu with Sub Menu.

When clicking on Default, the Start Menu will revert back to the Default Settings as set by the Administrator.

Example

Windows 10 Theme

When Start Menu Settings is combined with the Look and Feel Windows 10 Light or Dark theme, the user has the following options for changing the Look and Feel :

  • Show Small, Medium or Large Icons in the Start Menu. This applies to the icons as shown in the left treeview. It does not apply to the icons as shown in the Panels / Tiles.
  • Show the Start Menu either Solid or a bit Transparent
  • Show all Items in 1 Row or show the Start Menu with Sub Menus.
    • When using the Panel/Tiles option, a Single Menu on the left will be used.
  • Show Items in Panels with Tiles, similar to the Windows 10 Start Menu with Tiles.
    • Applications can be started by either single-click (or touch) on a Tile, or by double-click on a Tile.
  • Use a Light or Dark Theme.

When clicking on Default, the Start Menu will revert back to the Default Settings as set by the Administrator.

Example

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Control Panel [ms-controlpanel:]

Control Panel

ms-controlpanel:

It might be feasible that the user has the ability to start 1 or more Control Panel items.

  • Select ms-controlpanel: on an empty row

  • Select 1 of the available Control Panel Items, or select Control Panel All Settings.

The list of available Control Panel items depends on the version of Windows and might include third-party items.

Optimize, Default Applications and Sets

When Optimize or Default Applications and Sets is used, pre-defined Control Panel Items for Users and a Set with those Control Panel Items will be created:

All Items

User Items

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


UWP Settings [ms-settings:]

UWP Settings

ms-settings:

UWP Settings are available on

  • Windows 10

Users

It might be feasible that the user has the ability to start 1 or more UWP Settings.

  • Select ms-settings on an empty row

  • Select 1 of the available UWP Settings for the User.
  • Optional: edit the "Display name" for an appropriate description of the UWP Settings.

Optimize

When Optimize is used, pre-defined "UWP Settings Items" for Users, and a Set containing those "UWP settings", will be created:

Administrators

The Administrator should not be limited when it is about UWP Settings. Therefore Administrators should have "UPW All Settings":

Example

In this example the directive $aad Show this Set as Panel is added to the Set UWP Settings (Users).

If the user is using the Look and Feel Windows 10, and if the option Panels / Tiles is being used, the user has the Set "UWP Settings (User)" as a Panel, containing the UWP settings as Tiles.


Recycle Bin [ms-recyclebin:]

Recycle Bin

When this Special Command is assigned to the user(s), the AADS Menu has Recycle Bin as a menu option:


$aad Apply Restrict Control

Apply Restrict / Relaxed Control

$aad Apply Restrict Control

This Special Application Control Directive overrules the global setting. When the global setting is set to “Apply relaxed Application control”, then this Special Application Control Directive does overrule that, and apply strict Application control to an User or Group.

Example

  • The User "POS10" has only 1 assigned application, a Point Of Sale application.
    • When an user has only 1 assigned application, after the login of the user, this 1 application will be started and will be shown full screen.
    • When an user has only 1 assigned application, and this application terminates, the user will be logged off and the RDP session will be ended.
  • The directive "$aad Apply Strict Control" makes sure that nothing else can be started.


$aad Apply Relaxed Control

$aad Apply Relaxed Control

When this Special Application Control Directives is assigned to an user or a group, it will overrule the global setting for Strict or Relaxed Application Control.

Example

The group Administrators have "File Explorer" assigned, and the directive "$aad Apply Relaxed Control", implying that members of Administrators are not limited / restricted by AADS Application Control.

Example

This is a minimal collection of Applications and Directives. The result of this is a default Windows desktop with no restrictions for the members of the group Administrators:

  • Because of the directive $aad Windows Menu , Explorer is started such that a default Windows Menu is shown to the User (users who are a member of the group Administrators)
  • Because of "$aad Apply Relaxed Control", there are no restrictions for the User (users who are a member of the group Administrators)


$aad Limit Settings

Limit Settings

The directive "$aad Limit Settings" should be used within a Set containing Settings. This applies to either Control Panel settings or UWP settings .

When Optimize is used, a default Set with UWP settings is created for the Users:

When Optimize or Default Applications and Sets is used, a default Set with Control Panel items is created for the Users:

In both these example, because of "$aad Limit Settings", the User is limited to the settings as available in the Set. The User is not able / not allowed to do other Settings.

Example

The Administrator has created a Set with Limited UWP settings for the Users in the Group "Warehouse Department":

The member of the Group "Warehouse Department" are presented with the following desktop:

The member of the Group "Warehouse Department" are not allowed / are not able to do other UWP Settings.


$aad Apply Wallpaper

Apply Wallpaper

It is possible to use AADS Application Control to give the user an assigned Wallpaper

Use the F3-key or the Browse button while the cursor is in the column "Program Name" for browsing for an desktop-image:

Example

This example is the combination of:

  • $aad Apply Wallpaper
  • $aad DockDesktop menu

RDP Client

It is required that the RDP Client enables showing of the WallPaper:

WallPaper styles

Stretch

  • The dimensions (width x height) of the WallPaper will not be respected.
  • The WallPaper will be stretched, both vertical and horizontal, to fix in the dimensions of the screen.
  • In case the dimensions of the WallPaper do differ from the dimensions of the screen, stretching of the WallPaper might be perceived by the User as a "distorted" WallPaper.

Example

Tile

Tile should be used with a "small image", small relative to the size of the desktop. The small image will be "tiled" across the desktop.

Example

Center

  • If the dimensions of the WallPaper are identical to the dimensions of the Screen, then the WallPaper will fit perfectly on the Desktop.
  • If the dimensions of the WallPaper are different from the dimensions of the Screen, the WallPaper will not be re-sized, and will be placed at the center of the Desktop.
    • If the WallPaper is bigger then the Desktop, parts of the WallPaper are not shown.
    • If the WallPaper is smaller then the Desktop, parts of the Desktop are not covered.

Example

Fit

  • Fit will resize the WallPaper, while respecting the dimensions of the WallPaper.
  • The WallPaper will be resized such that if will "fit" in the Desktop.
  • Because the WallPaper will not be stretched, it might happen that either horizontal or vertical, parts of the WallPaper are not visible / are cut-off.

Example

In this example, vertically parts of the WallPaper are cut-off.

Note:

  • The option Fit does not work as expected on Windows XP / Server 2003.
  • On Windows XP / Server 2003 the option Fit is identical to the option Stretch.

Fill

  • Fill will resize the WallPaper, while respecting the dimensions of the WallPaper.
  • The WallPaper will be resized such that if will "fit" in the Desktop, either Horizontal or Vertical.
  • Because the dimensions of the WallPaper might be different then the dimensions of the Desktop, part of the Desktop might not be covered by the WallPaper.

Example

Note:

  • The option Fill does not work as expected on Windows XP / Server 2003.
  • On Windows XP / Server 2003 the option Fill is identical to the option Stretch.


Solid Desktop Color

$aad Desktop Solid Color

Performance

A solid color on the Desktop makes the Remote Session quicker compared to a Wallpaper . The response of the Remote Desktop Session will be quicker.

Settings

  • Use F3, the Menu-key, or double-click on the color for selecting a color.

Example

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


$aads Desktop Theme

$aad Desktop Theme

$aad Desktop Theme is available on:

  • Windows 10

Apply this Directive to an user or group:

When the user does a login, the selected Theme will we applied to the desktop of the user.

Themes with border (Windows 10, Server 2016 / 2019)

From a performance point of view, it is recommended to turn off Themes.

Server

Turn off Themes can be done on the Server, by de-selecting all options.
It is recommended to select "Smooth edges of screen fonts" because of readability.

Client

Turn off Themes can also be done on the RDP Client.

Windows 10

In case of Windows 10, themes are always applied to the look-and-feel of each Window on the Desktop of the user.
However, from a performance point of view, it is still useful to "turn off themes", because several aspects of those themes are turned off, like a "shadow" around each Window. And this will improve the performance of the Remote Desktop Session.

When Themes are turned off, the default Windows 10 can be perceived as "un-clear" because the border of Windows is only 1 pixel. Because of that, AADS installs 3 themes with a sizeable border:

Server Theme

Windows 10 Dark Theme

Windows 10 Light Theme

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


$aad Windows Menu

Windows Menu

The "point" of AADS Application Control is to replace the default Windows Menu by a restricted, under-control-of-the-Administrator menu. However, it might be feasible to excluded some users from these restrictions.

Example

This is a minimal collection of Applications and Directives. The result of this is a default Windows desktop with no restrictions for the members of the group Administrators:

  • Because of the directive "$aad Windows Menu", Explorer is started such that a default Windows Menu is shown to the User (users who are a member of the group Administrators)
  • Because of $aad Apply Relaxed Control, there are no restrictions for the User (users who are a member of the group Administrators)

Windows 10

AADS for Windows 10 has the function Optimize, which does disable some not-needed Windows functionality. One of the optimizations is disabling the default Windows Start Menu with Tiles.

Disable Start Menu with Tiles

When the option "Disable Start Menu with Tiles" has been set, no user will see the default Windows Start Menu with Tiles. It is expected that all users will get a Start Menu based on Application Control settings.

Should it happen that an user does not have any assigned Applications thru Application Control settings, and "Disable Start Menu with Tiles" has been set, the user gets a small default AADS Start Menu:

This small default AADS Start Menu is also shown in case the directive $aad Windows Menu is used, and the "Disable Start Menu with Tiles" has been set.


$aad DockDesktop menu

DockDesktop menu

The details of DockDesktop are described here.

Example

Optimize is used in this example to create a default set of Applications and Sets. After Optimize is done, 1 setting is changed: the Users will get the DockDesktop Menu:

Result is as follows:

  • The initial screen of DockDesktop contains the same "items" as the Start Menu.
  • The various Sets are available as "ICON Folders".
  • Double Click on an "ICON Folders" or using the ENTER key, opens the Set / ICON Folder.

  • When the User clicks on the Start Button in the TaskBar, DockDesktop will respond to that and will popup.


$aad Menu: AADServer theme

Start Menu: AADServer theme

  • AADS Start Menu's can be shown in a Single Column or with Sub Menu's
  • AADS Start Menu's can be positioned in each corner of the Desktop.

Single Column

Example

  • The whole Start Menu is shown in a single Column.
  • Sub Menu's are shown by expanding the small arrow.

Multiple Columns

Sub Menu's / SET's are shown in a Sub Menu

Example

Position of the Start Menu

With Explorer

If the User has Windows Explorer assigned, the position of the Start Menu is not determined by AADS Application Control, but it is determined by the position of the Windows TaskBar.

The User can change the position of the Taskbar by "drag-and-dropping" the Taskbar where he/she wants to have the Taskbar.
It is also possible to use a Taskbar Settings tool that is available when installing AADServer:

  • A tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:

Without Explorer

If the User has not Windows Explorer assigned, the position of the Start Menu is determined by AADS Application Control.

Example

Note: the Users do not have Explorer assigned in this example.

Result:

Start Menu Settings

If the Administrator has assigned Start Menu Settings (AADServer) to the User, the User can change the position of the Start Menu:

  • Exit: leave this dialog without doing any settings.
  • Apply: leave this dialog while applying the settings.
  • Default: revert back to the global, default settings as done by the Administrator.


$aad Menu: Windows 7 theme

Start Menu: Windows 7 theme

  • AADS Start Menu's can be shown in a Single Column or with Sub Menu's
  • AADS Start Menu's can be positioned in each corner of the Desktop.

Single Column

Example

  • The whole Start Menu is shown in a single Column.
  • Sub Menu's are shown by expanding the small arrow.

Multiple Columns

Sub Menu's / SET's are shown in a Sub Menu

Example

Position of the Start Menu

With Explorer

If the User has Windows Explorer assigned, the position of the Start Menu is not determined by AADS Application Control, but it is determined by the position of the Windows TaskBar.

The User can change the position of the Taskbar by "drag-and-dropping" the Taskbar where he/she wants to have the Taskbar.
It is also possible to use a Taskbar Settings tool that is available when installing AADServer:

  • A tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:

Without Explorer

If the User has not Windows Explorer assigned, the position of the Start Menu is determined by AADS Application Control.

Example

Note: the Users do not have Explorer assigned in this example.

Result:

Start Menu Settings

If the Administrator has assigned Start Menu Settings (AADServer) to the User, the User can change the position of the Start Menu:

  • Exit: leave this dialog without doing any settings.
  • Apply: leave this dialog while applying the settings.
  • Default: revert back to the global, default settings as done by the Administrator.


$aad Menu: Windows 10 Theme

Start Menu: Windows 10 theme

The following is applicable to:

  • Start Menu: Windows 10 Dark theme
  • Start Menu: Windows 10 Light theme

  • AADS Start Menu's can be shown in a Single Column or with Sub Menu's.
  • AADS Start Menu's can be shown with Panels containing Tiles.
  • AADS Start Menu's can be positioned in each corner of the Desktop.

Single Column

Example

  • The whole Start Menu is shown in a single Column.
  • Sub Menu's are shown by expanding the small arrow.

Multiple Columns

Sub Menu's / SET's are shown in a Sub Menu

Example

Panels containing Tiles

Example

  • When the Look-and-Feel is "Panels containing Tiles", the Administrator can use the Directive $aad Show this Set as Panel.
    Those Sets with this directive will be shown as a Panel containing Tiles.

Panels containing Tiles

When the Start Menu is shown with Panels containing Tiles, the User has a few options for customizing the Start Menu.

Re-size Start Menu

  • The Start Menu can be re-sized by drag-and-dropping the corner.

Move Panels

  • Using the mouse, drag-and-drop, Panels can be moved

Re-size Panels

  • Using the mouse, drag-and-dropping the "bottom-bar", the Panel can be re-sized.

Tile Sub Menu

  • Right-click mouse or the AppMenu key on an Tile gives a sub-menu

Tile View Item

  • Tile View Item shows the properties of a Tile.

The App-XXX number as shown is the number of the App in AADS Maintenance and Control:

Navigation

Cursor keys | Move the cursor around in the Start Menu, TreeView Panels and Tiles.
TAB Key | Jump from the TreeView to the Panels, and back.
Enter Key
  • When the cursor is on a Tile, the Application will be Executed.
  • When the cursor is in the Treeview, and the selection is on a Set, the Set will be expanded
  • When the cursor is in the Treeview, and the selection is on an Application, the Application will be executed.
App Menu Key

When a Tile is Selected, the App Menu key will show the Popup Menu for the Tile.

Left Mouse, Double Click

Double Click on an Application will Execute the Application.

Right Mouse, Click

Right Mouse click on a Tile will show the Popup Menu for the Tile.

Position of the Start Menu

With Explorer

If the User has Windows Explorer assigned, the position of the Start Menu is not determined by AADS Application Control, but it is determined by the position of the Windows TaskBar.

The User can change the position of the Taskbar by "drag-and-dropping" the Taskbar where he/she wants to have the Taskbar.
It is also possible to use a Taskbar Settings tool that is available when installing AADServer:

  • A tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:

Without Explorer

If the User has not Windows Explorer assigned, the position of the Start Menu is determined by AADS Application Control.

Example

Note: the Users do not have Explorer assigned in this example.

Result:

Start Menu Settings

If the Administrator has assigned Start Menu Settings (AADServer) to the User, the User can change the position of the Start Menu:

  • Exit: leave this dialog without doing any settings.
  • Apply: leave this dialog while applying the settings.
  • Default: revert back to the global, default settings as done by the Administrator.


$aad Show Small/Medium/Large Menu

Show Small / Medium / Large Menu

The Items in an AADS Start Menu can be shown Small, Medium or Large:

Example Small size Menu Items

Result

Example Medium size Menu Items

Result

Example Large size Menu Items

Result

Note:

  • The size of the Tiles are always the same and are not determined by the Directive $aad Show Small/Medium/Large Menu.
  • The Directive $aad Show Small/Medium/Large Menu does only determine the size of the items in the Column on the left.


$aad Show this Set as Panel

Show this Set as Panel

  • The Directive "$aad Show this Set as Panel" should only be used with a Set
  • The Directive "$aad Show this Set as Panel" is only applicable if $aad Menu: Windows 10 Theme is being used, either Dark or Light Theme.
    • This Directive is only applicable if Panels and Tiles are being used.

Example

  • The Directive is assigned to 2 Sets

Result

  • Both Sets are visible as a Panel with Tiles.


$aad Start Menu Create Personal Items

Start Menu Create Personal Items

  • The Directive "$aad Start Menu Create Personal Items" is only applicable if $aad Menu: Windows 10 Theme is being used, either Dark or Light Theme.
  • This Directive is only applicable if Panels and Tiles are being used.
  • The Directive "$aad Start Menu Create Personal Items" does not imply that the User is somehow able to change the Applications and Sets as defined by the Administrator.
  • Applications and Sets as defined by the Administrator are only manageable by the Administrator.
  • The Directive "$aad Start Menu Create Personal Items" does make it possible for the User to create its own Panels and Tiles.
  • Panels and Tiles as created by the User, will be shown next to the Panels and Tiles as defined by the Administrator.

Example

Optimize has been used for this example, and the Look-and-Feel for the Users is changed to Panels and Tiles:

Result

The User has the Directive "$aad Start Menu Create Personal Items" assigned, and therefore the User will be able to create and maintain User Panels with Tiles.


Panels

Panels

2 types of Panels do exist

  • System Panels
  • User Panels

System Panels

  • A System Panel is a Panel that is configured by the Administrator, using the directive $aad Show this Set as Panel
  • A System Panel can not be edited by the User.
  • A system Panel does not have a Menu in the Top-Right corner.

User Panels

An User is allowed and is enabled to create and maintain User Panels, if the Administrator has assigned the directive $aad Start Menu Create Personal Items to the User.

  • An User Panel is a Panel that is created by the User.
  • An User Panel can be edited by the User.
  • An User Panel does have a Menu in the Top-Right corner.


Create Panel

Create Panel

  • Users can only create User Panels.
  • System Panels are maintained by the Administrator.

Create Panel, method 1

Using a Right-Click mouse on the empty Start Menu, the User can create a Panel:

Result

  • An empty Panel will be created.
  • The initial name / title of the Panel is the Username.

Create Panel, method 2

Select a Set in the Treeview / Menu on the left, and drag-and-drop the Set onto an empty space in the Start Menu:

Result

  • The whole Set will appear as Panel


Move Panel

Move Panel

Both User and System Panels can be moved by the User.

Pick the Panel up by its Title-bar and drag-and-drop the Panel on the desirable location.

Result

  • Using the mouse, drag-and-drop, Panels can be moved


Resize Panel

Resize Panel

Both User and System Panels can be resized by the User.

  • Using the mouse, drag-and-dropping the "bottom-bar", the Panel can be re-sized.


Rename Panel

Rename Panel

Only User Panels can be renamed by the User.

  • The Popup Menu has a "Rename Panel" option.

Renaming the Panel

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Delete Panel

Delete Panel

Only User Panels can be deleted by the User.

Click on the Panel Menu in the Top-Right corner of the Panel:

  • The Popup Menu has a "Delete Panel" option

  • Click on Yes to delete the Panel.

Result

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Tiles

Tiles

The User can create and maintain Tiles in User Panels.

  • Create Tiles, including Copy and Paste Tiles
  • Move Tiles
  • View Tiles
  • Edit Tiles
  • Delete Tiles


Create Tiles, Copy and Paste Tiles

Create Tiles, Copy and Paste Tiles

Create Tiles, method 1

Right-click mouse on an User Panel, or use the Menu of the Panel to show the Popup Menu:

  • Select Create Tile.

Create Tile results in the following dialog:

  • The User can enter a file, like a document, or a program / executable.
  • Values can be entered
    • manually,
    • using the browse-buttons, or
    • using drag-and-drop from Explorer.

Example

The User can do drag-and-drop from the folder with Documents, and create Tiles for the Documents that he/she needs to access frequently.

  • Click on Apply

Result

Create Tiles, method 2

Using Explorer, select a File or a Program / Executable, and do a "Copy":

Within the Start Menu, do a "Paste Tile":

Result

Create Tiles, method 3

Select a Tile and click on "Copy Tile":

Select an User Panel (Panel created by the User), and click on "Paste Tile":

Result

Create Tiles, method 4

Select an Item in the TreeView / Menu and drag-and-drop the Item on an User Panel:

Result

Create Tiles, method 5

Select an Item in the TreeView / Menu and drag-and-drop the Item on some empty space in the StartMenu:

Result

A fresh new User Panel will be created, and it will contain the Item as a Tile.

Create Tiles, method 6

Select a Tile in a System Panel and drag-and-drop the Item on some empty space in the StartMenu.

A fresh new User Panel will be created, containing the Tile.

Result

Note:

  • If you drag-and-drop a Tile from a System Panel, the Tile will be copied.
  • If you drag-and-drop a Tile from the Treeview / Menu on the left, the Tile will be copied.
  • If you drag-and-drop a Tile from an User Panel, the Tile will be moved.


Move Tiles

Move Tiles

Move a Tile within an User Panel

Select a Tile, and drag-and-drop the Tile on the desirable location

Result

Move a Tile to another User Panel

Result

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


View Tiles

View Tiles

View a Tile from a System Panel

Right-click mouse on Tile, or use the AppMenu key:

Result

  • Tile View Item shows the properties of a Tile.

The App-XXX number as shown is the number of the App in AADS Maintenance and Control:

View a Tile from an User Panel

  • A Tile from an User Panel does not have an App-XXX number.
  • The absence of an App-XXX number indicates that this is a personal Tile created by the User. It is not a Tile from a System Panel.


Edit Tiles

Edit Tiles

Only Tiles in User Panels can be edited by the User.

Right-click mouse on a Tile:

Result

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Delete Tiles

Delete Tiles

Only Tiles in User Panels can be deleted by the User.

Right-click mouse on a Tile:

Result

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Look and Feel

Look and Feel

  • AADS Themes are available in every AADS version.
  • AADS Themes can be used on every Windows version.
    • From Windows XP to Windows 10.
    • From Server 2003 to Server 2019.

AADS Theme

  • $aad Menu: AADServer theme

Windows 7 Theme

  • $aad Menu: Windows 7 theme

Windows 10 Theme

  • Windows 10 Theme Dark

  • Windows 10 Theme Lights

  • Windows 10 Theme Panels and Tiles (Light Theme)


Session Menu

Session Menu

  • When Application Control is being applies to the user, the last Menu-item in the Menu as shown to the user, is "Session":

When the user selects "Session", the following popup is shown:

  • AADS Look & Feel theme:

  • Windows 10 Look & Feel theme:

  • If policies and user-rights do allow for it, the Session Menu does also contain Restart and Shutdown:

  • Logoff: the user will be logged off.
  • Disconnect: the desktop will be locked and disconnect. At a later moment the user can re-connect to the running session.
  • Lock workstation: the desktop will be locked.
  • Change Password: the user will have the ability to change his/her password:

Change Password

The "Change Password" dialog can also be started as follows:

If needed, the Administrator can create,

  • an item in the Start Menu of the PC,
  • or on the Desktop of the user,
  • or create an AADS Application Control item,

for giving the user a direct link, item, short-cut, etc, to the Change Password dialog.


1FA / 2FA

Multi Factor Authentication

2FA is available in AADS for Windows Vista / Server 2008 and newer.

1FA

  • Both 2FA Mobile and 2FA Email are de-selected.
  • The only "authorization" is the Windows userID and password of the Users.

2FA

  • Either or both 2FA Mobile and 2FA Email are selected.

MFA (multi factor authentication) can be enabled by enabling either or both 2FA Mobile or 2FA Email:

2FA Mobile

2FA mobile requires that the user has installed an App on their Mobile Device that can generate so called TOTP (Time-based One Time Passwords), which are based on the Open Standard RFC 6238 .

Some examples of these mobile Apps:

  • https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp
  • https://apps.apple.com/us/app/freeotp-authenticator/id872559395
  • https://f-droid.org/en/packages/org.liberty.android.freeotpplus/
  • https://play.google.com/store/apps/details?id=com.beemdevelopment.aegis
  • https://f-droid.org/en/packages/com.beemdevelopment.aegis/

Apps based on the Open Standard RFC 6238

  • do not require an internet connection
  • do not require a SIM card
  • do not require WIFI

The (Mobile) Device with the OTP App can be completely Offline. This is a relevant aspect of this solution, because it implies that the OTP is not somehow transmitted from the Server to the (Mobile) Device and because nothing is transmitted, nothing can "capture" or "listen on the line" and steal the OTP code.

The Open Standard RFC 6238 does require that the Server and the (Mobile) Device both have accurate clock settings, including accurate TimeZone settings.
It is not required that the Server and the (Mobile) Device are in the same TimeZone on this planet, but it is required that the clock is properly set.

2FA Email

2FA Email requires that the Administrator does "enter" the email address of the users into the Windows User Administration:

  • The Description field is used for entering the Email Address of the User.

Nr. of Digits

The Nr. of Digits determines the number of digits of the OTP code as it has to be entered by the user:

  • It is recommended to use either 6 or 8 digits, because most Mobile Apps do handle either 6 or 8 digits correctly.
  • Only "some" Mobile Apps are able to handle other number of digits, like 4, 5, 7, 9, 10, etc.

In case 2FA Mobile is not used; in case only 2FA Email is used, then it is OK to choose any number of digits, because the recommendation for 6 or 8 digits does only apply to use of OTP Apps on Mobile Devices.

TimeOut (minutes)

When asked to enter the OTP, the user has to do this within the TimeOut. If the TimeOut is exceeded, the session will be disconnected.

This implies that the email with the OTP as received by the user, needs to be received within this Time Limit.
Unfortunately it does happen that email is received with delay, for example because of anti-spam filtering...

Nr. of Tries

The Nr. of Tries sets how many tries the user has for correctly entering the OTP.

The Nr. of Tries "is synchronized" / "is the same setting" as the Nr of Failed Login Attempts in the Firewall.
If the user has tried to enter the OTP incorrectly to often, the RDP Firewall will block the user.

Apply to the Console

Default it is not required to enter an OTP code when logging in onto the Console.

One should carefully consider the necessity before enabling "Apply to the Console", because the Console is often used / necessary in case of problems. And if there are problems, it would be "unfortunate" if it is not possible to login while using the Console because of 2FA reasons...See Trouble: 2FA ...

Note : when the Server is rebooted in "Windows Safe Mode", 2FA is disabled.

Public / Private IP Address

Using Multi Factor Authentication for Public IP Address is required. This setting can not be disabled.

Using MFA for Private IP Addresses is optional. For example, it could be that the users within the office building are the only users / employees who are able to enter the office building, and therefore it does never happen that "others" are working on PCs / Clients within the office building. In such a case the Administrator can choose not to require 2FA for Private/Local IP Addresses.

Start Menu of the User

Optional the user can have an 2FA-OTP Program Item in the Windows Start Menu. The 2FA-OTP program enables the user to "delete" the current Token, and generate a new Token with the next logon.
This can be compared to the functionality for the user to be able to change his/her Windows password.

All Users / If Member of

2FA can be applied to all users, or can be applied based on membership of a Windows Group.
This can be a local Group defined on the local AADServer, or a Group defined in the Domain.


Mobile

2FA Mobile

Server

Public / Private IP Address

The 1st Time an User does connect to the AADServer, a Mobile Token is generated for the User, and the User is expected to "Save" this Mobile Token on his/her Mobile Device.

In order to avoid that this "1st Time Token Generating" is done by a remote hacker on the Internet, it might be better to require that the User comes to the Office,
assuming that within the Office building Local IP Addresses are used.

  • The User comes to the Office building.
  • He/she brings his/her Mobile Device to the Office.
  • The User does the "1st Time Token Generating" procedure inside the Office building.

Allowable Time Difference

The protocol as used for the OTP is based on the Open Standard RFC 6238. This standard required that both the Server and all Mobile Devices do have correct Clock and TimeZone settings.
A small difference is Time is allowed, and how small this Time Difference is, can be set by the Administrator.

Tokens

The Tokens as generated are shown. In case this Server is used in an AADS Farm, the Tokens of the other Servers in the Farm are also shown:

The Administrator can "Delete" Tokens. When a Token is deleted:

  • The User should also "delete" the Token from his/her Mobile Device.
  • The User will need to do again the "1st Time" procedure.

User / Client

1st Time

The first time an User does connect to the AADServer, the 2FA Mobile Token is generated. This is shown to the User:

The User is expected to "scan" the QR-code with his/her Mobile Device and "Save" the Token on his/her Mobile Device.
After the user has Saved the Token on the Mobile Device, the session will disconnect.

Test the QR Code

The User can optional "test" the scanned Token by clicking on Test QR:

The shown OTP code should match with the OTP code as shown on the Mobile Device.

Both the Local Time and the UTC time of the AADServer is shown, because if the OTP code does not match with the Mobile Device,
most likely the AADServer and / or the Mobile Device do not have correct clock settings.

A small "time difference" between the AADServer and the Mobile Devices is acceptable:

The maximum Allowable Time difference can be set by the Administrator on the AADServer.

Next time

The next time the User does a connect to the AADServer, the user is presented with a Dialog where he/she needs to enter the OTP code as it is generated by the OTP App on his/her Mobile Device:


Email

2FA Email

Server

  • The Administrator has to enter the appropriate settings, and click on the Apply-button.
  • After clicking on the Apply-button, it is possible to send a Test-email.
  • Optional all sent-emails and trace-files are saved. In case of smtp-related-trouble, the trace-files might be useful for analyzing the smtp-related-trouble.

Name in SSL Certificate

When the option "Name in SSL Certificate" is selected, the mailserver is expected to have a SSL certificate containing the name as entered. The AADServer checks if this name is found in the SSL certificate of the mailserver.

SMTP UserID and Password

If required by the mailserver, enter the UserID and password for connecting to the mailserver.

Send From

Enter the email address as defined in the mailserver for the AADServer.

Send To

The email address of an User. This user can receive a Test-email after clicking on Send Test Email.

SMTP Hostname (FQDN)

Wether or not a FQDN is required, is not an AADS-issue. It depends on the mailserver. In the example above, the mailserver is "mail.company.com". The Administrator of this mailserver will tell you if a FQDN for this AADServer is required, and what the FQDN should be.

Email Address

  • Enter an email-address for each User.
  • The email-address can be enclosed using:
    < >
    [ ]
    " "
    ' '

User / Client

When the User does a connect to the AADServer, the user is presented with a Dialog where he/she needs to enter the OTP code as it is send by email to the User:


Recommend Settings

Recommend Settings

1. Define a group 2FA_Users

  • Create a group 2FA_Users and make 1 or more Users member of this group.
  • This can be a local group in de local AADServer, or a group defined in the Domain.

  • If 2FA email is used, be sure to enter an email-address for each User who will need to receive the OTP by email.

2. Configure 2FA within AADS

  • If 2FA email is used, be sure to enter the details of the Emailserver.

3. Mobile Device

If 2FA Mobile is used, be sure to install an OTP App on the Mobile Device of the Users.

Some examples of these mobile Apps:

  • https://play.google.com/store/apps/details?id=org.fedorahosted.freeotp
  • https://apps.apple.com/us/app/freeotp-authenticator/id872559395
  • https://f-droid.org/en/packages/org.liberty.android.freeotpplus/
  • https://play.google.com/store/apps/details?id=com.beemdevelopment.aegis
  • https://f-droid.org/en/packages/com.beemdevelopment.aegis/

Apps based on the Open Standard RFC 6238


Trouble: 2FA

Get yourself in trouble with 2FA

  • Administrator is used for logon onto the Console of the Server.
  • However, default on Windows Vista and newer, the userID Administrator is disabled.
  • Apply to the Console is selected.
  • 2FA Email is selected.
  • However, default the Administrator has no email address assigned.
  • Also the email server is down so no emails are send by the emailserver.
  • 2FA Mobile is not selected, but that does not matter, because the Administrator has not yet installed a 2FA App on his/her mobile.
  • Also the Administrator has left his/her mobile phone at home / hotel / somewhere far far away. And the battery is empty.

In this example it is not possible anymore for the Administrator to login on the AADServer...

HowTo Fix

  • Boot the Server into Windows Safe Mode.
  • Start AADS Maintenance and Control.
  • Disable 2FA by de-selecting both 2FA Mobile and 2FA Email.
  • Reboot.

HowTo Prevent Trouble

2FA Mobile

  • Install a 2FA Mobile App on your mobile device.
  • Create a Windows Group called 2FA_Users.
  • Make 1 (or more) test users member of the group 2FA_Users.
  • Test that the login including 2FA works OK.

2FA Email

  • Enter all email server settings correctly.
  • Create a Windows Group called 2FA_Users.
  • Make 1 (or more) test users member of the group 2FA_Users.
  • Test that the OTP email is received by the test users, within the settings of TimeOut (minutes).
  • Test that the login including 2FA works OK.

After this, the Administrator can make him/herself member of the group 2FA_Users and apply 2FA to him/her self.

Recommended Settings


Webserver

Web server

The integrated web server offers browser based access to an AADS Terminal Server. Remote desktop access is possible using only a browser.

IPv4

The webserver only supports IPv4 connections.

Supported browsers

Unfortunately not any browser can be used; only Microsoft Internet Explorer can be used. This is caused by the fact that the integrated web server is based on Active-X components, and Active-X is only possible using Microsoft Internet Explorer.

  • IE 6
  • IE 7
  • IE 8
  • IE 9
  • IE 10
  • IE 11

Editing the HTML

The demo version of AADS Terminal Server does limit your options for changing the layout of the pages as served by the integrated web server. The full version does give you the possibility to change the layout in any way you want.

Please note: our support is limited to AADS Terminal Server. It is not possible for us to support customers on “how to write HTML, CSS, or other web page issues”. It is OK with us if you change the HTML-pages as served by our web server, but it is your responsibility to ensure you write valid, usable and working HTML-pages.
We do appreciate the books from O'Reilly. Go to their website and search for HTML-books.

http://www.oreilly.com/

Starting the web server

Within our Maintenance Program is tab page for the web server:

When changing a parameter, click on Apply. The parameters will be immediately applied.

  • When you select the checkbox, and click on Apply, the web server will be started right away.

When you click on Apply, the web server will be stopped, and depending on the checkbox started again.
Stopping and starting the web server does NOT affect current remote desktop session with the AADS Terminal Server.

When the checkbox is checked, the web server will also be started when the AADS Terminal Server is rebooted.

Location of the WWW folder

The default folder for the HTML-pages is below the Program Files folder or the ProgramData folder of the AADS Terminal Server:

When you change the location to something else, and click on the Apply button, the default HTML-files will be created in this new location.

Security / Limitations of the integrated web server

The integrated web server is limited to:

  • HTTP Get and Head command. Anything else like HTTP Post is not supported.

This implies that the integrated web server can not be used for "accessing", "updating" or "writing" to the www-folder. There is no logic within the integrated web server to do such thing.

Our integrated web server has nothing to do with Microsoft Internet Information Server (IIS) and is not based on IIS; it does not use any IIS code.
It is a completely self-developed web server. Updates from Microsoft related to IIS are not required for an AADS Terminal Server.

The objects / files in the WWW folder are accessed by the web server using “Read and Share right”. This implies that the WWW folder can be made read-only and that the web server does not try to get write, lock or update access to the WWW folder.
The only exception to the previous statement is, when the web server is restarted with a new WWW folder path, it does write to the WWW folder, because then the www server and Maintenance Program will write the default HTML-objects in the new WWW-folder.

We should mention the following: because of the Active-X object as served by the web server, only the browser Microsoft Internet Explorer is supported. This browser does have its peculiar non-standard, proprietary behavior. For instance, sometimes this browser sends the command OPTIONS to a web server. This command is a non-standard, proprietary command that is used between Microsoft Internet Explorer and Microsoft Internet Information Server (IIS).
Our integrated web server has nothing to do with Microsoft IIS and is not based on IIS. Therefore our integrated web server does not support this non-standard, proprietary OPTIONS command. The result will be 4xx errors in the logfile of our web server.

Indexing a folder

Our web server does not index a folder like IIS or Apache can do. When a client enters an URL which contains a folder and not an object, our web server appends index.html to the URL.
When index.html does not exist in the requested folder, a 404-error is generated.

If you want to have a folder indexed, do create a file called index.html inside this folder and keep it up-to-date with the contents of the folder.

If you do NOT want to index a folder, and do NOT want to confront your users with a 404-error, create an index.html file in every folder. The contents of the index.html can be a nice message and some kind of javascript-refresh statement that loads the default index.html as located in the root of the www-folder.

Traversing

Our web server only serves objects inside or below the WWW-folder as entered in the Maintenance Program. Your users might want to try ../../.. in URL with the objective to traverse beyond the WWW-folder. This is not allowed or supported by our www server.

ContentTypes.cfg

If you change the HTML-pages and starts to serve filetypes like EXE, BIN, DMG, MP3, AVI, SWF, etc, be sure to edit the file ContentTypes.cfg. In case the web server serves an object and its filetype is not found in ContentTypes.cfg, the default filetype reported to the browser of the client is “application/octet-stream”. The impact of this is that the browser will show a message to the user, asking "where to save this file".

Parameters in HTML-pages

It is possible to include parameters within the HTML-pages as served by the web server. The default Error pages do use them and can be interpreted as an example for these parameters.

When you write your own HTML-pages for our integrated webserver, you can use the following parameters.

Parameters are always enclosed in %. Before serving the HTML-page to the client, the integrated webserver will change the parameter to the actual value.

%system datetime% | Current date time of the AADServer, UTC
%client ipaddress% | TCP/IP Address of the client. Please note: due to NAT (network address translation) the reported IP Address might be different then what you expect.
%client portnumber% | The TCP/IP port number of the client.
%server portnumber% | The TCP/IP port number of the server. Default this is 80.
%host request% | The host name as entered by the client in the address bar of the browser. The hostname can have several values. The client can connect by entering an IP Address or a DNS-name. Due to NAT or other network related solutions, the AADServer might be connected in different ways with different hostnames as entered by the client.
%this host% | The netbios name of this AADServer
%this host rdp port% | The Portnumber for the RDP sessions. Default this is 3389.
%uri request% | The full URL as entered by the client on the addressbar. It is the part behind the host name as entered by the client on the addressbar.
%user agent% | The user agent of the browser used by the client.
%http server version% | The version of the integrated web server.
%client utc datetime% | The date time when the client did first connect.
%aad product type% | The AADS product type like aad_19_demo. This value can also be found in HKLM\Software\AADServer
%000-00000002% | Title of the product. This is the translation variable cAppTitle.
%000-00000003% | Name of the product. This is the translation variable cAppName.
%000-00000009% | Type of product. Default value \"Enterprise\"
%000-00000010% | Type of product. Default value \"Classic\"

These variables are related to the translation of AADS Terminal Server.

Logfile

The logfile is called AADServer_www_Server.utf8.log.

The logfile shows the following info:

  • date / time
  • Info, Warning or Error
  • IP Address of the client
  • HTTP-result code:
    • 200 is OK
    • 4XX is an error related to the client
    • 5XX is an error related to the server
  • Hostname as entered by the client in the address bar of the browser:
    • The web server can be accessed using the IP Address of the server, or DNS-name.
  • object served:
    • In case of the Demo version of AADS Terminal Server, the objects are served from internal memory and not from the WWW-folder (although they must exist in the WWW-folder....). Because the objects are served from memory in case of AADS Terminal Server, changing the contents of the WWW-folder will not have an effect.

The logfile is a wrap-around logfile and will overwrite itself. The maximum size is 1 MB. If auditing is important, the Administrator should schedule some kind of automatic backup of this logfile.


IE 6

Internet Explorer 6

The builtin webserver of AADS Terminal Server can be used with Internet Explorer 6. However, it is strongly recommended to upgrade Internet Explorer to the highest version possible for the Client PC. In case the Client PC uses Windows XP, it is possible to install Internet Explorer 8.

First time: Enable Add-on

The first time the built-in webserver is accessed from a Client PC running IE 6, the following might happen:

Click on "to enable the add-on, click here". The following screen will be shown:

Enable the "Microsoft Terminal Services Client Control".
(and while doing this, disable any other that you do not need).

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". This can be verified via "Internet Options", Tabpage "Program" and then the button "Manage Add-ons...."

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.


IE 7

Internet Explorer 7

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 7. However, it is strongly recommended to upgrade Internet Explorer to the highest version possible for the Client PC. In case the Client PC uses Windows XP, it is possible to install Internet Explorer 8.

First time: Enable Add-on

The first time the built-in webserver is accessed from a Client PC running IE 7, the following might happen:

Click on "To enable the add-on, click here". The following screen will be shown:

Enable the "Microsoft Terminal Services Client Control".
(and while doing this, disable any other that you do not need).

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". This can be verified via the "Tools" button:

Note: if you do not enter the IP Address of the AADServer, but do enter a "DNS / Netbios" name, like "AADServer4", make sure that those names can be resolved.
For example, if a "ping AADServer4" fails, then it will also not be possible to connect to "AADServer4".

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled:


IE Compatibility View

IE Compatibility View

Introduced in Internet Explorer 8 is an option called "Compatibility View". This can be relevant for the built-in webserver of AADS Terminal Server. It might be required to disable or enable the so called "Compatibility View" when using the built-in webserver of AADS Terminal Server.

For more information about this, please see the Microsoft website:

http://windows.microsoft.com/en-us/internet-explorer/use-compatibility-view


IE 8

Internet Explorer 8

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 8. In case of Windows XP / Server 2003, this is the highest version of Internet Explorer that Microsoft has made for Windows XP / Server 2003.

First time: Run Add-on

The first time the built-in webserver is accessed from a Client PC running IE 8, the following might happen:

The user will need to select "Run Add-on".

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". Using the "Tools" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

The menu item "Manage Add-ons" will show the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

It might be required to disable the " IE Compatibility View " in order to get the best result:

When "IE Compatibility View " is enabled , it might happen that scrollbars are shown while these are not needed:


IE 9

Internet Explorer 9

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 9.

First time: Allow Add-on

The first time the built-in webserver is accessed from a Client PC running IE 9, the following might happen:

Click on "Allow".

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". Using the "Tool - shaped" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

Select Manage add-ons shows the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

It might be required to disable the "IE Compatibility View " in order to get the best result:

When "IE Compatibility View " is enabled, it might happen that scrollbars are shown while these are not needed:


IE 10

Internet Explorer 10

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 10.

First time: Allow Add-on

The first time the built-in webserver is accessed from a Client PC running IE 10, the following might happen:

Click on "Allow".

Verify the Add-on

Using the "Tool - shaped" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

Select Manage add-ons shows the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

It will be required to enable the "IE Compatibility View " in order to get the best result:

In case " IE Compatibility View " is disabled, the following error might be shown:

Click on the "IE Compatibility View - button" in the Addressbar and try again to connect to the AADS Terminal Server.

For good measurements you can enable the following option of IE 10:


IE 11

Internet Explorer 11

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 11.

First time: Allow Add-on:

The first time the user connect to the AADS Terminal Server, the following popup might be shown:

Click on "Allow".

Manage Add-ons

Using the "Tool - shaped" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

Select Manage add-ons shows the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

Using the "Tool - shaped" button, the user must "add" the AADServer to the list of servers for "Compatibility View ".
Select "Compatibility View " settings" in the following menu:

The following screen will be shown:

In this example the netbios-name of 3 AADS Terminal Servers are "added" and 1 IP Address of an AADS Terminal Server.

Note: if you enter "DNS / Netbios" names, like "aadserver1", make sure that those names can be resolved.
For example, if a "ping aadserver1" fails, then it will also not be possible to connect to "aadserver1".


IE 11 - Windows 10

Internet Explorer 11, running on Windows 10

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 11 running on Windows 10.

First time: Allow Add-on:

The first time the user connect to the AADS Terminal Server, the following popup might be shown:

Click on "Allow".

Manage Add-ons

Check to verify that "Microsoft Terminal Services Client Control" is enabled:

IE Compatibility View

Using the "Tool - shaped" button, the user must "add" the AADServer to the list of servers for "Compatibility View ".
Select "Compatibility View " settings" in the following menu:

The following screen will be shown:

Click on "Add". In this example the IP Address of the AADS Terminal Server is "added".

"Add" the AADServer to the "Local intranet Zone"

Note: if you do not enter the IP Address of the AADServer, but do enter a "DNS / Netbios" name, like "aadserver1", make sure that those names can be resolved.
For example, if a "ping aadserver1" fails, then it will also not be possible to connect to "aadserver1".

Connect to the AADServer

When connecting to the AADServer a full white desktop is initially shown (and no hint about what you should do...)

Click on the "white space" and a popup about clipboard or other settings does appear.

Click on "Connect" and the Remote Desktop will be shown:


Integrated PostScript / PDF Printer

Integrated PostScript / PDF Printer

  • Users can print their documents to the AADServer printer. The AADServer printer appears between the other available printers when doing some printing.
  • The printed documents either appear as PDF and / or Postscript (PS) files.

Example: Printing from Notepad

Example: Printing from MS-Word

Location of the printed PDF / PS Files

  • The printed documents appear in the "AADS Printer Files" folder, which is located inside the Documents folder of the User. Example:

    The logged in User in this example is "luser001". The PDF / PS file is placed in the personal folder of the user:

    • c:\users\luser001\Documents\AADServer Print Files


Configuring the Integrated Postscript / PDF printer

Configuring the Integrated Postscript / PDF printer

  • When the PostScript / PDF printer is enabled, automatically an AADS Printer is created.
  • Users can select and use the printer.
  • Result will be a printed Postscript (PS) or PDF file in the Personal Folder of the user.

  • When either, or both PostScript and / or PDF is selected, the AADS Printer will be available.
  • When neither PostScript or PDF is selected, the AADS Printer will be removed from the Server.
  • The location of where the PDF / Postscript files are placed, can be changed.
    If this is changed, for instance, on a different server, please note that the user must have create and write rights on this different server.

Queue

The printer queue can be viewed in the usual way:

Settings

Default printer settings like papersize can be changed:

  • AADSServer printer, right click mouse, properties
  • General tabpage
  • Preferences... button
  • Advanced... button
  • Change Paper Size

Postscript Output Options

Depending on your Word Processor (MS-Word, Libre Office, Office software, etc), it might be required to change the following setting:

  • AADSServer printer, right click mouse, properties
  • Advanced tabpage
  • Printing Defaults... button
  • Advanced... button
  • Change the Postscript Output Option to Optimize for Portability.

GhostScript versions

AADS includes a version of GhostScript for generating the Postscrpt or PDF documents.

It is possible to install a different version of GhostScript, and instruct AADServer to use this different version of GhostScript.

GhostScript installers can be downloaded from:

https://www.ghostscript.com/

When AADS Control and Maintenance detects versions of GhostScript, it will show them:

  • Select 1 of the GhostScript versions as installed and available.


Do not install multiple PDF solutions

Do not install multiple PDF-solutions

The built-in PDF printer of AADS Terminal Server is based in open source code: GhostScript

Other Licenses

If you would investigate this, you will learn that all most all PDF writers are always based on GhostScript.
If you install 2 or more different (commercial) PDF printers on the same server, there is the possibility that a ghostscript version problem is created.
Therefore it is recommend not to install 2 or more different (commercial) PDF-printer solutions on 1 server at the same time.

It is OK to install multiple different version of GhostScript; that is something we have tested.

GhostScript installers can be downloaded from:

https://www.ghostscript.com/

When AADS Control and Maintenance detects versions of GhostScript, it will show them:

  • Select 1 of the GhostScript versions as installed and available.


RDP Firewall

RDP Firewall

The built-in RDP Firewall of your AADS Terminal Server is not a replacement of the Windows Firewall. It is not a replacement for anti-virus software or security-software in general.

The built-in AADS RDP Firewall gives you protection, specifically and focussed on RDP connections, sessions, and logon's. Improper RDP sessions, failed logons, hack attempts thru a RDP session, will be detected, logged, and handled by the built-in AADS RDP Firewall. These type of "attacks" are not handled by anti-virus software or security-software in general. Almost never are these types of "attacks" blocked by network devices like the router/firewall that connects the company to the internet. And now that you are using an AADS Terminal Server and therefore are running a Terminal Server, you will need the protection for Terminal Servers: the AADS built-in RDP Firewall. The AADS RDP Firewall is one of the reasons why AADS is a better solution then default MS Terminal Server, Citrix or others.

  • Always enable and use the AADS RDP Firewall on your AADS Terminal Server.

Other "typical" security problems like viruses, are not handled by the built-in AADS RDP Firewall. Therefore the usual recommendations do still apply:

  • Enable and configure properly a Firewall on Windows .
  • Install and configure properly Anti-Virus software .

RDP Firewall

Default the built-in RDP Firewall is enabled and has the following settings:

IPv4, IPv6

AADS Terminal Server can handle both IPv4 and IPv6 traffic.

PortNumber

You can change the default port number which is used by the AADS Terminal Server for listening for Remote Desktop Sessions.

  • The default number is TCP port number 3389.

The range of the custom value is 1000 – 65534. Although a number lower then 1000 might be technical possible, this is disabled in order to prevent problems.

If you change the port number to another value:

  • You will also have to change your firewall settings.
  • If you use some kind of router to connect to the Internet, most likely you have defined a NAT-entry in your router in order to forward a port to the AADS Terminal Server. You must also update this NAT-entry in your router.
  • You must inform all you users, because the client software they use for connecting to the AADS Terminal Server needs to know about the changed port number.

Reboot required

A reboot is required before the new port number is used by AADS Terminal Server.

Enable the Firewall

Don't be tempted to disable the AADS built-in Firewall. Too often we receive ZIP Support Files with loglines indicating many hack-attempts because of a disabled AADS RDP Firewall or no Firewall at all. This also applies to local networks. If one (or more) of the Client PCs are hacked, infected, the virus on the Client PCs may attempt to login on the AADServer and is doing many RDP-logins. Regularly we receive ZIP Support Files with these type of problem...

No firewall is not acceptable, because then to many hack-attempts are happening, and those hack-attempts do use/waste Windows resources, and if that happens for a day, Windows might become unstable.

Note: The Windows Firewall or firewalls build into routers and / or other network devices, do not block RDP sessions which are done with the objective to hack a Terminal Server. One should not assume that some network device or firewall has the ability to detect multiple failed RDP logins, followed by blocking the remote client / device.

Allow RDP Connections from Private IP Addresses

Access from Local / Private IP Addresses is default allowed (and usally there is no reason for not allowing this).

Local / Private IPv4 address ranges

  • 10.0.0.0 - 10.255.255.255
  • 172.16.0.0 - 172.31.255.255
  • 192.168.0.0 - 192.168.255.255
  • 169.254.0.0 - 169.254.255.255

Local / Private IPv6 address ranges

  • FCxx:: /8
  • FDxx:: /8
  • FE80:: /10
  • ::FFFF.n.n.n.n    IPv4 mapped in IPv6 address, IPv4 address is a local/private IPv4 address.
  • ::0000.n.n.n.n    IPv4 embedded in IPv6 address, IPv4 address is a local/private IPv4 address.

Allow RDP Connections from Public IP Addresses

Access from Public IP Addresses is default not allowed.

Access from Public IP Addresses can be allowed:

  • Temporary allowed.
  • Permanent allowed.

Permanent Allow RDP Connections from Public IP Addresses

Permanent Allow RDP Connections from Public IP Addresses is possible as follows:

  • Permanent allowed, allowed for all users.
  • Only allowed for users who a member of a specific group.

Permanent allow RDP Connections from Public IP Addresses for all users

Only allow RDP Connections from Public IP Addresses for users who a member of a specific group

Example: the Administrator has created a group called "On The Road" users:

Access from Public IP Addresses is only allowed for users who are member of the group "On The Road users".

By clicking on the button showing the group name, the Administrator can select the appropiate group:

Allow Temporary RDP Connections from Public IP Addresses

The objective of the option "Allow Temporary RDP Connections from Public IP Addresses" is as follows:

  • All users are local office users.
  • No user needs to do a RDP session from a remote location; no user needs to do a RDP session from a Public IP Address.

However,

  • Adminstration is done by a remote Administrator. That can be someone in a remote office or someone from an external (IT-) company.
  • Once in a while the remote Administrator has to do some job. Installing some updates, making a backup, etc.
  • The users (or an Administrator among the users) can temporary allow the remote Administrator access from a Public IP Address, such that the remote Administrator can do the job within a given time frame.

Either only Administrators or all Users can temporary allow RDP Connections from Public IP Addresses

Program: Temporary RDP Connections from Public IP Addresses are allowed

The Application folder of an AADS Terminal Server contains the following program:

Any user can start this program, although it depends on the configuration as shown above here, if the user can do something with the program.

The user can select an amount of time between 1 and 48 hours, and click on the Apply button. If he selects, for example, 3 hours, it shows as follows:

The end-date and time is shown. For the next 3 hours it is possible to do RDP connections from Public IP Addresses.

When the remote administrator is done with his job, the user can optional click on the Stop-button, and the period for allowing RDP connections from Public IP Addresses is terminated immediately.

Note; when the user clicks on Stop, the current active session of the remote administrator will not be disconnected. However, if the remote administrator attempts to connect again, that attempt will be denied.

If the AADS Terminal Server is configured that it is not allowed to enable temporary RDP Connections from public IP Addresses:

then the user can not set a temporary period:

GeoIP Location

GeoIP Location offers the ability to allow only connections from certain countries (Allow List) or block connections from certain countries (Deny List).

GeoIP Location should be used with RDP connections.

Spamhaus Drop list

Quote from the Spamhaus website: DROP includes netblocks that are hijacked or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).

It is quite unlikely that legitimate users do need to do a login on an AADServer, from one of the netblocks / IP ranges which are included on the Spamhaus Drop list. Therefore it is better to block all connections from these netblocks / IP ranges.

Spamhaus Drop List should be used with RDP connections.

Failed Logins

Well known names / Other, self defined names

The Firewall will block Clients when it is detected that the Client has done 5 failed logon attempts.

When it is about "failed logon attempts", it can be about those zombie-hacked-PC's, hacked routers, compromised IOT devices, hacked smart TV's, etc, in a botnet out there on the internet. And this botnet with hacked devices does attempt to hack into the AADServer with the well known Administrator userID or other well-known, pre-defined userID's.
Or it can be about, for example, a former employee, or a visitor to the company office, who knows the userIDs of the employees, and attempts to hack into the AADServer with the usernames / userIDs as defined for the employees.
Either hack-attempts are blocked by the AADS RDP Firewall.

There are however circumstances where it is not really required to block Client PCs which do multiple failed logon attempts with specific company usernames / userIDs. For example, Point Of Sales systems that do automatically login on the AADServer, with a specific username like "POSClient123" (example of an username), and a password that nobody knows. Login is done automatically when booting the POS Client PC. And in the event that the remote POS Client PC makes an error, for example because the barcode reader is disconnected, it might not be needed to block the remote POS Client PC in the Firewall, but just fix the error. In such a case the IT Administrator of the AADServer can choose to handle only failed login / hack attempts when it is done with a well known user names like Administrator, but do not block a Client in the Firewall in case the failed login attempt is done with other, self defined user names.
However, if it is chosen not the block such failed login attempts, a rough (ex-)employee for example, might start some trouble with login attempts, using those usernames like "POSClient123". Therefore it is recommended always to enable Notifications, specifically the Notification for a failed logon attempt.

Default setting is to block Clients in any case. Wether the failed login / hack attempt is done with a well known username like Administrator, or a specific username that is known only on this AADServer, the Client will be blocked after 5 failed login / hack attempts.

Deny after number of Failed Logon Attempts

Default a Client will be blocked after 5 Failed Login attempts. In case 2FA is used, this is also applicable in case a remote user does 5 failed entries for a 2FA code.

Deny Period

When it is attempted to do a Remote Login from a specific IP Address, and there are 5 Failed Attempts within the configured Deny-period of 7 days, the IP Address of the Remote PC / Client is entered on the Temporary Blocked list for the next 7 days.

The Client PC will be removed automatically from the Temporary Blocked list when it has not been seen for 7 days. The 7 days are counted down to 0 from the last moment that the Client PC has contacted the AADServer. Any attempt to login again in those 7 days, will prolong the 7 days.
It is possible to change the "Deny Period":

  • Forever
  • Days:Hours
  • Hours:Minutes

Create TXT logfiles

If required, TXT logfiles will be created, for example because of usage or audit requirements.

The logfiles are created in

AADS for Windows x32 | C:\Program Files\AADServer\logging
AADS for Windows x64 | C:\ProgramData\AADServer\logging

Connect Rate Limit

The built-in Firewall has Connect Rate Limit settings, such to prevent attacks on the Server. There are 3 increasing sets indicate the number of connections within a given amount of time. These 3 sets are applied when the same IP Address does multiple connections to the Server. When exceeding this number of connections, the attempts from the Client to do more connections are denied. The current active connections which were within the limits of the 3 sets, are allowed; the current active connections are not disconnected when the "next" connection attempt from the Client exceeds the Connect Rate Limit sets.

Block access from Localhost to Localhost

Default AADS will Block access from Localhost to Localhost.

The objective of "Block access from Localhost to Localhost" is to block viruses and / or RAT (remote access tools) on an infected PC / Server.

This setting does not prevent the infection of a PC / Server. AADS is not Anti Virus software. As usual any PC or Server needs proper Anti Virus software. However, if it happens that the PC / Server gets infected, this setting is an additional protection against the operation of RAT viruses.

In the event that a PC / Server gets infected with a RAT virus, using the RAT virus the hacker might attempt to get full RDP access to the infected PC / Server and do whatever the hacker wants to do. Because the RAT virus / software runs locally on the PC / Server, it is possible to block this type of RDP access by blocking access from Localhost to Localhost. The users within the company are not affected by this setting.

Because of our Support, we have received multiple ZIP Support Files from customers in trouble, and from the details of the logging in the ZIP Support Files, we have learned that it was a RAT virus that was causing the trouble. And we have also learned from the logging that we can block the operation of the RAT virus by blocking access from Localhost to Localhost.

  • If this setting is set, the IP Addresses of the AADServer will appear on the Automatic Deny List.
  • If this setting is not set, the IP Addresses of the AADServer will appear on the Automatic Allow List.


Process flow of the RDP Firewall

Process flow of the RDP Firewall

  • The AADS Firewall first looks at the incoming connection and sees if it is a IPv4 or IPv6 connection, and if IPv6 is allow and enabled. IPv4 is always enabled and allowed.
  • Next the AADS Firewall test if it is a Public or Private IP Address.

Following the decision about Public or Private IP Address, the AADS Firewall decides about the connection based on the 8 Firewall Lists:

  • Connect Rate Limit
  • Automatic Deny List
  • Manual Deny List
  • Spamhaus Drop List
  • GeoIP Location Allow List
  • GeoIP Location Deny List
  • Temporary Blocked List
  • Automatic Allow List
  • Manual Allow List


GeoIP Location

GeoIP Location

GeoIP Location offers either a Allow List or a Deny List.

Note: it is not possible, nor is it needed, to have a GeoIP Allow List and Deny List at the same time. Such is never needed...just think about it...

  • If the Allow List is used, and 1 or more countries are placed on the Allow List, then all other countries are blocked. And because all other countries are blocked, there is no need to have a Deny List with 1 or more countries, because, as stated, when using an Allow List, all other countries are blocked.
  • If the Deny List is used, and 1 or more countries are placed on the Deny List, then all other countries are allowed. And because all other countries are allowed, there is no need to have an Allow List with 1 or more countries, because, as stated, when using a Deny List, all other countries are allowed.

GeoIP and RDP

The use of GeoIP for RDP connections is strongly recommended. Most hack-attempts from around the world as they do happen, are blocked when using the GeoIP Allow List, or when placing (many...most...) countries on the GeoIP Deny List.

Manage

Manage shows the details of the loaded GeoIP / Spamhaus Drop List database:

  • Number of countries
  • Number of IPv4 ranges/networks in the world
  • Number of IPv6 ranges/networks in the world
  • An info field that indicates a date-stamp of the GeoIP Location Data.

Because of redundancy, AADS uses either GeoIP location data from MaxMind or from IPInfoDB.

MaxMind

AADS uses GeoLite2 data created by MaxMind, available from MaxMind.

IPInfoDB

AADS uses IP2Location LITE data available from IPInfoDB.

Updates and Download

  • Once a day does the AADServer check if an update of the GeoIP location / Spamhaus Drop List data is available from our websites:
    • https://www.aads-worldwide.ae
    • https://www.aads-worldwide.hk
    • https://www.aads-worldwide.ch
  • When an update is available, the AADServer will download the update and use it immediately.
  • Optional a HTTP(S) proxy server can be entered for downloading the data.
  • See the FAQ where we publish details about our web / License servers.

Updates

It is important that the AADServer can check for Updates of the GeoIP location / Spamhaus Drop List, and Download the data.

Both the GeoIP data and the Spamhaus Drop List are updated roughly on a daily to weekly basis and is therefore "outdated" within a month. Using "outdated" data should be avoided because nowadays IPv4 networks are (re-)sold from country to country, implying that "outdated" data would allow connections from IP Addresses, or block connections from IP Addresses, because in the "outdated" GeoIP the IP Address belong to country "XYZ" while currently the IPv4 range is sold and used in country "ABC".

Suggestion: Enable and use Notifications. Whenever an Update is available or there is some problem with downloading the latest GeoIP location / Spamhaus Drop List data, a Notification (email) is send to the Administrator of the AADServer.

Search GeoIP

It is possible to search in the local GeoIP database:

  • Enter an IP Address, IPv4 or IPv6, and the GeoIP location will be shown

  • If the IP Address is also located on the Spamhaus Drop List, you will know:


GeoIP Allow List

GeoIP Allow List

Note: The countries mentioned in this example of the GeoIP Allow List, are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

When using an Allow List, only connections from countries on the Allow List are allowed. All other connections from all other countries in the world are blocked.

Example:

The list shows the number of known IPv4 networks and IPv6 networks in each country.

Add a Country to the GeoIP Allow List

  • Use [TAB] or [Down] for creating an empty row, and click on the field in the column Country,

or

  • Right-Click with the mouse on the list with Countries and select "Add":

A popup with all Countries does appear. Select the Country that needs to be added to the GeoIP Allow List.

After adding 1 or more countries:

  • Use the [Save] button for Saving the list, or
  • Use the [Read] button for ignoring the changes that has just been done, and read the GeoIP Allow List again as it was saved.

Delete 1 or more Countries from the GeoIP Allow List

  • Use the column Date/Time for selecting 1 or more Countries
  • Right-click with the mouse
  • Select Delete in the popup menu

After deleting 1 or more countries:

  • Use the [Save] button for Saving the GeoIP Allow List, or
  • Use the [Read] button for ignoring the changes that has just been done, and read the GeoIP Allow List again as it was saved.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


GeoIP Deny List

GeoIP Deny List

Note:The countries mentioned in this example of the GeoIP Deny List, are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

When using a GeoIP Deny List, all connections from countries on the GeoIP Deny List will be blocked. Connections from all other countries in the world are allowed.

Example:

The list shows the number of known IPv4 networks and IPv6 networks in each country.

Add a Country to the GeoIP Deny List

  • Use [TAB] or [Down] for creating an empty row, and click on the field in the column Country,

or

  • Right-Click with the mouse on the list with Countries and select "Add":

A popup with all Countries does appear. Select the Country that needs to be added to the GeoIP Deny List.

After adding 1 or more countries:

  • Use the [Save] button for Saving the list, or
  • Use the [Read] button for ignoring the changes that has just been done, and read the GeoIP Deny List again as it was saved.

Delete 1 or more Countries from the GeoIP Deny List

  • Use the column Date/Time for selecting 1 or more Countries
  • Right-click with the mouse
  • Select Delete in the popup menu

After deleting 1 or more countries:

  • Use the [Save] button for Saving the GeoIP Deny List, or
  • Use the [Read] button for ignoring the changes that has just been done, and read the GeoIP Deny List again as it was saved.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


Spamhaus Drop List

Spamhaus Drop List

Quote from the Spamhaus website: DROP includes netblocks that are hijacked or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers).

It is unlikely that legitimate users do need to do a login on an AADServer, from one of the netblocks / IP ranges which are included on the Spamhaus Drop list. Therefore it is better to block all connections from these netblocks / IP ranges.

About the Spamhaus Drop List

Information and details about the Spamhaus DropList can be found here.

Updates and Download

  • Once a day does the AADServer check if an update of the GeoIP location / Spamhaus Drop List data is available from our websites:
    • https://www.aads-worldwide.hk
    • https://www.aads-worldwide.ch
    • https://www.aads-worldwide.ae
  • When an update is available, the AADServer will download the update and use it immediately.
  • Optional a HTTP(S) proxy server can be entered for downloading the data.
  • See the FAQ where we publish details about our web / License servers.

Updates

It is important that the AADServer can check for Updates of the GeoIP location / Spamhaus Drop List, and Download the data.

Both the GeoIP data and the Spamhaus Drop List are updated roughly on a daily to weekly basis and is therefore "outdated" within a month. Using "outdated" data should be avoided because nowadays IPv4 networks are (re-)sold from country to country, implying that "outdated" data would allow connections from IP Addresses, or block connections from IP Addresses, because in the "outdated" GeoIP the IP Address belong to country "XYZ" while currently the IPv4 range is sold and used in country "ABC".

Suggestion: Enable and use Notifications. Whenever an Update is available or there is some problem with downloading the latest GeoIP location / Spamhaus Drop List data, a Notification is send to the Administrator of the AADServer.


Failed Logon / Temporary Block List

Failed Logon / Temporary Block List

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

Failed Logon

A List of Failed Logons is shown:

Every Failed Logon is recorded, and if there are "to many" failed logons, the offending IP Address is placed on the Temporary Blocked List.
Default a Client will be placed on the Temporary Blocked List after 5 Failed Login attempts, and will be blocked for the next 7 days.

Delete Failed Logon Events

  • By clicking on the "Date/Time" column, 1 or more Failed Logon Events can be selected.
    Using the "Delete"-option in the Popup Menu, those Events can be deleted.
    • When there are no Failed Logon Events are selected (indicated by the color blue), Delete will delete the current Failed Logon Event.
  • Do not forget to click on the "Save"-button after deleting 1 or more Failed Logon Events.

The point of this, is that it might happen that an OK / normal user accidentally has done some Failed Logons, for example because the caps-lock key of the keyboard was locked, and the user does not notice this, and the user attempts to login multiple times.
And when there are, for example, 4 Failed Logons from the Client-PC of this user, and the number of Number of Failed Logon Attempts is 5, then all the user needs to do in the next week, is 1 Failed Logon and he/she gets blocked for the next 7 days.

The main purpose of the Firewall is to stop hack-attempts; not to stop an OK user who makes a silly typo error when entering the username and password.
Therefore it is possible for the Administrator to delete the Events Failed Logon Attempts (after he has informed the erroneous but OK user that he should not do 5 failed attempts to enter his name and password......)

If the user has attempted to logon with something else then his/her own username, it is recommended not to delete the Events Failed Logon Attempt,
but first to figure what or why the user has attempted to do a logon with some other userID then his/her normal userID.

Copy to Manual Allow or Manual Deny list

Using the Popup Menu, Copy to Allow List or Deny list, the Administrator can directly copy the IP Address of the offender to the Manual Allow List, or to the Manual Deny list .

After Copying 1 or more IP Addresses to the Manual Allow List or Manual Deny list , be sure to switch to the Manual Allow List or Manual Deny list after the "copy" and Save the Manual Allow List or Manual Deny list .

Search and Select

When entering some search text, automatically search results are selected in both the Failed Logon list and the Temporary Block List:

The Menu options:

  • Delete
  • Copy to Allow list
  • Copy to Deny list

will do their job in 1 go on all selected search results.
The color blue indicates which events are selected.

The point this, is that it is easy to search-and-select an User or an IP-Address, and delete it from the Failed Logon and Temporary Block list in 1 Go.
Suppose an user has accidentely done several failed logons, and the user, and the IP-Address appears both on the Failed Logon and Temporary Block list, it is easy to delete the user and the IP-Address from both Firewall lists.

Temporary Blocked

When there are "to many" Failed Logon attempts from an IP Address, the IP Address will be entered on the Temporary Blocked list.
The Number of Failed Logon Attempts defines what is "to many".

When a Client is on the Temporary Blocked List,

  • The connection between the Client and the Server will be disconnected.
  • If the Deny-period is 7 days, any attempt in the next 7 days will be blocked. The Client is not allowed to connect for 7 days.
  • Every time the Client attempts to connect and login again, the block time of 7 days will be prolonged. The Client will be blocked for 7 days, counted from the last date / time moment that the Client did attempt to connect and login in to the AADS Terminal Server.
  • After the Client has not be seen in 7 days, automatically the IP Address of the Client will be cleared from the Temporary Blocked List.

Note:

  • If the user attempts to connect a 2th time from the same Client PC, from the same IP Address, and the user does many Failed Logons,
    but there is already an active session from the IP Address of the Client PC, because the user did correctly a logon some time ago,
    then this existing, active session will be not be disconnected.
    The blocking only applies to new connect and logon attempts.
  • 2th note: after the moment the user does a logoff from this existing, active session, he will have to wait for 7 days, the Deny Period , before he can logon again on the AADS Terminal Server......

Sort by IPv4/6

Either all IPv4 or IPv6 will be shown first.

Toggle IPv6 view

Toggles between various ways IPv6 addresses can be shown.

Export

It is possible to export the following Firewall Lists to CSV (comma separated values) files. The exported CSV files can be found in:

  • Administrators have READ + WRITE rights on this folder and the Files.
  • Users have READ rights.
  • After 24 hours, these CSV files will be deleted.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar / click on "Date/Time" column | Select / de-select an entry.


Allow List

Allow List

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

Automatic Allow List

The Automatic Allow List will only contain the local IP Addresses of this AADS Terminal Server.
If you want to place some IP Addresses on the Allow List, use the Manual Allow List.

If you de-select Block access from Localhost to Localhost

the Automatic Allow List contains all local IP Addresses of this AADS Terminal Server.

If you de-select, access from Localhost to Localhost is allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic Allow List.

If you select Block access from Localhost to Localhost, which is recommended to do,
the Automatic Allow List contains will not contain the local IP Addresses of this AADS Terminal Server; the Automatic Allow List will be empty.
If you select, access from Localhost to Localhost is not allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic Deny List .

The Automatic Allow List is empty...

The local IP Addresses of this AADS Terminal Server are on the Automatic Deny List

Manual Allow List

The Administrator can enter IP Addresses or ranges of IP Addresses:

Note: as you can see in this example, when a Public IP Address is entered that "does not exist" in the real world, it will be shown with "Unknown country". However, this might also happen if the GeoIP Location database is old/expired and should be renewed...

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-option in the Popup Menu, those Client IP Addresses can be deleted and do loose their privilege of always to be allowed to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

Allow List overrules

Whatever is entered on the Allow List, Automatic and Manual, is allowed to connect to the AADS Terminal Server.
The Allow List overrules all other lists.

Be careful with the Manual Allow list!

Suppose the PC of an Administrator is somehow "infected" with a RAT virus (Remote Access Tool), the PC of the Administrator does never gets blocked when the IP Address of this PC is on the Allow list...

Sort by IPv4/6

Either all IPv4 or IPv6 will be shown first.

Toggle IPv6 view

Toggles between various ways IPv6 addresses can be shown.

Export

It is possible to export the following Firewall Lists to CSV (comma separated values) files. The exported CSV files can be found in:

  • Administrators have READ + WRITE rights on this folder and the Files.
  • Users have READ rights.
  • After 24 hours, these CSV files will be deleted.

Subnet mask / Range

It is possible to enter 1 IP Address, by leaving the Subnet Mask / Range empty.

IPv4

A Range can be entered as follows:

  • "begin" IP Address and "end" IP Address. See the Thin Clients Sales Department as an example.
  • /1 to /31. See Range Example 1.
  • /n1.n2.n3.n4. See Range Example 2.

IPv6

A Range can be entered as follows:

  • "begin" IP Address and "end" IP Address.
  • /4 to /128

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


Deny List

Deny List

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

Automatic Deny List

If you select Block access from Localhost to Localhost, which is recommended,

the Automatic Deny List contains all local IP Addresses of this AADS Terminal Server:

The Automatic Deny List will only contain the local IP Addresses of this AADS Terminal Server.
The Automatic Deny List will never contain any other IP Addresses.

If you want to place some IP Addresses on the Deny List, use the Manual Deny List.

If you do de-select Block access from Localhost to Localhost

then the Automatic Deny List will be empty; the Automatic Deny List will not contain any IP Address.

If you de-select, access from Localhost to Localhost is allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic Allow List .

Manual Deny List

The Administrator can enter IP Addresses or ranges of IP Addresses:

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-button, those Client IP Addresses can be deleted and are allowed once again to connect to the AADS Terminal Server.

Do not forget to click on the "Save"-button.

Sort by IPv4/6

Either all IPv4 or IPv6 will be shown first.

Toggle IPv6 view

Toggles between various ways IPv6 addresses can be shown.

Export

It is possible to export the following Firewall Lists to CSV (comma separated values) files. The exported CSV files can be found in:

Subnet mask / Range

It is possible to enter 1 IP Address, by leaving the Subnet Mask / Range empty.

IPv4

A SubNetMask / Range can be entered as follows:

  • "begin" IP Address and "end" IP Address. See the Thin Clients Sales Department as an example.
  • /1 to /31. See Range Example 1.
  • /n1.n2.n3.n4. See Range Example 2.

IPv6

A SubNetMask / Range can be entered as follows:

  • "begin" IP Address and "end" IP Address.
  • /4 to /128

/all IPv4 IPv6

Described here

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


/all

/all

Be carefull with an /all range

  • An /allrange on the Deny List implies that every IP Address is blocked.

The /all range can only be used as follows:

  • Enter the right IP Addresses or right IP Ranges on the Manual Allow List .
  • Enter the /allrange on the Deny List
  • The Manual Allow List overrules the Deny List
    • Only those Clients entered in the Manual Allow List will be allowed.
    • All other IP Addresses in the world, and all local IP Addresses, will be blocked.

The /all range should not be used with:

  • Geo IP Location Allow and Deny List
  • Failed Logon List
  • Temporary Blocked list

because these Firewall Lists are over-ruled by the Manual Allow List.

  • The Range 0.0.0.0 to 255.255.255.255 denotes all IPv4 addresses.
  • The Range 0:: to FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF denotes all IPv6 addresses.

Example

Allow List

Deny List

The Deny List does completely block every IPv4 and IPv6 address. Only those on the Allow List will be allowed (because the Allow List overrules all other Lists)


Logging

Logging

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

The loglines shows why a connection is allowed, denied and disconnected.

Copy to Manual Allow or Manual Deny list

Using the popup menu, Copy to Allow List or Deny List, the Administrator can directly copy the IP Address of the offender to the Manual Deny List,
or copy to the Manual Allow list in case it is not an offender.

After doing this, be sure to switch to the Manual Deny or Manual Allow list after the "copy" and Save the Manual Deny List or Manual Allow list.

The Tabpage with the "username" shows what the logged-in user/Administrator currently has done with AADS Maintenance Control:

Export

It is possible to export the following Firewall Lists to CSV (comma separated values) files. The exported CSV files can be found in:

Navigation

Cursor keys Move the cursor around the list.


Backup/Restore

Backup/Restore

Using Backup/Restore, the Administrator can create a Backup-File with all the relevant AADServer settings.

The Backup-File will be a ZIP-File, and it will be placed on the desktop of the Administrator:

In the name of the Backup-File you will find the date-time stamp of the Backup.

The Backup-File can be used to restore all AADServer settings on this AADServer. It can also be used to quickly copy all AADServer settings to another AADServer; use the Restore function on this other AADServer for importing all AADS-Settings as they are placed in this Backup-File.

  • Backup
  • Restore


Backup

Backup

What can (and can not) be placed in the backup, is shown:

  • All settings related to Application Control .
  • AADS Firewall, the Manual Allow List and the Manual Deny List. Other FW Lists are created and filled automatically and do not need to be in a backup/restore.
    All settings and files related to the built-in WebServer .
  • All the AADS Settings.

The disabled options are related to AADS Enterprise. AADS Classic does not have the disabled functions.

Optional the Backup-File can be protected with a password.


Restore

Restore

The first step is to select a Backup-File. When a Backup-File is selected, depending on the contents of the Backup-File, the Restore-options will be enabled:

Note: after a Restore, it might happen that AADS Maintenance Control does restart itself.

Password

When the Backup-File is protected with a password, it will be required to enter the Password, before any Restore option becomes available.

Check all Settings after a Restore

It is strongly recommended that after a Restore, the Administrator uses AADS Maintenance Control, and checks if all settings are OK, because, for example:

The Backup-File might be 1 year old. Therefore it might contain settings that are not expected anymore. For example, it might contain www-pages that are 1 year old and are out-dated. Or it might contain Application Control settings for applications that are not being used or installed anymore on the AADServer.


Client Software

Client Software

An AADServer can be accessed using any modern RDP client running on Windows, OSX, Linux, iOS, Android, etc.

  • Microsoft RDP Client

AADS Client Software

For Windows, Mac OSX and Linux, the users might prefer to use the AADS Client Software.
The AADS Client Software can be used for accessing any Terminal Server.

Note: AADS Client Software for Linux and OSX is included in AADS Enterprise.

Build AADS Client software

The AADS Client software can easily be build:

  • RDP Client build

Install AADS Client software

  • Install AADS Client for Windows

Use AADS Client software

  • Use AADS Client


Microsoft RDP Client

Microsoft RDP Client

Microsoft RDP Client can be used for connecting to an AADServer.

The following settings are recommended:

Server authencication

Server authentication is intended for connecting to a Microsoft Terminal Server, including a certificate for the Server. This option of the Microsoft RDP Client is not applicable when connecting to an AADServer.

Note: AADS can do authencication, both Server and Client authencication. See the SSL Gateway for more details.

RD Gateway Server

RD Gateway Server is not applicable, not used, when connecting to an AADServer.

Start a program

The option "Start a program..." is not supported by AADS. If you need to start a program, use Application Control, Auto Run an Application.


Install AADS Client for Windows

Install AADS Client for Windows

See RDP Client Build for creating the AADS Client Build. Copy the Client Build to the Windows PC. On the Client PC the file

aad_RDP_ClientSetup.exe

needs to be executed with Administrator rights.

Installation OK

When installed on the Client PC, a simple popup is shown that the installation has been successful:

Start Menu entry

In the Start Menu of the PC, an entry is placed.

Add / Remove software

An entry is created for the Uninstall of the Client Software.

Installation fails

If the installation fails, the user will be informed, and on the desktop of the user, a Client ZIP Support File is created:


Use AADS Client

Use AADS Client

Authorization

Windows

Enter the required information to login on the AADS Terminal Server. Optional you can select to save your password, such that the next time you use the AADS Client, it will be filled in.

Save my password

When you select "Save my password", the password will be saved in a local INI-file. Encryption is being used for saving the password.

IPv4, IPv6, Default

When entering a DNS-name for the Host, the user can select to connect by IPv4, IPv6 or default. Default will be IPv4 unless only IPv6 is available.

IPv4

IPv6

*

The user can select IPv4, IPv6 or *

  • IPv4
    • The user enters the IPv4 address of the AADServer.
    • In case a hostname is entered (not an IPv4 address) and DNS is required, a DNS request is done for an IPv4 address, and the connection is made using IPv4.
  • IPv6
    • The user enters the IPv6 address of the AADServer.
    • In case a hostname is entered (not an IPv6 address) and DNS is required, a DNS request is done for an IPv6 address, and the connection is made using IPv6.
  • *
    • default IPv4 will be done.

Readonly / edit Name and Password

Initially AADS Client shows the Authorization details in a "read only" modus, such to avoid that accidentally the Authorization details are changed.

When clicking on the small "edit button", next to "Username", it becomes possible for the user to enter and change the Authorization details:

Note: when AADS Client is started, and initially there is no "Username" or "Host", for example because it is the very first time AADS Client is started, then AADS Client does not start in "read only" mode; AADS Client immediately allows for the user to enter the Authorization details:

In this case the user needs to be able to enter the Authorization details.


Settings

Settings

Client Settings for Windows

Desktop Size

You can select the size of the Remote Desktop.

  • The option "Full Screen" will show the Remote Desktop indeed Full Screen, on the current monitor of the client.
    • If the Client has 2 or more monitors, the Remote Desktop will be shown Full Screen on the current monitor onto which the AADS Client is running.
  • The option "Full Screen - taskbar" will make sure that the taskbar of the Client will remain visible while working with the Remote Desktop.

Full screen on all monitors

AADS Client for Windows is "monitor aware". When the AADS Client detects that the Client PC has 2 or more monitors, it behaves as follows:

  • The option Full screen implies that the AADS Client will be Full screen on the monitor it is currently running. Example:
    • If you want the AADS Client to show a Full screen Remote Desktop session on monitor 3, move the AADS Windows to monitor 3 before you click on "Connect", and the Remote Desktop will be shown Full screen on monitor 3.
  • If you want the AADS Client to be Full screen on all monitors, select the option "Full screen on all monitors".

Example: Client will be Full screen on Monitor 3

The Remote Desktop in this example will be shown Full screen on Monitor 3, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 3, so it will do the Remote Desktop on Monitor 3:

Example: Client will be Full screen on Monitor 2

The Remote Desktop in this example will be shown Full screen on Monitor 2, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 2, so it will do the Remote Desktop on Monitor 2:

Example: Full screen on all monitors

The Remote Desktop in this example will be shown Full screen on all Monitors:

Full screen limitations Windows

There are technical limitations in the ability of Windows Client PCs to do Full Screen. It depends on the version of the Microsoft Remote Desktop Client software as it is installed on the Client PC.

  • First it is attempted by the AADS Client software to show the Remote Desktop as big as possible.
  • If it is not possible to show the Remote Desktop as big as possible, it is attempted to show the Remote Desktop with a width of 1600 px.
  • If it is not possible to show the Remote Desktop with a width of 1600 px, it is attempted to show the Remote Desktop with a width of 1280 px.

When you notice that the maximum width of the Remote Desktop Window is limited to 1600 px or 1280 px, you can attempt the following:

  • Upgrade the Remote Desktop software on the Client PC with the latest Remote Desktop Client software from Microsoft.

Connection Bar

Show, or show not the connection bar in the Remote Desktop Session.

IPv6 Scope ID

Described here .

Remaining settings

The remaining settings are similar to the settings in the Default RDP Client software from Microsoft.


IPv6 Scope ID

IPv6 Scope ID

  • Scope ID is about IPv6.
  • Scope ID is not relevant and not used for IPv4 connections.
  • The IPv6 Scope ID is a number. It is not Text.
  • What number you need to enter, has nothing to do with AADS, but depends on the Client PC.
  • It is about the Client PC. It is not about the Server.
  • What number you need to enter differs between Windows, OSX and Linux.

When an IPv6 connection attempts fails with some kind of "routing" error, then this "routing" error might be caused by not having entered an IPv6 Scope ID. Possible and hopefully the correct IPv6 ScopeID will fix this "routing" error.

Windows

Windows Vista and newer

  • Usually you can leave the IPv6 ScopeID empty. Windows will figure out by it selves what the IPv6 Scope ID must be.

Windows XP and Server 2003

  • Usually a correct value of the IPv6 Scope ID needs to be entered.

Obtaining the IPv6 Scope ID

Option 1:

  • Contact the IT department that supports the Client PC and ask them about the IPv6 ScopeID for this Client PC.

Option 2:

  • Open a dos-box, and enter the command ipconfig :

  • The IPv6 Scope ID of this Client PC is 10.

Client PC with multiple network cards

If the Client PC has multiple network cards, it will also have multiple IPv6 Scope ID's. In such a case, see Option 1: Contact the IT department that supports the Client PC and ask them about the appropriate IPv6 ScopeID for this Client PC, such that this Client PC can connect with the AADServer(s).


Connections

Connections

The AADS Client software is able to handle multiple connections to multiple AADS Terminal Servers:

  • The Folder button can be used to change the location of the multiple RDP-files.
  • The Duplicate button can be used to copy the selected "Connection" to a new one.
  • The Rename button can be used to rename the selected "Connection".
  • The Delete button can be used to delete the selected "Connection".

When "Multiple connection usage" is selected, in the first tabpage you select which "Connection" you want to use:

RDP Files

The settings of each "Connection" are written in a RDP file. These RDP-connection-files are placed in the selected folder.

In case a "Connection" is for a connection to an AADS Terminal Server -Farm, there will also be a v001_c003-file for that connection:

The connection "Server Sales" is a connection to an AADS Terminal Server -Farm. The details of this AADS-Farm (how many servers, ip addresses, etc) are stored in the file "Server Sales.aad_farm_v001_c003.txt".


Support

Support

In case there are issues with the AADS Client Software, the tabpage Support contains a ZIP Support Button. By clicking on the button, a Client-ZIP-Support-File will be created on the desktop:


Monitor Information

Monitor Information

The tabpage Monitor shows the details of the Monitors on the Client PC. This can be relevant in case the Client PC has more then 1 monitor, and the user wants to have a RDP-session on a specific monitor, or across all monitors.

1 Monitor is shown

When the AADS Client only shows 1 monitor, then apparently the operating system, videocard and driver do report 1 monitor.
Possible the PC has more then 1 monitor, but those multiple monitors are presented by the operating system, videocard and driver as 1 big monitor.

Multiple Monitors are shown

When the AADS Client shows mulitple monitors, it becomes possible to show the Remote Desktop on a specific monitor:

Example: Client will be Full screen on Monitor 3

The Remote Desktop in this example will be shown Full screen on Monitor 3, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 3, so it will do the Remote Desktop on Monitor 3:

Example: Client will be Full screen on Monitor 2

The Remote Desktop in this example will be shown Full screen on Monitor 2, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 2, so it will do the Remote Desktop on Monitor 2:

When the AADS Client shows multiple monitors, and those multiple monitors all have the exact same width x height, it becomes possible to show the Remote Desktop on all monitors:

Example: Full screen on all monitors

The Remote Desktop in this example will be shown Full screen on all Monitors:


Command Line parameters

Command line parameters

The AADS Client understands 4 command line parameters:

1 | RDP file | Personal RDP-file for the user. | Read / Write access
2 | v001c003 file | Personal v001c003 file which indicates an AADS Farm | Read / Write access
3 | RDP file | Master RDP file | Read access
4 | v001c003 file | Master v001c003 file | Read access

Example how to use these 4 command line parameters:

The following 2 shortcuts on the desktop of the user can be created for accessing Farm 1 and Farm 2:

aadWin32client.exe %homepath%\farm1.rdp %homepath%\farm1_v001c003.txt G:\master\farm1.rdp G:\master\farm1_v001c003.txt

aadWin32client.exe %homepath%\farm2.rdp %homepath%\farm2_v001c003.txt G:\master\farm2.rdp G:\master\farm2_v001c003.txt

(the examples above are 1 long command line with 4 command line parameters)

Farm 1 explained:

1 | RDP file | %homepath%\farm1.rdp This will be the personal RDP file for the user. The environment variable will be expanded. However, the very first time, this file does not exist. In that case the master file in command line parameter 3 will be used.
2 | v001c003 file | %homepath%\farm1_v001c003.txt Personal v001c003 file which indicates Farm 1. This fill will be created and updated. The very first time this file does not exist. In that case the master file in command line parameter 4 will be used, and the user will not be prompted for an IP Address of a server in the Farm.
3 | RDP file | G:\master\farm1.rdp This RDP file should contain correct initial values for the users of Farm1. It will only be red, once, when the personal RDP file as indicated by command line parameter 1 does not exist.
4 | v001c003 file | G:\master\farm1_v001c003.txt This v001c003 farm file should contain initial values for the users of Farm1. It will only be red, once, when the personal v001c003 file as indicated by command line parameter 2 does not exist.

The Administrator can create several shortcuts for accessing the multiple Farms.

  • Each shortcut can have its own 4 command line parameters.
  • Each shortcut can have its own 2 master files in command line parameter 3 and 4.


Connection Examples

Connection Examples

Hostname | Win10Server
IPv4 address | 192.168.200.100
IPv6 address | fe80::49ab:a012:38f5:4401
Portnumber RDP | 12345

  • The default portnumber for RDP is 3389. Because of these examples, it is changed to 12345

Windows Firewall on the Win10Server

Hosts file on the Win7 Client PC

For these examples, the hosts file is used on the Client PC such that the servername Win10Server can be resolved by the Client PC. Usually resolving DNS names is not done by editing the hosts file on each Client PC, but is done otherwise.

Note: When DNS is used to connect to a Server, it might happen that the selection for IPv4 or IPv6 in the Client is "over-ruled" by the response of the DNS Server. For example, If the DNS Server "only" replies with an IPv4 address for the Server, then the Client might attempt to connect using IPv4, and ignore the setting for IPv6.

AADS Client on Windows 7

RDP

  • Connect to Server using IPv4 address
  • RDP on port 12345

  • Connect to Server using DNS Name
  • using IPv4
  • RDP on port 12345

  • Connect to Server using IPv6 address
  • RDP on port 12345

  • Connect to Server using DNS Name
  • using IPv6
  • RDP on port 12345

Microsoft RDP client on Windows 7

RDP

  • Connect to Server using IPv4 address
  • RDP on port 12345

  • Connect to Server using DNS Name
  • RDP on port 12345

The Microsoft RDP Client has no explicite setting for IPv4 or IPv6
when connecting using a DNS name.

  • Connect to Server using IPv6 address
  • RDP on port 12345

Note

Not all possible combinations of RDP, IPv4, IPv6, DNS are shown in these examples.
However, when viewing these examples, it should be understood how it works...


DockDesktop

DockDesktop

In the folder Program Files\AADServer the tool aadDockDesktop is installed. Purpose of aadDockDesktop is to show the desktop icons at a different location on the screen then as default done by Windows:

  • The icons shown by aadDockDesktop are those that are visible on the default Windows desktop of the user.
  • On each corner, aadDockDesktop has a small docking arrow / button. By clicking on this small docking arrow / button, aadDockDesktop will dock itself to that specific location on the screen.
  • The small docking arrows / buttons can also be used to resize aadDockDesktop, or to move it along the screen-edge where it is docked.

Hide resize / move arrows-buttons

If you click on the “no arrow / button” -button, the small arrows / buttons will disappear. Doing so will prevent that the user does accidentally resize or move aadDockDesktop:

Close DockDesktop

By clicking on the close-button, aadDockDesktop will terminate:

DockDesktop setting

The config-button shows the configuration options:

Auto ReSize if to small

In case aadDockDesktop is to small, such that not all icons are shown, such that there is a vertical and / or horizontal scrollbar visible, aadDockDesktop will enlarge itself until all icons are visible.

No Close

The close button will disappear and it will not be possible to terminate aadDockDesktop.
Also the option Do not show on Taskbar will be checked, and disabled.

Hide icons on normal desktop

When un-checked the default Windows desktop does also show the usual desktop icons
When checked, the default Windows desktop does not show any icon. Example:

Show those standard desktop icons

when checked, those standard desktop icons like My Computer, Recycle Bin, etc, are shown. When un-checked, only the icons in the personal desktop of the user are shown.

The personal desktop is a setting / location that can be changed by the administrator. Default the personal desktop is located in %USERPROFILE%\Desktop.
If the user has no icons in %USERPROFILE%\Desktop, aadDockDesktop will be empty.
The example here above has the option "Show those standard desktop icons" checked.

Do not show on Taskbar

if checked, the taskbar will not show an item for aadDockDesktop.
If un-checked, the Taskbar will show an item for aadDockDesktop:

Show Full Screen, do not Align icons at Top

DockDesktop can position itself Full Screen. When Show Full Screen is combined with the option Align icons at Top, unchecked, then aadDockDesktop mimics the default Windows desktop:

Show Full Screen, Align icons at Top

Popup when moving mouse in me

Popup when moving mouse in me or desktop

When one of these options is checked, aadDockDesktop will show itself “on top” when the mouse is moved over it.

Read only / No right click / No popup menu

When checked, the default right-click options that do exist on those desktop icons, are disabled. The only right-click that is available, is right-click on the Recycle bin. When doing so, the usual popup asking "Empty the Recycle Bin, yes / no" is shown.

Auto run after login

When checked, DockDesktop will create an entry for itself in the RUN-key in the registry / profile of the user, such that it will be started every time after a login.
When unchecked, the entry in the RUN-key in the registry / profile of the user will be deleted.

Note: when aadDockDesktop is started using AADS Application Control, then this setting is not required.

Show transparent when not active

aadDockDesktop is shown transparent onto the desktop:

Windows Menu

The small Windows-button shows a session menu:

INI-file

aadDockDesktop maintains an INI-file for the user in “Application Data”-folder beneath the personal folder of the user. Which folder that exactly is, can vary and is determined by the Operating System, or by specific settings done by the Administrator.

The INI-file is called aadDockDesktop.ini.

The various config-settings are saved in this INI-file. All possible settings in an INI-file:

Left=340
Top=0
Height=340
Width=460
Dock position=right-top
Auto size=no
Do not close=yes
Hide icons on MS desktop=yes
Do show standard Desktop icons=yes
Hide from taskbar=yes
Popup when moving mouse over me=no
Popup when moving mouse over me or desktop=no
Do Transparancy if not Active=yes
Align icons at Top=yes
Percentage Transparancy=20
Show Full Screen=no
Read only. No right click. No popup menu=yes
Autostart for this user after login=no
Do Resize and Dock=yes
Path=

Path

Path is the only setting in the INI-File that can not be set using the Configuration-panel of aadDockDesktop.

In case Path is empty, aadDockDesktop will show the default Global Desktop as offered by Windows, or the personal desktop of the user in case the option “Show those standard desktop icons” is not checked.

When the setting Path has a value, then aadDockDesktop does expect to find icons in this folder. Examples:

Path=\\server\groups\sales\AppGroup1

Path=c:\icongroups\sales\AppGroup1

It is expected that the folder AppGroup1 contains icons / shortcuts which will be shown by aadDockDesktop.

Note: possible the second example, where Path points towards drive C:, is a better example, because Windows might show the user a warning when attempting to access an icon / link in a folder on a network drive.

Normally Path is never used, but an Administrator might use it in special cases where aadDockDesktop needs to show a special set of icons for the user.

Command-line parameters

It is not required to start DockDesktop with any command-line parameter. However, if done so, 1 or 2 parameters are possible. All parameters should be am INI-file.
The first command-line parameter / INI-file will be the user INI-file. It will replace the default INI-file for the user as described above here.
The second command-line parameter / INI-file will be the system INI-file.
DockDesktop will open the second, system INI-file with only read-access. Whatever config-setting is set in the system INI-file will overrule the config-setting in the user INI-file.

Example:

aadDockDesktop “%userprofile%\aadDockDesktop.ini” “c:\globalsettings\aadDockDesktop.ini”

The 1th INI-file will be in the user-folder.
The 2th INI-file will be a global INI-file with some settings that do apply for every user.

Content of c:\globalsettings\aadDockDesktop.ini

There are only 5 settings in the system INI-file. These 5 settings will overrule the 5 settings in the user INI-file. All other settings in the user INI-file can be changed by the user.

The result of this example is as follows:

The settings which are placed in the system INI-file are all applied, and the user can not change those settings.
Only the settings which are not placed in the system INI-file can be changed by the user.


ViewUsers

ViewUsers

The tool aadViewUsers is installed in the folder \program files\aadServer on the server.

When it is started by an user which does not have Administrator Rights, it is shown as follows:

When it is started by an Administrator, is shows more options:

When it is started in the Console of the AADS Terminal Server, the button for Control is not available.

What can you do with ViewUsers

  • Users are able to send messages to each other.
  • Administrators are able Disconnect or Logoff an user.
  • Administrators who are not working on the Console of the AADS Terminal Server are able to Remote Control a session:

Remote Control of another user

  • Be sure that you are self logged in with Administrator rights.
  • Select another user.
  • Select a preferred hot-key combination that can be used to disconnect the Remote Control Session.
  • Click on Control.

The "Target" user get to see a popup on his desktop with the question if he/she will accept the Remote Control action:

If accepted by the user, the Administrator can view the Desktop of the user.

In the upper-right corner of the Remote Controlled Session, a small button is shown as an indication that the session of the user is being Remote Controlled:


AppControl

AppControl

In the folder Program Files\AADServer the tool aadAppControl is installed. aadAppControl can be started from the command line with the following options:

aadAppControl.exe /TBSETTINGS

It will enable the user to do Taskbar Settings. Nowadays with Windows 10 that is not always possible anymore with then Windows 10 UWP Settings screens.

  • It can be used any version of Windows.

  • The very first time an user does a login, and Windows creates a profile for the user, this tool might not work, because the profile has just been created.
    The 2th time an user does a login, everything will work OK.

A short-cut to this tool is installed in Accessories:

aadAppControl.exe /CHANGEPASSWORD

It will enable the user to change his/her password:


Uninstall

Uninstall

The Support tabpage contains the option for uninstall.

Prior to uninstalling this notification is shown.

Uninstall does not solve AADS problems

Before you consider to uninstall AADS Terminal Server, you should know that uninstall AADS Terminal Server does not solve any problem.
Uninstall AADS Terminal Server does only do:

  • uninstall:
    • delete all AADS files.
    • delete all AADS settings.
    • restore default Windows single logon, single desktop settings.

If you want to fix some kind of AADS Terminal Server problem, all you have to do is re-install AADS Terminal Server. Do not uninstall AADS Terminal Server. Re-install AADS Terminal Server on top of the current installation.

No other users should be active while uninstalling

Be sure that nobody is logged in except for the Administrator. In case other users are logged in, system files and settings are locked and can not be restored by AADS Terminal Server uninstall.

Do not manually remove AADS Program Files

In case there is some "other problem" with an AADS Terminal Server, and because of this you want to Uninstall AADS, you might be tempted to delete AADS Program Files, hoping that this will also remove AADS and fix this "other problem". It is not recommended to delete AADS Program Files. AADS is part of the Operating System, and deleting AADS Program Files will not solve any problem, but cause more problems.

If you want to Uninstall AADS Terminal Server, it can always be done as follows:

  • Boot Windows into Save Mode.
  • While running Windows in Save Mode, use AADS Maintenance Control, the Uninstall button, for Uninstalling AADS Terminal Server.

Manual activity after uninstall

After the uninstall of AADS Terminal Server you should perform the following actions:

  • Configure your Firewall in such a way that remote desktop sessions are not possible.
  • Remove all users form the group Remote Desktop users.


Copyrights

Previous

Copyrights

All contents copyrighted by:

AADS WorldWide Terminal Server (AADS Services)

Support Office:
City Tower 2
Sheikh Zayed Road
Dubai
UAE

Other licenses

Lazarus and Free Pascal

Lazarus is a Intergrated Development Environment (IDE) for Pascal and is distributed using GPL. Lazarus can be found here:

http://www.lazarus.freepascal.org/

Using Lazarus it is possible to develop programs based on Pascal. Free Pascal is distributed using GPL, and can be found here:

http://www.freepascal.org/

Both Lazarus and Free Pascal do come with libraries. These libraries can be obtained by downloading either Lazarus and / or Free Pascal.

rDesktop

rDesktop is a linux implementation of a RDP-client, and is distributed using GPL. rDesktop can be found here:

http://www.rdesktop.org/

FreeRDP

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. FreeRDP can be found here:

http://www.freerdp.com/

GhostScript

Ghostscript is an interpreter for the PostScript language and for PDF. Ghostscript is distributed using GPL, and can be found here:

http://pages.cs.wisc.edu/~ghost/

OpenSSL

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols,
and can be found here:

http://www.openssl.org/

The OpenSSL license can be found here:

http://www.openssl.org/source/license.html

MaxMind

AADS uses GeoLite2 data created by MaxMind, available from MaxMind.

IPInfoDB

AADS uses IP2Location LITE data available from IPInfoDB .

Spamhaus DROP

AADS uses the DROP list as made available by Spamhaus.

RDS-IT

Client software and FireWall portions copyrighted by RDS-IT.

GPL

Information about GPL, the GNU General Public License, can be found here:

http://www.gnu.org/licenses/gpl.html

Apache License, Version 2.0

Information about Apache License, Version 2.0, can be found here:

http://www.apache.org/licenses/LICENSE-2.0

Other products

All products mentioned are copyrighted by their respective owners.

© 2012-2021 AADS WorldWide. Terminal Server | Application Server | Remote Desktop solutions | Firewall

Previous


Black List

Black List

Note:The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

Automatic Black List

If you selectBlock access from Localhost to Localhost

the Automatic Black List contains all local IP Addresses of this AADS Terminal Server:

  • The Automatic Black List will only contain the local IP Addresses of this AADS Terminal Server.
    The Automatic Black List will never contain any other IP Addresses.
    If you want to place some IP Addresses on the Black List, use the Manual Black List.
  • If you do de-select Block access from Localhost to Localhost

    then the Automatic Black List will be empty; the Automatic Black List will not contain any IP Address.
    If you de-select, acces from Localhost to Localhost is allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic White List .
  • If you select Block access from Localhost to Localhost
    acces from Localhost to Localhost is not allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic Black List.

Manual Black List

The Administrator can enter IP Addresses or ranges of IP Addresses:

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-button, those Client IP Addresses can be deleted and are allowed once again to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

Sort by IPv4/6

Either all IPv4 or IPv6 will be shown first.

Toggle IPv6 view

Toggles between various ways IPv6 addresses can be shown.

Subnet mask / Range

It is possible to enter 1 IP Address, by leaving the Subnet Mask / Range empty.

IPv4

A SubNetMask / Range can be entered as follows:

  • "begin" IP Address and "end" IP Address. See the Thin Clients Sales Department as an example.
  • /1 to /31. See Range Example 1.
  • /n1.n2.n3.n4. See Range Example 2.

IPv6

A SubNetMask / Range can be entered as follows:

  • "begin" IP Address and "end" IP Address.
  • /4 to /128

/all

Described here

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


/all

/all

Be carefull with an /all range

  • An /all range on the Black List implies that every IP Address is blocked.

The /all range can only be used as follows:

  • Enter the right IP Addresses or right IP Ranges on the Manual White List .
  • Enter the /all range on the Black List
  • The Manual White List overrules the Black List
    • Only those Clients entered in the Manual White List will be allowed.
    • All other IP Addresses in the world, and all local IP Addresses, will be blocked.

The /all range can not be used with

  • Geo IP Location White and Black List
  • Failed Logon List
  • Temporary Blocked list

because these Firewall Lists are over-ruled by the Manual White List and the Manual Black List.

  • The Range 0.0.0.0 to 255.255.255.255 denotes all IPv4 addresses.
  • The Range 0:: to FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF denotes all IPv6 addresses.

Example IPv4

White List

Black List

The Black List does completely block every IPv4 and IPv6 address. Only those on the White List will be allowed (because the White List overrules the Black List)

Example IPv6

White List

Black List

The Black List does completely block every IPv4 and IPv6 address. Only those on the White List will be allowed (because the White List overrules the Black List)


Failed Logon

Failed Logon

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

A List of Failed Logon is shown:

Every Failed Logon is recorded, and if there are "to many" failed logons, the offending IP Address is placed on the Temporary Blocked List.
Default a Client will be placed on the Temporary Blocked List after 5 Failed Login attempts, and will be blocked for the next 7 days.

Delete Failed Logon Events

By clicking on the "Date/Time" column, 1 or more Failed Logon Events can be selected.
Using the "Delete"-option in the Popup Menu, those Events can be deleted. Do not forget to click on the "Save"-button.

The point of this, is that it might happen that an OK / normal user accidentally has done some Failed Logons, for example because the caps-lock key of the keyboard was locked, and the user does not notice this, and the user attempts to login multiple times.
And when there are, for example, 4 Failed Logons from the Client-PC of this user, and the number of Number of Failed Logon Attempts is 5, then all the user needs to do in the next week, is 1 Failed Logon and he/she gets blocked for the next 7 days.

The main purpose of the Firewall is to stop hack-attempts; not to stop an OK user who makes a silly typo error when entering the username and password.
Therefore it is possible for the Administrator to delete the Events Failed Logon Attempts (after he has informed the silly but OK user that he should not do 5 failed attempts to enter his name and password......)

If the user has attempted to logon with something else then his/her own username, it is recommended not to delete the Events Failed Logon Attempt,
but first to figure what or why the user has attempted to do a logon with some other userID then his/her normal userID.

Copy to Manual Black or Manual White list

Using the Popup Menu, Copy to Black List or White list, the Administrator can directly copy the IP Address of the offender to the Manual Black List, or to the Manual White list in case it is not an offender. When doing this, be sure to switch to the Manual Black or Manual White list after the "copy" and save the Manual Black or Manual White list.

Sort by IPv4/6

Either all IPv4 or IPv6 will be shown first.

Toggle IPv6 view

Toggles between various ways IPv6 addresses can be shown.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar / click on "Date/Time" column | Select / de-select an entry.


Temporary Blocked

Temporary Blocked

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

When there are "to many" Failed Logon attempts from an IP Address, the IP Address will be entered on the Temporary Blocked list.
The Number of Failed Logon Attempts defines what is "to many".

When a Client is on the Temporary Blocked List,

  • The connection between the Client and the Server will be disconnected.
  • If the Deny-period is 7 days, any attempt in the next 7 days will be blocked. The Client is not allowed to connect for 7 days.
  • Every time the Client attempts to connect and login again, the block time of 7 days will be prolonged. The Client will be blocked for 7 days, counted from the last date / time moment that the Client did attempt to connect and login in to the AADS Terminal Server.
  • After the Client has not be seen in 7 days, automatically the IP Address of the Client will be cleared from the Temporary Blocked List.

Note:

  • If the user attempts to connect a 2th time from the same Client PC, from the same IP Address, and the user does many Failed Logons,
    but there is already an active session from the IP Address of the Client PC, because the user did correctly a logon some time ago,
    then this existing, active session will be not be disconnected.
    The blocking only applies to new connect and logon attempts.
  • 2th note: after the moment the user does a logoff from this existing, active session, he will have to wait for 7 days, the Deny Period , before he can logon again on the AADS Terminal Server......

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-option in the Popup Menu, those Client IP Addresses can be deleted and are allowed once again to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

Copy to Manual Black or Manual White list

Using the Popup Menu, the Administrator can directly copy the IP Address of the offender to the Manual Black List, or to the Manual White list in case it is not an offender. When doing this, be sure to switch to the Manual Black or Manual White list after the "copy" and save the Manual Black or Manual White list.

Sort by IPv4/6

Either all IPv4 or IPv6 will be shown first.

Toggle IPv6 view

Toggles between various ways IPv6 addresses can be shown.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar / click on "Date/Time" column | Select / de-select an entry.


White List

White List

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

Automatic White List

  • The Automatic White List will only contain the local IP Addresses of this AADS Terminal Server.
    If you want to place some IP Addresses on the White List, use the Manual White List.
  • If you de-select Block access from Localhost to Localhost

    the Automatic White List contains all local IP Addresses of this AADS Terminal Server.
    If you de-select, acces from Localhost to Localhost is allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic White List.
  • If you select Block access from Localhost to Localhost
    the Automatic White List contains will not contain the local IP Addresses of this AADS Terminal Server.
    If you select, acces from Localhost to Localhost is not allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic Black List .

Manual White List

The Administrator can enter IP Addresses or ranges of IP Addresses:

Note: as you can see in this example, if the Administrator enters a Public IP Address that "does not exist" in the real world, it will be shown with "Unknown country". However, this might also happen if the GeoIP Location database is old/expired and should be renewed...

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-option in the Popup Menu, those Client IP Addresses can be deleted and do loose their privilege of always to be allowed to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

White List overrules

Whatever is entered on the White List, Automatic and Manual, is allowed to connect to the AADS Terminal Server.
The White List overrules:

  • the Manual Black List
  • the Temporary Blocked List.

The White List does not overrule:

  • the Automatic Black List

Be carefull with the Manual White list!

See the example above. Suppose the PC of the Administrator is somehow "infected" with a RAT virus (Remote Access Tool), the PC of the Administrator does never gets blocked because the IP Address of this PC is on the White list...

Sort by IPv4/6

Either all IPv4 or IPv6 will be shown first.

Toggle IPv6 view

Toggles between various ways IPv6 addresses can be shown.

Subnet mask / Range

It is possible to enter 1 IP Address, by leaving the Subnet Mask / Range empty.

IPv4

A Range can be entered as follows:

  • "begin" IP Address and "end" IP Address. See the Thin Clients Sales Department as an example.
  • /1 to /31. See Range Example 1.
  • /n1.n2.n3.n4. See Range Example 2.

IPv6

A Range can be entered as follows:

  • "begin" IP Address and "end" IP Address.
  • /4 to /128

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.