This Manual

Next

Home

This Manual: build 170.1 (1 Feb 2020)

This manual is applicable to AADS Build 170.1 (1 Feb 2019)

This manual can be downloaded: AADS Terminal Server Enterprise Manual . The file format is a CHM-file (Compressed Help File).

Every Windows version is able to view the contents of a CHM-file, provided that the file is located on a local disk.
CHM-files which are located on a network-drive are not viewable in Windows.

The App-store for OSX offers various readers for CHM-files.

On Linux you can use the package xCHM for viewing CHM-files.

This manual applies to:

  • AADS Enterprise Terminal Server - Windows Server 2019, Windows Server 2016, Server 2016 Essentials - 64 bits - no user limit - v16.0
  • AADS Enterprise Terminal Server - Windows Server 2012, Server 2012 Essentials and Foundation - 64 bits - no user limit - v12.0
  • AADS Enterprise Terminal Server - Windows Server 2008-R2, SBS 2008, SBS 2011 - 64 bits - no user limit - v6.1
  • AADS Enterprise Terminal Server - Windows Server 2008 - 32 bits - no user limit - v6.0
  • AADS Enterprise Terminal Server - Windows Server 2003 - 32 bits - no user limit - v3.0
  • AADS Enterprise Terminal Server - Windows 10 - 32 bits - no user limit - v10.2
  • AADS Enterprise Terminal Server - Windows 10 - 64 bits - no user limit - v10.3
  • AADS Enterprise Terminal Server - Windows 8.x - 32 bits - no user limit - v8.2
  • AADS Enterprise Terminal Server - Windows 8.x - 64 bits - no user limit - v8.3
  • AADS Enterprise Terminal Server - Windows 7 - 32 bits - no user limit - v7.2
  • AADS Enterprise Terminal Server - Windows 7 - 64 bits - no user limit - v7.3
  • AADS Enterprise Terminal Server - Windows Vista - 32 bits - no user limit - v5.0
  • AADS Enterprise Terminal Server - Windows Vista - 64 bits - no user limit - v5.1
  • AADS Enterprise Terminal Server - Windows XP Prof SP2 or higher - 32 bits - no user limit v2.2

AADSetup tells you which build of AADS is about to be installed:

AADS Maintenance Control tells you which build of AADS is installed:

    Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

    Next

    Home


Installation

Installation

Setup program name

The AADS Terminal Server Setup program is either call AADServer**Demo.exe or AADServer**Full.exe. The ** denotes the AADS Terminal Server Version you are installing.

Administrator

Only an user with Elevated Administrator access on the system can install the AADS Terminal Server software.

32 bits versus 64 bits

Except for a small detail related to the SSL Gateway, which is described in SSL Gateway chapter, there are no differences between the 32 and 64 bits versions of AADS Terminal Server.

Installation Procedure

Select Language

Select the desired language. AADS will be installed with the selected language.
The selected language will also be included when generating a Client Build for RDP or a Client Build for SSL .

Demo version

In the first screen of the “Demo Version” you are requested to read the License Terms of Use and acknowledge them. The Demo version also contains a Check for Update button in the first screen:

Before your proceed with the installation of AADS Terminal Server Demo, be sure to check that you are installing the latest version.

AADS Terminal Server Demo will run for 60 days. After 60 days it is not possible any more to login using a Remote Desktop Session; login is only possible using the console of the AADS Terminal Server.

Full, Paid version

In the first screen of the "Paid, Full version" you are requested to enter your license code. The AADS License Numbers has 2 formats:

  • 12 positions in the range A..Z and 0..9. Example: 12AB 34CD 56EF (this is not a valid number)
  • 18 positions, containing only letters A..Z. Example: EKOHIGJZ-TTMJKDFG-EWPLKAQR (this is also not a valid number)

When you are installing AADS Full, you will need to enter the License Number in the 12 position format.
After the installation of AADS Terminal Server Full, AADS Maintenance Control will show you the License Number in the 18 position format.

When you are installing AADS Demo, there is no need for entering a License Number.
After the installation of AADS Terminal Server Demo, AADS Maintenance Control will show you Demo as the License Number.

You are also requested to read the Terms of Use and acknowledge them.

After entering you license code and the acknowledgement of the Terms of Use, the Next-button becomes available.

HTTP Port 80

A HTTP-request and reply is sent to our License Servers in order to validate your license. AADS Terminal Server Setup behaves like a normal browser when contacting the License Servers. It does a HTTP-request on port 80.

HTTP Proxy

Optional you can specify a IPv4 HTTP-Proxy server (IPv6 Proxy is not supported...)

  • Enter the IPA or DNS address of the HTTP proxy server.
  • Enter the portnumber of the HTTP proxy server.

Checking system requirements

The AADS Terminal Server Setup program checks whether or not the installation of AADS Terminal Server is possible:

In case it is possible, you can click on Next in order to install AADS Terminal Server.
If you click on Exit now, nothing will be installed.

The AADS Terminal Server software is installed In a couple of steps.

The Full, Paid version of AADS Terminal Server can be re-installed on the same server in case such is required.

When your server is part of a Domain, the following screen will be shown:

AADS Terminal Server Setup will contact the Domain and do all appropriate settings for joining the domain and enabling Domain Users to use this AADServer.

Please read the paragraph about Domain Authorization . This paragraph shows screen-dumps of what you should enter in the 4 fields as shown here in the AADS Terminal Server Setup program.

Result of the Installation Procedure

The software is installed:

You are one reboot away from using your AADS Terminal Server.

RDP FireWall

Default setting for the built-in RDP FireWall is that RDP connections from public IP Addresses to the AADS Terminal Server are blocked. However, because the Administrator is busy with installing and configuring AADS, it might be required to temporary allow RDP Connections from Public IP Addresses. Default it is possible to access the AADS Terminal Server from public IP Addresses for 1 hour after the reboot. The Administrator who is installing AADS can change this to a maximum for the next 48 hours.

Recommendation: It is not recommended to enable RDP Connections from Public IP Addresses. AADS Terminal Server Enterprise contains a built-in SSL Gateway . This is much more secure then plain RDP. Therefore it is recommended to proceed as follows after the reboot:

  • Install AADS Terminal Server.
  • After the installation, after the reboot, configure and enable the built-in SSL Gateway .
  • Generate a SSL Client build , and verify that SSL connections do work OK for you.
  • When SSL connections are verified and do work OK, disable RDP connections from Public IP Addresses completely .

Basically the administrator should only do once a RDP Connection from a Public IP Address, if he is installing AADS remotely on a server. But after the installation, one of the first things he should do is generate a SSL Client Build for himself, test it, and then while connected thru SSL, he should completely disable RDP Connections from Public IP Addresses.

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall


What is installed Where

What is installed Where...

Administrator

Maintenance AADServer

A program entry will be made in the Administrative section of the Start menu of the system.

All Operational settings are done using Maintenance AADServer.

Allow Temporary RDP Connections from Public IP Addresses

Described here

Users

Screen Saver settings

An entry is created in the "Accessories" menu for "Screen Saver Settings":

Default Screen Saver settings for Windows Server are as follows:

These default Windows Server Screen Saver settings are applied in case AADS is used on any version of Windows.

Taskbar settings

For reasons unknown it is not always possible to do "Taskbar Settings" by doing a right-click-mouse on the Taskbar (applicable to Windows 10 and Server 2016/2019...),
a tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:

Calculator

The new UWP calculator in Windows 10 and Server 2016 is not everybody's favorite calculator.
A "classic" version of Microsoft Calculator is installed, and shortcut is placed in the "Accessories" menu:

Allow Temporary RDP Connections from Public IP Addresses

Described here

DockDesktop

Described here

ViewUsers

Described here

Panels and Tiles Manual for the Users

c:\program files\aadserver\UserManualStartMenu.chm


Virtualization

Virtualization

AADS works OK when running inside a VM (Virtual Machine). We do most test-work using Virtualization.
We have a FAQ about AADS and Virtualization .

When using Virtualization to run Windows and AADS, do make sure that you apply "reasonable" VM-settings:

  • Assign enough memory to the VM.
    4 GB for Windows 7 or Windows 10 is the "minimum".

  • Assign at least 2 cores / cpu's to the VM. Modern versions of Windows do not run very smooth any more on only 1 cpu / core.


Additional steps before using AADS Terminal Server

Additional steps before using AADS Terminal Server

After the installation of the AADS Terminal Server software, and after the reboot of the system, you need to perform a couple of steps in order to use the AADS Terminal Server:
  • Create users that can login using a Remote Desktop Session. If your Windows system has only one user, you will hardly use the benefits of the AADS Terminal Server product.
  • Make sure that all users have a password. It is not possible to have a Remote Desktop Session with an user ID that has no password. This is simply to unsafe.
  • Make sure that all users are member of the group "Remote desktop users". If an user is not a member of the group "Remote desktop users", this user will not be allowed to have a Remote Desktop Session. You can also use our Maintenance Program to give any verified user access to the AADS Terminal Server. A verified user is an user who has entered his username and password.
  • Open the Windows Firewall for Remote Desktop Sessions. The default RDP is TCP port 3389.

Important: Sometimes you might turn off the Windows Firewall because you are testing a system and while doing such you are not "interested" in the protection as offered by the Windows Firewall. It does happen that the firewall is turned on again, without informing you. An example of this behaviour is joining or un-joining a Windows system from a domain. After the (un)join, the Windows Firewall is turned on again.

Please visit our website, specific the FAQ Support-pages. You will find detailed examples and howto's between our FAQ's which describes how you can perform these steps.


Setup problems

Setup problems

Example 1

The AADS Terminal Server Setup program does a checking of the system for requirements. In case the requirements are not met, you will be informed what the problem is.
AADS Terminal Server can not be used on Windows Home.

Example 2

Problem: There seems to be another software installation that is waiting for a reboot

The installation of the software requires 1 reboot of the server in order to complete the installation of the software. A reboot of a Windows system in order to complete the installation of software is quite normal. Therefore, other software companies might also require a reboot to complete their installation of the software.
To prevent problems and conflicts, AADS Terminal Server Setup program will not install when another piece of software requires a reboot to complete its installation.

Sometimes, our Setup program keeps on saying "There seems to be another software installation that is waiting for a reboot" because every time the system is running, for some reason a piece of software put itself in the Registry of the PC, specific the location where Setup-programs can finalize their installation. Some viruses and trojan horses abuse the Registry, specific this setup-location, in order to install itself again every time the PC is restarted.
In case the Setup program keeps on telling you the message "There seems to be another software installation that is waiting for a reboot", you are advised to check your PC for viruses, spyware or trojan horses.

If you are sure that no viruses are running on your PC, you can execute the following Registry File. It will clear the settings in the Registry that are blocking the installation of the Software. The procedure is as follows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\]
"PendingFileRenameOperations"=-

  • Create the Registry-file as shown here above. Create it for example on your desktop and call it "pending.reg".
  • Be sure that the Registry-file has the extension ".reg". Because Windows does default not shown the extensions, and the file you just created might have the extension ".txt".
  • Double click on the Registry file. The setting will be "merged" in the Registry.
  • Continue the installation of the Software.

Final screen in case of AADS Terminal Server Setup problems

In case the Setup program decides that installation is not possible, it will finish as shown.

If you need support on the problem, you are requested to supply us with the Support-ZIP-file. This will assist us with analyzing the problem. You can use the ZIP-button to create the ZIP-file. It will be placed on your desktop.


Upgrade / Re-install of AADS Terminal Server

Upgrade / Re-install of AADS Terminal Server

The AADS Terminal Server Setup program always behaves as if it is doing an upgrade. This implies that it will respect the settings that are already done.

An upgrade from the Demo version to a Full version is therefore quite simple:

  • Buy the Full version,
  • Run the Setup of the Full version,

and that's it.

The Upgrade behavior does apply to:

  • An upgrade from AADS Small version to AADS Enterprise,
  • An upgrade from Demo to the Full version,
  • An upgrade from an old version 1.2.3 to a new version 1.2.4.

and it applies to:

  • A downgrade from version 3.2.1 to version 1.2.3

It is possible to downgrade AADS Terminal Server, although we would not know why you would want to do that. If you downgrade from Full version to Demo version, the result will be that your Server is again limited to 3 users.

If you do not want the Setup program to do an upgrade of your current AADS Terminal Server, you must first uninstall the current AADS Terminal Server software, and after the uninstall, run the AADS Terminal Server Setup program. All AADS Settings are lost and you will need to reconfigure everything on your AADS Terminal Server.

Fixing problems by re-installing AADS Terminal Server

Sometimes you can fix problems with a re-install of AADS Terminal Server. It does unfortunately happen that, for example, Windows Update or some kind of anti-virus software update, does revert settings that are relevant for AADS Terminal Server. Usually Windows is a single user, single desktop, single login operating system, offering only 1 Remote Desktop Session, and those updates might not expect or understand the multi-user, multi-desktop, multi-login, multiple concurrent Remote Desktop Sessions as made available by AADS Terminal Server.
When there is an issue, do not uninstall AADS Terminal Server. Only re-install AADS Terminal Server on top of the current installation.

Firewall

AADS has been changed and improved. It will be required to configure both the AADS built-in RDP Firewall and the Windows Firewall.

  • AADS built-in RDP Firewall
  • Windows Firewall

Don't be tempted to disable the Window Firewall or the AADS built-in RDP Firewall. Too often we receive ZIP Support Files with loglines indicating many hack-attempts because of a disabled AADS RDP Firewall or no Firewall


From DEMO to FULL

From DEMO to FULL

The AADS Terminal Server Setup program always behaves as if it is doing an upgrade. This implies that it will respect the settings that are already done.

An upgrade from the Demo version to a Full version is therefore quite simple:

  • Buy AADS Full.
  • Download AADS Full Setup using the download links that are send to you by email.
  • Run AADS Full Setup, and enter the License Number.

How it does not work...

  • It is not possible somehow to enter the License Number into AADS Demo.
  • Only AADS Full Setup has the option to enter the License Number.

How it does work...

  • Entering the AADS License number can only be done by running AADS Full Setup.

AADS Full Setup

AADS Full Setup can be used to enter the AADS License Number.

AADS Demo Setup

AADS Demo can not be used to enter the AADS License Number.


Upgrade from XPUnlimited

Upgrade from XPUnlimited

The AADS Terminal Server Setup program always behaves as if it is doing an upgrade. This implies that it will respect the XPUnlimited settings that are already done.
Do not un-install XPUnlimited, but install AADS Terminal Server on top of XPUnlimited.

When AADS Terminal Server Setup detects old XPUnlimited files and settings, the following specific actions will happen:

  • All XPUnlimited settings will be migrated to AADS settings, including:
    • Application Control settings
    • Auto Logon
    • Domain / Workgroup Settings
    • SSL Gateway settings and all SSL Certificates
    • Webserver
    • PDF printer
  • XPUnlimited executable files will be deleted
  • XPUnlimited logging and, if applicable, SSL Certificates, and, if applicable, the www-folder, will be backup-ed in the folder:
    \ProgramData\It_is_OK_to_delete_old_xpunlimited_folder    (x64 versions of Windows)
    \Program Files\It_is_OK_to_delete_old_xpunlimited_folder  (x32 versions of Windows)

Firewall

AADS has been changed and improved compared to XPUnlimited. It will be required to configure both the AADS built-in RDP Firewall and the Windows Firewall.

  • AADS built-in RDP Firewall
  • Windows Firewall

Don't be tempted to disable the Window Firewall or the AADS built-in RDP Firewall. Too often we receive ZIP Support Files with loglines indicating many hack-attempts because of a disabled AADS RDP Firewall or no Firewall at all......


Operation

Operation

The Operation of AADS Terminal Server can be monitored and controlled using our Maintenance tool. It can be found in the Administrative Tools of the Control Panel:

The initial screen of AADS Terminal Server Maintenance tools is as follows:


Control

Control

Running Mode

  • Default Running Mode is that all users can login and work with a Remote Desktop Session.

There are 2 other optional Running Modes, which can be used when the Administrator needs to do some maintenance, software update, etc.

  • No Remote Desktop Sessions are allowed. Only the Console login is allowed.
  • Remote Desktop Sessions are only allowed for Administrators. The Console login is also allowed.

Message

Prior to changing the Running mode, or for example prior to rebooting the server, the Administrator can send a Message to all users.

Logoff

After sending the Message to all users (and giving them some time...) the Administrator can forcefully logoff all users.

See also ViewUsers

Reboot, ShutDown

The Administrator can Reboot or ShutDown the Server.

Connections

As shown in the example above, AADS Demo can handle 3 sessions, and currently there is 1 session active.

Boot Time

The Boot time and Uptime of the AADServer is shown.

About Reboot and Shutdown

Reboot or Shutdown does always not work

Unfortunately Shutdown or Reboot on Windows does not always work, because:

  • New hardware, old Windows...
  • New Windows, old hardware...

For all kind of reasons, hardware vendors, together with Microsoft and other software companies, do define new specifications for hardware, power, bios, etc.

UEFI is an example of a specification which is related to this problem. Older hardware might not adhere to the latest UEFI specifications, while a modern version of Windows do expects this.

The reverse is also applicable: an old version of Windows, for example Windows XP or Windows 7, might not have the drivers suitable for a modern piece of hardware including modern ACPI, UEFI, modern bios, etc, with the result that this "old" Windows is not able to shutdown or reboot the server properly.

Behind the AADS buttons "Reboot" and "Shutdown" is some logic that attempts to do the Reboot / Shutdown job in 3 different ways. In total this might take up to 90 seconds.

A proper Shutdown / Reboot is important

It is still (very much) desirable to do a proper Reboot / Shutdown when working with Windows, because otherwise files, disk, registry, etc, might get damaged if Windows is not shutdown / rebooted in a proper way.

If your default Windows buttons / menu for Reboot or Shutdown do not work properly, use the AADS buttons in AADS Control for Reboot / Shutdown, and see if the AADS buttons do work OK and do indeed Reboot / Shutdown the server. Again, it might take up to 90 seconds before AADS has found a way to Reboot or Shutdown the server properly.

Virtualization

Virtualization attempts to mimic virtual hardware, including the same details as mentioned here above: ACPI, UEFI, bios, etc.

Virtualization can bring the benefit that you might be able to choose between:

  • Mimic old hardware suitable to old Windows
  • Mimic new hardware suitable to most recent Windows

Please consult the manual and / or website of the Virtualization software on how to handle this issue.

Example:

When running Windows 10 inside a VM, using an "old" Virtualbox host, it might be required to choose "Minimal" for the Paravirtualization interface. Otherwise Windows 10 will not boot.


License

License

The License tabpage shows the License type and License Number. The AADS License Numbers has 2 formats:

  • 12 positions in the range A..Z and 0..9. Example: 12AB 34CD 56EF (this is not a valid number)
  • 18 positions, containing only letters A..Z. Example: EKOHIGJZ-TTMJKDFG-EWPLKAQR (this is indeed not a valid number)

AADS Maintenance Control Full, will show you the License Number in the 18 position format.

AADS Maintenance Control Demo, will show you "Demo" as the License Number.

Offline License Type

The Full, Paid version of AADS Terminal Server can use both an "Offline" and "Online License Type".
In case an "Offline License Type" is being used, it is shown as follows:

The Offline License Type does not need Internet access and does not need to be re-newed.

Online License Type

In the example above, a Demo License is shown, which is always of the "Online License Type".
A Demo License is valid for 60 days. The End-date is shown.

Automatic License Update, Online License Type

Approximately once a week the Online License will be renewed.
Default updating the "Online License" is done automatically.

Automatic License Re-Install, Online License Type

In case the Server changes, the License needs to be re-installed.
In case an Online License is used, the re-install of the AADS License can be done automatically.

When NOT to use Automatic License Re-Install, Online License Type

  • VM's are copied "all the time" and are started on random PC's, for example a Test-PC of an Administrator.
    • It is so easy to copy and clone and run VM's...so why not do that...
  • When the VM-copy is started, AADS sees that it is used on a different Server.
  • The AADS License will be re-installed and associated with this random PC/Server.
  • The AADS License on the real Production Server will be invalidated automatically, because:
    • 1 Server, 1 License. This is our main License Term (and business).
  • The Production Server will stop working...

When to use Automatic License Re-Install, Online License Type

  • VM-copies are made.
  • The VM-copy is started on some other Production Server, because the current Production Server or the current AADS-VM has a problem and is stopped.
  • VM-copies are not randomly started on random PC's.

HTTP Proxy

Optional you can specify a IPv4 HTTP-Proxy server (IPv6 Proxy is not supported...)

  • Enter the IPA or DNS address of the HTTP proxy server.
  • Enter the portnumber of the HTTP proxy server.

Manual License Re-New, Online License Type

In case it is preferred not to connect the AADServer to the Internet, it is possible to use a browser for the re-newing of the "Online License".
The AADServer can be disconnected from the Internet.

In such a case,

  • de-select Automatic License Update,
  • de-select Automatic License Re-Install,

and click on the Apply-button.

And when the AADServer needs to re-new the temporary Online License, it will be shown as follows:

When the "Online License" needs to be re-newed, a "LIC REQUEST" will be shown.

Copy-and-paste the complete "LIC REQUEST" in to a browser, into the "License Request" procedure on our website:

Click on the "submit-button", and after a few seconds, a "LIC REPLY" is shown:

Copy the whole "LIC Reply" into AADS Control, and click on the "Set License" button:

Click on the "Set License" button.

Within a few minutes, the "LIC Reply" is processed by the AADServer, and such is shown as follows:

Notifications

Be sure to read the paragraph about Notifications . When Notifications are enabled, the AADServer will sent an email to the Administrator when the Manual License Re-New procedure needs to be done.

The Administrator can expect 1 email once a week.


Support

Support

The Support tabpage shows all AADS files, and informs you if they are OK or not. Due to "over-active anti virus" software, it might happen 1 or more AADS programs gets deleted. AADS Maintenance and Control (if it is not deleted by some "over-active anti virus" software... ) will tell you about the problem:

Restoring the deleted programs might be possible using some kind of "restore" function of the "over-active" anti virus software. Be sure to "re-configure" the "over-active" anti virus, such that it does not delete anymore AADS files.

If the "over-active" anti virus software does not have a proper "restore" function, it will be required to proceed as follows:

  • See the FAQs about AADS and "over-active" anti virus .
  • Do attempt to re-configure the "over-active" anti virus, such that it does not delete anymore AADS files.
  • After the re-configuring of the "over-active" anti virus, re-install AADS.
    • Do not un-install AADS.
    • Re-install AADS on top of the current installation.
  • After the re-installation of AADS, all files should be shown OK:

ZIP Support Button

When asking us support, please mail us the Support-ZIP-file. This ZIP-file will be placed on your desktop, and it will contain all the information we need to analyze the problem.

Important: when creating a Support-ZIP-file, be sure to login on the AADS Terminal Server as an Administrator. Otherwise information might not show up in the log file.

Uninstall

Prior to uninstalling this notification is shown.

Uninstall does not solve AADS problems

Before you consider to uninstall AADS Terminal Server, you should know that uninstall AADS Terminal Server does not solve any problem.
Uninstall AADS Terminal Server does only do:

  • uninstall:
    • delete all AADS files.
    • delete all AADS settings.
    • restore default Windows single logon, single desktop settings.

If you want to fix some kind of AADS Terminal Server problem, all you have to do is re-install AADS Terminal Server. Do not uninstall AADS Terminal Server. Re-install AADS Terminal Server on top of the current installation.

No other users should be active while uninstalling

Be sure that nobody is logged in except for the Administrator. In case other users are logged in, system files and settings are locked and can not be restored by AADS Terminal Server uninstall.

Do not manually remove AADS Program Files

In case there is some "other problem" with an AADS Terminal Server, and because of this you want to Uninstall AADS, you might be tempted to delete AADS Program Files, hoping that this will also remove AADS and fix this "other problem". It is not recommended to delete AADS Program Files. AADS is part of the Operating System, and deleting AADS Program Files will not solve any problem, but cause more problems.

If you want to Uninstall AADS Terminal Server, it can always be done as follows:

  • Boot Windows into Save Mode.
  • While running Windows in Save Mode, use AADS Maintenance Control, the Uninstall button, for Uninstalling AADS Terminal Server.

Manual activity after uninstall

After the uninstall of AADS Terminal Server you should perform the following actions:

  • Configure your Firewall in such a way that remote desktop sessions are not possible.
  • Remove all users form the group Remote Desktop users.


Update

Update

Check for Update

The Update-check button opens a website-page of our AADS Worldwide website.
The webpage will inform you whether or not you are running the most recent version of AADS Terminal Server, or an old version.

Download and install updates

The option "Download and install updates" requires that the AADS License is an Online License type.

When the license type is an Online License type, once a week it will be checked if there is an update available. In the event that we have published an update of AADS, the update will be downloaded and installed. After a reboot, the update will be applied.

Please note: the update will be downloaded and installed, but will be active only after a reboot. An automatic, forced reboot is not done as part of the update. The users can continue to work and the Administrator can decide when to do a reboot.


Notifications

Notifications

Notifications are emails sent to the Administrator (or someone else.....) of the AADServer.

Enter the appropriate settings, and click on the Apply-button.

After clicking on the Apply-button, it is possible to send a Test-email.

Optional all sent-emails and trace-files are saved. In case of smtp-related-trouble, the trace-files might be useful for analyzing the smtp-related-trouble.

SMTP Hostname (FQDN)

Wether or not a FQDN is required, is not an AADS-issue. It depends on the mailserver. In the example above, the mailserver is "mail.bigcompany.com". The Administrator of this mailserver will tell you if a FQDN for this AADServer is required, and what the FQDN should be.

When to send a Notification

The second tabpage shows the various "when" to send a Notification:

Note: the Notification for "Update" is about AADS updates. It is not about Windows or other updates.

Notification: Problem with Online License

About this Notification: it is send when there is "some problem" with the renewal & verification of the Online License. For example, the problem can be that the internet connection of the AADServer is temporarily failing.

When this email is send, that does not imply that the AADServer stops functioning. An AADServer continues to function properly for at least 1 week, up to 2 weeks, in case there is a problem with the renewal & verification of the Online License. This implies that, when you receive a Notification about "some problem" with the renewal & verification of the Online License, you have at least 1 week to fix whatever needs to be fixed. If required, we will assist you.
And possible the problem goes away within a few hours or the next day, when for example, the internet connection of the AADServer starts to work again so the retries as done by the AADServer for the renewal & verification of the Online License are successful.


Terminal Services

Terminal Services

AADS Terminal Server can be used with any RDP Client Software, provided that the Client software is using the same T128 / MS-RDP protocol as Microsoft is using in Windows. As an extra AADS Enterprise Terminal Server does include RDP+.

  • Settings
  • RDP+ Client Build
  • Connections
  • Disconnect / Logoff

RDP+ has extra functionality to RDP Standard:

  • Send print files to the Client, without any printer driver problem.
  • Smart File Transfer between Client and Server.
  • Automatic update of the AADS Client Software on the Client PCs.


Settings

Settings

Advanced settings using Microsoft Management Console

The initial screen of the Advanced Settings is as follows:

  • You can set and configure Policies for this AADS Terminal Server.
    • You can configure advanced Remote Desktop Settings.
  • You can add / remove local users and groups on the AADS Terminal Server.
  • You can view the Windows Eventlog .

Please note: initial it might take a few seconds to show this screen.

Advanced Remote Desktop Settings

You can do some fine-tuning, but you are advised to be carefully with changing the default settings. You might render your system unusable.

When you click on an option, extra text will appear that explains this option. You are advised to read this text carefully prior to changing an option.

Please note: not all Remote Desktop options are implemented. Several Remote Desktop options are displayed because AADS Terminal Server delivers 1 solution for various Windows versions.

Reboot required

Changing an Advanced Setting of the AADS Terminal Server will require a reboot of the Windows System; the change will be in effect after a reboot.

Control Panel

The "Control Panel" button shows the Windows Control Panel, with direct links to every setting that is possible with the Windows Control Panel:

Temp Folder

AADS changes the default Windows Temp folder for the users, because the default Windows Temp folder is not always suitable in case non-western languages like Thai, Japanese, Chinese, Arabic, etc, are used.
The Administrator can choose to use Default Windows Temp folders. For western languages the default Windows Temp folder will usually be OK.

Require membership of the group Remote Desktop Users

Default only users who are member of the group Remote Desktop Users can login. You can remove this requirement by selecting "verified users". A verified user is an user who has a valid username and password defined locally in Windows, or in the Domain.

Note: members of the group Administrators can login, independent of this setting.

Block logins if Windows is reaching a resource limit

AADS Terminal Server contains a thread that detects generic problems. One of those generic problems is an UNDER-sized or UNDER-powered server.

When this thread needs, for example 30 seconds, it indicates that there has been a moment where the cpu was 100% busy with something for this amount of time.
In those 30 seconds, nobody could login, nobody got a moving mouse, maybe tcp/ip connections are dropped because of time-outs, time-outs while writing data to disk, etc.
This implies a failing server. This implies failing basic functionality of Windows.

This "snap time" is something that is build into AADS Terminal Server. It is not really about AADS Terminal Server itself, but we get support emails about it.
There are also events in the Window logging from AADS Terminal Server stating

  • Windows is exceeding a resource limit

If that happens to often, with no particular cause, then the server is UNDER sized.
If that happens once, for instance because the virusscanner is doing a scan at 02:00, then it can be considered as OK.

Please be advised to check the Windows Event log for warnings and errors.

When you check the option "Block logins if Windows is reaching a resource limit", new logins on this AADS Terminal Server are blocked as long as the server has a "to-high" cpu utilization.

Timeout "Signing out" message

When an user does a Session Logoff, the user is presented with the message "Signing out". And while this message is shown to the user, the Server stops all user processes, close files, closes applications, close the session, etc, etc.

Since Windows 10 build 1903 it can take 10 seconds before Windows has closed and cleaned up a session. System software like AntiVirus software can also be a reason why it take a long time before the Session is closed and Logged off.
This implies that it can take 10 (very long...) seconds that the user is looking at the message "Signing out", or for 10 (very long...) seconds is looking at a black screen.

AADS offers a Time Out setting. If the Time Out is set to 3 seconds, the user will see the "Signing out" message for 3 seconds.
It might take longer before the session is indeed cleaned-up by Windows, but the user does not have to wait for this; after the short time-out the session is disconnected and the user can continue to work on his/her Client PC.

In case the short timeout for the "Signing out" message does result in problems, choose (system default) and wait for the Session Logoff to finish as long as it is needed...while the Client PC / MAC shows the message "Signing out" or shows a black screen...


RDP+ Client Build

RDP+ Client Build

RDP+ (Plus) offer extra Remote Desktop functionality to RDP Standard. RPD+ (Plus) is only available in an AADS Enterprise Terminal Server, and requires the use of the AADS Client software for Windows, Mac OSX and Linux.

Currently RDP+ offers the following benefit.

  • Send print files to the Client, without any printer driver problem.
  • Smart File Transfer between Client and Server.

AADServer does also offer a built-in PDF / Postscript printer . The PDF / Postscript print files will be send to the client PC where they can be viewed and / or printed. This solution has the benefit that it avoids all those printer driver problems that can exist when attempting to print using RDP Standard.

Client software

RDP+ requires the AADS Client software on the client. You can easily build a Client Setup build for Windows, Mac OSX and Linux.
The Client Setup build will be placed on the desktop of the Administrator. From there it can be distributed to the user(s).

Optional you can password-protect the Client Setup build. The user who wishes to install the Client Setup build on his client PC, will be requested for the password while installing the Client Setup build on his client PC.

  • The Windows Client can be used on any Windows version from Windows XP to Windows 10, Windows Server, x32 and x64.
  • The Mac OSX Client can be used on OSX x64 10.9 Maverick or newer.
  • The Linux Client has been tested on:
    • Fedora
    • Debian
    • openSUSE
    • Mageia
    • Linux Lite
    • Ubuntu

See Client Software on HowTo use the Client Software.


Connections

Connections

The tab page Connections shows all active RDP connections:

  • Client: the hostname and local IP Address of the Client PC.
  • Server: The servername and its IP Address. In case the AADS Terminal Server is used in a Farm, one of the other servers might be shown here in case the desktop runs on a different server in the Farm then this Terminal Server.
  • User: The Login Domain and Username is shown. The [number] is the SessionID of the desktop.
  • Time: The Logon time of the user, and the total time the session is running.

Disconnect

The selected connection / user can be disconnected.

Note: when Load Balancing is used, use Show Users for disconnecting users.

Logoff

The selected connection / user can be logged off.

Note: when Load Balancing is used, use Show Users for logging off users.

Sorting and Searching

When you right-click with the mouse on the column-headers, a popup menu is shown with various sort-options.

The Administrator can enter a "search" string, and do an "next" and "previous" search on this string.

Toggle IPv6 View

The menu option "Toggle IPv6 View" enables various ways an IPv6 address can be displayed.


Disconnect / Logoff

Disconnect / Logoff

Using our program "ViewUsers" it is possible to Disconnect or Logoff other users. Default this ability is only possible for Administrators.

The IT-Administrator can define a group, on the local AADServer, and members of this group can be allowed to Disconnect or Logoff other users.

Define a new group and make 1 or more users member of this group.

Members of the group "DisconnectLogoff" are allowed to use the tool ViewUsers , and Disconnect or Logoff other users.

Search

The searchbox can be used to search for a Local group, or in case the AADServer is joined to a Domain, search for a Domain group.


Optimize

Optimize

"Optimize" is available in AADS for:

  • Windows 10
  • Server 2016, Server 2019

Other AADS versions for other Windows versions do have the similar function Default Applications and Sets .

1-Button Wizard: Optimize

"Optimize" is as an easy wizard for default Application Control settings, resulting in better response and performance of the Terminal Server.

Before you use "Optimize", if applicable, first do the settings for Domain Authorization .

  • When this Server is part of a Domain, "Optimize" will apply settings for the group "Domain Users".
  • When this Server is a stand-alone Server, "Optimize" will apply settings to the local group "Remote Desktop Users".

The objective of "Optimize" is to disable some Windows functions and settings and replace the Window Start Menu with an AADS Start Menu. These Windows functions and settings are not always needed on a Terminal Server, and do consume a lot of CPU and Memory. When these Windows functions are disabled, the response and performance of the Server will be noticeable better, certainly with 10, 20 or more concurrent users.

  • Click on the "Optimize" button
  • ...wait a few seconds...
  • Optional enable or disable some of the selections "Optimize Windows". It is recommended to enable all "Optimizations", such to get the best response and performance.
  • Click on Apply.
  • Some "Optimizations" require a reboot. If the "Reboot" button becomes enabled, a reboot is required. Click on the "Reboot" button as the last step.

Office and Browsers

  • In case Microsoft Office is installed, a Set for Microsoft Office will be created
  • In case Libre Office is installed, a Set for Libre Office will be created
  • In case one for the following browsers is installed, the browser will appear on in the Set "Internet Browsers"
    • Microsoft Internet Explorer
    • Mozilla Firefox
    • Google Chrome (Enterprise Installation, not a single user installation)
    • Chromium (Enterprise Installation, not a single user installation)
    • Apple Safari
    • Opera
    • Vivaldi
    • Seamonkey

Result

Relaxed Application Control

The objective of "Optimize" is to improve the response and performance of the Terminal Server and give a similar user-experience as default Windows. Because of this objective, "Optimize" does not apply Restrict Application Control, but does apply Relaxed Application Control:

It is possible to change this settings, and apply Restrict Application Control to the users:

1. Remove "$aad Apply Relaxed Control" from the group:

2. Assign "$aad Apply Restrict Control" to the group:

3. Save the settings:

Default Desktop for the Users: Windows 10 Look and Feel

When "Optimize" is used, all Users will be presented with an AADS Start Menu:

The details and settings of this Start Menu can be changed and adjusted by the Administrator.

Other Look and Feel's are possible.

Disable Start Menu with Tiles

When the option "Disable Start Menu with Tiles" has been set, no user will see the default Windows Start Menu with Tiles. It is expected that all users will get a Start Menu based on Application Control settings.

Should it happen that an user does not have any assigned Applications thru Application Control settings, the user gets a small default AADS Start Menu:

AADS Application Control has a special directive for assigning the default Windows Menu to an user or group. When the directive $aad Windows Menu is used, and "Disable Start Menu with Tiles" has been set, the directive $aad Windows Menu shows the small AADS Start Menu, and does not show the default Windows Start Menu with Tiles.

Suppress Windows Update during office hours

We have has learned that Windows Update for Windows 10 and Server 2016/2019 can cause trouble. Therefore AADS can suppress Windows Update during office hours.

  • This is available for Windows 10 and Server 2016/2019.
  • This is not available for other versions of Windows.

Windows 10 and Server 2016/2019 do have Policies for Windows Update, but those Policies do not really stop Windows Update, and those policies do not differentiate between the day-of-the-week's:

The objective of these settings is to suppress Windows Update during Office hours.

  • Let Windows Update run during "evening / night hours".
  • Do a fresh reboot prior to the start of the workday. A fresh reboot of Windows can be a good remedy against all kind of trouble...


Un-Optimize aka Default Windows

Un-Optimize aka Default Windows

Click on the button "Default Windows" and all the Optimize settings will be reverted back to, indeed, Default Windows.


Default Applications and Sets

Default Applications and Sets

"Default Applications and Sets" is available in AADS for:

  • Windows Server 2008-R2, SBS 2008, SBS 2011
  • Windows Server 2008
  • Windows Server 2003
  • Windows 7
  • Windows Vista
  • Windows XP Prof SP2 or higher

Other AADS version for other Windows version do have the similar function Optimize.

1-Button Wizzard: Generate

"Default Applications and Sets" is as an easy wizard for default Application Control settings.

Before you use "Default Applications and Sets", if applicable, first do the settings for Domain Authorization .

  • When this Server is part of a Domain, "Default Applications and Sets" will apply settings for the group "Domain Users".
  • When this Server is a stand-alone Server, "Default Applications and Sets" will apply settings to the local group "Remote Desktop Users".

  • Click on the "Generate" button
  • ...wait a few seconds...
  • the result will be shown in Users, Groups and Applications

Office and Browsers

  • In case Microsoft Office is installed, a Set for Microsoft Office will be created
  • In case Libre Office is installed, a Set for Libre Office will be created
  • In case one for the following browsers is installed, the browser will appear on in the Set "Internet Browsers"
    • Microsoft Internet Explorer
    • Mozilla Firefox
    • Google Chrome (Enterprise Installation, not a single user installation)
    • Chromium (Enterprise Installation, not a single user installation)
    • Apple Safari
    • Opera
    • Vavaldi
    • Seamonkey

Result

Relaxed Application Control

"Default Applications and Sets" does not apply Restrict Application Control, but does apply Relaxed Application Control:

It is possible to change this settings, and apply Restrict Application Control to the users:

1. Remove "$aad Apply Relaxed Control" from the group:

2. Assign "$aad Apply Restrict Control" to the group:

3. Save the settings:

Default Desktop for the Users: Windows 7 Look and Feel

When "Default Applications and Sets" is used for disabling the default Windows Start Menu, all Users will be presented with an AADS Start Menu.

The details and settings of the AADS Start Menu can be changed and adjusted by the Administrator.

Default Desktop for the Users: AADS Look and Feel

Other Look and Feel's are possible.


Default Windows

Default Windows

If you do not want to use AADS Application Control any more, and wants to go back to "Default Windows", select

  • No application control, Users always see a complete desktop

followed by the "Save" button.


Application Control

Application Control

  • The purpose of AADS Application Control is to limit the desktop of the Users such that they can cause "less problems".
  • The Users should only have a limited desktop with only those few applications they need for their work.
  • The default Windows Start Menu will be replaced with a limited AADS Start Menu.
  • Users can not "edit" or "change" the limited AADS Start Menu.
    • It is the Administrator who configures the Start Menu of the Users.
    • The only exception to this is the optional Directive $aad Start Menu Create Personal Items .

Availability

AADS Application Control is available as follows:

 | Desktop Applications (win32 applications) | Metro Applications / Immersive Shell | Continuum Applications / Universal Windows Platform (UWP)
Windows Server 2016, Server 2016 Essentials Windows Server 2019 | Can be controlled | n/a | Can not be controlled
Windows Server 2012, Server 2012 Essentials | Can not be controlled | Can not be controlled | n/a
Windows Server 2008-R2, SBS 2008, SBS 2011 | Can be controlled | n/a | n/a
Windows Server 2008 | Can be controlled | n/a | n/a
Windows Server 2003 | Can be controlled | n/a | n/a
Windows 10 | Can be controlled | n/a | Can not be controlled
Windows 8.x | Can not be controlled | Can not be controlled | n/a
Windows 7 | Can be controlled | n/a | n/a
Windows Vista | Can be controlled | n/a | n/a
Windows XP | Can be controlled | n/a | n/a

Initial Screen

The initial screen is as follows:

When Optimize or Default Applications and Sets has been used, the initial screen is as follows:


Mode and Type

Application control mode and type

Application control mode

Application Control has 3 different modes op operation:

The default mode is “No Application Control”. Every remote user always sees a complete, default Windows desktop.

The second and third option turns on the Application Control. The difference between the second and third option is what a user sees in case no applications are available for the user. The second option will give the user a complete desktop without any restriction. The third option will show the remote user a message that the Administrator has not made any application available for the user. The remote user is not able to continue to work:

Application control type: Strict or Relaxed

Strict Application control implies that the user is not allowed to start any other application then those which are assigned to him by AADS Application Control.
Default this is the best, most secure choice.

However, it might happen that some applications do need to start other (sub-) applications. For example, an Office suite that starts the Write-program, or the Spreadsheet program.
The Administrator might not always be able to figure out how many other (sub-) applications are needed to be started by the user. And if the Administrator does not know exactly what the user will be starting, then the Administrator can also not assign those (sub-)applications to the user.
This might be a circumstance where "Relaxed Application control" can be considered.

Please note: when Relaxed Application Control is applied, assigned applications can / are allowed to start other, not-assigned applications. Examples:

  • The Office program can start the separate Help-program when the user presses F1.
    • This is an OK situation.
  • The Browser can start its own separate Updater-program. It will do this when it detects that an update is available for download.
    • This can be OK. However, the Administrator might not want that users or programs do decide for themselves when to install updates.

Administrator and Application Control

Application Control does not apply to the user Administrator. It is important that the user Administrator can not be restricted using Application Control, because if he gets restricted, he can not start the Maintenance program any more in order to fix his restrictions......

Failing Domain or Failing Authorization

Which Applications are available to an user can depend on the Group-membership of the user. In the event of problems related to a Failing Authorization, for example because Windows is failing, or some third party Credential Provider is failing, the AADServer is not able to determine what the Group-membership of the user is. In such an event, it is possible to block all users, except the Administrator, such to prevent that the users do access "the wrong applications". The Administrator must fix the problems related to the Failing Authorization, and after this is fixed, the users can access their assigned applications again.


Start Menu Title

Start Menu Title

It is possible to change the Title of the Start Menu as presented to the user:

2 text-lines can be edited. It is possible to enter some text in each of the 2 lines, whatever you want.

Within the text you can enter "environment variables". If you want to see which "environment variables" are available on an AADServer, open a DOS-BOX and enter the command "set":

Show date/time

It is possible to show the date/time in the Start Menu of the user, using the custom-line of test %DT= xxxx%

The format of the date/time as shown, can be edited as follows:

c | Displays the date using the format given by the ShortDateFormat global variable, followed by the time using the format given by the LongTimeFormat global variable. The time is not displayed if the fractional part of the DateTime value is zero
d | Displays the day as a number without a leading zero (1-31).
dd | Displays the day as a number with a leading zero (01-31).
ddd | Displays the day as an abbreviation (Sun-Sat) using the strings given by the ShortDayNames global variable.
dddd | Displays the day as a full name (Sunday-Saturday) using the strings given by the LongDayNames global variable.
ddddd | Displays the date using the format given by the ShortDateFormat global variable.
dddddd | Displays the date using the format given by the LongDateFormat global variable.
m | Displays the month as a number without a leading zero (1-12). If the m specifier immediately follows an h or hh specifier, the minute rather than the month is displayed.
mm | Displays the month as a number with a leading zero (01-12). If the mm specifier immediately follows an h or hh specifier, the minute rather than the month is displayed.
mmm | Displays the month as an abbreviation (Jan-Dec) using the strings given by the ShortMonthNames global variable.
mmmm | Displays the month as a full name (January-December) using the strings given by the LongMonthNames global variable.
yy | Displays the year as a two-digit number (00-99).
yyyy | Displays the year as a four-digit number (0000-9999).
h | Displays the hour without a leading zero (0-23).
hh | Displays the hour with a leading zero (00-23).
n | Displays the minute without a leading zero (0-59).
nn | Displays the minute with a leading zero (00-59).
s | Displays the second without a leading zero (0-59).
ss | Displays the second with a leading zero (00-59).
t | Displays the time using the format given by the ShortTimeFormat global variable.
tt | Displays the time using the format given by the LongTimeFormat global variable.
am/pm | Uses the 12-hour clock for the preceding h or hh specifier, and displays 'am' for any hour before noon, and 'pm' for any hour after noon. The am/pm specifier can use lower, upper, or mixed case, and the result is displayed accordingly.
a/p | Uses the 12-hour clock for the preceding h or hh specifier, and displays 'a' for any hour before noon, and 'p' for any hour after noon. The a/p specifier can use lower, upper, or mixed case, and the result is displayed accordingly.
ampm | Uses the 12-hour clock for the preceding h or hh specifier, and displays the contents of the TimeAMString global variable for any hour before noon, and the contents of the TimePMString global variable for any hour after noon.
/ | Displays the date separator character given by the DateSeparator global variable.
: | Displays the time separator character given by the TimeSeparator global variable.
'xx'/"xx" | Characters enclosed in single or double quotes are displayed as-is, and do not affect formatting.

The Menu as shown to user can have 3 different "size" formats. See Special Application Control Directives for more information.

$aad Show Small Menu

On the desktop of the user, when he starts a Remote Desktop Session, the result will be as follows:

Only the 1st of the 2 text-lines is shown. The 2th text-line is not shown in case of a Small Start Menu.

$aad Show Medium / Large Menu

In case of Medium or Large Start Menu, both text-lines are shown:


Users and Groups, Sets and Applications

Users and Groups, Sets and Applications

Application Control is done in 3 steps:

  1. Define Applications.
  2. Define Sets, and assign Applications to Sets.
  3. Assign Sets and / or Applications to Users and / or Groups.

Pre-defined configuration with Applications and Sets

When Optimize or Default Applications and Sets is used, a pre-defined configuration with Applications and Sets will be applied.

It might be convenient to start with either Optimize or Default Applications and Sets , because it will pre-fill in a lot of Applications and Sets:

  • In case Microsoft Office is installed, a Set for Microsoft Office will be created when using Optimize or Default Applications and Sets
  • In case Libre Office is installed, a Set for Libre Office will be created when using Optimize or Default Applications and Sets
  • In case one for the following browsers is installed, the browser will appear on in the Set "Internet Browsers"
    • Microsoft Internet Explorer
    • Mozilla Firefox
    • Google Chrome (Enterprise Installation, not a single user installation)
    • Chromium (Enterprise Installation, not a single user installation)
    • Apple Safari
    • Opera
    • Vavaldi
    • Seamonkey

Example Windows 7

This example is the result of using Default Applications and Sets .

Example Windows 10

This example is the result of using Optimize .

These 2 example shows the result of

  • Optimize (Windows 10, Server 2016, Server 2019)
    • The Local Group "Administrators" have a minimal menu.
    • The Local Group "Remote Desktop Users" have several Applications and Sets applied.
  • Default Applications and Sets (all other previous Windows versions)
    • The Domain Group "Domain Users" have several Applications and Sets applied.

In case of Windows 10, Server 2016, Server 2019, the group Administrators do also have an AADS Start Menu, such to replace the in-efficient and slow default Windows Start Menu with Tiles.

After applying the Pre-defined Applications and Sets, the Administrator can change and edit the assigned Applications and Sets.

Read and Save

The button "Read" loads all settings. If some changes are done, but those changes are not wanted or needed, the "Read" button will load the previous Saved settings again.

The button "Save" saves all current settings.

Un- do and Re-do

Using the "un-do" and "re-do" buttons it is possible to un-do or re-do changes while editing.

Layout

The "Layout" buttons changes the Layout of the screen:

Either the Applications are besides the Sets, or below the Sets.

Search Icons

Both Sets and Applications can have a custom Icon assigned. In order to facilitate the selection of customs icons, AADS creates and maintains a folder on the Terminal Server in which it places a copy of all icons it finds on the Terminal Server:

AADServer will automatically scan for Icons once a week.

If it is needed to update this icon-folder now, because some Applications has been installed and those icons from those Applications should also appear in the Icon-folder, use the button "Search Icons".


Applications

Applications

Navigation

  • Use the Cursor-keys or Tab-key to navigate thru the Applications.

Selecting

Use Keyboard

  • When the cursor is in the Icon-column, use the Space-key for selecting / de-selecting an Application.

Use Mouse

  • Using the mouse, click on the App-X number for selecting / de-selecting an Application.
  • Right-click on the App-X number for a Popup-menu, for selecting / de-selecting all Applications:

Searching

  • Enter a string in the Searchbox. Appearances of the Search-string will be highlighted:

Use Keyboard

  • While the cursor is inside the Search-box, use the Enter-key to jump to the next occurrence of the Search-string.

Use Mouse

  • Use the Search-Up and Down buttons to jump to the next / previous occurrence of the Search-string.

Zoom-in, Zoom out

  • Use the Zoom button to toggle between Zoom-in / Zoom-out:

Assign 1 or more Applications to a Set

Use Keyboard and / or Mouse to assign Applications

  • Select the Set.
  • Select 1 or more Applications.
  • Use the Assign-button or Drag-and-Drop to assign the Application(s) to the Set.

  • The result will be as follows:

Assign 1 or more Applications to an User or Group

Use Keyboard and / or Mouse to assign Applications

  • Select an User or a Group:
  • Select 1 or more Application(s):

  • Click on the Assign-button. The selected Application(s) will be assigned to the selected User / Group.

Use Drag-and-Drop to assign Applications

  • Select 1 or more Application(s)
  • Drag-and-drop the selected Application(s) to the User or Group or click on the Assign button:

Note:

  • Applications can be assigned to 1 or more Sets.
  • Applications can be assigned to 1 or more Users.
  • Applications can be assigned to 1 or more Groups.

Add new Application(s)

Use Keyboard and / or Mouse to add new, empty Rows

  • Select an Application:

  • Use the Insert-key or click on the Insert-button. A new empty row will appear that can be used for entering the details of the new Application:

  • Use the Down-key or Tab-key repeatedly, beyond the last Application.
    1 or more new, empty row(s) will appear which can be used for entering the details of the new Application(s):

  • Use the Add-Row button. A new empty row will be added that can be used for entering the details of the new Application.

Use Drag-and-Drop to add Applications from Explorer

  • Select the Programs in Explorer that you want to Add.
  • Drag-and-drop the Programs from Explorer to the List of Applications:

  • The "Dropped" Applications will be inserted at the drop-location:

Delete Application(s)

  • Select 1 or more Application(s):

  • Use the "Delete Application" button for deleting the selected Application(s):
  • The Application(s) will be deleted from the list of Applications.
  • The Application(s) will be deleted from Sets.
  • The Application(s) will be deleted from Users and / or Groups.

Sorting Application(s)

Sorting Applications is relevant, because the Sort Order as shown here, will be the same order as the Applications do appear in the Start Menu of the User. The User can not sort the Applications as they are shown in the Start Menu.

Use Drag-and-Drop to Sort

  • Select 1 Application:

  • Drag the Application where it should be:

Use Keyboard and / or Mouse to Sort

  • Select 1 or more Application(s)
  • Use the Sort-Up and Down-buttons to sort the selected Application(s).

Executing an Application

  • Right-click on the Program Name, or use the "Execute" button.
  • The Popup Menu has an option to execute the Program:

  • The selected Application will be Executed. This can be convenient just for some testing...
  • AADS Application Control is used by an Administrator. Therefore the selected Application will be executed under the rights of current logged-in Administrator.

Application Properties

Applications do have 6 properties

Property: Icon

When no custom Icon is assigned to the Application, the default Icon of the Application will be shown and used in the Start Menu of the user.

Customizing the Icon

  • Double-click on the Icon, or,
  • Select the Icon and use the Enter-key or F3-key, or,
  • Use the Browse-button
  • Select a custom Icon.

Deleting the custom Icon

Deleting the Icon implies that the custom Icon will not be used anymore, and that the default Icon of the application will be shown and used in the Start Menu of the user.

  • Select the Icon, using the mouse or cursor-keys.
  • Use the Delete-key.

Property: Display Name

Editing the Display Name

  • Double click the Display Name, or,
  • Use the Enter-key for editing the Display Name, or,
  • Use the Edit-button:

Special Application Control Directives

  • Use the Right-mouse, or,
  • Use the F3 or Menu-key:

    A Popup-Menu with Special Application Control Directives will be shown.

Hidden Display Name $

When a Display Name starts with $, the Program is "Hidden" and will not appear in the Start Menu of the User. However, the User is allowed to use the program; the User can use the program.

Hidden Programs and Restricted Application Control

When Restricted Application Control is applied, the User can only start Applications that are explicitly assigned to the User by the Administrator. However, It might happen that an User needs to be able to use some additional Applications.

Example Hidden Program: Libre Office QuickStarter

Libre Office comes with a TrayIcon-quickstart utility. This Program does not have to appear in the Start Menu of the User, but the User might want to be able to run it and use it. This is where "Hidden" can be used. By defining and assigning a "Hidden" program to an User, the "Hidden" program will not appear in the Start Menu of the User. But the "Hidden" program can be started and used by the User.

Note:

  • Hidden means that the Application is hidden from the Start Menu / is not shown in the Start Menu of the User.
  • The Application is available to the user and running as usual.

Property: Program Name

Editing the Program Name

  • Double click the Program Name, or,
  • Use the Enter-key for editing the Program Name, or,
  • Use the Edit-button for editing the Program Name:

Browse for a Program

  • Select the Program in the column Program Name.
  • Use the F3-key for Browsing, or,
  • Use the Browse-button for Browsing:

Popup Menu

  • Use the Right-mouse, or,
  • Use the Menu-key to show a Popup-Menu:
  • Browse for the Program/Executable.
  • Execute the Program/Executable. AADS Application Control is used by an Administrator. Therefore the selected Application will be executed under the rights of current logged-in Administrator.

Property: Startup Folder

Usually the contents of the Startup Folder depends on the Program.

  • The Startup Folder can be left empty.
  • The Startup Folder can be a full-qualified folder on drive C: or on some network-drive.
  • The Startup Folder can contain Environment Variables:

Editing the Startup Folder

  • Double click the Startup Folder, or,
  • Use the Enter-key for editing the Startup Folder, or,
  • Use the Edit-button:

Browse for a Startup Folder:

  • Use the F3-key for Browsing, or,
  • Use the Browse-button for Browsing:

Property: Command Line

Usually the contents of the Command Line depends on the Program.

Editing the Command Line

  • Double click the Command Line, or,
  • Use the Enter-key for editing the Command Line, or,
  • Use the Edit-button:

Property: Startup

An Application can be started as follows:

AutoRun | The Application will be started directly after the login of the user. Multiple Applications can be flagged as AutoRun.
Maximize | When started, the Application will be initially shown Maximized. The user is able to Restore or Minimize the Application.
Minimize | When started, the Application will be initially shown Minimized. The user is able to Restore or Minimize the Application.
Visible | Default all Applications are shown Visible. The User can interact with the Application. An Application can be flagged as “not shown Visible” or “Hidden”. An user can not interact with a Hidden Application. This option can be useful, for example, for starting CMD-files which will start another Application. In combination with Autorun, you can start some kind of Hidden Service application for the user, without showing it. For instance, you might use it to start some Anti Virus client software without showing it to the user.
Elevated | The Application will be started "Elevated".

Editing the Startup-options

  • Use the mouse to select / de-select the Startup-options.

Example Elevated Application

In the example below, WordPad is marked for Elevation:

On the client, one can expect the following:

Environment variables and Escape Character &

Environment variables can be used in:

  • Program Name
  • Startup Folder
  • Command Line

Example:

The Administrator can open a DosBox, using the command Set, and see all the Environment Variables that do exist.
Those Environment Variables can be used while defining Applications for the Users.

The Benefit of this can be, for example, that a Backup / Restore of AADS Application Control Settings is more usable. When restoring an AADS Backup to a different Server, to a new Server, with a different Windows version, by using Environment Variables the defined Applications in Application Control are usable and OK on this other Server.

Examples how to use Environment variables

 | Result for user domain003
C:\documents\%username% | C:\documents\domain003
%userprofile%\some folder | C:\Documents and Settings\domain003\some folder

Escape character &

The & character can be used for special character in the range $01 .. $FF (hexadecimal between 1 and 255).
The & character is used as a so called escape character. Examples:

 | Result for user domain003
C:\documents\&25username&25 | C:\documents\%username%
C:\documents\&26username&26 | C:\documents\&username&
C:\documents\&22username&22 %username% | C:\documents\”username” domain003
“C:\documents\username” %username% | “C:\documents\username” domain003

Take a good look at the last 2 examples: the first occurrence of username is not considered to be an environment variable because it is not enclosed in %. In the third example it is enclosed in &22. This is the hex-value of the character “, so result will be “username”.
The second occurrence of username is considered as an environment variable because it is enclosed in %. Therefore it is replaced with domain003 in this example.

The &XX appearance will always be translated to a character:

Command line parameter or Startup Folder | Result for user domain003
C:\documents\&25username&25 | C:\documents\%username%
“C:\documents\&25username&25” | “C:\documents\%username%”
“C:\documents\&26username” | “C:\documents\&username”


Sets

Sets

Navigation

  • Use the Cursor-keys or Tab-key to navigate thru the Sets.

$aad Common Programs

When using the Optimize or Default Applications and Set procedure, the set "$aad Common Programs" is created as a collection with default programs. This set can not be assigned to an user or a group.

Selecting

Use Keyboard

  • When the cursor is in the Icon-column, use the Space-key for selecting / de-selecting a Set.

Use Mouse

  • Using the mouse, click on the Set-X number for selecting / de-selecting a Set.
  • Right-click on the Set-X number for a Popup-menu, for selecting / de-selecting all Sets:

Expand / Collapse

Each Set or all Sets can shown be Expanded / Collapsed.

Use Mouse

  • Use the Popup-Menu for Expanding / Collapsing all Sets.
  • Click on the Expand/Collapse arrow for expanding / collapsing a Set.

Use Keyboard

  • Use Shift-Left for expanding a Set.
  • Use Shift-Right for collapsing a Set.

Searching

  • Enter a string in the Searchbox. Appearances of the Search-string will be highlighted.

Use Keyboard

  • While the cursor is inside the Search-box, use the Enter-key to jump to the next occurrence of the Search-string.

Use Mouse

  • Use the Search-Up and Down buttons to jump to the next / previous occurrence of the Search-string.

Zoom-in, Zoom out

  • Use the Zoom button to toggle between Zoom-in / Zoom-out:

Export 1 or more Sets with Applications

  • Select 1 or more Sets
  • Save the selected Sets in an INI-file:

Import 1 or more Sets with Applications

  • Use the "Import Set" button to select a previous saved INI-file with Set(s):

  • The Set(s) and assigned Applications, will be merged with the current Sets and Applications.

Assign 1 or more Sets to an User or Group

Use Keyboard and / or Mouse to assign Applications

  • Select an User or a Group.
  • Select 1 or more Set(s):

  • Click on the Assign-button. The selected Set(s) will be assigned to the selected User / Group:

Use Drag-and-Drop to assign Sets

  • Select 1 or more Set(s)
  • Drag-and-drop the selected Set(s) to the User or Group:

  • The selected Set(s) will be assigned to the selected User / Group

Note:

  • Sets can be assigned to 1 or more Users.
  • Sets can be assigned to 1 or more Groups.
  • Sets can be assigned to 1 or more Sets, as a sub-Set. At maximum Sets can be assigned up to 5 levels deep.

Example Sub-Sets:

  • The result for the User is as follows:

Add new Set(s)

Use Keyboard and / or Mouse to add new, empty Rows

  • Select an Set:

  • Use the Insert-key or click on the Insert-button. A new empty row will appear that can be used for entering the details of the new Set:

  • Use the Down-key or Tab-key repeatedly, beyond the last Set.
    1 or more new, empty row(s) will appear which can be used for entering the details of the new Set(s).
  • Use the Add-Row button. A new empty row will be added that can be used for entering the details of the new Set:

Delete Set(s)

  • Select 1 or more Set(s)
  • When the Set(s) contain assigned Applications, deleting the Set implies that all assigned Applications will be removed from the Set(s). The Set itself is not deleted.

    Use the "Delete Set" button:

  • The Set(s) will be made empty, as in, all assigned Applications will be removed from the Set(s)
  • The Set(s) will be deleted from Users and / or Groups.
  • When the Set(s) contain no Applications, deleting the Set implies that the Set(s) will be deleted:

    Use the "Delete Set" button, again:

Sorting Set(s)

Use Drag-and-Drop to Sort

  • Select 1 Set:

  • Drag the Set where it should be:

Use Keyboard and / or Mouse to Sort

  • Select 1 or more Set(s)
  • Use the Sort-Up and Down-buttons to sort the selected Set(s).

Set Properties

Sets do have 2 properties.

Property: Icon

When no custom Icon is assigned to the Set, the default Icon of for Sets will be shown and used in the Start Menu of the user.

Customizing the Icon

  • Double-click on the Icon, or,
  • Select the Icon and use the Enter-key or F3-key, or,
  • Use the Browse-button
  • Select a custom Icon:

Deleting the custom Icon

Deleting the Icon implies that the custom Icon will not be used anymore, and that the default Icon for Sets will be shown and used in the Start Menu of the user.

  • Select the Icon, using the mouse or cursor-keys:

  • Use the Delete-key:

Property: Display Name

Editing the Display Name

  • Double click the Display Name, or,
  • Use the Enter-key for editing the Display Name, or,
  • Use the Edit-button:

Hidden Display Name $

  • When a Display Name starts with $, the Set is created by AADServer, or by the Administrator, for administrative purposes.
    Such a Set can contain applications, can be exported and imported, but can not be assigned to a User, Group or Set.

Execute an Application

  • Select an Application and click on the Execute button:


Users and Groups

Users and Groups

Navigation

  • Use the Cursor-keys to navigate.
  • Use Shift-Left to collapse.
  • Use Shift-Right to expand.
  • Use a key between A and Z to jump to the next entry that starts with this letter.

Searching

  • Enter a string in the Searchbox.

Use Keyboard

  • While the cursor is inside the Search-box, use the Enter-key to jump to the next occurrence of the Search-string.

Use Mouse

  • Use the Search-Down buttons to jump to the next occurrence of the Search-string.

Delete Assigned Applications and / or Sets

Delete an Application

  • Select the Application:

  • Use the Delete-key or the "Delete" button for deleting the assigned Application:

Delete a Set

  • Select the Set:

  • Use the Delete-key or the "Delete" button for deleting the assigned Set.
    In case the deleted Set contains assigned sub-Sets, those will also be deleted.

Delete everything from an User or a Group

  • Select the User or Group.
  • Use the Delete-key or the "Delete" button.
  • Everything that is assigned to the User or Group will be deleted.

Execute an Application

  • Select an Application and click on the Execute button:


Demo Nag screen

Demo Nag screen

The demo version of AADS Terminal Server shows a "nag" screen after a login, in case Application Control is used:

This "nag" screen is not shown when using the Full, Paid version of AADS Terminal Server.


Application Control and Explorer / Desktop

Application Control and Explorer / Desktop

Assign Explorer.exe

In the following example the User is allowed to start Explorer.exe:

  • Whenever an User has Explorer.exe in it's list of allowed applications, it will always be started. It is not required to select the Autostart-option. Explorer.exe will be started anyway.
  • Whenever an User has Explorer.exe in it's list of allowed applications, a desktop and taskbar is shown.

Explorer.exe is always "Auto Started"

It might be desirable to start Explorer.exe optionally, or start “explorer.exe” with a command-line parameter containing c:\my documents. This is possible.

However, when an user is assigned Explorer.exe, it will always be auto started, because when Explorer.exe is started for the first time, it will always create and show a desktop. This is build in Explorer.exe; this is how Explorer.exe is made by Microsoft. Therefore it is not possible to show the user his documents-folder and not having a desktop with a taskbar, etc.

When the User has Explorer as an Application, there will always be a Taskbar.

Although a Taskbar is shown, including the well known Start button, the default Windows Start menu can replaced by an AADS Start menu.

Explorer as an AADS menu item

Visible menu item for Explorer

Explorer.exe is visible in the menu of an user:

  • When the User click on File Explorer, the default Home-folder of the User will be shown.

Hidden menu item for Explorer

Explorer.exe is not visible in the menu of an user:

When the menu-item for Explorer is hidden, it will not appear on the Start Menu of the user:

Start Menu position on the Desktop

In this example the Start Menu position is "Bottom Right".

  • However, when Explorer is started on the Desktop, there will always a Taskbar. And because of that, the position of the Start Menu is depending on the position of the Taskbar.

The User can change the position of the Taskbar by "drag-and-dropping" the Taskbar where he/she wants to have the Taskbar.
It is also possible to use a Taskbar Settings tool that is available when installing AADServer:

  • A tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:


Applications and Policies

Applications and Policies

After you have configured Application Control on your AADS Terminal Server, you can do some fine-tuning with Policies. The initial screen for setting Policies is available thru the "Advanced" button:

Which policies are shown can be different. It depends on your Windows-type and version, and which Service Packs are installed.

Do not test it in a production environment

You should test the Policies first on a separate Test environment before trying it in production. For instance, if you apply to many policies or to many restrictions, you might restrict yourself and you might not be able any more to reverse the restrictions. In such case, a reboot of the AADS Terminal Server in Safe Mode is required for attempts to fix the situation. This is a problem you want to avoid in a production environment.


Special Application Control Directives

Special Application Control Directives

AADS Terminal Server does offer Special Application Control Directives for additional control of the User Desktop.

Format

  • Special Application Control Directives start with $aad
  • It is OK to use spaces in the name of an Application Control Directive.
    Example:

    $aad Show Limited Menu
    $aadShowLimitedMenu
  • It is OK to append some extra free format text behind an Application Control Directive.
    Example:

    $aad Limited Menu Office users some extra text

Right click with the mouse in the Display Name column, or use the AppMenu key on the keyboard, or use the F3 key:


Run Program [runprogram:]

Run Program

runprogram:

The Special Directive "Run Program" has a similar functionality as it is known from default Windows:

If "Run Program" is made available for the Users, the Start Menu will show it:

"Run Program" as offered by the AADS Menu, has 2 extra options:

  • It is possible to start the program with "Run As" aka "Elevated".
  • It is possible to delete the History-list, which contains the list of commands / programs that have been entered and executed before.


Start Menu Settings (AADServer) [startmenusettings:]

Start Menu Settings (AADServer)

The directive "Start Menu Settings" enables it for the user to change some Look and Feel aspects of the Start Menu.

If the Administrator does not give the user the directive "Start Menu Settings", then the user can not change the Look and Feel of the Start Menu. The Look and Feel of the Start Menu will be as configured by the Administrator.

AADServer Theme

When "Start Menu Settings" is combined with the Look and Feel AADServer theme, the user has the following options for changing the Look and Feel :

  • Show Small, Medium or Large Icons in the Start Menu
  • Show the Start Menu either Solid or a bit Transparent
  • Show all Items in 1 Row or show the Start Menu with Sub Menus.

When clicking on Default, the Start Menu will revert back to the Default Settings as set by the Administrator.

Example

Windows 7 Theme

When "Start Menu Settings" is combined with the Look and Feel Windows 7 theme, the user has the following options for changing the Look and Feel :

  • Show Small, Medium or Large Icons in the Start Menu
  • Show the Start Menu either Solid or a bit Transparent
  • Show all Items in 1 Row or show the Start Menu with Sub Menu.

When clicking on Default, the Start Menu will revert back to the Default Settings as set by the Administrator.

Example

Windows 10 Theme

When Start Menu Settings is combined with the Look and Feel Windows 10 Light or Dark theme, the user has the following options for changing the Look and Feel :

  • Show Small, Medium or Large Icons in the Start Menu. This applies to the icons as shown in the left treeview. It does not apply to the icons as shown in the Panels / Tiles.
  • Show the Start Menu either Solid or a bit Transparent
  • Show all Items in 1 Row or show the Start Menu with Sub Menus.
    • When using the Panel/Tiles option, a Single Menu on the left will be used.
  • Show Items in Panels with Tiles, similar to the Windows 10 Start Menu with Tiles.
    • Applications can be started by either single-click (or touch) on a Tile, or by double-click on a Tile.
  • Use a Light or Dark Theme.

When clicking on Default, the Start Menu will revert back to the Default Settings as set by the Administrator.

Example

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Control Panel [ms-controlpanel:]

Control Panel

ms-controlpanel:

It might be feasible that the user has the ability to start 1 or more Control Panel items.

  • Select ms-controlpanel: on an empty row

  • Select 1 of the available Control Panel Items, or select Control Panel All Settings.

The list of available Control Panel items depends on the version of Windows and might include third-party items.

Optimize, Default Applications and Sets

When Optimize or Default Applications and Sets is used, pre-defined Control Panel Items for Users and a Set with those Control Panel Items will be created:

All Items

User Items

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


UWP Settings [ms-settings:]

UWP Settings

ms-settings:

UWP Settings are available on

  • Windows 10
  • Server 2016
  • Server 2019

Users

It might be feasible that the user has the ability to start 1 or more UWP Settings.

  • Select ms-settings on an empty row

  • Select 1 of the available UWP Settings for the User.
  • Optional: edit the "Display name" for an appropriate description of the UWP Settings.

Optimize

When Optimize is used, pre-defined "UWP Settings Items" for Users, and a Set containing those "UWP settings", will be created:

Administrators

The Administrator should not be limited when it is about UWP Settings. Therefore Administrators should have "UPW All Settings":

Example

In this example the directive $aad Show this Set as Panel is added to the Set UWP Settings (Users).

If the user is using the Look and Feel Windows 10, and if the option Panels / Tiles is being used, the user has the Set "UWP Settings (User)" as a Panel, containing the UWP settings as Tiles.


$aad Apply Restrict Control

Apply Restrict / Relaxed Control

$aad Apply Restrict Control

This Special Application Control Directive overrules the global setting. When the global setting is set to “Apply relaxed Application control”, then this Special Application Control Directive does overrule that, and apply strict Application control to an User or Group.

Example

  • The User "POS10" has only 1 assigned application, a Point Of Sale application.
    • When an user has only 1 assigned application, after the login of the user, this 1 application will be started and will be shown full screen.
    • When an user has only 1 assigned application, and this application terminates, the user will be logged off and the RDP session will be ended.
  • The directive "$aad Apply Strict Control" makes sure that nothing else can be started.


$aad Apply Relaxed Control

$aad Apply Relaxed Control

When this Special Application Control Directives is assigned to an user or a group, it will overrule the global setting for Strict or Relaxed Application Control.

Example

The group Administrators have "File Explorer" assigned, and the directive "$aad Apply Relaxed Control", implying that members of Administrators are not limited / restricted by AADS Application Control.

Example

This is a minimal collection of Applications and Directives. The result of this is a default Windows desktop with no restrictions for the members of the group Administrators:

  • Because of the directive $aad Windows Menu , Explorer is started such that a default Windows Menu is shown to the User (users who are a member of the group Administrators)
  • Because of "$aad Apply Relaxed Control", there are no restrictions for the User (users who are a member of the group Administrators)


$aad Limit Settings

Limit Settings

The directive "$aad Limit Settings" should be used within a Set containing Settings. This applies to either Control Panel settings or UWP settings .

When Optimize is used, a default Set with UWP settings is created for the Users:

When Optimize or Default Applications and Sets is used, a default Set with Control Panel items is created for the Users:

In both these example, because of "$aad Limit Settings", the User is limited to the settings as available in the Set. The User is not able / not allowed to do other Settings.

Example

The Administrator has created a Set with Limited UWP settings for the Users in the Group "Warehouse Department":

The member of the Group "Warehouse Department" are presented with the following desktop:

The member of the Group "Warehouse Department" are not allowed / are not able to do other UWP Settings.


$aad Apply Wallpaper

Apply Wallpaper

It is possible to use AADS Application Control to give the user an assigned Wallpaper

Use the F3-key or the Browse button while the cursor is in the column "Program Name" for browsing for an desktop-image:

Example

This example is the combination of:

  • $aad Apply Wallpaper
  • $aad DockDesktop menu

RDP Client

It is required that the RDP Client enables showing of the WallPaper:

WallPaper styles

Stretch

  • The dimensions (width x height) of the WallPaper will not be respected.
  • The WallPaper will be stretched, both vertical and horizontal, to fix in the dimensions of the screen.
  • In case the dimensions of the WallPaper do differ from the dimensions of the screen, stretching of the WallPaper might be perceived by the User as a "distorted" WallPaper.

Example

Tile

Tile should be used with a "small image", small relative to the size of the desktop. The small image will be "tiled" across the desktop.

Example

Center

  • If the dimensions of the WallPaper are identical to the dimensions of the Screen, then the WallPaper will fit perfectly on the Desktop.
  • If the dimensions of the WallPaper are different from the dimensions of the Screen, the WallPaper will not be re-sized, and will be placed at the center of the Desktop.
    • If the WallPaper is bigger then the Desktop, parts of the WallPaper are not shown.
    • If the WallPaper is smaller then the Desktop, parts of the Desktop are not covered.

Example

Fit

  • Fit will resize the WallPaper, while respecting the dimensions of the WallPaper.
  • The WallPaper will be resized such that if will "fit" in the Desktop.
  • Because the WallPaper will not be stretched, it might happen that either horizontal or vertical, parts of the WallPaper are not visible / are cut-off.

Example

In this example, vertically parts of the WallPaper are cut-off.

Note:

  • The option Fit does not work as expected on Windows XP / Server 2003.
  • On Windows XP / Server 2003 the option Fit is identical to the option Stretch.

Fill

  • Fill will resize the WallPaper, while respecting the dimensions of the WallPaper.
  • The WallPaper will be resized such that if will "fit" in the Desktop, either Horizontal or Vertical.
  • Because the dimensions of the WallPaper might be different then the dimensions of the Desktop, part of the Desktop might not be covered by the WallPaper.

Example

Note:

  • The option Fill does not work as expected on Windows XP / Server 2003.
  • On Windows XP / Server 2003 the option Fill is identical to the option Stretch.


$aad Desktop Solid Color

$aad Desktop Solid Color

Performance

A solid color on the Desktop makes the Remote Session quicker compared to a Wallpaper . The response of the Remote Desktop Session will be quicker.

Settings

  • Use F3, the Menu-key, or double-click on the color for selecting a color.

Example

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


$aad Windows Menu

Windows Menu

The "point" of AADS Application Control is to replace the default Windows Menu by a restricted, under-control-of-the-Administrator menu. However, it might be feasible to excluded some users from these restrictions.

Example

This is a minimal collection of Applications and Directives. The result of this is a default Windows desktop with no restrictions for the members of the group Administrators:

  • Because of the directive "$aad Windows Menu", Explorer is started such that a default Windows Menu is shown to the User (users who are a member of the group Administrators)
  • Because of $aad Apply Relaxed Control, there are no restrictions for the User (users who are a member of the group Administrators)


$aad DockDesktop menu

DockDesktop menu

The details of DockDesktop are described here.

Example

Optimize is used in this example to create a default set of Applications and Sets. After Optimize is done, 1 setting is changed: the Users will get the DockDesktop Menu:

Result is as follows:

  • The initial screen of DockDesktop contains the same "items" as the Start Menu.
  • The various Sets are available as "ICON Folders".
  • Double Click on an "ICON Folders" or using the ENTER key, opens the Set / ICON Folder.

  • When the User clicks on the Start Button in the TaskBar, DockDesktop will respond to that and will popup.


$aad Menu: AADServer theme

Start Menu: AADServer theme

  • AADS Start Menu's can be shown in a Single Column or with Sub Menu's
  • AADS Start Menu's can be positioned in each corner of the Desktop.

Single Column

Example

  • The whole Start Menu is shown in a single Column.
  • Sub Menu's are shown by expanding the small arrow.

Multiple Columns

Sub Menu's / SET's are shown in a Sub Menu

Example

Position of the Start Menu

With Explorer

If the User has Windows Explorer assigned, the position of the Start Menu is not determined by AADS Application Control, but it is determined by the position of the Windows TaskBar.

The User can change the position of the Taskbar by "drag-and-dropping" the Taskbar where he/she wants to have the Taskbar.
It is also possible to use a Taskbar Settings tool that is available when installing AADServer:

  • A tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:

Without Explorer

If the User has not Windows Explorer assigned, the position of the Start Menu is determined by AADS Application Control.

Example

Note: the Users do not have Explorer assigned in this example.

Result:

Start Menu Settings

If the Administrator has assigned Start Menu Settings (AADServer) to the User, the User can change the position of the Start Menu:

  • Exit: leave this dialog without doing any settings.
  • Apply: leave this dialog while applying the settings.
  • Default: revert back to the global, default settings as done by the Administrator.


$aad Menu: Windows 7 theme

Start Menu: Windows 7 theme

  • AADS Start Menu's can be shown in a Single Column or with Sub Menu's
  • AADS Start Menu's can be positioned in each corner of the Desktop.

Single Column

Example

  • The whole Start Menu is shown in a single Column.
  • Sub Menu's are shown by expanding the small arrow.

Multiple Columns

Sub Menu's / SET's are shown in a Sub Menu

Example

Position of the Start Menu

With Explorer

If the User has Windows Explorer assigned, the position of the Start Menu is not determined by AADS Application Control, but it is determined by the position of the Windows TaskBar.

The User can change the position of the Taskbar by "drag-and-dropping" the Taskbar where he/she wants to have the Taskbar.
It is also possible to use a Taskbar Settings tool that is available when installing AADServer:

  • A tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:

Without Explorer

If the User has not Windows Explorer assigned, the position of the Start Menu is determined by AADS Application Control.

Example

Note: the Users do not have Explorer assigned in this example.

Result:

Start Menu Settings

If the Administrator has assigned Start Menu Settings (AADServer) to the User, the User can change the position of the Start Menu:

  • Exit: leave this dialog without doing any settings.
  • Apply: leave this dialog while applying the settings.
  • Default: revert back to the global, default settings as done by the Administrator.


$aad Menu: Windows 10 Theme

Start Menu: Windows 10 theme

The following is applicable to:

  • Start Menu: Windows 10 Dark theme
  • Start Menu: Windows 10 Light theme

  • AADS Start Menu's can be shown in a Single Column or with Sub Menu's.
  • AADS Start Menu's can be shown with Panels containing Tiles.
  • AADS Start Menu's can be positioned in each corner of the Desktop.

Single Column

Example

  • The whole Start Menu is shown in a single Column.
  • Sub Menu's are shown by expanding the small arrow.

Multiple Columns

Sub Menu's / SET's are shown in a Sub Menu

Example

Panels containing Tiles

Example

  • When the Look-and-Feel is "Panels containing Tiles", the Administrator can use the Directive $aad Show this Set as Panel.
    Those Sets with this directive will be shown as a Panel containing Tiles.

Panels containing Tiles

When the Start Menu is shown with Panels containing Tiles, the User has a few options for customizing the Start Menu.

Re-size Start Menu

  • The Start Menu can be re-sized by drag-and-dropping the corner.

Move Panels

  • Using the mouse, drag-and-drop, Panels can be moved

Re-size Panels

  • Using the mouse, drag-and-dropping the "bottom-bar", the Panel can be re-sized.

Tile Sub Menu

  • Right-click mouse or the AppMenu key on an Tile gives a sub-menu

Tile View Item

  • Tile View Item shows the properties of a Tile.

The App-XXX number as shown is the number of the App in AADS Maintenance and Control:

Navigation

Cursor keys | Move the cursor around in the Start Menu, TreeView Panels and Tiles.
TAB Key | Jump from the TreeView to the Panels, and back.
Enter Key
  • When the cursor is on a Tile, the Application will be Executed.
  • When the cursor is in the Treeview, and the selection is on a Set, the Set will be expanded
  • When the cursor is in the Treeview, and the selection is on an Application, the Application will be executed.
App Menu Key

When a Tile is Selected, the App Menu key will show the Popup Menu for the Tile.

Left Mouse, Double Click

Double Click on an Application will Execute the Application.

Right Mouse, Click

Right Mouse click on a Tile will show the Popup Menu for the Tile.

Position of the Start Menu

With Explorer

If the User has Windows Explorer assigned, the position of the Start Menu is not determined by AADS Application Control, but it is determined by the position of the Windows TaskBar.

The User can change the position of the Taskbar by "drag-and-dropping" the Taskbar where he/she wants to have the Taskbar.
It is also possible to use a Taskbar Settings tool that is available when installing AADServer:

  • A tool and shortcut for "Taskbar Settings" is placed in the "Accessories" menu:

Without Explorer

If the User has not Windows Explorer assigned, the position of the Start Menu is determined by AADS Application Control.

Example

Note: the Users do not have Explorer assigned in this example.

Result:

Start Menu Settings

If the Administrator has assigned Start Menu Settings (AADServer) to the User, the User can change the position of the Start Menu:

  • Exit: leave this dialog without doing any settings.
  • Apply: leave this dialog while applying the settings.
  • Default: revert back to the global, default settings as done by the Administrator.


$aad Show Small/Medium/Large Menu

Show Small / Medium / Large Menu

The Items in an AADS Start Menu can be shown Small, Medium or Large:

Example Small size Menu Items

Result

Example Medium size Menu Items

Result

Example Large size Menu Items

Result

Note:

  • The size of the Tiles are always the same and are not determined by the Directive $aad Show Small/Medium/Large Menu.
  • The Directive $aad Show Small/Medium/Large Menu does only determine the size of the items in the Column on the left.


$aad Show this Set as Panel

Show this Set as Panel

  • The Directive "$aad Show this Set as Panel" should only be used with a Set
  • The Directive "$aad Show this Set as Panel" is only applicable if $aad Menu: Windows 10 Theme is being used, either Dark or Light Theme.
    • This Directive is only applicable if Panels and Tiles are being used.

Example

  • The Directive is assigned to 2 Sets

Result

  • Both Sets are visible as a Panel with Tiles.


$aad Start Menu Create Personal Items

Start Menu Create Personal Items

  • The Directive "$aad Start Menu Create Personal Items" is only applicable if $aad Menu: Windows 10 Theme is being used, either Dark or Light Theme.
  • This Directive is only applicable if Panels and Tiles are being used.
  • The Directive "$aad Start Menu Create Personal Items" does not imply that the User is somehow able to change the Applications and Sets as defined by the Administrator.
  • Applications and Sets as defined by the Administrator are only manageable by the Administrator.
  • The Directive "$aad Start Menu Create Personal Items" does make it possible for the User to create its own Panels and Tiles.
  • Panels and Tiles as created by the User, will be shown next to the Panels and Tiles as defined by the Administrator.

Example

Optimize has been used for this example, and the Look-and-Feel for the Users is changed to Panels and Tiles:

Result

The User has the Directive "$aad Start Menu Create Personal Items" assigned, and therefore the User will be able to create and maintain User Panels with Tiles.


Panels

Panels

2 types of Panels do exist

  • System Panels
  • User Panels

System Panels

  • A System Panel is a Panel that is configured by the Administrator, using the directive $aad Show this Set as Panel
  • A System Panel can not be edited by the User.
  • A system Panel does not have a Menu in the Top-Right corner.

User Panels

An User is allowed and is enabled to create and maintain User Panels, if the Administrator has assigned the directive $aad Start Menu Create Personal Items to the User.

  • An User Panel is a Panel that is created by the User.
  • An User Panel can be edited by the User.
  • An User Panel does have a Menu in the Top-Right corner.


Create Panel

Create Panel

  • Users can only create User Panels.
  • System Panels are maintained by the Administrator.

Create Panel, method 1

Using a Right-Click mouse on the empty Start Menu, the User can create a Panel:

Result

  • An empty Panel will be created.
  • The initial name / title of the Panel is the Username.

Create Panel, method 2

Select a Set in the Treeview / Menu on the left, and drag-and-drop the Set onto an empty space in the Start Menu:

Result

  • The whole Set will appear as Panel


Move Panel

Move Panel

Both User and System Panels can be moved by the User.

Pick the Panel up by its Title-bar and drag-and-drop the Panel on the desirable location.

Result

  • Using the mouse, drag-and-drop, Panels can be moved


Resize Panel

Resize Panel

Both User and System Panels can be resized by the User.

  • Using the mouse, drag-and-dropping the "bottom-bar", the Panel can be re-sized.


Rename Panel

Rename Panel

Only User Panels can be renamed by the User.

  • The Popup Menu has a "Rename Panel" option.

Renaming the Panel

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Delete Panel

Delete Panel

Only User Panels can be deleted by the User.

Click on the Panel Menu in the Top-Right corner of the Panel:

  • The Popup Menu has a "Delete Panel" option

  • Click on Yes to delete the Panel.

Result

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Tiles

Tiles

The User can create and maintain Tiles in User Panels.

  • Create Tiles, including Copy and Paste Tiles
  • Move Tiles
  • View Tiles
  • Edit Tiles
  • Delete Tiles


Create Tiles, Copy and Paste Tiles

Create Tiles, Copy and Paste Tiles

Create Tiles, method 1

Right-click mouse on an User Panel, or use the Menu of the Panel to show the Popup Menu:

  • Select Create Tile.

Create Tile results in the following dialog:

  • The User can enter a file, like a document, or a program / executable.
  • Values can be entered
    • manually,
    • using the browse-buttons, or
    • using drag-and-drop from Explorer.

Example

The User can do drag-and-drop from the folder with Documents, and create Tiles for the Documents that he/she needs to access frequently.

  • Click on Apply

Result

Create Tiles, method 2

Using Explorer, select a File or a Program / Executable, and do a "Copy":

Within the Start Menu, do a "Paste Tile":

Result

Create Tiles, method 3

Select a Tile and click on "Copy Tile":

Select an User Panel (Panel created by the User), and click on "Paste Tile":

Result

Create Tiles, method 4

Select an Item in the TreeView / Menu and drag-and-drop the Item on an User Panel:

Result

Create Tiles, method 5

Select an Item in the TreeView / Menu and drag-and-drop the Item on some empty space in the StartMenu:

Result

A fresh new User Panel will be created, and it will contain the Item as a Tile.

Create Tiles, method 6

Select a Tile in a System Panel and drag-and-drop the Item on some empty space in the StartMenu.

A fresh new User Panel will be created, containing the Tile.

Result

Note:

  • If you drag-and-drop a Tile from a System Panel, the Tile will be copied.
  • If you drag-and-drop a Tile from the Treeview / Menu on the left, the Tile will be copied.
  • If you drag-and-drop a Tile from an User Panel, the Tile will be moved.


Move Tiles

Move Tiles

Move a Tile within an User Panel

Select a Tile, and drag-and-drop the Tile on the desirable location

Result

Move a Tile to another User Panel

Result

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


View Tiles

View Tiles

View a Tile from a System Panel

Right-click mouse on Tile, or use the AppMenu key:

Result

  • Tile View Item shows the properties of a Tile.

The App-XXX number as shown is the number of the App in AADS Maintenance and Control:

View a Tile from an User Panel

  • A Tile from an User Panel does not have an App-XXX number.
  • The absence of an App-XXX number indicates that this is a personal Tile created by the User. It is not a Tile from a System Panel.


Edit Tiles

Edit Tiles

Only Tiles in User Panels can be edited by the User.

Right-click mouse on a Tile:

Result

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Delete Tiles

Delete Tiles

Only Tiles in User Panels can be deleted by the User.

Right-click mouse on a Tile:

Result

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

Home


Look and Feel

Look and Feel

  • AADS Themes are available in every AADS version.
  • AADS Themes can be used on every Windows version.
    • From Windows XP to Windows 10.
    • From Server 2003 to Server 2019.

AADS Theme

  • $aad Menu: AADServer theme

Windows 7 Theme

  • $aad Menu: Windows 7 theme

Windows 10 Theme

  • Windows 10 Theme Dark

  • Windows 10 Theme Lights

  • Windows 10 Theme Panels and Tiles (Light Theme)


Session Menu

Session Menu

  • When Application Control is being applies to the user, the last Menu-item in the Menu as shown to the user, is "Session":

When the user selects "Session", the following popup is shown:

  • AADS Look & Feel theme:

  • Windows 10 Look & Feel theme:

  • If policies and user-rights do allow for it, the Session Menu does also contain Restart and Shutdown:

  • Logoff: the user will be logged off.
  • Disconnect: the desktop will be locked and disconnect. At a later moment the user can re-connect to the running session.
  • Lock workstation: the desktop will be locked.
  • Change Password: the user will have the ability to change his/her password:

Change Password

The "Change Password" dialog can also be started as follows:

If needed, the Administrator can create,

  • an item in the Start Menu of the PC,
  • or on the Desktop of the user,
  • or create an AADS Application Control item,

for giving the user a direct link, item, short-cut, etc, to the Change Password dialog.


Auto Logon

Auto Logon

Console

The Administrator can enter an Auto Logon UserID and password for the Console. When the AADS Terminal Server is rebooted, this user is logged on automatically:


Domain Authorization

Domain Authorization

Domain Authorization should not be handled by Windows, but by the AADS Terminal Server. We have our own modules for this. By having our own modules for Authorization, AADS Terminal Server is able to do Application Control for Domain Users.

Identify your domain

In the example below, the domain is called ipc.w2k3domain.intern. The server running the domain is called w2k3test:

Test the connectivity to your Domain

Before you proceed with configuring your AADS Terminal Server, be sure that both the Domain name and the Domain Server name are reachable from the AADS Terminal Server. You can open a DOS-box and use the ping command:

IPC$

Windows servers do have a so called IPC$ share. The AADS Terminal Server uses the IPC$ on the Domain Server for requests about users. So, be sure that the IPC$ of the Domain server can be accessed by the AADS Terminal Server.

Samba and Netlogon

In case you use Samba as a Domain Server, be sure to read the appropriate “howto's” and (online) manuals about Samba. For instance, you will have to define a “netlogon” share in order to mimic a Microsoft Domain Server.

Enter the Domain Settings

The tab page Domain / Workgroup is the place where you enter the relevant Domain information:

Click on verify, and the entered information will be verified. The progress-logging will be shown.

Click on Apply when done. After clicking on Apply, the Reboot button will be enabled.

Reboot required

It is recommended to reboot the AADS Terminal Server after applying the Domain settings.

Domain Server

The field “Domain Server” is optional. Preferable you should not use it.

In case you do not use the field “Domain Server”, the AADS Terminal Server will automatically determine which PDC and / or BDC is available (Primary Domain Controller and Backup Domain Controller)

If you enter a netbios name of a PDC or of a BDC, the AADS Terminal Server will only use this one PDC/BDC for its domain functions. The AADS Terminal Server will not fallback to another PDC or BDC in case the assigned PDC / BDC is not available.

When the Domain, the network and the AADS Terminal Server are correctly configured, the AADS Terminal Server is always able to determine the Primary Domain Controller (PDC) and the Backup Domain Controller(s) (BDCs).
However, if the network is not configured correctly, the AADS Terminal Server might have a problem:

  • The AADS Terminal Server is using a DNS-server, which does know the name of the PDC, but which does not know the name of the BDC. This is a DNS problem which does impact the AADS Terminal Server. The AADS Terminal Server is not able to use the BDC because the assigned DNS server can not tell the AADS Terminal Server what the netbios name is of the BDC.
  • The AADS Terminal Server is using 1 or more default gateways, which do know how to route network traffic to the PDC but not to the BDC(s). This is a network problem which does impact the AADS Terminal Server. The AADS Terminal Server can not use the BDC(s) because the assigned default gateway is not able to route the network traffic to the BDC(s).

In this case you can consider to enter a netbios name in the Domain Server field, in order to compensate for the mis-configuration of the network.

Trouble shooting Domain Server

When the AADS Terminal Server reboots, it joins the domain. If this does not work correctly, examine the following:

  • Can you ping the netbios name of the PDC from the AADS Terminal Server?
  • Can you ping the netbios name of the BDC(s) from the AADS Terminal Server?
  • Which DNS server(s) are assigned to the AADS Terminal Server?
  • Do these DNS server(s) know the PDC and / or BDCs?
  • Which default gateway(s) are assigned to the AADS Terminal Server?
  • Do these DNS server(s) know the PDC and / or BDCs?

A fix for troubles related to Domain Joining

  • Write down the Netbiosname of the AADServer:

  • Make the AADServer a Local Server using AADS Maintenance and Control:

    The name of the Workgroup is irrelevant.
  • Apply and Reboot the AADServer.
  • Go to the Domain Controller, and open Active Directory, Computers.
  • Search for the Netbios Name of the AADServer in the list Computer:

  • Delete the AADServer from Active Directory
  • Go to back to the AADServer.
  • Join the AADServer again to the Domain, using AADS Maintenance and Control.

Because the AADServer was deleted from Active Directory, when now joining the AADServer again to the Domain, fresh, new settings will be applied in the Active Directory Administration, and all should be OK.

Example configuration Domain Joining

PDC

netbios name TESTW2k3
IP address 192.168.200.210
The PDC does also act as DNS-server

BDC

netbios name TESTW2k3b
IP address 192.168.200.211
The BDC does also act as DNS-server

Network card of AADS Terminal Server:

  • The AADS Terminal Server uses both the PDC and BDC for its DNS-settings and for its default gateway.
  • The AADS Terminal Server has nothing entered in the field Domain Server, because it is always able to determine which PDC and / or BDC is available.

Group Domain Users ==> Local group Remote Desktop Users

The Domain Group "Domain Users" will be added to the local group Remote Desktop Users by the AADS Terminal Server Setup program:

Application Control only for Domain Groups, not for Domain Users

When it comes to Domain Authorization, AADS Application Control is limited to Domain Groups. It would be possible to include Domain Users, but this might result in performance problems. Large Domains can contain several thousand Domain users. Showing them all and manage them all on an AADS Terminal Server might result in performance problems.
Therefore AADS Application Control can applied only to Domain Groups:

  • Organize and define Domain Groups that, for example, mimics your business processes within the company.
  • Make the right set of Domain User(s) member of the appropriate Domain Group(s).
  • Each Domain Users will get its appropriate desktop, under control by AADS Application Control. Which applications are available for the Domain User, is directed by its membership of 1 or more Domain Groups.


Farm / Load Balancing

Farm / Load Balancing

Objective of the Farm

The objective of the Farm is to:

  • Distribute the load of the users among multiple AADS Terminal Servers. The load is distributed, based on the number of users, cpu load, memory load and number of processes on each server.
  • Give the users always the same desktop, their own data, etc, independent of the AADS Terminal Server they are working on.

Central Repository

The Farm solution assumes that a central repository is used for the user data. An example of a central repository is Domain Authorization and Roaming Profiles. For the remaining of this manual such is assumed. The whole concept of the Farm is based on:

  • An user can work on any of the AADS Terminal Servers in the Farm.

And,

  • An user always expects his / her own desktop, own files, the known applications, etc.

In order to be able to give the user his / her own desktop, independent of the AADS Terminal Server in the Farm, roaming profiles are required.

Definition: Preferred server

The preferred server is the server with the least load. Which server this is, is automatically determined. Clients will get a Remote Desktop from the preferred server.

Clients

Use of the Farm does not requires the use of specific client software or client devices. Any default RDP client or PC can connect to an AADS Farm, and benefit from the Load Balancing.
Our AADS Client Software offers some benefits compared to default RDP client software or devices. It will, for example, connect quicker to an available server in the AADS Farm.

Mirror AADS Terminal Servers

The System Administrator should install every application on all AADS servers. Our Maintenance Program does not install Office, Firefox, email software, etc.
However, Application Control settings done using our Maintenance Program can be distributed among the Farm:

Doing so makes sure that Application Control settings are identical on each server in the Farm.


Configuration Examples

Configuration Examples

Example 1

  • Three AADS Terminal Servers are working together in a Farm.
  • The name of the Farm is the name of the Domain Server.
  • All three AADS Terminal Servers do have the same applications installed. This is done by the System Administrator:
    • Office
    • Email
    • Browser
    • etc
  • The central fileserver holds all the user data.

The clients can use any of the AADS Terminal Servers, without noticing any difference in their user experience, desktop, applications and data.

Example 2

  • The AADS Terminal Servers are connected to both the “Client” network and the “Server” network.
    • The AADS Terminal Servers have 2 network cards.
  • The AADS Terminal Servers are configured in such a way that their internal network communication related to the Farm and related to the Load Balancing, is done using the “Server” network and is not done using the “Client” network.
    • By separating Client network traffic from the Server network traffic, more reliability is accomplished.

Example 3

AADServer WXP

Clients network card

Farm network card

Domain settings

Load Balancing settings

AADServer Win10

    Clients network card

    Farm network card

    Domain settings

    Load Balancing settings

    Default Gateways

    In this example both the Clients and Farm network cards do have a Default Gateway assigned. It is possible, and sometimes recommended to assign a Default Gateway to only 1 network card: the network card which is connected somehow to the rest of the company or the internet.

    In this example, the Farm network is not connected to the rest of the company, and is not connected to the internet. Such a configuration can be considered as "more secure". Because the Farm network is not connected to the rest of the company or the internet, the Farm network card does not need a Default Gateway.

    AADServer WXP Farm network card

    AADServer Win10 Farm network card

    Preferred DNS server

    Both the Clients and Farm network card needs a Preferred DNS Server.

    • The Domain Controller on the 10.x.x.x network does include a DNS server. The AADServers do need to find and use the Domain Controller and its DNS function. Otherwise the AADServer would not be able to find and join the Domain with the name "ipc.w2k3domain.intern".
    • The AADServers and the Clients are connected to the company and the internet thru the 192.168.x.x network. This network has a router / DNS server with the IP address 192.168.200.124.

    (it is theoretically possible to "copy" all DNS entries from the Domain Controller in the 10.x.x.x network, and copy them to the DNS server in the 192.168.x.x network, but that is just "more" work and not very convenient...)


Settings

Farm Settings

Enable Load Balancing

Usage of the Farm capabilities does start with Enabling the Load Balancing.

IP Address of this Server

This is the IP Address clients will use for connecting to this AADS Terminal Server.
In the example above, all Clients will connect to this AADServer:

  • IPv4: 192.168.12.34
  • IPv6: FD00::1:2:3:4

The Clients can connect by either IPv4 or IPv6.

DHCP not recommended / Use fixed IP Address for the Servers.

It is recommended to give the AADServers a fixed IP Address. Do not use DHCP for assigning an IP Address to the AADServers.

DHCP implies that the IP Addresses of the AADServer might change every few hours or days, and that will only cause trouble with the Load Balancing. Servers should have a fixed IP Address.

IPv6

The small, green (IPv)6 can be used to toggle between the various ways an IPv6 address can be displayed.

Broadcast IP Address and Portnumber

The UDP Broadcast IP Address and Portnumber is used between the AADS Terminal Servers in the Farm for communication between each other.
It is not used in any way between Clients and Servers.

Example:

  • There are 3 Terminal Servers in the Farm:

    • Terminal Server 1
      • Terminal Server network IP Address 10.1.50.5
      • Client network IP Address 192.168.200.247
    • Terminal Server 2
      • Terminal Server network IP Address 10.1.100.5
      • Client network IP Address 192.168.200.248
    • Terminal Server 3
      • Terminal Server network IP Address 10.1.150.5
      • Client network IP Address 192.168.200.249
  • The UDP Broadcast IP Address is set as 10.255.255.255

The Farm used IPv4 UDP for communication among the Servers in the Farm.

Note

The broadcast IP is a setting that is determined by the IP address and Subnetmask of the network card.

Broadcast IP Example 1

  • IP Address 192.168.1.1
  • Subnetmask 255.255.0.0
  • Broadcast IP Address of this network is 192.168.255.255

Broadcast IP Example 2

  • IP Address 10.1.50.5
  • Subnetmask 255.0.0.0
  • Broadcast IP Address of this network is 10.255.255.255

Block multiple login

It is important to block multiple logins from users. The reason for this is the use of roaming profiles. When an user is allowed to login twice or more, there will be trouble with his roaming profile, because it is being used and changed on 2 or more Terminal Servers at the same time, and this does always results in "conflicts". The profile of the user might get damaged.
Therefore it is advised to block multiple logins among the Farm.

Create Logfiles

If required, each Terminal Server in an AADS Farm can create logfiles, per month for user activity. Purpose of these logfiles is auditing if such is required.
The format of the logfiles is fixed, with exception of the date/time stamp, which can be local time or UTC time.
The logfiles are located in:

Win32: \Program Files\AADServer\UserActivities
Win64: \ProgramData\AADServer\UserActivities

For each month a new logfiles will be created. The current month-number and year are used for the naming of the logfiles:

aad_YYYYMM_UserActivities.log

The first line of the log file denotes the format:

'Activities','Server','Domain','Username','Date (YYYY-MM-DD)','Time (HH:MM:SS)'

Redundancy in the Farm: let each Terminal Server generate the logfiles

Each Terminal Server in the Farm is able to generate the same log file. From a redundancy point of view it is indeed better to let each Terminal Server in the Farm generate the same log file about the user activities.


Load Balancing among the Farm

Load Balancing among the Farm

All the Terminal Servers in the Farm use the same settings for CPU, Users, Memory and Processes. When you change the settings on one Terminal Server, and click on Apply, the settings will be distributed to the other Terminal Servers in the Farm.

The “importance” of the four parameters for the Load Balancing, and the outcome, being which server is the Preferred Terminal Server, can be changed by changing the percentage of Load Factor.

How does the Load Balancing work?

1. Settings you can do

If all Terminal Servers are identical:

  • identical hardware
  • identical operating system

then you start with the following parameters:

 | %
cpu | 0%
mem | 0%
users | 100%
processes | 0%

These parameters do imply that the load balancing is solely based on the number of users that is currently logged in on each Terminal Server.
If Terminal Server 1 has 6 users logged in, and Terminal Server 2 has 5 users logged in, then Terminal Server 2 is the preferred Terminal Server for the next login.
From here, some fine tuning can be done.

Some examples:

Suppose that most of the times, the users do work with the same applications, then the number of processes on each Terminal Server will be predictable.
However, occasionally, users do start more applications and more processes then on an average day.

 | %
cpu | 0%
mem | 0%
users | 70%
processes | 30%

When all the users do start the usual processes, the 30% as set on processes does not have much influence on the decision what is the Preferred Terminal Server for the next login.
But when a few users on server 1, for example, start many more applications and processes then usual, such that Terminal Server 1 has more then an average load, more users will login on Terminal Server 2.

It does also happen that applications do vary in the amount of memory they use.
For example MS-Word. A small document implies that the user, while working on the document, is using just a few MB of memory, while a large document can imply a much larger amount of memory is used.

 | %
cpu | 0%
mem | 30%
users | 70%
processes | 0%

With these parameters, if all Terminal Servers in the farm are handling, for example, 10 users, but Terminal Server 1 is using more memory because it users are working on bigger documents, then the next logins will be assigned to Terminal Server 2.

It does also happen that applications do vary in the amount of cpu they use.
For example some kind of administrative program that does a lot of lookup's in a database and present the information to the user.
Such a lookup can be cpu-intensive.

 | %
cpu | 30%
mem | 0%
users | 70%
processes | 0%

When all Terminal Servers in the farm are handling the same amount of users, then the next logins will go to the Terminal Server with the lowest cpu utilization.

When your Terminal Servers are identical, but there is some variation is the size of documents (==> memory usage and cpu load) or the number of applications that are started by the users (== > processes), the following settings are a good start for tuning your AADS Farm:

 | %
cpu | 15%
mem | 15%
users | 55%
processes | 15%

The previous examples and explanations do assume that all Terminal Servers are identical.
If there are different Terminal Servers in the AADS Farm:

  • different hardware.
  • slow and faster cpu's
  • some Terminal Servers having 4 GB memory, some having 16 GB memory
  • some Terminal Servers running WXP, some running Win7
one can use the parameters to handle this.

Examples:

  • slow and faster cpu's
Assign 50% to cpu, such that the Terminal Server with the slower cpu does handle less users then the Terminal Server with faster cpu.
  • some Terminal Servers running WXP, some running Win7
Assign 20% to cpu, such that the Terminal Server with the WXP, which is a bit faster then Win7, does handle a bit more users then the server with Win7.
  • some Terminal Servers having 4 GB memory, some having 16 GB memory

Assign 70% to memory, such that the Terminal Server with only 4 GB, which will be used quickly, handles less users then the Terminal Server with 16 GB memory.

2. How to decide what the best parameters are

  • if the Terminal Servers are all identical,
  • if the users do pretty much the same job and the same applications,
assign up to 100% to users and start from there.
  • if the Terminal Servers are not identical
  • if the users do different jobs and different applications
do attempt to estimate what the bottlenecks will be: cpu utilization, amount of memory used, or the number of started processes, and assign a percentage to each bottleneck, such that each bottleneck gets the right treatment.
For example: if you estimate that there will be more a cpu utilization issue, compared to the amount of memory used, assign more percentage to cpu then to memory.
You can use the task manager to get these estimates:
  • Let the users work in the Farm, start the task manager on each Terminal Server in the Farm, and get an estimate about the bottlenecks cpu, memory and processes.

3. The math behind it

Example: The AADS Farm contains 2 Terminal Servers:

Terminal Server 1

  • 35% cpu load
  • 55% mem load
  • 10 users
  • 70 processes

Terminal Server 2

  • 25% cpu load
  • 45% mem load
  • 14 users
  • 89 processes

Load balancing parameters

  • cpu: 30%
  • mem: 30%
  • users: 25%
  • processes: 15%

Pre-calculation / normalization users

  • highest number of users in the farm: 14
  • factor = 100 div 14 = 7.14

Pre-calculation / normalization processes:

  • highest number of processes in the farm: 89
  • factor = 100 div 89 = 1.12

Calculation Terminal Server 1:

% | load |  |  |
0,30 * | 35 |  | = 10,5 | (cpu)
0,30 * | 55 |  | = 16,5 | (memory)
0,25 * | 10 * | 7,14 | = 17,85 | (user)
0,15 * | 70 * | 1,12 | = 11,76 | (processes)
 |  |  | = 56,61 |

Calculation Terminal Server 2:

% | load |  |  |
0,30 * | 25 |  | = 7,5 | (cpu)
0,30 * | 45 |  | = 13,5 | (memory)
0,25 * | 14 * | 7,14 | = 25,00 | (user)
0,15 * | 89 * | 1,12 | = 15,00 | (processes)
 |  |  | = 61 |

The load of Terminal Server 1 is lower. Terminal Server 1 is the Preferred Terminal Server for the next login.

Farm Name

The Farm Name is shown, and it is the name of the Windows Domain.

Preferred Server

Every few seconds, each server on the Farm calculates what the Preferred Terminal Server is, and it's name is shown.

Real Time Load Balancing Numbers

Example: a Farm with 3 Terminal Servers:

Terminal Server

The name of the Terminal Server

Users

The current number of logged in users. This includes both “Active” users and “Disconnected” users

CPU

The current cpu load.

  • Default “measure” time is every 5 seconds

Memory

The current use of the available physical memory

  • Default “measure” time is every 5 seconds

  • Please note: the number represent the physical memory, because this is important with regard to the load and performance of a Terminal Server. It does not include virtual memory or pagefile memory.

Processes

The current number of processes:

  • Default “measure” time is every 5 seconds

Time out

Each Terminal Server in the Farm expect at least once every 90 seconds a status message from the other Terminal Servers in the Farm. When a status message is not received in the past 90 seconds, that specific Terminal Server is considered to be off line and does, apparently, not participate any more in the Load Balancing.

The second number is the number of seconds when the last status message was received. Normally every 5 seconds a status message is sent. So, the second number of seconds should, normally, not exceed 5 seconds.

DT Sent

This is the date / time of the last message as sent by the other Terminal Server. The other Terminal Server states that it did send the message at this specific date / time

DT Received

This is the date / time of the last status message received from the other Terminal Server, by this Terminal Server.

In case all the clocks of all the Terminal Servers in the Farm are synchronized, then DT Sent and DT Received will be identical. In case the clocks are not synchronized, you will see a difference in the date / time.


Show Running Servers

Show Running Terminal Servers

The Farm contains 2 Terminal Servers. Select one of the Terminal Servers in the Farm, and a history of the load is shown. Every 5 seconds the graphs are updated. The most recent load is shown on the left in the graphs, and is mentioned by the numbers in the upper right corner of the graphs.

IPv6

The small, green (IPv)6 can be used to toggle between the various ways an IPv6 address can be displayed.


Show Users

Show Users

All the Active and Disconnected users in the Farm are shown. Of each user the following information is shown:

  • The Terminal Server on which the Desktop is running
  • The name of the user
  • The [Session Number]
  • Date / Time that the user this a login
  • Current time the user is Active or the status Disconnect.

The Administrator can select 1 or more users, or 1 or more columns, and perform the following action on the users:

  • Disconnect them
  • Log them off
  • Send them a message.

Selecting and Sorting

A right-mouse click on the column headers shows a popup menu with various "select" and "sort" options:

Searching

The Administrator can enter a "search" string, and do an "next" and "previous" search on this string.


Show Other Servers and Farms

Show Other Terminal Servers and Farms

When using an AADS Farm, it is assumed that there is 1 Farm for 1 Windows Domain. The name of the Farm is the name of the Windows Domain.

Accidentally it might happen that the Administrator has the intention to add more Terminal Servers to the Farm, but for (yet) unknown reasons this new Terminal Server does not show up in the Farm. Optional it shows up here. If it shows up here, then this new Terminal Server has possible different Domain Settings, or does not belong to the same IP Subnet of the other Terminal Servers in the Farm.

  • Check the Broadcast IP Address of this Terminal Server against the Broadcast IP Address of the other Terminal Servers.
  • Check the Domain name of this Terminal Server against the Domain Name of the other Terminal Servers.


Farm and SSL Gateway

AADS Farm and SSL Gateway(s)

Server Certificate distribution to Clients

An AADS Farm can have 1 or more SSL Gateways. When Servers are added or removed from the Farm, and this Server has a SSL Server Certificate, this SSL Server Certificate needs to be distributed to, or revoked from the AADS Clients PCs.

AADS Clients do have a built-in RDP+ Client Update Manager . Each time an AADS Client connects with a Server in the Farm, the RDP+ Client Update Manager as it is running on the Client, will automatically update the set of SSL Server Certificates on the Client PC in the event that a Server in the Farm has been added or removed.

  • Update the set of SSL Server Certificates on the Client, in the event that a Server is added / removed from the AADS Farm.


Farm and RDP+ Firewall

Farm and RDP+ Firewall

Firewall Lists are kept synchronized among the Servers in the Farm.

Automatic synchronize of Firewall Lists in the Farm

  • Failed Logons are automatically distributed among the Farm.
  • When a Server has placed an IP Address on the Temporary blocked List, the whole Temporary blocked List will be broadcasted among the Farm. For example, if Server 1 in the Farm has perceived invalid logins from IP Address 1.2.3.4, and has placed this IPA on the Temporary blocked List, the Temporary blocked List will be distributed among the Farm. Every Server in the Farm will temporary block the IP Address 1.2.3.4.

The Administrator can edit the FW Lists; he can add or delete entries. This applies to the following FW Lists:

  • Failed Logon
  • Temporary Blocked
  • Manual White List
  • Black List

After he has edited a FW List, and has clicked on "Save", changes are automatically distributed among the Farm.


SSL Gateway

SSL Gateway

Objective

The objective of the SSL Gateway is to deliver a secure Remote Desktop session between any location in the world and an AADS Terminal Server. The term “secure” implies:

  • Strong SSL encryption is used in order to avoid “listening” on the connection. The RDP-protocol in itself is already encrypted, but a SSL encryption beneath the RDP connection, using strong certificates, will do a much better job.
  • Identification of both the client and the server. The SSL Gateway gives an Administrator the possibility to deliver specific Client Builds with an included certificate, which can only connect to 1 or more AADS Terminal Servers. Also, the Administrator can “withdraw” a Client certificate, such that the client can not connect any more.

Specifications

  • The certificates generated by the SSL Gateway are based on RSA, 4096 bits.
  • Both the client and the server do verify each other certificate.
  • The SSL Gateway can be used in an AADS Farm.

Example 1: Stand Alone AADS Terminal Server

  • The company has a connection with the internet. This connection is reachable by the domain name www.example.com
  • The client using the home PC connects using www.example.com:3443.
  • The Firewall does forward incoming connections for port 3443 to the AADS Terminal Server.
  • The AADS Terminal Server is running the SSL Gateway on port 3443.
  • It is a stand-alone AADS Terminal Server; there is no AADS Farm.

Example 2: AADS Farm with 3 Terminal Servers and 2 internet connections

  • The company has 2 connections with the internet.
    • When a client tries to connect to www.example.com:3444, the connection goes through the Firewall 1.
    • When a client connects using www.example.com:3445, the connection goes through the Firewall 2.
  • The client at the Home PC can use either www.example.com:3444 or www.example.com:3445
    • By offering client 2 connection addresses, and having 2 connections with the internet, the company can offer the client redundancy for the connection to the AADS Farm.
  • Firewall 1 forwards port 3444 to the SSL Gateway on AADS Terminal Server 1.
  • Firewall 2 forwards port 3445 to the SSL Gateway on AADS Terminal Server 2.
  • The SSL Gateways on both AADS Terminal Server 1 and 2 will handle the correct forwarding to the appropriate AADS Terminal Server in the Farm, based on the Load Balancing Parameters.
  • AADS Terminal Server 3 does not run the SSL Gateway.


Server Settings

SSL Gateway Server Settings

Important: correct Date & Time

Before you proceed with generating Server and Client SSL Certificates, make sure that the Date & Time on the Server is correct

  • The Date & Time must be correct
  • The TimeZone must be correct
  • This applies to both the Server and the Clients.

If the Date & Time, or the TimeZone is not correct, either on the Server or the Clients, the generated certificates might not be accepted by the Clients.

Example:

  • Server has a wrong Date & Time in the "future", or
  • Server has a wrong TimeZone due to which the Date & Time is in the "future".
  • Certificates are generated.
  • Client Build is generated.
  • Client Build is installed on a Client PC.
  • Client PC does not accept the SSL Certificate, because it is in the "future" and therefore can never be correct.

Generate a Server Certificate and Key pair

After a fresh installation of AADS Terminal Server, the Terminal Server does not have any certificate. Enable the “Generate Server” button, and you can generate a Server Certificate- Key pair.

  • The Certificate- and Key pair is valid for 10 years.
  • The Certificate contains the (netbios) name of the AADS Terminal Server.

Delete Server

Using the Delete Server button you can delete the current Server Certificate- and Key pair.

Important:

The Server Certificate (not the Key) will be made available to the Client. If you Delete the current Server Certificate- and Key pair, and generate a new pair, you will need to distribute a Client Setup Build to all your clients in order to supply them with the new Server Certificate.

After deleting the current Server Certificate- and Key pair, it is not possible any more for any Client who has the current Server Certificate, to establish a connection with the AADS Terminal Server.

Therefore, be careful with deleting the current Server Certificate- and Key pair. Use it only deliberately when you do not want that Clients who knows the current Server Certificate are able to establish a connection with the AADS Terminal Server.

Enable the SSL Gateway

After generating the Server Certificate and key pair, you can start the SSL Gateway:

  • Select "Enable SSL Gateway"
  • Enable the Apply button, and click on Apply:

32 bits versus 64 bits

The 32 bits version of AADS Terminal Server stores the certificates in the folder:
\program files\aadserver\certs

The 64 bits version of AADS Terminal Server stores the certificates in the folder:
\programdata\aadserver\certs

All other functionality is identical.

Failed connections logging

In the logging-folder of an AADS Terminal Server a log file is created which contains logging about failed SSL connections. For example, when a Client Certificate- and Key-pair is deleted, and an user is still attempting to connect to the AADS Terminal Server(s) using this Certificate- and Key-pair, it will logged.

The 32 bits version of AADS Terminal Server stores the logging in the folder:
\program files\aadserver\logging

The 64 bits version of AADS Terminal Server stores the certificates in the folder:
\programdata\aadserver\logging


Client Certificates and Keys

Client Certificates and Keys

Generate Client

Enter a name, and click on "Generate Client". Result will be the creation of a Client Certificate with this name.

You can generate a separate Certificate- and Key pair for each individual. You can also choose to generate a “functional user” Certificate- and Key pair, like 1 pair for Sales-employees.
Each employee of the Sales department will be using the same Client Certificate.
If auditing is important, you should generate separate Client Certificates for each user, such that based on the logfiles it is clear which user has done what and when.

Delete Client

Using the Delete Client button, a Certificate- and Key pair of the selected user will be deleted. Any user that has this Certificate- and Key pair, will not be able any more to establish a connection with the AADS Terminal Server.

Create a Client Build

  • Select 1 of the generated Client Certificates.
  • Select 1 or more Target OS Platforms.
  • Enter optional a password (enter it twice).
    • The user who will install and use this Client Build, will need to know the password for installing this Client Build on his/her Windows PC, Mac or Linux System.
  • Select what to do with previous Client SSL Certificates on the PC of the user:
    • If you select Replace, any previous Client SSL Certificates on the PC of the user will be deleted when the user installs this Client Build.
    • If you select Merge, the now selected Client SSL Certificate, and the previous Client SSL Certificates that are already available on the PC of the user, will be merged.
  • Click on Build Client Setup.
    • The result will be a Setup-program, placed on the desktop of the Administrator.
    • This Setup-program needs to be distributed to the user.

Replace Certificates versus Merge Certificates

  • The option “Replace” implies that, when installing on the client, all previous SSL certificates will be deleted and after the installation, only the new SSL certificates that are in this Client Build Setup, are installed on the client PC.
  • The option “Merge” implies that the previous SSL certificates on the client PC will be merged with the new SSL certificates that are inside this Client Setup Build.

“Replace” is most likely the best option when distributing Client Setup Builds to “normal” users.
The option “Merge” can be used, for example, by the Administrator. When he has to administrate multiple different AADS Terminal Servers from customers, for each AADS Terminal Server of each customer he can do a Client Setup Build with the merge option, resulting in a big set of SSL certificates on his own client PC, such that he can work on each of the AADS Terminal Servers.

Sorting and Searching

A right-mouse click on the column headers shows a popup menu with various "sort" options.

The Administrator can enter a "search" string, and do an "next" and "previous" search on this string.


Client Build for Windows

Client Build for Windows

AADS Client for Windows

AADS Client for Windows is 1 big Setup.exe file.
In its name you will find:

  • The name of the AADS Terminal Server.
  • The date of the Certificate. It is valid for the next 10 years.
  • The name of the Certificate.


Client Build for Mac OSX

Client Build for Mac OSX

AADS Client for Mac OSX

AADS Client for Mac OSX is 1 big ZIP File.
In its name you will find:

  • The name of the AADS Terminal Server.
  • The date of the Certificate. It is valid for the next 10 years.
  • The name of the Certificate.

About this OSX.zip file

These ZIP files contain the client software for OSX. Be careful with manipulating these files on Windows. These ZIP files contain elements that are not known and understand by Windows. The elements are:

  • x-attribute for making a program executable on Linux and OSX.
  • Links. These are Links to target filenames.

If you want to know more about the x-attribute, do study the "chmod" command as available on Linux and OSX.
If you want to know more about Links, do study the "ln" command as available on Linux and OSX.

It is OK to open en view the ZIP files, but it is NOT OK to change them in any way, using Windows.
If you change the ZIP files using Windows, those elements might be removed or damaged,
because Windows does not know and understand those elements,
resulting in ZIP Files that are not usable anymore on Linux and OSX,
resulting in client software that is not working anymore on Linux and OSX.

OSX requirements

  • Our Client is 64 bits software and requires OSX Mavericks 10.9 or newer.
  • Our Client requires X11 / XQuartz to be installed. This can be downloaded from the XQuartz website.

  • The X11 / XQuartz package can also be downloaded from our website:

    Mavericks, or newer OSX 10.9 or newer X11 - XQuartz 2.7.11 (link 1)
    X11 - XQuartz 2.7.11 (link 2)
    X11 - XQuartz 2.7.11 (link 3)

  • Install the package

    • Install X11 - XQuartz 2.7.11 on Mavericks or newer


Client Build for Linux

Client Build for Linux

AADS Client for Linux x32 and x64

AADS Client for Linux results in a ZIP-File for Linux x32 and Linux X64.
In its name you will find:

  • The name of the AADS Terminal Server.
  • The date of the Certificate. It is valid for the next 10 years.
  • The name of the Certificate.

About this X32 and X64.zip files for Linux

These ZIP files contain the client software for Linux. Be careful with manipulating these files on Windows. These ZIP files contain elements that are not known and understand by Windows. The elements are:

  • x-attribute for making a program executable on Linux and OSX.
  • Links. These are Links to target filenames.

If you want to know more about the x-attribute, do study the "chmod" command as available on Linux and OSX.
If you want to know more about Links, do study the "ln" command as available on Linux and OSX.

It is OK to open en view the ZIP files, but it is NOT OK to change them in any way, using Windows.
If you change the ZIP files using Windows, those elements might be removed or damaged,
because Windows does not know and understand those elements,
resulting in ZIP Files that are not usable anymore on Linux and OSX,
resulting in client software that is not working anymore on Linux and OSX.

Linux requirements

  • GTK 2.x
  • X11
  • rdesktop or freerdp


Other Certificates and Keys

Other Certificates and Keys

There are 3 reasons why Other Certificates and Keys can be relevant:

  • Replace All Certificates
  • Import Certficates from another AADServer, or from a previous, old AADServer
  • Certificates and Keys in an AADS Farm


Replace all Certificates

Replace all Certificates

When talking about security, SSL, the SSL Certificates, it does happen that there is a policy in place for "regularly" replacing the Certificates. What is "regularly"? That varies and can be anything between 3 months or 3 years. The length of time a Certificate can be considered as OK depends on various factors, like for what it is used, who is using it, etc. And it depends on whether or not 1 or more "other" companies, organizations, are involved in generating and verifying the Certificates. Certificates in Browsers for example, which are used to secure the SSL connection with webservers, use a multitude of third parties to verify the Certificates. The Browser needs to have trust in all those third parties; hopefully it does not happen that a third party has a security problem, due to which the Certificates can not be trusted and a Man-In-The-Middle attack can be done...

Because the SSL Gateway does generate its own Certificates, and it has no dependency at all on any third party for checking the validity of the Certificates, the SSL gateway has no need to trust anyone else in the world (including us, AADS WorldWide). Therefore the SSL Gateway generates Certificates that can be used for 10 years.

Despite the previous statements, if there is a "reason" to replace all Certificates sooner then those 10 years, such can be done as follows:

Example

1. Current Certificates

2. Generate a new Server Certificate.

The current Server en Client Certificates will be renamed and appear as "Other Certificates and Keys".
They can now be called the "previous / old" Certificates:

  • The Server- and Client Name will not be renamed.
  • It is the FileName that will be renamed; the FileName has a number-prefix.

Because this is "only" an example, the "old / previous" Certificates are "only" a few minutes old in this example.
Usually the Administrator would do this procedure, for example, after 3 years, implying that the "old / previous" Certificates will show a Valid After date that is 3 years old.

As long as the "old / previous" Certificates are not deleted from "Other Certificates and Keys", they can be used and the users can continue to work using the "old / previous" Server and Client certificates.

3. Generate new Client Certificates

4. Generate Client Builds

  • Client Builds are generated in this example for Sales, Store East and Store West.
  • Client Builds for Windows, OSX and Linux x64. In total 9 Client Builds:
    • 3 Client Build for Sales: Windows, OSX and Linux x64,
    • 3 Client Build for Store East: Windows, OSX and Linux x64,
    • 3 Client Build for Store West: Windows, OSX and Linux x64.

5. Distribute and Install the Client Builds

Give yourself and the users a reasonable period for distributing and installing the Client Builds. For example, 2 weeks.
In those 2 weeks all users are required to update their PC/Mac and install the new Client Build.

6. Delete the "old/previous" Certificates

After the reasonable period, delete the "old / previous" Server and Client Certificates from "Other Certificates and Keys"

When the "old / previous" Certificates are deleted, only Client PC's which have installed the new Client Build can connect to the Server.


Import Certificates and Keys from another Server

Import Certificates and Keys from another Server

The objective of "Import Certificates and Keys from another Server" is to make it possible for Clients from Server 1, to connect thru SSL to Server 2, and vice versa.

Example

  • On a Windows 10 Server, the following Certificates are generated:

  • Using Backup , the Certificates are placed in an AADS-Backup-file:

  • On the other AADServer, a Windows 7 Server, the Certificates from the Windows 10 Server are Restored:

  • The imported Certificates from the Windows 10 Server are now shown on the Windows 7 Server:

    The Windows 7 Server will now accept SSL connections from Client PC's using the Certificates from the Windows 10 Server.
  • The otherway around can / should also be done:
    • Backup the Certificates on the Windows 7 Server.
    • Restore the Certificates from the Windows 7 Server on the Windows 10 Server.
    • The Windows 10 Server will accept connections from Client PC's thru SSL when the Certificates from the Windows 7 Server are used.

No connection yet...

Before a Client PC can connect to the other Server

  • First the Client PC has to do a SSL connection to the Server it does know, connect to the Server it trust,

or

  • The Administrator makes new AADS Client builds and install / updates them on each Client PC.

Connect the Client PC to a Server it already does trust

Before a Client PC can connect to the other Server, first the Client PC has to do a SSL connection to the Server it does know, connect to the Server it trust, because:

  • The Client PC's which are using an AADS Client Build from the Windows 10 Server in this example, do only trust the Windows 10 Server. They do not trust anything else in the World...
  • The Client PC's which are using an AADS Client Build from the Windows 7 Server in this example, do only trust the Windows 7 Server. They do not trust anything else in the World...

First each Client PC which does only trust the Windows 7 Server, need to have an usual Remote Desktop connection thru SSL with the Windows 7 Server. A SSL connection of 10 minutes is enough. This connection will be used to update the list of trusted Server Certificates on the Client PC. The list of trusted Server Certificates will include the Server Certificate from the Windows 10 Server. Because these Client PC's do trust the Windows 7 Server, they will accept the update of the list of trusted Server Certificates from the Windows 7 Server.

Also, each Client PC which does only trust the Windows 10 Server, need to have a usual Remote Desktop connection thru SSL with the Windows 10 Server. A SSL connection of 10 minutes is enough. This connection will be used to update the list of trusted Server Certificates on the Client PC. The list of trusted Server Certificates will include the Server Certificate from the Windows 7 Server. Because these Client PC's do trust the Windows 10 Server, they will accept the update of the list of trusted Server Certificates from the Windows 10 Server.

The Clients can connect to another Server, only after they did have a SSL connection with a trusted Server, because the SSL connection with a trusted Server will be used to update the list of trusted Server Certificates on the Client PC.

Alternatively, the Administrator can make new AADS Client Builds and install / update them on each Client PC.

Client Build

When the Administrator makes new AADS Client Builds for Windows, OSX or Linux , those new Client Builds will contain all Server Certificates. In this example that would be the Windows 7 and Windows 10 Server.
After installing / updating the Client Build on a Client PC, the Client PC does trust both the Windows 7 and 10 Server, and will be able to connect to both the Windows 7 Server and Windows 10 Server.

Summarize

  • Backup and Restore all Certificates on each Server.
  • Client PCs need to connect 1 time thru SSL with a trusted Server, such to receive the update list with Server Certificates, or
  • The Administrator makes new Client Builds and install them on each Client PC.

Delete other Server and / or Client Certificates

As long as the other Server and Client Certificates do appear in "Other Certificates and Keys", Client PC's can connect thru SSL by using the other Server and Client Certificates.

When you do not want the other Server and Client certificates anymore, delete either each Client certicate using "Delete Client", or delete them all using "Delete Server and Clients".
When the other Server and / or Client certificates are deleted, Client PC's can not connect anymore thru SSL by using the other Server and / or Client Certificates.

Sorting and Searching

A right-mouse click on the column headers shows a popup menu with various "sort" options.

The Administrator can enter a "search" string, and do an "next" and "previous" search on this string.


Certificates and Keys in an AADS Farm

Certificates and Keys in an AADS Farm

Within an AADS Farm all the servers do exchange the SSL Certificates, such that any client can connect to any server in the Farm. On each server in the Farm you can see the "other" certificates from the "other" servers in the Farm.

Example:

Windows 7 Server

The AADS Farm is enabled:

Windows 7 Server is joined to the Domain:

Reboot...

Windows 10 Server

The AADS Farm is enabled:

Windows 10 Server is joined to the Domain:

Reboot...

After the Reboot of both Servers, both Servers will show the Certificates from the other Servers in the Farm.
The AADS Farm will automatically distribute all Certificates among the Farm.

When the Administrator generates a new Client Certificate on the Windows 7 Server,

automatically this new Client Certificate will also be distributed to the Windows 10 Server in the Farm:

Server in the Farm is Down...

When a Server in the Farm is down, the other Servers in the Farm will show the Certificates of this Server with a yellow highlight.

Example: the Windows 10 Server is down:

When the Windows 10 Server is running again, the other Servers in the Farm will show the Certificates of the Windows 10 Server in the usual way.

When the Windows 10 Server is down forever, it might be a good idea to delete both the Server and Clients Certificates of the Windows 10 Server

Deleting other Certificates

When a Server is not being used anymore, its Certificates should be deleted:

  • The Administrator can remove each separate Client Certificate of this server using the "Delete Client" button.
  • The Administrator can remove all Certificates of this server at the same time using the "Delete Server and Clients" button.

Please note: every server in the Farm has the Certificates of every other server in the Farm. When, for example, server Win7x64_70 is not being used anymore, its certificates needs to be deleted on every other server in the Farm...

Sorting and Searching

A right-mouse click on the column headers shows a popup menu with various "sort" options.

The Administrator can enter a "search" string, and do an "next" and "previous" search on this string.


Connections

Connections

Active connections to the SSL Gateway can be viewed:

  • The Certificate column shows which Certificate is being used by the Client.
  • The Client column shows the name of the Client and the IP Address of the Client.
  • The Server column shows on which AADS Terminal Server the Remote Desktop of the user is running.
  • The User column shows the Name of the user and the [Session Number].
  • The Time column shows the time the SSL connection became active and for how long.

The example above does also show that 3 different users do use the same Client Certificate "Sarah". For documentation purposes, this is easier (!), but in a production environment, the Administrator might not approve of this.

Clients can connect by either IPv4 or IPv6.

Disconnect

The selected connection / user can be disconnected.

Note: when Load Balancing is used, use Show Users for disconnecting users.

Logoff

The selected connection / user can be logged off.

Note: when Load Balancing is used, use Show Users for logging off users.

Searching and Sorting

A right-mouse click on the column headers shows a popup menu with various "sort" options.

The Administrator can enter a "search" string, and do an "next" and "previous" search on this string.

Toggle IPv6 View

The menu option "Toggle IPv6 View" enables various ways an IPv6 address can be displayed.


Webserver

Web server

The integrated web server offers browser based access to an AADS Terminal Server. Remote desktop access is possible using only a browser.

IPv4

The webserver only supports IPv4 connections.

Supported browsers

Unfortunately not any browser can be used; only Microsoft Internet Explorer can be used. This is caused by the fact that the integrated web server is based on Active-X components, and Active-X is only possible using Microsoft Internet Explorer.

  • IE 6
  • IE 7
  • IE 8
  • IE 9
  • IE 10
  • IE 11

Editing the HTML

The demo version of AADS Terminal Server does limit your options for changing the layout of the pages as served by the integrated web server. The full version does give you the possibility to change the layout in any way you want.

Please note: our support is limited to AADS Terminal Server. It is not possible for us to support customers on “how to write HTML, CSS, or other web page issues”. It is OK with us if you change the HTML-pages as served by our web server, but it is your responsibility to ensure you write valid, usable and working HTML-pages.
We do appreciate the books from O'Reilly. Go to their website and search for HTML-books.

http://www.oreilly.com/

Starting the web server

Within our Maintenance Program is tab page for the web server:

When changing a parameter, click on Apply. The parameters will be immediately applied.

  • if you select the checkbox, and click on Apply, the web server will be started right away.

When you click on Apply, the web server will be stopped, and depending on the checkbox started again.
Stopping and starting the web server does NOT affect current remote desktop session with the AADS Terminal Server.

When the checkbox is checked, the web server will also be started when the AADS Terminal Server is rebooted.

Location of the WWW folder

The default folder for the HTML-pages is below the Program Files folder or the ProgramData folder of the AADS Terminal Server:

When you change the location to something else, and click on the Apply button, the default HTML-files will be created in this new location.

Security / Limitations of the integrated web server

The integrated web server is limited to:

  • HTTP Get and Head command. Anything else like HTTP Post is not supported.

This implies that the integrated web server can not be used for "accessing", "updating" or "writing" to the www-folder. There is no logic within the integrated web server to do such thing.

Our integrated web server has nothing to do with Microsoft Internet Information Server (IIS) and is not based on IIS; it does not use any IIS code.
It is a completely self-developed web server. Updates from Microsoft related to IIS are not required for an AADS Terminal Server.

The objects / files in the WWW folder are accessed by the web server using “Read and Share right”. This implies that the WWW folder can be made read-only and that the web server does not try to get write, lock or update access to the WWW folder.
The only exception to the previous statement is, when the web server is restarted with a new WWW folder path, it does write to the WWW folder, because then the www server and Maintenance Program will write the default HTML-objects in the new WWW-folder.

We should mention the following: because of the Active-X object as served by the web server, only the browser Microsoft Internet Explorer is supported. This browser does have its peculiar non-standard, proprietary behavior. For instance, sometimes this browser sends the command OPTIONS to a web server. This command is a non-standard, proprietary command that is used between Microsoft Internet Explorer and Microsoft Internet Information Server (IIS).
Our integrated web server has nothing to do with Microsoft IIS and is not based on IIS. Therefore our integrated web server does not support this non-standard, proprietary OPTIONS command. The result will be 4xx errors in the log file of our web server.

Indexing a folder

Our web server does not index a folder like IIS or Apache can do. When a client enters an URL which contains a folder and not an object, our web server appends index.html to the URL.
When index.html does not exist in the requested folder, a 404-error is generated.

If you want to have a folder indexed, do create a file called index.html inside this folder and keep it up-to-date with the contents of the folder.

If you do NOT want to index a folder, and do NOT want to confront your users with a 404-error, create an index.html file in every folder. The contents of the index.html can be a nice message and some kind of javascript-refresh statement that loads the default index.html as located in the root of the www-folder.

Traversing

Our web server only serves objects inside or below the WWW-folder as entered in the Maintenance Program. Your users might want to try ../../.. in URL with the objective to traverse beyond the WWW-folder. This is not allowed or supported by our www server.

ContentTypes.cfg

If you change the HTML-pages and starts to serve filetypes like EXE, BIN, DMG, MP3, AVI, SWF, etc, be sure to edit the file ContentTypes.cfg. In case the web server serves an object and its filetype is not found in ContentTypes.cfg, the default filetype reported to the browser of the client is “application/octet-stream”. The impact of this is that the browser will show a message to the user, asking "where to save this file".

Parameters in HTML-pages

It is possible to include parameters within the HTML-pages as served by the web server. The default Error pages do use them and can be interpreted as an example for these parameters.

When you write your own HTML-pages for our integrated webserver, you can use the following parameters.

Parameters are always enclosed in %. Before serving the HTML-page to the client, the integrated webserver will change the parameter to the actual value.

%system datetime% | Current date time of the AADServer, UTC
%client ipaddress% | TCP/IP Address of the client. Please note: due to NAT (network address translation) the reported IP Address might be different then what you expect.
%client portnumber% | The TCP/IP port number of the client.
%server portnumber% | The TCP/IP port number of the server. Default this is 80.
%host request% | The host name as entered by the client in the address bar of the browser. The hostname can have several values. The client can connect by entering an IP Address or a DNS-name. Due to NAT or other network related solutions, the AADServer might be connected in different ways with different hostnames as entered by the client.
%this host% | The netbios name of this AADServer
%this host rdp port% | The Portnumber for the RDP sessions. Default this is 3389.
%uri request% | The full URL as entered by the client on the addressbar. It is the part behind the host name as entered by the client on the addressbar.
%user agent% | The user agent of the browser used by the client.
%http server version% | The version of the integrated web server.
%client utc datetime% | The date time when the client did first connect.
%aad product type% | The AADS product type like aad_19_demo. This value can also be found in HKLM\Software\AADServer
%000-00000002% | Title of the product. This is the translation variable cAppTitle.
%000-00000003% | Name of the product. This is the translation variable cAppName.
%000-00000009% | Type of product. Default value \"Enterprise\"
%000-00000010% | Type of product. Default value \"Classic\"

These variables are related to the translation of AADS Terminal Server.

Logfile

The log file is called AADServer_www_Server.utf8.log.

The log file shows the following info:

  • date / time
  • Info, Warning or Error
  • IP Address of the client
  • HTTP-result code:
    • 200 is OK
    • 4XX is an error related to the client
    • 5XX is an error related to the server
  • Hostname as entered by the client in the address bar of the browser:
    • The web server can be accessed using the IP Address of the server, or DNS-name.
  • object served:
    • In case of the Demo version of AADS Terminal Server, the objects are served from internal memory and not from the WWW-folder (although they must exist in the WWW-folder....). Because the objects are served from memory in case of AADS Terminal Server, changing the contents of the WWW-folder will not have an effect.

The log file is a wrap-around log file and will overwrite itself. The maximum size is 1 MB. If auditing is important, the Administrator should schedule some kind of automatic backup of this log file.


IE 6

Internet Explorer 6

The builtin webserver of AADS Terminal Server can be used with Internet Explorer 6. However, it is strongly recommended to upgrade Internet Explorer to the highest version possible for the Client PC. In case the Client PC uses Windows XP, it is possible to install Internet Explorer 8.

First time: Enable Add-on

The first time the built-in webserver is accessed from a Client PC running IE 6, the following might happen:

Click on "to enable the add-on, click here". The following screen will be shown:

Enable the "Microsoft Terminal Services Client Control".
(and while doing this, disable any other that you do not need).

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". This can be verified via "Internet Options", Tabpage "Program" and then the button "Manage Add-ons...."

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.


IE 7

Internet Explorer 7

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 7. However, it is strongly recommended to upgrade Internet Explorer to the highest version possible for the Client PC. In case the Client PC uses Windows XP, it is possible to install Internet Explorer 8.

First time: Enable Add-on

The first time the built-in webserver is accessed from a Client PC running IE 7, the following might happen:

Click on "To enable the add-on, click here". The following screen will be shown:

Enable the "Microsoft Terminal Services Client Control".
(and while doing this, disable any other that you do not need).

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". This can be verified via the "Tools" button:

Note: if you do not enter the IP Address of the AADServer, but do enter a "DNS / Netbios" name, like "AADServer4", make sure that those names can be resolved.
For example, if a "ping AADServer4" fails, then it will also not be possible to connect to "AADServer4".

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled:


IE Compatibility View

IE Compatibility View

Introduced in Internet Explorer 8 is an option called "Compatibility View". This can be relevant for the built-in webserver of AADS Terminal Server. It might be required to disable or enable the so called "Compatibility View" when using the built-in webserver of AADS Terminal Server.

For more information about this, please see the Microsoft website:

http://windows.microsoft.com/en-us/internet-explorer/use-compatibility-view


IE 8

Internet Explorer 8

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 8. In case of Windows XP / Server 2003, this is the highest version of Internet Explorer that Microsoft has made for Windows XP / Server 2003.

First time: Run Add-on

The first time the built-in webserver is accessed from a Client PC running IE 8, the following might happen:

The user will need to select "Run Add-on".

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". Using the "Tools" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

The menu item "Manage Add-ons" will show the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

It might be required to disable the "IE Compatibility View " in order to get the best result:

When "IE Compatibility View " is enabled , it might happen that scrollbars are shown while these are not needed:


IE 9

Internet Explorer 9

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 9.

First time: Allow Add-on

The first time the built-in webserver is accessed from a Client PC running IE 9, the following might happen:

Click on "Allow".

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". Using the "Tool - shaped" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

Select Manage add-ons shows the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

It might be required to disable the "IE Compatibility View " in order to get the best result:

When "IE Compatibility View " is enabled, it might happen that scrollbars are shown while these are not needed:


IE 10

Internet Explorer 10

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 10.

First time: Allow Add-on

The first time the built-in webserver is accessed from a Client PC running IE 10, the following might happen:

Click on "Allow".

Verify the Add-on

Using the "Tool - shaped" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

Select Manage add-ons shows the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

It will be required to enable the "IE Compatibility View " in order to get the best result:

In case "IE Compatibility View " is disabled, the following error might be shown:

Click on the "IE Compatibility View - button" in the Addressbar and try again to connect to the AADS Terminal Server.

For good measurements you can enable the following option of IE 10:


IE 11

Internet Explorer 11

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 11.

First time: Allow Add-on:

The first time the user connect to the AADS Terminal Server, the following popup might be shown:

Click on "Allow".

Manage Add-ons

Using the "Tool - shaped" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

Select Manage add-ons shows the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

Using the "Tool - shaped" button, the user must "add" the AADServer to the list of servers for "Compatibility View ".
Select "Compatibility View " settings" in the following menu:

The following screen will be shown:

In this example the netbios-name of 3 AADS Terminal Servers are "added" and 1 IP Address of an AADS Terminal Server.

Note: if you enter "DNS / Netbios" names, like "aadserver1", make sure that those names can be resolved.
For example, if a "ping aadserver1" fails, then it will also not be possible to connect to "aadserver1".


IE 11 - Windows 10

Internet Explorer 11, running on Windows 10

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 11 running on Windows 10.

First time: Allow Add-on:

The first time the user connect to the AADS Terminal Server, the following popup might be shown:

Click on "Allow".

Manage Add-ons

Check to verify that "Microsoft Terminal Services Client Control" is enabled:

IE Compatibility View

Using the "Tool - shaped" button, the user must "add" the AADServer to the list of servers for "Compatibility View ".
Select "Compatibility View " settings" in the following menu:

The following screen will be shown:

Click on "Add". In this example the IP Address of the AADS Terminal Server is "added".

"Add" the AADServer to the "Local intranet Zone"

Connect to the AADServer

When connecting to the AADServer a full white desktop is initially shown (and no hint about what you should do...)

Click on the "white space" and a popup about clipboard or other settings does appear.

Click on "Connect" and the Remote Desktop will be shown:


Integrated PostScript / PDF Printer

Integrated PostScript / PDF Printer

  • Users can print their documents to the AADServer printer. The AADServer printer appears between the other available printers when doing some printing.
  • The printed documents either appear as PDF and / or Postscript (PS) files.

Example: Printing from Notepad

Example: Printing from MS-Word

Location of the printed PDF / PS Files

  • The printed documents appear in the "AADS Printer Files" folder, which is located inside the Documents folder of the User. Example:

  • The logged in User in this example is "domain003". The PDF / PS file is placed in the personal folder of the user:

c:\users\domain003\My Documents\AADServer Print Files

Using AADS Client Software

Move, Copy or Print

  • When using the AADS RDP+ Client Software, the user can select "where" the PDF / PS file will be located.
    • Leave on the Server. The printed documents will be placed in the folder "AADS Printer Files".
    • Copy to the Client PC.
    • Move to the Client PC.
  • When using the AADS RDP+ Client Software, the user can print the PDF / PS on a local printer that is attached to the Client PC.
    • Print the document on a local printer attached to Client PC.

About "Print files on this Client"

Default RDP does make it possible to print documents on a local printer that is attached to the Client. Unfortunately this requires that the printer drivers on the Server, and on the Client, are capable of printing to this local printer. To often it happens that the printer drivers on the Server or the Client are not capable of printing to a local printer, especially with non-Microsoft, third party printer drivers on either the Server or the Client.

Because of this "problem", we made RDP+ and the Integrated PostScript / PDF Printer. It is an alternative approach to printing documents on the local printer that is attached to the Client PC.

Not using AADS Client Software

When not using AADS Client Software, only the first open "Leave print files on the Server" can be used, because the other options do need RDP+.
RDP+ is only available when using the AADS Client Software.


Configuring the Integrated Postscript / PDF printer

Configuring the Integrated Postscript / PDF printer

  • When the PostScript / PDF printer is enabled, automatically an AADS Printer is created.
  • Users can select and use the printer.
  • Result will be a printed Postscript (PS) or PDF file in the Personal Folder of the user.
    • If allowed and configured by the Administrator, the user can move, copy or print the PS / PDF to the Client PC.

  • When either, or both PostScript and / or PDF is selected, the AADS Printer will be available.
  • When neither PostScript or PDF is selected, the AADS Printer will be removed from the Server.
  • The location of where the PDF / Postscript files are placed, can be changed.
    If this is changed, for instance, on a different server, please note that the User must have create and write rights on this different server.

Queue

The printer queue can be viewed by the Administrator in the usual way:

Settings

Default printer settings like papersize can be changed:

  • AADSServer printer, right click mouse, properties
  • General tabpage
  • Preferences... button
  • Advanced... button
  • Change Paper Size

Postscript Output Options

Depending on your Word Processor (MS-Word, Libre Office, Office software, etc), it might be required to change the following setting:

  • AADSServer printer, right click mouse, properties
  • Advanced tabpage
  • Printing Defaults... button
  • Advanced... button
  • Change the Postscript Output Option to Optimize for Portability.

Printer Options Item

When the built-in PDF printer is active, the User can choose what he does with the print-job:

AADServer Select Client Printer:

Default, normal Windows Start Menu

These options are applicable if the default, normal Windows Start Menu is used.

The following 3 options determine where on the Desktop of the User the option appears "what to do with the printjobs":

The option "User decides" implies, indeed, that the User decides.

Please note that this option is only useful if AADS Client Software is being used, because then the User can indeed decide:

If the Administrator selects 1 of the first 3:

then the User can not decide about the "Show Printer Options" and whatever the User selects in the AADS Client Software, will be ignored by the AADS Terminal Server.

Optimize or Default Applications and Sets, or Application Control

In case AADS Application Control is being used, the settings shown here above about a Icon/Item on the Desktop or Windows Start Menu, are not applicable.

In case Optimize or Default Applications and Sets, or Application Control is being used, the Administrator can give the user an Item in the Start Menu for the Printer Options using the AADS Application Control - settings:


RDP+ HowTo use the Integrated PostScript / PDF Printer

RDP+ HowTo use the Integrated PostScript / PDF Printer

Using AADS Client Software

RDP+ requires the use of AADS Client Software.
When using the AADS Client Software , all options for moving, printing and copying the print files, can be used.

Not using AADS Client Software

When not using AADS Client Software , only the first open "Leave print files on the Server" can be used, because the other options do need RDP+.

What to do with PDF / PS print files: 4 options for the User:

The User can select 4 options:

Leave print files on the Server

Every User has his/hew own folder "Documents" on the server.
Below "Documents" a sub-folder called "AADServer Print Files" wil appear.
The folder "AADServer Print Files" contains all printed PDF / PS files:

Copy print files to this Client

The User selects "Copy print files to this Client":

In the Remote Desktop Session, the User does prints a document on the AADServer Printer.

Because it is about Copy ==> Copy print files to this Client ==> the printed PDF / PS file will appear both on the Server and on the Client.

  • In this example the User Testuser is using an OSX client. He/she is logged in the OSX-Client with the userID Testuser.
  • He/she does a RDP session to the AADServer. Within the RDP session he/she is logged in with the userID luser002.
  • The User is using our AADS Client Software on the Client PC.
  • The document in WordPad is printed on the Server. The result is the PDF-file luser002-Document-25 Jan 2018 16_47_50.pdf.
  • The document appears in the folder AADServer Print Files in the homefolder of luser002, on the Server.
  • The document appears also in the folder AADServer Print Files in the homefolder of Testuser on the OSX-Client.

Move print files to this Client

The User selects "Move print files to this Client":

The printed file is moved to the Client PC. The printer file does not appear on the Server.

  • In this example the User Testuser is using an OSX client. He/she is logged in the OSX-Client with the userID Testuser.
  • He/she does a RDP session to the AADServer. Within the RDP session he/she is logged in with the userID luser002.
  • The User is using our AADS Client Software on the Client PC.
  • The document in WordPad is printed on the Server. The result is the PDF-file luser002-Document-25 Jan 2018 16_59_06.pdf.
  • The document does not appear in the folder AADServer Print Files in the homefolder of luser002, on the Server.
  • The document is moved to the client and appears in the folder AADServer Print Files in the homefolder of Testuser on the OSX-Client.

Print print files to this Client

The User selects "Print print files to this Client", and selects 1 of the attached printers:

  • The Client PC in this example has a HP Laserjet printer attached.
  • The User is using our AADS Client Software on the Client PC.
  • The document will be printed on the Client, on the selected HP Laserjet printer.
  • The document does not appear in the folder AADServer Print Files in the homefolder of luser002, on the Server.
  • The document does not appear in the folder AADServer Print Files in the homefolder of Testuser on the OSX-Client.
  • The document is only printed...

    Examples

    Example 1

    This example assumes that the Administrator has done the following settings:

    The User starts a Remote Desktop Session, using our AADS Client Software on the Client PC.. The User has a default Windows Start Menu in this example. The result is as follows:

    When the User selects "AADServer Select Client Printer",
    on the Client PC a popup is shown:

    Example 2

    This example assumes that the Administrator has done the following settings:

    Optimize, Default Applications and Sets, or Application Control is being used:

    The Administrator has assigned "AADServer Select Client Printer" to the group "Remote Desktop Users".

    When the User does a login, the result is as follows:

    When the User selects "AADServer Select Client Printer" on the Start Menu, a popup dialog will be shown:

    Example 3

    This example assumes that the Administrator has done the following settings:

    When the User does a login, the result is as follows:

    When the User does a double-click on the icon, a popup dialog will be shown:

    Example 4

    This example assumes that the Administrator has done the following settings:

    On the Client PC, the User selects the option "Display connection bar":

    When the User does a login, the result is as follows:

    The Connection Bar shows a small printer icon. When the User clicks on the printer icon, a popup dialog will be shown:

    Example 5

    This example assumes that the Administrator has done the following settings:

    On the Client PC, using the AADS Client Software , the User can select how he/she would like to be able to "Select Client Printer":


Do not install multiple PDF solutions

Do not install multiple PDF-solutions

The built-in PDF printer of AADS Terminal Server is based in open source code: Ghostscript

https://www.aads-worldwide.hk/faqs/index.htm#page=Other_licenses.htm

If you would investigate this, you will learn that all most all PDF writers are always based on Ghostscript.
If you install 2 or more PDF printers on the same server, there is the possibility that a ghostscript version problem is created.
Therefore it is recommend not to install 2 or more PDF-printer solutions on 1 server at the same time.


FileTransfer

FileTransfer

Filetranfer is already possible with "normal" RDP and Terminal Servers; one can "map" remotely a disk from the Client to the Server.
Unfortunately the implementation of this functionality is quite poor. It is slow, and when it fails, there is no logging whatsoever such that can be analysed what the problem is.
Because of that, AADS Enterprise Terminal Server offers RDP+ FileTransfer.

The FileTransfer as done by AADS is made "smart":

  • FileTransfer is only done in case there is need to do it. Prior to FileTransfer it is checked if the file is different.
    • Comparison is done based on MD5 checksums.
  • Files are compressed and de-compressed for faster FileTransfer
    • Except small files, they are copied anyway, because when it is only a few bytes, compression is not worth the effort.
    • Except files larger then 100MB, because presumably these are videofiles and compression of videofiles is not really possible.
      Note: it is possible to transfer any filesize you want, but 100MB+ thru a "small" RDP connection might take some time.


Settings

Settings

File Transfer Start Item

Default, normal Windows Start Menu

These options are applicable if the default, normal Windows Start Menu is used.

These 3 options appear as follows on the Desktop of the user:

The option "User decides" implies, indeed, that the user decides.

Please note that this option is only useful if AADS Client Software is being used, because then the user can indeed decide:

If the Administrator selects 1 of the first 3:

then the user can not decide about the "Show File Transfer item" and whatever the user selects in the AADS Client Software, will be ignored by the AADS Terminal Server.

Optimize or Default Applications and Sets, or Application Control

In case AADS Application Control is being used, the settings shown here above about a Icon/Item on the Desktop or Windows Start Menu, are not applicable.

In case Optimize or Default Applications and Sets, or Application Control is being used, the Administrator can give the user an Item in the Start Menu for File Transfer using the AADS Application Control - settings:

The User will have an item in the Start Menu:

Maximum Filesize

The Administrator can limit the maximum filesize that can be transfered by the users.


Allow File Transfer

Allow File Transfer

The Administrator can allow File Transfer for all users, or allow File Transfer only when the user is member of a specific group:

In the example above, only member of the group "Allow FT" are allowed to do RDP+ File Transfer.

Search

The searchbox can be used to search for a Local group, or in case the AADServer is joined to a Domain, search for a Domain group.


Beyond Home Folder

Beyond Home Folder

Default users can only transfer files in and from their Home Folder, or folders below the Home Folder.

Optional the Administrator can allow some users to do RDP+ File Transfer beyond their Home Folder, based on the membership of a group:

There are 3 options for "File Transfer Beyond Home Folder":

  • The Administrator select "Allow Beyond Home Folder for All Users".
    • When the user does FileTransfer, he can enter and select any folder he wants on both the Client and the Server, and do FileTransfer between the 2 selected folders.
  • The Administrator select "Allow Beyond Home if member of", but the Administrator does not select any group
    • Because the Administrator has not selected a group, then the user is (!) off course not a member, and no user can select a folder on the Client, and the Server, beyond the home-folder. The user can only select folders below the home-folder.
  • The Administrator select "Allow Beyond Home if member of", and selects a group. In the example above the group "Allow FT BHF" is selected.
    • If the user is member of the selected group, he can select any folder on the Client and Server for FileTransfer.
    • If the user is not member of the selected group, he can only select folder on the Client and Server for FileTransfer below the home-folder.


Use RDP+ File Transfer

AADServer RDP+ FileTransfer

When the user clicks on FileTransfer, the following is shown:

  • In the Left Panel, the contents of the Client PC / MAC / Linux PC is shown.
  • In the Right Panel, the contents of the home folder of the user on the AADServer is shown.

In the example above, the user is logged in on the Client PC with the userID "testuser". The user has a Remote Desktop Session, and is logged in on the Server with the userID "domain001".
On the Client PC, the home folder is therefore:

  • c:\User's\testuser

Om the Server, the home folder in this example is therefore:

  • c:\users\domain001

Multiple selections

When you click on the first column, the column with the icon, it is possible to select multiple files and / or folders.
You can also use the "spacebar" for selecting / de-selecting a file or folder.

FileTransfer settings for the user

The user can control a few FileTransfer issues.

Hidden files

  • Hidden files on Windows are files with the attribute "hidden".
  • Hidden files on OSX and Linux are files which name does start with a dot.

Queue

The Queue shows the various files and folders that,

  • will be transferred (to do)
  • are currently being transferred (doing)
  • and are transferred (done)

Using the Cancel buttons, the user can cancel those files that are on the "ToDo" list or are "Doing" list.

The Delete button for the "Done" list clears the history.

Logging

The Logging shows what has been done:

Navigation

Cursor keys | Move the cursor around the list of files and folders.
Spacebar or click on the icon in the 1th column | Select / de-select a file or folder.
F2 | Rename a file or folder.
Del | Delete the selected file(s) or folder(s)
Enter or double click with the mouse | Enter a sub-folder.
ESC | When busy renaming a file or folder, cancel the renaming.


RDP Firewall

RDP Firewall

The built-in RDP Firewall of your AADS Terminal Server is not a replacement of the Windows Firewall. It is not a replacement for anti-virus software or security-software in general.

The built-in AADS RDP Firewall gives you protection, specifically and focussed on RDP connections, sessions, and logon's. Improper RDP sessions, failed logons, hack attempts thru a RDP session, will be detected, logged, and handled by the built-in AADS RDP Firewall. These type of "attacks" are not handled by anti-virus software or security-software in general. And now that you are using an AADS Terminal Server and therefore are running a Terminal Server, you will need the protection for Terminal Servers: the AADS built-in RDP Firewall. The AADS RDP Firewall is one of the reasons why AADS is a better solution then default MS Terminal Server, Citrix or others.

  • Always enable and use the AADS RDP Firewall on your AADS Terminal Server.

Other "typical" security problems like viruses, are not handled by the built-in AADS RDP Firewall. Therefore the usual recommendations do still apply:

  • Enable and configure properly a Firewall on Windows .
  • Install and configure properly Anti-Virus software .

Default the built-in RDP Firewall is enabled and has the following settings:

IPv4, IPv6

AADS Terminal Server can handle both IPv4 and IPv6 traffic.

PortNumber, RDP and SSL

You can change the default port number which is used by the AADS Terminal Server for listening for Remote Desktop Sessions.

  • The default number is TCP port number for RDP is 3389.
  • The default TCP port number for SSL is 3443.

The range of the custom value is 1000 – 65534. Although a number lower then 1000 might be technical possible, this is disabled in order to prevent problems.

If you change the port number to another value:

  • You will also have to change your firewall settings.
  • If you use some kind of router to connect to the Internet, most likely you have defined a NAT-entry in your router in order to forward a port to the AADS Terminal Server. You must also update this NAT-entry in your router.
  • You must inform all you users, because the client software they use for connecting to the AADS Terminal Server needs to know about the changed port number.

Reboot required

A reboot is required before the new port number is used by AADS Terminal Server.

Enable the Firewall

Don't be tempted to disable the AADS built-in Firewall. Too often we receive ZIP Support Files with loglines indicating many hack-attempts because of a disabled AADS RDP Firewall or no Firewall at all. This also applies to local networks. If one (or more) of the Client PCs are hacked, infected, the virus on the Client PCs may attempt to login on the AADServer and is doing many RDP-logins. Regularly we receive ZIP Support Files with these type of problem...

No firewall is not acceptable, because then to many hack-attempts are happening, and those hack-attempts do use/waste Windows resources, and if that happens for a day, Windows might become unstable.

Note: The Windows Firewall or firewalls build into routers and / or other network devices, do not block RDP sessions which are done with the objective to hack a Terminal Server. One should not assume that some network device or firewall has the ability to detect multiple failed RDP logins, followed by blocking the remote client / device.

Allow RDP Connections from Private IP Addresses

Access from Local / Private IP Addresses is default allowed (and usally there is no reason for not allowing this).

Local / Private IPv4 address ranges

  • 10.0.0.0 - 10.255.255.255
  • 172.16.0.0 - 172.31.255.255
  • 192.168.0.0 - 192.168.255.255
  • 169.254.0.0 - 169.254.255.255

Local / Private IPv6 address ranges

  • FCxx:: /8
  • FDxx:: /8
  • FE80:: /10
  • ::FFFF.n.n.n.n    IPv4 mapped in IPv6 address, IPv4 address is a local/private IPv4 address.
  • ::0000.n.n.n.n    IPv4 embedded in IPv6 address, IPv4 address is a local/private IPv4 address.

Allow RDP Connections from Public IP Addresses

Access from Public IP Addresses is default not allowed. If it is required to access the Terminal Server from the internet, from a Public IP Address, it is recommended to use a SSL connection and use the SSL Gateway .

Access from Public IP Addresses can be allowed:

  • Temporary allowed.
  • Permanent allowed.

Permanent Allow RDP Connections from Public IP Addresses

Permanent Allow RDP Connections from Public IP Addresses is possible as follows:

  • Permanent allowed, allowed for all users.
  • Only allowed for users who a member of a specific group.

Permanent allow RDP Connections from Public IP Addresses for all users

Only allow RDP Connections from Public IP Addresses for users who a member of a specific group

Example: the Administrator has created a group called "On The Road" users:

Access from Public IP Addresses is only allowed for users who are member of the group "On The Road users".

By clicking on the button showing the group name, the Administrator can select the appropiate group:

Allow Temporary RDP Connections from Public IP Addresses

The objective of the option "Allow Temporary RDP Connections from Public IP Addresses" is as follows:

  • All users are local office users.
  • No user needs to do a RDP session from a remote location; no user needs to do a RDP session from a Public IP Address.

However,

  • Adminstration is done by a remote Administrator. That can be someone in a remote office or someone from an external (IT-) company.
  • Once in a while the remote Administrator has to do some job. Installing some updates, making a backup, etc.
  • The users (or an Administrator among the users) can temporary allow the remote Administrator access from a Public IP Address, such that the remote Administrator can do the job within a given time frame.

Either only Administrators or all Users can temporary allow RDP Connections from Public IP Addresses

Program: Temporary RDP Connections from Public IP Addresses are allowed

The Application folder of an AADS Terminal Server contains the following program:

Any user can start this program, although it depends on the configuration as shown above here, if the user can do something with the program.

The user can select an amount of time between 1 and 48 hours, and click on the Apply button. If he selects, for example, 3 hours, it shows as follows:

The end-date and time is shown. For the next 3 hours it is possible to do RDP connections from Public IP Addresses.

When the remote administrator is done with his job, the user can optional click on the Stop-button, and the period for allowing RDP connections from Public IP Addresses is terminated immediately.

Note; when the user clicks on Stop, the current active session of the remote administrator will not be disconnected. However, if the remote administrator attempts to connect again, that attempt will be denied.

If the AADS Terminal Server is configured that it is not allowed to enable temporary RDP Connections from public IP Addresses:

then the user can not set a temporary period:

Allow SSL Connections

SSL connections are default allowed from both Private and Public IP Addresses.

The SSL Gateway describes how an AADServer handles SSL traffic.

GeoIP Location

GeoIP Location offers the ability to allow only connections from certain countries (White List) or block connections from certain countries (Black List).

GeoIP Location should be used with RDP connections. For SSL connections is GeoIP is less relevant because the SSL Gateway does only allow connections from known Client PCs.

Failed Logins

Well known names / Other, self defined names

The Firewall will block Clients when it is detected that the Client has done 5 failed logon attempts.

When it is about "failed logon attempts", it can be about those zombie-hacked-PC's, hacked routers, compromised IOT devices, hacked smart TV's, etc, in a botnet out there on the internet. And this botnet with hacked devices does attempt to hack into the AADServer with the well known Administrator userID or other well-known, pre-defined userID's.
Or it can be about, for example, a former employee, or a visitor to the company office, who knows the userIDs of the employees, and attempts to hack into the AADServer with the usernames / userIDs as defined for the employees.
Either hack-attempts are blocked by the AADS RDP Firewall.

There are however circumstances where it is not really required to block Client PCs which do multiple failed logon attempts with specific company usernames / userIDs. For example, Point Of Sales systems that do automatically login on the AADServer, with a specific username like "POSClient123" (example of an username), and a password that nobody knows. Login is done automatically when booting the POS Client PC. And in the event that the remote POS Client PC makes an error, for example because the barcode reader is disconnected, it might not be needed to block the remote POS Client PC in the Firewall, but just fix the error. In such a case the IT Administrator of the AADServer can choose to handle only failed login / hack attempts when it is done with a well known user names like Administrator, but do not block a Client in the Firewall in case the failed login attempt is done with other, self defined user names.
However, if it is chosen not the block such failed login attempts, a rough (ex-)employee for example, might start some trouble with login attempts, using those usernames like "POSClient123". Therefore it is recommended always to enable Notifications, specifically the Notification for a failed logon attempt.

Default setting is to block Clients in any case. Wether the failed login / hack attempt is done with a well known username like Administrator, or a specific username that is known only on this AADServer, the Client will be blocked after 5 failed login / hack attempts.

Number of Failed Logon Attempts

Default a Client will be blocked after 5 Failed Login attempts.

Deny Period

When it is attempted to do a Remote Login from a specific IP Address, and there are 5 Failed Attempts within the configured Deny-period of 7 days, the IP Address of the Remote PC / Client is entered on the Temporary Blocked list for the next 7 days.

The Client PC will be removed automatically from the Temporary Blocked list when it has not been seen for 7 days. The 7 days are counted down to 0 from the last moment that the Client PC has contacted the AADServer. Any attempt to login again in those 7 days, will prolong the 7 days.

Create TXT logfiles

If required, TXT logfiles will be created, for example because of usage or audit requirements.

The logfiles are created in

x32 | C:\Program Files\AADServer\logging
x64 | C:\ProgramData\AADServer\logging

Block access from Localhost to Localhost

Default AADS will Block access from Localhost to Localhost.

The objective of "Block access from Localhost to Localhost" is to block viruses and / or RAT (remote access tools) on an infected PC / Server.

This setting does not prevent the infection of a PC / Server. AADS is not Anti Virus software. As usual any PC or Server needs proper Anti Virus software. However, if it happens that the PC / Server gets infected, this setting is an additional protection against the operation of RAT viruses.

In the event that a PC / Server gets infected with a RAT virus, using the RAT virus the hacker might attempt to get full RDP access to the infected PC / Server and do whatever the hacker wants to do. Because the RAT virus / software runs locally on the PC / Server, it is possible to block this type of RDP access by blocking access from Localhost to Localhost. The users within the company are not affected by this setting.

Because of our Support, we have received multiple ZIP Support Files from customers in trouble, and from the details of the logging in the ZIP Support Files, we have learned that it was a RAT virus that was causing the trouble. And we have also learned from the logging that we can block the operation of the RAT virus by blocking access from Localhost to Localhost.

  • If this setting is set, the IP Addresses of the AADServer will appear on the Automatic Black List .
  • If this setting is not set, the IP Addresses of the AADServer will appear on the Automatic White List .


Process flow of the RDP Firewall

Process flow of the RDP Firewall

  • The AADS Firewall first looks at the incoming connection and sees if it is a IPv4 or IPv6 connection, and if IPv6 is allow and enabled. IPv4 is always enabled and allowed.
  • Next the AADS Firewall test if it is a Public or Private IP Address.

Following the decision about Public or Private IP Address, the AADS Firewall decides about the connection based on the 7 Firewall Lists:

  • Automatic Black List
  • Manual Black List
  • Automatic White List
  • Manual White List
  • Temporary Blocked List
  • GeoIP Location White List
  • GeoIP Location Black List


GeoIP Location

GeoIP Location

GeoIP Location offers either a White List or a Black List.

Note: it is not possible, nor is it needed, to have a GeoIP White List and Black List at the same time. Such is never needed...just think about it...

  • If the White List is used, and 1 or more countries are placed on the White List, then all other countries are blocked. And because all other countries are blocked, there is not need to have a Black List with 1 or more countries, because, as stated, when using a White List, all other countries are blocked.
  • If the Black List is used, and 1 or more countries are placed on the Black List, then all other countries are allowed. And because all other countries are allowed, there is not need to have a White List with 1 or more countries, because, as stated, when using a Black List, all other countries are allowed.

GeoIP and RDP

The use of GeoIP for RDP connections is strongly recommended. Most hack-attempts from around the world as they do happen, are blocked when using the GeoIP White List, or when placing (many...most...) countries on the GeoIP Black List.

GeoIP and SSL

The use of GeoIP for SSL connections is a "nice to have". Stopping connections based on GeoIP Location data is a bit quicker / less CPU intensive, then stopping a connection based on SSL negotiations.

Manage

Manage shows the details of the loaded GeoIP database:

  • Number of countries
  • Number of IPv4 ranges/networks in the world
  • Number of IPv6 ranges/networks in the world
  • An info field that indicates a date-stamp of the GeoIP Location Data.

Because of redundancy, AADS uses either GeoIP location data from MaxMind or from IPInfoDB.

MaxMind

AADS uses GeoLite2 data created by MaxMind, available from MaxMind.

IPInfoDB

AADS uses IP2Location LITE data available from IPInfoDB.

Updates and Download

  • Once a day does the AADServer check if an update of the GeoIP location data is available from our websites:
    • http://www.aads-worldwide.hk
    • http://www.aads-worldwide.ch
  • When an update is available, the AADServer will download the update and use it immediately.
  • Optional a HTTP proxy server can be entered for downloading the GeoIP location data.

Updates

It is important that the AADServer can check for Updates of the GeoIP data and Download the GeoIP data.

The GeoIP data is updated on a weekly basis and is therefore "outdated" within a month. Using "outdated" GeoIP data should be avoided because nowadays IPv4 networks are (re-)sold from country to country, implying that an "outdated" GeoIP database would allow connections from IP Addresses, or block connections from IP Addresses, because in the "outdated" GeoIP database the IP Address belong to country "XYZ" while currently the IPv4 range is sold and used in country "ABC".

Suggestion: Enable and use Notifications. Whenever an Update is available or there is some problem with downloading the latest GeoIP database, a Notification is send to the Administrator of the AADServer.


GeoIP White List

GeoIP White List

Note: The countries mentioned in this example of the GeoIP White List, are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

When using a White List, only connections from countries on the White List are allowed. All other connections from all other countries in the world are blocked.

Example:

The list shows the number of known IPv4 networks and IPv6 networks in each country.

Add a Country to the White List

  • Use [TAB] or [Down] for creating an empty row, and click on the field in the column Country,

or

  • Right-Click with the mouse on the list with Countries and select "Add":

A popup with all Countries does appear. Select the Country that needs to be added to the White List.

After adding 1 or more countries:

  • Use the [Save] button for Saving the list, or
  • Use the [Read] button for ignoring the changes that has just been done, and read the White List again as it was saved.

Delete 1 or more Countries from the White List

  • Use the column Date/Time for selecting 1 or more Countries
  • Right-click with the mouse
  • Select Delete in the popup menu

After deleting 1 or more countries:

  • Use the [Save] button for Saving the list, or
  • Use the [Read] button for ignoring the changes that has just been done, and read the White List again as it was saved.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


GeoIP Black List

GeoIP Black List

Note: The countries mentioned in this example of the GeoIP Black List, are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

When using a Black List, all connections from countries on the Black List will be blocked. Connections from all other countries in the world are allowed.

Example:

The list shows the number of known IPv4 networks and IPv6 networks in each country.

Add a Country to the Black List

  • Use [TAB] or [Down] for creating an empty row, and click on the field in the column Country,

or

  • Right-Click with the mouse on the list with Countries and select "Add":

A popup with all Countries does appear. Select the Country that needs to be added to the Black List.

After adding 1 or more countries:

  • Use the [Save] button for Saving the list, or
  • Use the [Read] button for ignoring the changes that has just been done, and read the Black List again as it was saved.

Delete 1 or more Countries from the Black List

  • Use the column Date/Time for selecting 1 or more Countries
  • Right-click with the mouse
  • Select Delete in the popup menu

After deleting 1 or more countries:

  • Use the [Save] button for Saving the list, or
  • Use the [Read] button for ignoring the changes that has just been done, and read the Black List again as it was saved.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


Failed Logon

Failed Logon

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

A List of Failed Logon is shown:

Every Failed Logon is recorded, and if there are "to many" failed logons, the offending IP Address is placed on the Temporary Blocked List.
Default a Client will be placed on the Temporary Blocked List after 5 Failed Login attempts, and will be blocked for the next 7 days.

Delete Failed Logon Events

By clicking on the "Date/Time" column, 1 or more Failed Logon Events can be selected.
Using the "Delete"-option in the Popup Menu, those Events can be deleted. Do not forget to click on the "Save"-button.

The point of this, is that it might happen that an OK / normal user accidentally has done some Failed Logons, for example because the caps-lock key of the keyboard was locked, and the user does not notice this, and the user attempts to login multiple times.
And when there are, for example, 4 Failed Logons from the Client-PC of this user, and the number of Number of Failed Logon Attempts is 5, then all the user needs to do in the next week, is 1 Failed Logon and he/she gets blocked for the next 7 days.

The main purpose of the Firewall is to stop hack-attempts; not to stop an OK user who makes a silly typo error when entering the username and password.
Therefore it is possible for the Administrator to delete the Events Failed Logon Attempts (after he has informed the silly but OK user that he should not do 5 failed attempts to enter his name and password......)

If the user has attempted to logon with something else then his/her own username, it is recommended not to delete the Events Failed Logon Attempt,
but first to figure what or why the user has attempted to do a logon with some other userID then his/her normal userID.

Copy to Manual Black or Manual White list

Using the Popup Menu, Copy to Black List or White list, the Administrator can directly copy the IP Address of the offender to the Manual Black List, or to the Manual White list in case it is not an offender. When doing this, be sure to switch to the Manual Black or Manual White list after the "copy" and save the Manual Black or Manual White list.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar / click on "Date/Time" column | Select / de-select an entry.


Temporary Blocked List

Temporary Blocked

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

When there are "to many" Failed Logon attempts from an IP Address, the IP Address will be entered on the Temporary Blocked list.
The Number of Failed Logon Attempts defines what is "to many".

When a Client is on the Temporary Blocked List,

  • The connection between the Client and the Server will be disconnected.
  • If the Deny-period is 7 days, any attempt in the next 7 days will be blocked. The Client is not allowed to connect for 7 days.
  • Every time the Client attempts to connect and login again, the block time of 7 days will be prolonged. The Client will be blocked for 7 days, counted from the last date / time moment that the Client did attempt to connect and login in to the AADS Terminal Server.
  • After the Client has not be seen in 7 days, automatically the IP Address of the Client will be cleared from the Temporary Blocked List.

Note:

  • If the user attempts to connect a 2th time from the same Client PC, from the same IP Address, and the user does many Failed Logons,
    but there is already an active session from the IP Address of the Client PC, because the user did correctly a logon some time ago,
    then this existing, active session will be not be disconnected.
    The blocking only applies to new connect and logon attempts.
  • 2th note: after the moment the user does a logoff from this existing, active session, he will have to wait for 7 days, the Deny Period , before he can logon again on the AADS Terminal Server......

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-option in the Popup Menu, those Client IP Addresses can be deleted and are allowed once again to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

Copy to Manual Black or Manual White list

Using the Popup Menu, the Administrator can directly copy the IP Address of the offender to the Manual Black List, or to the Manual White list in case it is not an offender. When doing this, be sure to switch to the Manual Black or Manual White list after the "copy" and save the Manual Black or Manual White list.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar / click on "Date/Time" column | Select / de-select an entry.


White List

White List

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

Automatic White List

  • The Automatic White List will only contain the local IP Addresses of this AADS Terminal Server.
    If you want to place some IP Addresses on the White List, use the Manual White List.
  • If you de-select Block access from Localhost to Localhost

    the Automatic White List contains all local IP Addresses of this AADS Terminal Server.
    If you de-select,acces from Localhost to Localhost is allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic White List.
  • If you select Block access from Localhost to Localhost
    the Automatic White List contains will not contain the local IP Addresses of this AADS Terminal Server.
    If youselect,acces from Localhost to Localhost is not allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic Black List .

Manual White List

The Administrator can enter IP Addresses or ranges of IP Addresses:

Note: as you can see in this example, if the Administrator enters a Public IP Address that "does not exist" in the real world, it will be shown with "Unknown country". However, this might also happen if the GeoIP Location database is old/expired and should be renewed...

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-option in the Popup Menu, those Client IP Addresses can be deleted and do loose their privilege of always to be allowed to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

White List overrules

Whatever is entered on the White List, Automatic and Manual, is allowed to connect to the AADS Terminal Server.
The White List overrules:

  • the Manual Black List
  • the Temporary Blocked List.

The White List does not overrule:

  • the Automatic Black List

Be carefull with the Manual White list!

See the example above. Suppose the PC of the Administrator is somehow "infected" with a RAT virus (Remote Access Tool), the PC of the Administrator does never gets blocked because the IP Address of this PC is on the White list...

Subnet mask / Range

It is possible to enter 1 IP Address, by leaving the Subnet Mask / Range empty.

IPv4

A Range can be entered as follows:

  • "begin" IP Address and "end" IP Address. See the Thin Clients Sales Department as an example.
  • /1 to /31. See Range Example 1.
  • /n1.n2.n3.n4. See Range Example 2.

IPv6

A Range can be entered as follows:

  • "begin" IP Address and "end" IP Address.
  • /4 to /128

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


Black List

Black List

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

Automatic Black List

If you select Block access from Localhost to Localhost

the Automatic Black List contains all local IP Addresses of this AADS Terminal Server:

  • The Automatic Black List will only contain the local IP Addresses of this AADS Terminal Server.
    The Automatic Black List will never contain any other IP Addresses.
    If you want to place some IP Addresses on the Black List, use the Manual Black List.
  • If you do de-select Block access from Localhost to Localhost

    then the Automatic Black List will be empty; the Automatic Black List will not contain any IP Address.
    If youde-select, acces from Localhost to Localhost is allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic White List .
  • If you select Block access from Localhost to Localhost
    acces from Localhost to Localhost is not allowed, because the local IP Addresses of this AADS Terminal Server are on the Automatic Black List.

Manual Black List

The Administrator can enter IP Addresses or ranges of IP Addresses:

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-button, those Client IP Addresses can be deleted and are allowed once again to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

Subnet mask / Range

It is possible to enter 1 IP Address, by leaving the Subnet Mask / Range empty.

IPv4

A SubNetMask / Range can be entered as follows:

  • "begin" IP Address and "end" IP Address. See the Thin Clients Sales Department as an example.
  • /1 to /31. See Range Example 1.
  • /n1.n2.n3.n4. See Range Example 2.

IPv6

A SubNetMask / Range can be entered as follows:

  • "begin" IP Address and "end" IP Address.
  • /4 to /128

/all

Described here

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


/all

/all

Be carefull with an /all range

  • An /all range on the Black List implies that every IP Address is blocked.

The /all range can only be used as follows:

  • Enter the right IP Addresses or right IP Ranges on the Manual White List .
  • Enter the /all range on the Black List
  • The Manual White List overrules the Black List
    • Only those Clients entered in the Manual White List will be allowed.
    • All other IP Addresses in the world, and all local IP Addresses, will be blocked.

The /all range can not be used with

  • Geo IP Location White and Black List
  • Failed Logon List
  • Temporary Blocked list

because these Firewall Lists are over-ruled by the Manual White List and the Manual Black List.

  • The Range 0.0.0.0 to 255.255.255.255 denotes all IPv4 addresses.
  • The Range 0:: to FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF denotes all IPv6 addresses.

Example IPv4

White List

Black List

The Black List does completely block every IPv4 and IPv6 address. Only those on the White List will be allowed (because the White List overrules the Black List)

Example IPv6

White List

Black List

The Black List does completely block every IPv4 and IPv6 address. Only those on the White List will be allowed (because the White List overrules the Black List)


Logging

Logging

Note: The countries mentioned in these examples are only mentioned here as an illustrative example. The mentioning of these countries should not interpreted as some kind of recommendation or statement about these countries.

The loglines shows why a connection is allowed, denied and disconnected.

Copy to Manual Black or Manual White list

Using the popup menu, Copy to White List or Black List, the Administrator can directly copy the IP Address of the offender to the Manual Black List,
or copy to the Manual White list in case it is not an offender.
When doing this, be sure to switch to the Manual Black or Manual White list after the "copy" and Save the Manual Black List or Manual White list.

The Tabpage with the "username" shows what the logged-in user/Administrator currently has done with AADS Maintenance Control:

Navigation

Cursor keys Move the cursor around the list.


DockDesktop

DockDesktop

In the folder "C:\Program Files\AADServer" the tool aadDockDesktop is installed. Purpose of aadDockDesktop is to show the desktop icons at a different location on the screen then as default done by Windows:

  • The icons shown by aadDockDesktop are those that are visible on the default Windows desktop of the user.
  • On each corner, aadDockDesktop has a small docking arrow / button. By clicking on this small docking arrow / button, aadDockDesktop will dock itself to that specific location on the screen.
  • The small docking arrows / buttons can also be used to resize aadDockDesktop, or to move it along the screen-edge where it is docked.

Hide resize / move arrows-buttons

If you click on the “no arrow / button” -button, the small arrows / buttons will disappear. Doing so will prevent an accidentally resize or move of aadDockDesktop:

Close DockDesktop

By clicking on the close-button, aadDockDesktop will terminate:

Session Menu

The small Windows-button shows a Session Menu for Logoff, Disconnect, etc.

DockDesktop setting

The config-button shows the configuration options:

Auto ReSize if to small

In case aadDockDesktop is to small, such that not all icons are shown, such that there is a vertical and / or horizontal scrollbar visible, aadDockDesktop will enlarge itself until all icons are visible.

No Close

The close button will disappear and it will not be possible to terminate aadDockDesktop.
Also the option Do not show on Taskbar will be checked, and disabled.

Hide icons on normal desktop

When un-checked the default Windows desktop does also show the usual desktop icons:

When checked , the default Windows desktop does not show any icon. Example:

Show those standard desktop icons

Users do have a "Personal Desktop". This is a folder which contain ICONs / ShortCuts to Applications. These ICONs / ShortCuts are personal and are only shown on the Desktop of this User.

The personal desktop is a setting / location that can be changed by the administrator. Default the personal desktop is located in %USERPROFILE%\Desktop.

DockDesktop will show the Personal ICONs / ShortCuts in the folder %USERPROFILE%\Desktop
If the user has no icons in %USERPROFILE%\Desktop, the initial screen as shown by DockDesktop will be empty.

When the option "Show those standard desktop icons" is checked, the initial screen of DockDesktop will also show the Global ICONs / ShortCuts that are shown on every User's Desktop.

Example:

The user "admin" in this example has a ICON / ShortCut to Notepad on his Personal Desktop:

The initial screen of DockDesktop does show both those standard Desktop ICONS / ShortCuts, and it shows the Personal ICONs / ShortCuts.

When the option "Show those standard desktop icons" is un-checked, the initial screen of DockDesktop will only show the ICONs / ShortCuts on the Personal Desktop:

Do not show on Taskbar

If checked, the Taskbar will not show an item for aadDockDesktop:

If un-checked , the Taskbar will show an item for aadDockDesktop:

Show Full Screen, do not Align icons at Top

DockDesktop can position itself Full Screen.

When Show Full Screen is combined with the option Align icons at Top, unchecked, then aadDockDesktop mimics the default Windows desktop:

Show Full Screen, Align icons at Top

When Show Full Screen is combined with the option Align icons at Top, checked , then aadDockDesktop shows as follows:

Popup when moving mouse in me

Popup when moving mouse in me or desktop

When one of these options is checked, aadDockDesktop will show itself “on top” when the mouse is moved over it.

Read only / No right click / No popup menu

When checked, the default right-click options that do exist on those desktop icons, are disabled. The only right-click that is available, is right-click on the Recycle bin. When doing so, the usual popup asking "Empty the Recycle Bin, yes / no" is shown.

Auto run after login

When checked, DockDesktop will create an entry for itself in the RUN-key in the registry / profile of the User, such that it will be started every time after a login.
When unchecked, the entry in the RUN-key in the registry / profile of the user will be deleted.

Note: when aadDockDesktop is started using AADS Application Control , then this setting is not required / is not applicable.

Show transparent when not active

aadDockDesktop is shown transparent onto the desktop:

INI-file

aadDockDesktop maintains an INI-file for the user in “Application Data”-folder beneath the personal folder of the user. Which folder that exactly is, can vary and is determined by the Operating System, or by specific settings done by the Administrator.

The INI-file is called aadDockDesktop.ini.

The various config-settings are saved in this INI-file. All possible settings in an INI-file:

Left=340
Top=0
Height=340
Width=460
Dock position=right-top
Auto size=no
Do not close=yes
Hide icons on MS desktop=yes
Do show standard Desktop icons=yes
Hide from taskbar=yes
Popup when moving mouse over me=no
Popup when moving mouse over me or desktop=no
Do Transparancy if not Active=yes
Align icons at Top=yes
Percentage Transparancy=20
Show Full Screen=no
Read only. No right click. No popup menu=yes
Autostart for this user after login=no
Do Resize and Dock=yes
Path=

Path

Path is the only setting in the INI-File that can not be set using the Settings of aadDockDesktop.

In case Path is empty, aadDockDesktop will show the default Global Desktop as offered by Windows, and the contents of the Personal desktop of the User.

When the setting Path has a value, then aadDockDesktop does expect to find ICONS / ShortCuts in this folder. Examples:

Path=\\server\groups\sales\AppGroup1

Path=c:\icongroups\sales\AppGroup1

It is expected that the folder AppGroup1 contains ICONS / ShortCuts which will be shown by aadDockDesktop.

Note: possible the second example, where Path points towards drive C:, is a better example, because Windows might show the user a warning when attempting to access an icon / link in a folder on a network drive.

Usually Path is never used, but an Administrator might use it in special cases where aadDockDesktop needs to show a special set of ICONS / ShortCuts for the Users.

Command-line parameters

It is not required to start DockDesktop with any command-line parameter. However, if done so, 1 or 2 parameters are possible. All parameters should be am INI-file.
The first command-line parameter / INI-file will be the user INI-file. It will replace the default INI-file for the user as described above here.
The second command-line parameter / INI-file will be the system INI-file.
DockDesktop will open the second, system INI-file with only read-access. Whatever config-setting is set in the system INI-file will overrule the config-setting in the user INI-file.

Example

aadDockDesktop “%userprofile%\aadDockDesktop.ini” “c:\globalsettings\aadDockDesktop.ini”

  • The 1th INI-file will be in the user-folder.
  • The 2th INI-file will be a global INI-file with some settings that do apply for every user.

Content of c:\globalsettings\aadDockDesktop.ini

  • In this example, there are only 5 settings in the system INI-file.
  • These 5 settings will overrule the 5 settings in the user INI-file.
  • All other settings in the user INI-file can be changed by the User.

The result of this example is as follows:

The settings which are placed in the system INI-file are all applied, and the User can not change those settings. Those settings are disabled for the User.
Only the other settings which are not placed in the system INI-file can be changed by the User.


ViewUsers

ViewUsers

The tool aadViewUsers is installed in the folder \program files\aadServer aadserver on the server.

When it is started by an user which does not have Administrator Rights, it is shown as follows:

When it is started by an Administrator, is shows more options:

\

When it is started in the Console of the AADS Terminal Server, the button for Control is not available.

What can you do with ViewUsers

  • Users are able to send messages to each other.
  • Administrators are able Disconnect or Logoff an user.
  • Administrators who are not working on the Console of the AADS Terminal Server are able to Remote Control a session:

Remote Control of another user

Note: Remote Control of another user is not possible on Windows 8.x, Windows 10, or newer.

  • Be sure that you are self logged in with Administrator rights.
  • Select another user.
  • Select a preferred hot-key combination that can be used to disconnect the Remote Control Session.
  • Click on Control.

The "Target" user get to see a popup on his desktop with the question if he/she will accept the Remote Control action:

If accepted by the user, the Administrator can view the Desktop of the user.

In the upper-right corner of the Remote Controlled Session, a small button is shown as an indication that the session of the user is being Remote Controlled:


AppControl

AppControl

In the folder Program Files\AADServer the tool aadAppControl is installed. aadAppControl can be started from the command line with the following options:

aadAppControl.exe /TBSETTINGS

It will enable the user to do Taskbar Settings. Nowadays with Windows 10 that is not always possible anymore with then Windows 10 UWP Settings screens.

  • It can be used any version of Windows.

  • The very first time an user does a login, and Windows creates a profile for the user, this tool might not work, because the profile has just been created.
    The 2th time an user does a login, everything will work OK.

A short-cut to this tool is installed in Accessories:

aadAppControl.exe /CHANGEPASSWORD

It will enable the user to change his/her password:


Client Software

Client Software

An AADServer can be accessed using any modern RDP client running on Windows, OSX, Linux, iOS, Android, etc.

  • Microsoft RDP Client

AADS Client Software

For Windows, Mac OSX and Linux, the users might prefer to use the AADS Client Software.
The AADS Client Software can be used for accessing any Terminal Server.

  • The AADS Windows Client can be used on any Windows version from Windows XP to Windows 10, Windows Server, x32 and x64.
  • The AADS Mac OSX Client can be used on OSX x64 10.9 Maverick or newer.
  • The AADS Linux Client has been tested on:
    • Fedora
    • Debian
    • openSUSE
    • Mageia
    • Linux Lite
    • Ubuntu

Build AADS Client software

The AADS Client software can easily be build. You can deliver 2 types of AADS Client Software to your users:

  • Without SSL. This type can do RDP+ sessions and Load Balancing.
  • With SSL. This type can do SSL sessions, RDP+ sessions and Load Balancing.

Install AADS Client software

  • Install AADS Client for Windows
  • Install AADS Client for Mac OSX
  • Install Client for Linux

Use AADS Client software

  • Use AADS Client


Microsoft RDP Client

Microsoft RDP Client

Microsoft RDP Client can be used for connecting to an AADServer.

The following settings are recommended:

Server authencication

Server authentication is intended for connecting to a Microsoft Terminal Server, including a certificate for the Server. This option of the Microsoft RDP Client is not applicable when connecting to an AADServer.

Note: AADS can do authencication, both Server and Client authencication. See the SSL Gateway for more details.

RD Gateway Server

RD Gateway Server is not applicable, not used, when connecting to an AADServer.

Start a program

The option "Start a program..." is not supported by AADS. If you need to start a program, use Application Control, Auto Run an Application.


Install AADS Client for Windows

Install AADS Client for Windows

Copy the Client Build to the Windows PC. On the Client PC the file

aad_XXXXX_Date_Name_ClientSetup.exe

needs to be executed with Administrator rights.

Installation OK

When installed on the Client PC, a simple popup is shown that the installation has been successful:

Start Menu entry

In the Start Menu of the PC, an entry is placed.

Add / Remove software

An entry is created for the Uninstall of the Client Software.

Installation fails

If the installation fails, the user will be informed, and on the desktop of the user, a Client ZIP Support File is created:


Install AADS Client for Mac OSX

Install AADS Client for Mac OSX

Step 1:

  • Copy the Client Build to your OSX desktop:

Step 2:

  • Double-click on the OSX.zip file. Next to the ZIP File, the folder rdpOSXclient will appear:

Step 3:

  • Double-click / open the folder rdpOSXclient. The OSX app will appear:

Double-click or start the rdpOSXclient.app:

OSX...Can not start the Application...UnZip...is it bug...?

Occasionally it happens that it is not possible to start the rdpOSXclient.app. OSX will show you an error that this program can not be started.
Although we are not sure, it seems as if occasionally UnZip fails on OSX.
When it happens that OSX refuses to start the unzipped application, proceed as follows:

  • Delete the unzipped folder called rdpOSXclient.
    • Do not delete the ZIP File. The ZIP File is fine. The problem is with unzipping on OSX.
  • UnZip again the ZIP File.
  • The folder rdpOSXclient will be created again, containing the application.

When the UnZip is done a second time, usually it works OK.

X11 - XQuartz

The AADS client software requires at least OSX 10.9 "Mavericks" to be installed. The AADS client software for OSX can not be used on older versions of OSX.

It also requires the installation of the X11 - Quartz package.
When the AADS Client software for Mac OSX does not see that X11 - XQuartz package is installed, it will inform the user:

When the user clicks on the Information button, a webpage about X11 - XQuartz will be opened.


OSX: X11 - XQuartz

OSX: X11 - XQuartz

The AADS Client software for Mac OSX requires the X11 - XQuartz package to be installed.

Step 1: Download the X11 - XQuartz package

The appropriate package can also be downloaded from our website:

Mavericks, or newer. OSX 10.9 or newer X11 - XQuartz 2.7.11 (link 1)
X11 - XQuartz 2.7.11 (link 2)
X11 - XQuartz 2.7.11 (link 3)

Note: This list of downloads is based on the assumption that your Mac is updated with the latest updates from Apple for your version of OSX 10.9 or newer.

Step 2: Install the package

Be sure to login on your Mac with an userID that has Administrator Privileges.
The primary / first user is usual an Administrator account.

Step 1:

Download XQuartz-2.7.11.dmg and place it on your Desktop:

Step 2:

Open the package by double-clicking on the dmg-file:

Step 3:

Install the package:

Step 4:

Reboot your Mac or logout / login:

Your Mac is now ready for the AADS Client software.

The packages can also be downloaded from the XQuartz website:

  • XQuartz website
  • All releases on the XQuartz website

Be sure to download the correct version which is appropriate for the version of OSX that is being used.


Install AADS Client for Linux

Install AADS Client for Linux

Step 1:

Copy the ZIP-File to the desktop of your Linux PC:

Step 2:

Extract the folder, including the paths, to your home folder:

The folder- and filename will be either X32 or X64, depending on 32- or 64 bits Linux client.

Step 3:

Start the application rdpX32client (or rdpX64client on Linux 64 bit):

The application rdpX32client will create the folder rdpAppDir in the home-folder of the user, which will contain the

  • Certificates,
  • the settings file,
  • the logfiles:


Use AADS Client

Use AADS Client

Authorization

Windows

Mac OSX

Linux

Enter the required information to login on the AADS Terminal Server. Optional you can select to save your password, such that the next time you use the AADS Client, it will be filled in.

Save my password

When you select "Save my password", the password will be saved in a local INI-file. Encryption is being used for saving the password.

IPv4, IPv6

The user can select IPv4, IPv6 or *

  • IPv4
    • The user enters the IPv4 address of the AADServer.
    • In case a hostname is entered (not an IPv4 address) and DNS is required, a DNS request is done for an IPv4 address, and the connection is made using IPv4.
  • IPv6
    • The user enters the IPv6 address of the AADServer.
    • In case a hostname is entered (not an IPv6 address) and DNS is required, a DNS request is done for an IPv6 address, and the connection is made using IPv6.
  • *
    • default IPv4 will be done.


Settings

Settings

Client Settings for Windows

Client Settings for Mac OSX

Client Settings for Linux

Load Balancing

Select Load Balancing if the AADS Client is being used to connect to an AADS Terminal Server Farm.

Ask user for Load Balancing hostname

When connecting to an AADS Terminal Server Farm, and the AADS Client does not yet know any Terminal Server in the Farm, because for example this is the first time the AADS Client is being used,
the user will be asked for the name or ip address of a Terminal Server in the AADS Farm.

Show remote desktop Seamless

Note: This option is only available in the AADS Client for Windows.

The Remote Desktop can be shown Seamless on the client. When doing so, the option to specify the size of the Remote Desktop becomes disabled:

Seamless example 1:

  • The Remote Desktop is shown seamless (this requires the AADS Client software for Windows on the Client PC).
  • The bottom taskbar is from the Client.
  • The icons on the left are from the Client Desktop.
  • The icons on the right are shown by aadDockDesktop. Those icons belong to the Remote Desktop. These icons are "here" because of the $aad DockDesktop menu directive.

Seamless example 2:

The screendump in example 2 shows 2 taskbars:

  • The bottom taskbar is from the client
  • The second taskbar is from the Remote Desktop session.

The screendump in example 2 also shows "a problem". The desktop icons of the Remote Desktop are mixed up with the desktop icons of the client.
Default Windows does always show desktop icons on the left side of the screen, so now they are shown on top of each other.

Seamless Example 3 with DockDesktop

You can use DockDesktop on either or both the Client and the Remote Desktop to "fix" this problem:

Desktop Size

You can select the size of the Remote Desktop.

  • The option "Full Screen" will show the Remote Desktop indeed Full Screen, on the current monitor of the client.
    • If the Client has 2 or more monitors, the Remote Desktop will be shown Full Screen on the current monitor onto which the AADS Client is running.
  • The option "Full Screen - taskbar" will make sure that the taskbar of the Client will remain visible while working with the Remote Desktop.

Full screen on all monitors

Note: This option is only available in the AADS Client for Windows.

AADS Client for Windows is "monitor aware". When the AADS Client detects that the Client PC has 2 or more monitors, it behaves as follows:

  • The option Full screen implies that the AADS Client will be Full screen on the monitor it is currently running. Example:
    • If you want the AADS Client to show a Full screen Remote Desktop session on monitor 3, move the AADS Windows to monitor 3 before you click on "Connect", and the Remote Desktop will be shown Full screen on monitor 3.
  • If you want the AADS Client to be Full screen on all monitors, select the option "Full screen on all monitors".

Example: Client will be Full screen on Monitor 3

The Remote Desktop in this example will be shown Full screen on Monitor 3, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 3, so it will do the Remote Desktop on Monitor 3:

Example: Client will be Full screen on Monitor 2

The Remote Desktop in this example will be shown Full screen on Monitor 2, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 2, so it will do the Remote Desktop on Monitor 2:

Example: Full screen on all monitors

The Remote Desktop in this example will be shown Full screen on all Monitors:

Full screen limitations Windows

There are technical limitations in the ability of Windows Client PCs to do Full Screen. It depends on the version of the Microsoft Remote Desktop Client software as it is installed on the Client PC.

  • First it is attempted by the AADS Client software to show the Remote Desktop as big as possible.
  • If it is not possible to show the Remote Desktop as big as possible, it is attempted to show the Remote Desktop with a width of 1600 px.
  • If it is not possible to show the Remote Desktop with a width of 1600 px, it is attempted to show the Remote Desktop with a width of 1280 px.

When you notice that the maximum width of the Remote Desktop Window is limited to 1600 px or 1280 px, you can attempt the following:

  • Upgrade the Remote Desktop software on the Client PC with the latest Remote Desktop Client software from Microsoft.

Connection Bar

Show, or show not the connection bar in the Remote Desktop Session.

IPv6 Scope ID

Described here .

Linux: Choose RDP Engine

The Linux client have the option to choose between rdesktop or xfreerdp as the RDP Engine:

OSX: Choose RDP Engine

The OSX client have the option to choose between rdesktop or xfreerdp as the RDP Engine:

Custom options

Custom options can be used to pass extra parameters to rdesktop or xfreerdp.

Remaining settings

The remaining settings are similar to the settings in the Default RDP Client software from Microsoft.


IPv6 Scope ID

IPv6 Scope ID

  • Scope ID is about IPv6.
  • Scope ID is not relevant and not used for IPv4 connections.
  • The IPv6 Scope ID is a number. It is not Text.
  • What number you need to enter, has nothing to do with AADS, but depends on the Client PC.
  • It is about the Client PC. It is not about the Server.
  • What number you need to enter differs between Windows, OSX and Linux.

When an IPv6 connection attempts fails with some kind of "routing" error, then this "routing" error might be caused by not having entered an IPv6 Scope ID. Possible and hopefully the correct IPv6 ScopeID will fix this "routing" error.

Windows

Windows Vista and newer

  • Usually you can leave the IPv6 ScopeID empty. Windows will figure out by it selves what the IPv6 Scope ID must be.

Windows XP and Server 2003

  • Usually a correct value of the IPv6 Scope ID needs to be entered.

Obtaining the IPv6 Scope ID

Option 1:

  • Contact the IT department that supports the Client PC and ask them about the IPv6 ScopeID for this Client PC.

Option 2:

  • Open a dos-box, and enter the command ipconfig :

  • The IPv6 Scope ID of this Client PC is 10.

Client PC with multiple network cards

If the Client PC has multiple network cards, it will also have multiple IPv6 Scope ID's. In such a case, see Option 1: Contact the IT department that supports the Client PC and ask them about the appropriate IPv6 ScopeID for this Client PC, such that this Client PC can connect with the AADServer(s).

OSX

Default an IPv6 Scope ID is required.

Obtaining the IPv6 Scope ID

Option 1:

  • Contact the IT department that supports the Client Mac and them about the IPv6 ScopeID for this Client Mac.

Option 2:

  • Open a Terminal and enter the command ifconfig

The IPv6 ScopeID of this Mac is 4.

Mac with multiple network cards

If the Client Mac has multiple network cards, it will also have multiple IPv6 Scope ID's. In such a case, see Option 1: Contact the IT department that supports the Client Mac and ask them about the appropriate IPv6 ScopeID for this Client Mac, such that this Client Mac can connect with the AADServer(s).

Linux

  • Default an IPv6 Scope ID is required.
  • If the AADServer and the Linux Client PC have both a Public IPv6 address, enter 14 for the IPv6 Scope ID.
  • If the AADServer and the Linux Client PC have both a Local/Private IPv6 address, enter 2 for the IPv6 Scope ID. When IPv6 is used internally within a company, usually Local/Private IPv6 addresses are used for Client PC's, implying 2 for the IPv6 Scope ID.
  • If either 14 or 2 do not result in an IPv6 connection from the Client to the Server, contact the IT department that supports the Linux Client/Distri and ask them about the IPv6 ScopeID for this Linux Client.

Linux Client with multiple network cards

If the Linux Client has multiple network cards, it will also have multiple IPv6 Scope ID's. In such a case: Contact the IT department that supports the Linux Client and ask them about the appropriate IPv6 ScopeID for this Linux Client, such that this Linux Client can connect with the AADServer(s).


RDP+

RDP+

Availability

RDP+ is only available when connecting to an AADS Enterprise Terminal Server. The small version of AADS Terminal Server does not have the ability to do RDP+

Printjobs

RDP+ has the ability to transfer a printjob from the AADS Terminal Server to the client.

Using normal RDP it is possible for the AADS Terminal Server to print directly to the printer that is connected to a client. However, it is unfortunately also quite common that this does not work as expected due to various reasons like old, incorrect or different printer drivers on either the client or the server.

When RDP+ is used for print jobs, it is expected that the built-in PDF printer is used on the AADS Terminal Server;

  • Applications should print towards the built-in PDF printer.
  • When the printjob is finished, automatically the printjob can be transferred to the client:

Leave print files on the Server

The PDF-print file will be placed in the personal "AADServer Print Files" of the user on the AADS Terminal Server.

Copy print files to this Client

The PDF-print file will be placed in the personal "AADServer Print Files" of the user in the AADS Terminal Server, and the PDF file will be copied to the client in a personal folder "AADServer Print Files" on the client.

Move print files to this Client

The PDF-print file will not be placed in the personal "AADServer Print Files" of the user in the AADS Terminal Server. The PDF file will be moved from the AADS Terminal Server to the client in a personal folder "AADServer Print Files" on the client.

Location of the folder "AADServer Print Files"

The folder "AADServer Print Files" will be created below the Documents folder of the user.

When to use RDP+ Printjobs

The difference between using the local printer in the standard RDP way of printing, is that in case of the standard RDP way of printing, it is the server which does the print job. And both the server and the client do need the correct printer drivers in order for the server to be able to connect and use the printer that is connected to the client.
When using the RDP+ way of printing, the AADS Terminal Server does print to the built-in PDF printer on the server. That is “an easy printjob” and does not result in problems related to printerdrivers.
When the print job is finished, RDP+ does an automatic file-copy (or file-move) of the printed PDF-file from the AADS Terminal Server to the client, and a local printjob on the client is started.
Doing so can bypass those common printer problems when attempting to print as done in the standard RDP way of printing.

When you have a problem with printing to local printers, possible related to printerdrivers, you should consider to use RDP+ for printing.

Printer Options item

The options are described in the paragraph about the Integrated Postscript / PDF Printer.

FileTransfer

How the RDP+ FileTransfer works, is described in the paragraph about FileTransfer.


SSL

SSL

The option SSL can only be used with an AADS Enterprise Terminal Server, running the SSL gateway.

When SSL is selected, the user can choose among the installed Client Certificates:

SSL implies RDP+

When SSL is selected, automatically RDP+ is selected, because whenever SSL is selected, automatically the AADS Terminal Server can also do any RDP+ option.


Load Balancing

Load Balancing

Load Balancing can be used to connect the Client to an AADS Farm

Initial Dialog

When "Load Balancing" and "Ask user for Load Balancing hostname" is selected, the first time when the user attempts to connect to the Farm, the following initial dialog will be shown:

The user can enter:

  • DNS name of 1 of the AADServers in the Farm
  • IPv4 Address of 1 of the AADServers in the Farm
  • IPv6 Address of 1 of the AADServers in the Farm

The AADS Client will contact the Farm and obtain the IP Addresses of all AADServers in the Farm.

The next time the AADS Client is used, it will use the previous obtained Farm info and connect to any of the Servers in the AADS Farm. The Client will not ask the user again for 1 of the IP Addresses / names of a Server in the AADS Farm.

The user clicks on "Connect" and the Client PC will be connected to 1 of the Servers in the Farm.
The "preferred server" is shown. Which server in the Farm this is, depends on the current load of the each Server in the Farm.
The client will connect to the "preferred server".

In the example here, the Client will connect to the Farm using IPv6.
IPv6 will be used, because in the initial dialog where the user was asked to enter an DNS Name or IP Address of 1 of the Servers in the Farm, the user did enter an IPv6 address of 1 of the Servers.
If the user enters in the initial dialog an IPv4 address of 1 of the Server in the AADS Farm, then the Client will connect to the servers in the Farm using IPv4.

Other Farm

When the user clicks on "Other Farm", again the initial dialog will be shown where the user can enter the DNS name or IP Address of 1 of the Servers in the Farm.

Ask user for Load Balancing hostname

When connecting to an AADS Terminal Server Farm, and the AADS Client does not yet know any Terminal Server in the Farm, because for example this is the first time the AADS Client is being used,
the user will be asked for the name or ip address of a Terminal Server in the AADS Farm.

When the option Ask user for Load Balancing hostname is not selected, and the AADS Client does not yet know any Terminal Server in the Farm, the following message will be shown to the user:

SSL

When SSL and Load Balancing is selected:

The user will not be asked in an intial dialog for an IP address or DNS Name of a Server in the AADS Farm.

When SSL and Load Balancing is selected, it is the SSL Gateway of the AADServer that does the Load Balancing.
The SSL Gateway of the AADServer will connect the Client to the "preferred server" in the Farm.

The Client connects to the SSL Gateway on AADServer "aadserver1.company.com". The SSL Gateway will connect this Client to the "preferred server" in the AADS Farm.


Connect to a specific Server in the AADS Farm

Connect to a specific Server in the AADS Farm

When using any "generic RDP Client" software, not the AADS Client software, automatically the connection of this "generic RDP client" will be handled by the Load Balancing in the Farm.

An Administrator might have the need to connect to a specific Server in the AADS Farm. This can not be done using any "generic RDP Client" software. It can be done when using the AADS Client Software. In the Setting-tab, the Administrator selects RDP+ and un-check Load Balancing:

  • un-check Load Balancing
  • check RDP+

and the Administrator is able to connect directly to a specific Server in the Farm.


Connections

Connections

The AADS Client software is able to handle multiple connections to multiple AADS Terminal Servers:

  • The Folder button can be used to change the location of the multiple RDP-files.
  • The Duplicate button can be used to copy the selected "Connection" to a new one.
  • The Rename button can be used to rename the selected "Connection".
  • The Delete button can be used to delete the selected "Connection".

When "Multiple connection usage" is selected, in the first tabpage you select which "Connection" you want to use:

RDP Files

The settings of each "Connection" are written in a RDP file. These RDP-connection-files are placed in the selected folder.

In case a "Connection" is for a connection to an AADS Terminal Server -Farm, there will also be a v001_c003-file for that connection:

The connection "Server Sales" is a connection to an AADS Terminal Server -Farm. The details of this AADS-Farm (how many servers, ip addresses, etc) are stored in the file "Server Sales.aad_farm_v001_c003.txt".


Support

Support

In case there are issues with the AADS Client Software, the tabpage Support contains a ZIP Support Button. By clicking on the button, a Client-ZIP-Support-File will be created on the desktop:


Monitor Information

Monitor Information

The tabpage Monitor shows the details of the Monitors on the Client PC. This can be relevant in case the Client PC has more then 1 monitor, and the user wants to have a RDP-session on a specific monitor, or across all monitors.

1 Monitor is shown

When the AADS Client only shows 1 monitor, then apparently the operating system, videocard and driver do report 1 monitor.
Possible the PC has more then 1 monitor, but those multiple monitors are presented by the operating system, videocard and driver as 1 big monitor.

Multiple Monitors are shown

When the AADS Client shows mulitple monitors, it becomes possible to show the Remote Desktop on a specific monitor:

Example: Client will be Full screen on Monitor 3

The Remote Desktop in this example will be shown Full screen on Monitor 3, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 3, so it will do the Remote Desktop on Monitor 3:

Example: Client will be Full screen on Monitor 2

The Remote Desktop in this example will be shown Full screen on Monitor 2, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 2, so it will do the Remote Desktop on Monitor 2:

When the AADS Client shows multiple monitors, and those multiple monitors all have the exact same width x height, it becomes possible to show the Remote Desktop on all monitors:

Example: Full screen on all monitors

The Remote Desktop in this example will be shown Full screen on all Monitors:


Command Line parameters

Command line parameters

The AADS Client understands 4 command line parameters:

1 | RDP file | Personal RDP-file for the user. | Read / Write access
2 | v001c003 file | Personal v001c003 file which indicates an AADS Farm | Read / Write access
3 | RDP file | Master RDP file | Read access
4 | v001c003 file | Master v001c003 file | Read access

Example how to use these 4 command line parameters:

The following 2 shortcuts on the desktop of the user can be created for accessing Farm 1 and Farm 2:

aadWin32client.exe %homepath%\farm1.rdp %homepath%\farm1_v001c003.txt G:\master\farm1.rdp G:\master\farm1_v001c003.txt

aadWin32client.exe %homepath%\farm2.rdp %homepath%\farm2_v001c003.txt G:\master\farm2.rdp G:\master\farm2_v001c003.txt

(the examples above are 1 long command line with 4 command line parameters)

Farm 1 explained:

1 | RDP file | %homepath%\farm1.rdp This will be the personal RDP file for the user. The environment variable will be expanded. However, the very first time, this file does not exist. In that case the master file in command line parameter 3 will be used.
2 | v001c003 file | %homepath%\farm1_v001c003.txt Personal v001c003 file which indicates Farm 1. This fill will be created and updated. The very first time this file does not exist. In that case the master file in command line parameter 4 will be used, and the user will not be prompted for an IP Address of a server in the Farm.
3 | RDP file | G:\master\farm1.rdp This RDP file should contain correct initial values for the users of Farm1. It will only be red, once, when the personal RDP file as indicated by command line parameter 1 does not exist.
4 | v001c003 file | G:\master\farm1_v001c003.txt This v001c003 farm file should contain initial values for the users of Farm1. It will only be red, once, when the personal v001c003 file as indicated by command line parameter 2 does not exist.

The Administrator can create several shortcuts for accessing the multiple Farms.

  • Each shortcut can have its own 4 command line parameters.
  • Each shortcut can have its own 2 master files in command line parameter 3 and 4.


Connection Examples

Connection Examples

Hostname | Win10Server
IPv4 address | 192.168.200.100
IPv6 address | fe80::49ab:a012:38f5:4401
Portnumber RDP | 12345
Portnumber SSL | 23456

  • The default portnumber for RDP is 3389. Because of these examples, it is changed to 12345
  • The default portnumber for SSL is 3443. Because of these examples, it is changed to 23456

Windows Firewall on the Win10Server

Hosts file on the Win7 Client PC

For these examples, the hosts file is used on the Client PC such that the servername Win10Server can be resolved by the Client PC. Usually resolving DNS names is not done by editing the hosts file on each Client PC, but is done otherwise.

Note: When DNS is used to connect to a Server, it might happen that the selection for IPv4 or IPv6 in the Client is "over-ruled" by the response of the DNS Server. For example, If the DNS Server "only" replies with an IPv4 address for the Server, then the Client might attempt to connect using IPv4, and ignore the setting for IPv6.

AADS Client on Windows 7

RDP or RDP+

  • Connect to Server using IPv4 address
  • RDP on port 12345

  • Connect to Server using DNS Name
  • using IPv4
  • RDP on port 12345

  • Connect to Server using IPv6 address
  • RDP on port 12345

  • Connect to Server using DNS Name
  • using IPv6
  • RDP on port 12345

SSL

  • Connect to Server using IPv4 address
  • SSL on port 23456

  • Connect to Server using DNS Name
  • using IPv4
  • SSL on port 23456

  • Connect to Server using IPv6 address
  • SSL on port 23456

  • Connect to Server using DNS Name
  • using IPv6
  • SSL on port 23456

Microsoft RDP client on Windows 7

RDP

  • Connect to Server using IPv4 address
  • RDP on port 12345

  • Connect to Server using DNS Name
  • RDP on port 12345

The Microsoft RDP Client has no explicite setting for IPv4 or IPv6
when connecting using a DNS name.

  • Connect to Server using IPv6 address
  • RDP on port 12345

AADS Client on Linux/OSX

RDP or RDP+

  • Connect to Server using IPv4 address
  • RDP on port 12345

  • Connect to Server using DNS Name
  • using IPv4
  • RDP on port 12345

  • Connect to Server using IPv6 address
  • RDP on port 12345

  • Connect to Server using DNS Name
  • using IPv6
  • RDP on port 12345

SSL

  • Connect to Server using DNS Name
  • using IPv6
  • SSL on port 23456

Note

Not all possible combinations of RDP, SSL, IPv4, IPv6, DNS are shown in these examples.
However, when viewing these examples, it should be understood how it works...


RDP+ Client Update Manager

RDP+ Client Update Manager

The RDP+ Client Update Manager runs on each Client PC, and takes care of the following:

  • Update AADS Client Software in case the AADServer is updated.
  • Updates itself in case the AADServer is updated.
  • Update the set of SSL Server Certificates in case a Server is added / removed from the AADS Farm.

AADS Client for Windows

RDP+ Client Update Manager for Windows is a separate service process. It is installed on the Client PC when AADS Client for Windows is installed.

AADS Client for OSX and Linux

AADS Client for OSX and Linux do have the same built-in RDP+ Client Update Manager, but it is not a separate process as it is on Windows. It is a built-in function of the AADS Client for OSX and Linux.

In order for the RDP+ Client Update Manager being able to do it's update-job, it is assumed that the OSX and Linux AADS Clients are installed as described in this Manual. In case the Administrator installs the AADS Clients in some different way, such that the AADS Clients do not have "read/write rights" to update itself, or for updating SSL certificates, the RDP+ Client Update Manager will log errors and no update will be done.


Backup/Restore

Backup/Restore

Using Backup/Restore, the Administrator can create a Backup-File with all the relevant AADServer settings.

The Backup-File will be a ZIP-File, and it will be placed on the desktop of the Administrator:

In the name of the Backup-File you will find the date-time stamp of the Backup.

The Backup-File can be used to restore all AADServer settings on this AADServer. It can also be used to quickly copy all AADServer settings to another AADServer; use the Restore function on this other AADServer for importing all AADS-Settings as they are placed in this Backup-File.

  • Backup
  • Restore


Backup

Backup

What can (and can not) be placed in the backup, is shown:

  • Auto Logon
  • Domain / Workgroup settings
  • SSL Gateway settings and Certificates
  • All settings related to Application Control .
  • RDP+ Firewall, the Manual White List and the Black List. Other FW Lists are created and filled automatically and do not need to be in a backup/restore.
  • All settings and files related to the built-in WebServer .
  • All the AADS Settings.

It might happen that an option is default not checked, because this AADS function is not being used. For example, if Application Control is not used, then it makes little sense to include it in the Backup-File.

Optional the Backup-File can be protected with a password.


Restore

Restore

The first step is to select a Backup-File. When a Backup-File is selected, depending on the contents of the Backup-File, the Restore-options will be enabled:

In the example above,

  • The Backup-File is protected with a Password.
  • The Backup-File does not contain any FW Lists.

Note: after a Restore, it might happen that AADS Maintenance Control does restart itself.

Password

When the Backup-File is protected with a password, it will be required to enter the Password, before any Restore option becomes available.

Full Restore takes 3 steps

When you want to restore the Auto Logon or Domain, Workgroup settings, this will need to be done separately from Restoring other AADS Settings. A Full Restore needs to be done in 3 steps:

  1. Auto Logon
  2. Domain, Workgroup settings
  3. All other AADS settings

Check all Settings after a Restore

It is strongly recommended that after a Restore, the Administrator uses AADS Maintenance Control, and checks if all settings are OK, because, for example:

The Backup-File might be 1 year old. Therefore it might contain settings that are not expected anymore. For example, it might contain www-pages that are 1 year old and are out-dated. Or it might contain Application Control settings for applications that are not being used or installed anymore on the AADServer.


Uninstall

Uninstall

The Support tabpage contains the option for uninstall.

Prior to uninstalling this notification is shown.

Uninstall does not solve AADS problems

Before you consider to uninstall AADS Terminal Server, you should know that uninstall AADS Terminal Server does not solve any problem.
Uninstall AADS Terminal Server does only do:

  • uninstall:
    • delete all AADS files.
    • delete all AADS settings.
    • restore default Windows single logon, single desktop settings.

If you want to fix some kind of AADS Terminal Server problem, all you have to do is re-install AADS Terminal Server. Do not uninstall AADS Terminal Server. Re-install AADS Terminal Server on top of the current installation.

No other users should be active while uninstalling

Be sure that nobody is logged in except for the Administrator. In case other users are logged in, system files and settings are locked and can not be restored by AADS Terminal Server uninstall.

Do not manually remove AADS Program Files

In case there is some "other problem" with an AADS Terminal Server, and because of this you want to Uninstall AADS, you might be tempted to delete AADS Program Files, hoping that this will also remove AADS and fix this "other problem". It is not recommended to delete AADS Program Files. AADS is part of the Operating System, and deleting AADS Program Files will not solve any problem, but cause more problems.

If you want to Uninstall AADS Terminal Server, it can always be done as follows:

  • Boot Windows into Save Mode.
  • While running Windows in Save Mode, use AADS Maintenance Control, the Uninstall button, for Uninstalling AADS Terminal Server.

Manual activity after uninstall

After the uninstall of AADS Terminal Server you should perform the following actions:

  • Configure your Firewall in such a way that remote desktop sessions are not possible.
  • Remove all users form the group Remote Desktop users.


Copyrights

Previous

Copyrights

All contents copyrighted by:

AADS WorldWide LTD

Miramar Tower
132 Nathan Road
Tsimshatsui Kowloon
Hong Kong 		City Tower 2
Sheikh Zayed Road
Dubai
UAE

Other products

All products mentioned are copyrighted by their respective owners.

Other licenses

Lazarus and Free Pascal

Lazarus is a Integrated Development Environment (IDE) for Pascal and is distributed using GPL. Lazarus can be found here:

http://www.lazarus.freepascal.org/

Using Lazarus it is possible to develop programs based on Pascal. Free Pascal is distributed using GPL, and can be found here:

http://www.freepascal.org/

Both Lazarus and Free Pascal do come with libraries. These libraries can be obtained by downloading either Lazarus and / or Free Pascal.

rDesktop

rDesktop is a linux implementation of a RDP-client, and is distributed using GPL. rDesktop can be found here:

http://www.rdesktop.org/

FreeRDP

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. FreeRDP can be found here:

http://www.freerdp.com/

GhostScript

Ghostscript is an interpreter for the PostScript language and for PDF. Ghostscript is distributed using GPL, and can be found here:

http://pages.cs.wisc.edu/~ghost/

OpenSSL

The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols as well as a full-strength general purpose cryptography library, and can be found here:

http://www.openssl.org/

The OpenSSL license can be found here:

http://www.openssl.org/source/license.html

GPL

Information about GPL, the GNU General Public License, can be found here:

http://www.gnu.org/licenses/gpl.html

Apache License

Information about the Apache License, can be found as follows:

https://www.google.com/search?q=apache+license

MaxMind

AADS uses GeoLite2 data created by MaxMind, available from MaxMind.

IPInfoDB

AADS uses IP2Location LITE data available from IPInfoDB.

Copyright 2012-2019 AADS WorldWide LTD. AADS Terminal Server | Application Server | Remote Desktop solutions | Firewall

Previous


Install X11 - 2.6.3 on OSX Leopard

Install X11 - 2.6.3 on OSX Leopard

Be sure to login on your Mac with an userID that has Administrator Privileges.
The primary / first user is usual an Administrator account.

Step 1:

  • Download X11-2.6.3.dmg and place it on your Desktop:

Step 2:

  • Open the package by double-clicking on the dmg-file:

Step 3:

  • Install the package named XQuartz 2.6.3:

Step 4:

  • Your Mac is now ready for the AADS Client software.
  • You can optionally save the package X11-2.6.3.dmg in case you might need it to install it again in the future.


Install XQuartz 2.7.7 on Snow Leopard 10.6 or newer

Install XQuartz 2.7.7 on Snow Leopard 10.6 or newer

Be sure to login on your Mac with an userID that has Administrator Privileges.
The primary / first user is usual an Administrator account.

Step 1:

  • Download XQuartz-2.7.7.dmg and place it on your Desktop:

Step 2:

  • Open the package by double-clicking on the dmg-file:

Step 3:

  • Install the package:

Step 4:

Reboot your Mac or logout / login:

Step 5:

  • Your Mac is now ready for the AADS Client software.
  • You can optionally save the package XQuartz-2.7.7.dmg in case you might need it to install it again in the future.