This manual

Next

Home

This Manual: Build 124.18 (18 Apr 2016)

This manual is applicable to AADS Build 124.18 (18 Apr 2016)

This manual can be downloaded: AADS Terminal Server Small Manual . The file format is a CHM-file (Compressed Help File).

Every Windows version is able to view the contents of a CHM-file, provided that the file is located on a local disk.
CHM-files which are located on a network-drive are not viewable in Windows.

The App-store for OSX offers various readers for CHM-files.

On Linux you can use the package xCHM for viewing CHM-files.

This manual applies to:

  • AADS Small Terminal Server - Windows 10 - 32 bits - 5 user - v10.0
  • AADS Small Terminal Server - Windows 10 - 32 bits - 10 user - v10.0
  • AADS Small Terminal Server - Windows 10 - 32 bits - no user limit - v10.0
  • AADS Small Terminal Server - Windows 10 - 64 bits - 5 user - v10.1
  • AADS Small Terminal Server - Windows 10 - 64 bits - 10 user - v10.1
  • AADS Small Terminal Server - Windows 10 - 64 bits - no user limit - v10.1
  • AADS Small Terminal Server - Windows 8.x - 32 bits - 5 user - v8.0
  • AADS Small Terminal Server - Windows 8.x - 32 bits - 10 user - v8.0
  • AADS Small Terminal Server - Windows 8.x - 32 bits - no user limit - v8.0
  • AADS Small Terminal Server - Windows 8.x - 64 bits - 5 user - v8.1
  • AADS Small Terminal Server - Windows 8.x - 64 bits - 10 user - v8.1
  • AADS Small Terminal Server - Windows 8.x - 64 bits - no user limit - v8.1
  • AADS Small Terminal Server - Windows 7 - 32 bits - 5 user - v7.0
  • AADS Small Terminal Server - Windows 7 - 32 bits - 10 user - v7.0
  • AADS Small Terminal Server - Windows 7 - 32 bits - no user limit - v7.0
  • AADS Small Terminal Server - Windows 7 - 64 bits - 5 user - v7.1
  • AADS Small Terminal Server - Windows 7 - 64 bits - 10 user - v7.1
  • AADS Small Terminal Server - Windows 7 - 64 bits - no user limit - v7.1
  • AADS Small Terminal Server - Windows XP Prof SP2 or higher - 32 bits - 5 user - v1.9
  • AADS Small Terminal Server - Windows XP Prof SP2 or higher - 32 bits - 10 user - v1.9
  • AADS Small Terminal Server - Windows XP Prof SP2 or higher - 32 bits - no user limit - v1.9
  • AADS Small Terminal Server - Windows Vista - 32 bits - 5 user - v4.0
  • AADS Small Terminal Server - Windows Vista - 32 bits - 10 user - v4.0
  • AADS Small Terminal Server - Windows Vista - 32 bits - no user limit - v4.0
  • AADS Small Terminal Server - Windows Vista - 64 bits - 5 user - v4.01
  • AADS Small Terminal Server - Windows Vista - 64 bits - 10 user - v4.1
  • AADS Small Terminal Server - Windows Vista - 64 bits - no user limit - v4.1

AADS Maintenance Control tells you which build of AADS is installed:

Copyright 2016 AADS WorldWide LTD, Hong Kong. AADS Terminal Server | Application Server | Remote Desktop solutions

Next

Home


Installation

Installation

Setup program name

The AADS Terminal Server Setup program is either call AADServer**Demo.exe or AADServer**Full.exe. The ** denotes the AADS Terminal Server version you are installing.

Administrator

Only an user with Elevated Administrator access on the system can install the AADS Terminal Server software.

Installation Procedure

Select Language

Select the desired language. AADS will be installed with the selected language.
The selected language will also be included when generating a Client Build for RDP or a Client Build for SSL.

Demo version

In the first screen of the “Demo Version” you are requested to read the License Terms of Use and acknowledge them. The Demo version also contains a "Check for Update" button in the first screen:

Before your proceed with the installation of AADS Terminal Server Demo, be sure to check that you are installing the latest version.

AADS Terminal Server Demo will run for 60 days. After 60 days it is not possible any more to login using a Remote Desktop Session; login is only possible using the console of the AADS Terminal Server.

Full, Paid version

In the first screen of the "Paid, Full version" you are requested to enter your license code. The AADS License Numbers has 2 formats:

  • 12 positions in the range A..Z and 0..9. Example: 12AB 34CD 56EF (this is not a valid number)
  • 18 positions, containing only letters A..Z. Example: EKOHIGJZ-TTMJKDFG-EWPLKAQR (this is also not a valid number, just an example)

When you are installing AADS Full, you will need to enter the License Number in the 12 position format.
After the installation of AADS Terminal Server Full, AADS Maintenance Control will show you the License Number in the 18 position format.

When you are installing AADS Demo, there is no need for entering a License Number.
After the installation of AADS Terminal Server Demo, AADS Maintenance Control will show you "Demo" as the License Number.

You are also requested to read the terms of use and acknowledge them.

After entering you license code and the acknowledgement of the Terms of Use, the Next-button becomes available.

HTTP Port 80

A HTTP-request and reply is sent to our License Servers in order to validate your license. AADS Terminal Server Setup behaves like a normal browser when contacting the License Servers. It does a HTTP-request on port 80.
Optional you can specify a HTTP-Proxy server.

Checking system requirements

The AADS Terminal Server Setup program checks whether or not the installation of AADS Terminal Server is possible:

No Domain Users

When the Setup program detects that this Windows System is part of a Domain, it will remove it from the Domain. AADS Small can only be used on stand-alone servers.

Install AADS

In case it is possible, you can click on Next in order to install AADS Terminal Server.
If you click on Exit now, nothing will be installed.

The AADS Terminal Server software is installed In a couple of steps.

The Full, Paid version of AADS Terminal Server can be re-installed on the same server in case such is required.

Result of the Installation Procedure

The software is installed:

You are one reboot away from using your AADS Terminal Server.

RDP FireWall

Default setting for the built-in RDP FireWall is that RDP connections from public IP Addresses to the AADS Terminal Server are blocked. However, because the Administrator is busy with installing and configuring AADS, it might be required to temporary allow RDP Connections from Public IP Addresses. Default it is possible to access the AADS Terminal Server from public IP Addresses for 1 hour after the reboot. The Administrator who is installing AADS can change this to a maximum for the next 48 hours.

Maintenance AADServer

A program entry will be made in the Administrative section of the Start menu of the system.

Copyright 2016 AADS WorldWide LTD, Hong Kong. AADS Terminal Server | Application Server | Remote Desktop solutions


Virtualization

Virtualization

AADS works OK when running inside a VM (Virtual Machine). We do most test-work using Virtualization.
We have a FAQ about AADS and Virtualization .

When using Virtualization to run Windows and AADS, do make sure that you apply "reasonable" VM-settings:

  • Assign enough memory to the VM.
    4 GB for Windows 7 is reasonable.

  • Assign at least 2 cores / cpu's to the VM. Modern versions of Windows do not run very smooth any more on only 1 cpu / core.


Additional steps before using AADS Terminal Server

Additional steps before using AADS Terminal Server

After the installation of the AADS Terminal Server software, and after the reboot of the system, you need to perform a couple of steps in order to use the AADS Terminal Server:

  • Create users that can login using a Remote Desktop Session. If your Windows system has only one user, you will hardly use the benefits of the AADS Terminal Server product.
  • Make sure that all users have a password. It is not possible to have a Remote Desktop Session with an user ID that has no password. This is simply to unsafe.
  • Make sure that all users are member of the group "Remote desktop users". If an user is not a member of the group "Remote desktop users", this user will not be allowed to have a Remote Desktop Session. You can also use our
  • Maintenance Program to give any verified user access to the AADS Terminal Server. A verified user is an user who has entered his username and password.
  • Open your firewall for Remote Desktop Sessions. The port that needs to be open is TCP port 3389. Default this port is closed, so your Windows system does not allow you to have any remote desktop session.

Important: Sometimes you might turn off the Windows Firewall because you are testing a system and while doing such you are not "interested" in the protection as offered by the Windows Firewall. It does happen that the firewall is turned on again, without informing you. An example of this behaviour is joining or un-joining a Windows system from a domain. After the (un)join, the Windows Firewall is turned on again.

Please visit our website, specific the FAQ Support-pages. You will find detailed examples and howto's between our FAQ's which describes how you can perform these steps.


Setup problems

Setup problems

Example 1

The AADS Terminal Server Setup program does a checking of the system for requirements. In case the requirements are not met, you will be informed what the problem is.
AADS Terminal Server can not be used on Windows Home.

Example 2

Problem: There seems to be another software installation that is waiting for a reboot

The installation of the software requires 1 reboot of the server in order to complete the installation of the software. A reboot of a Windows system in order to complete the installation of software is quite normal. Therefore, other software companies might also require a reboot to complete their installation of the software.
To prevent problems and conflicts, AADS Terminal Server Setup program will not install when another piece of software requires a reboot to complete its installation.

Sometimes, our Setup program keeps on saying "There seems to be another software installation that is waiting for a reboot" because every time the system is running, for some reason a piece of software put itself in the Registry of the PC, specific the location where Setup-programs can finalize their installation. Some viruses and trojan horses abuse the Registry, specific this setup-location, in order to install itself again every time the PC is restarted.
In case the Setup program keeps on telling you the message "There seems to be another software installation that is waiting for a reboot", you are advised to check your PC for viruses, spyware or trojan horses.

If you are sure that no viruses are running on your PC, you can execute the following Registry File. It will clear the settings in the Registry that are blocking the installation of the Software. The procedure is as follows:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\]
"PendingFileRenameOperations"=-

  • Create the Registry-file as shown here above. Create it for example on your desktop and call it "pending.reg".
  • Be sure that the Registry-file has the extension ".reg". Because Windows does default not shown the extensions, and the file you just created might have the extension ".txt".
  • Double click on the Registry file. The setting will be "merged" in the Registry.
  • Continue the installation of the Software.

Final screen in case of AADS Terminal Server Setup problems

In case the Setup program decides that installation is not possible, it will finish as shown.

If you need support on the problem, you are requested to supply us with the Support-ZIP-file. This will assist us with analyzing the problem. You can use the ZIP-button to create the ZIP-file. It will be placed on your desktop.


Upgrade of AADS Terminal Server

Upgrade / Re-install of AADS Terminal Server

The AADS Terminal Server Setup program always behaves as if it is doing an upgrade. This implies that it will respect the settings that are already done.

An upgrade from the Demo version to a Full version is therefore quite simple:

  • Buy the Full version,
  • Run the Setup of the Full version,

and that's it.

The Upgrade behavior does apply to:

  • An upgrade from AADS Small version to AADS Enterprise,
  • An upgrade from Demo to the Full version,
  • An upgrade from an old version 1.2.3 to a new version 1.2.4.

and it applies to:

  • A downgrade from version 3.2.1 to version 1.2.3

It is possible to downgrade AADS Terminal Server, although we would not know why you would want to do that. If you downgrade from Full version to Demo version, the result will be that your Server is again limited to 3 users.

If you do not want the Setup program to do an upgrade of your current AADS Terminal Server, you must first uninstall the current AADS Terminal Server software, and after the uninstall, run the AADS Terminal Server Setup program. All AADS Settings are lost and you will need to reconfigure everything on your AADS Terminal Server.

Fixing problems by re-installing AADS Terminal Server

Sometimes you can fix problems with a re-install of AADS Terminal Server. It does unfortunately happen that, for example, Windows Update or some kind of anti-virus software update, does revert settings that are relevant for AADS Terminal Server. Usually Windows is a single user, single desktop, single login operating system, and those updates might not expect or understand the multi-user, multi-desktop, multi-login as made available by AADS Terminal Server.
When there is an issue, do not uninstall AADS Terminal Server. Only re-install AADS Terminal Server on top of the current installation.

Firewall

AADS has been changed and improved. It will be required to configure both the AADS built-in RDP Firewall and the Windows Firewall.

  • AADS built-in RDP Firewall
  • Windows Firewall

Don't be tempted to disable the Window Firewall or the AADS built-in RDP Firewall. Too often we receive ZIP Support Files with loglines indicating many hack-attempts because of a disabled AADS RDP Firewall or no Firewall


Upgrade from XPUnlimited

Upgrade from XPUnlimited

The AADS Terminal Server Setup program always behaves as if it is doing an upgrade. This implies that it will respect the XPUnlimited settings that are already done.
Do not un-install XPUnlimited, but install AADS Terminal Server Setup on top of XPUnlimited.

When AADS Terminal Server Setup detects old XPUnlimited files and settings, the following specific actions will happen:

  • All XPUnlimited settings will be migrated to AADS settings, including:
    • Application Control settings
    • Webserver
    • PDF printer
  • XPUnlimited executable files will be deleted
  • XPUnlimited logging and, if applicable, the www-folder, will be backup-ed in the folder:
    \ProgramData\It_is_OK_to_delete_old_xpunlimited_folder    (x64 versions of Windows)
    \Program Files\It_is_OK_to_delete_old_xpunlimited_folder  (x32 versions of Windows)

Firewall

AADS has been changed and improved compared to XPUnlimited. It will be required to configure both the AADS built-in RDP Firewall and the Windows Firewall.

  • AADS built-in RDP Firewall
  • Windows Firewall

Don't be tempted to disable the Window Firewall or the AADS built-in RDP Firewall. Too often we receive ZIP Support Files with loglines indicating many hack-attempts because of a disabled AADS RDP Firewall or no Firewall at all......


Operation

Operation

The Operation of AADS Terminal Server can be monitored and controlled using our Maintenance tool. It can be found in the Administrative Tools of the Control Panel:

The initial screen of AADS Terminal Server Maintenance tools is as follows:


Control

Control

Run / Stop

Using the Run and Stop buttons, it is possible to temporarily disable new Remote Desktop logins to an AADS Terminal Server. Current Remote Desktop Sessions will not be affected.

Usually there is no need to stop the AADS Terminal Server. It might be useful for those moments, for example, where the Administrator is about to install an application, or an update of something, and because of that users should temporarily not be able to login on the AADS Terminal Server.

Uninstall

You can use the first tab page for un-installing the AADS Terminal Server software.

Connections

As shown in the example above, AADS Demo can handle 3 sessions, and currently there is 1 sessions.

Boot Time

The Boot Time and Uptime of the AADServer is shown.


License

License

The License tabpage shows the License type and License Number. The AADS License Numbers has 2 formats:

  • 12 positions in the range A..Z and 0..9. Example: 12AB 34CD 56EF (this is not a valid number)
  • 18 positions, containing only letters A..Z. Example: EKOHIGJZ-TTMJKDFG-EWPLKAQR (this is not a valid number)

AADS Maintenance Control Full, will show you the License Number in the 18 position format.

AADS Maintenance Control Demo, will show you "Demo" as the License Number.

Offline License Type

The Full, Paid version of AADS Terminal Server can use both an "Offline" and "Online License Type".
In case an "Offline License Type" is being used, it is shown as follows:

The Offline License Type does not need Internet access and does not need to be re-newed.

Online License Type

In the example above, a Demo License is shown, which is always of the "Online License Type".
A Demo License is valid for 60 days. The End-date is shown.

Automatic License Re-New, Online License Type

Approximately once a week the Online License will be renewed.
Default renewing the "Online License" is done automatically.

Manual License Re-New, Online License Type

In case it is preferred not to connect the AADServer to the Internet, it is possible to use a browser for the re-newing of the "Online License".
The AADServer can be disconnected from the Internet.

In such a case, de-select Automatic License Update, and click on the Apply-button.
And when the AADServer needs to re-new the temporary Online License, it will be shown as follows:

When the "Online License" needs to be re-newed, a "LIC REQUEST" will be shown.

Copy-and-paste the complete "LIC REQUEST" in to a browser, in to the "License Request" procedure on our website:

Click on the "submit-button", and after a few seconds, a "LIC REPLY" is shown:

Copy the whole "LIC Reply" into AADS Control, and click on the "Set License" button:

Click on the "Set License" button.

After a couple of seconds, the "LIC Reply" is processed by the AADServer, and such is shown as follows:

Notifications

Be sure to read the paragraph about Notifications . When Notifications are enabled, the AADServer will sent an email to the Administrator when the Manual License Re-New procedure needs to be done.


Support

Support

Check for Update

The Update-check button opens a website-page of our AADS WorldWide website.
The webpage page will inform you whether or not you are running the most recent version of AADS Terminal Server, or an old version.

ZIP Support Button

The Zip-button creates a Support-Zip-File on your desktop. This contains the information we need for giving you support.

Create a Support-ZIP-file when asking support

When asking us support, please mail us the Support-ZIP-file. This ZIP-file will be placed on your desktop, and it will contain all the information we need to analyze the problem.

Important: when creating a Support-ZIP-file, be sure to login on the AADS Terminal Server as an Administrator. Otherwise information might not show up in the logfile.


Notifications

Notifications

Notifications are emails sent to the Administrator (or someone else.....) of the AADServer.

Enter the appropriate settings, and click on the Apply-button.

After clicking on the Apply-button, it is possible to send a Test-email.

Optional all sent-emails and trace-files are saved. In case of smtp-related-trouble, the trace-files might be useful for analyzing the smtp-related-trouble.

When to send a Notification

The second tabpage shows the various "when" to send a Notification:


Terminal Services

Terminal Services

Settings

Advanced settings using Microsoft Management Console

The initial screen of the Advanced Settings is as follows:

  • You can set and configure Policies for this AADS Terminal Server.
    • You can configure advanced Remote Desktop Settings.
  • You can add / remove local users and groups on the AADS Terminal Server.
  • You can view the Windows Eventlog.

Please note: initial it might take a few seconds to show this screen.

Advanced Remote Desktop Settings

You can do some fine-tuning, but you are advised to be carefully with changing the default settings. You might render your system unusable.

When you click on an option, extra text will appear that explains this option. You are advised to read this text carefully prior to changing an option.

Please note: not all Remote Desktop options are implemented. Several Remote Desktop options are displayed because AADS Terminal Server delivers 1 solution for various Windows versions.

Reboot required

Changing an Advanced Setting of the AADS Terminal Server will require a reboot of the Windows System; the change will be in effect after a reboot.

Users and Groups

Select Users in the left panel. Use the right mouse button on the “white space” in the right panel. A sub-menu will be shown, including New User...

Use the right mouse on a user. The sub-menu that is shown contains the option for giving the user a password.
Users without a password can not have a remote desktop session. This is to unsafe.

Select Groups in the left panel. Use the right mouse on the group Remote Desktop Users. The sub-menu that is shown contains the option for adding an user to the group.

Removing a user's membership of the group Remote Desktop Users is also done using the “Add to Group” menu options. When clicking on the sub-menu “Add to Group”, a dialog is shown that can be used for both adding and removing users.

Only users who belong to the group Remote Desktop Users can have a remote session.

Control Panel

The "Control Panel" button shows the Windows Control Panel, with direct links to every setting that is possible with the Windows Control Panel:

Portnumber

You can change the default port number which is used by the AADS Terminal Server for listening for Remote Desktop Sessions. The default number is TCP port number 3389.
The range of the custom value is 1000 – 65534. Although a number lower then 1000 might be technical possible, this is disabled in order to prevent problems.

If you change the port number to another value:

  • You will also have to change your firewall settings.
  • If you use some kind of router to connect to the Internet, most likely you have defined a NAT-entry in your router in order to forward a port to the AADS Terminal Server. You must also update this NAT-entry in your router.
  • You must inform all you users, because the client software they use for connecting to the AADS Terminal Server needs to know about the changed port number.

Reboot required

A reboot is required before the new port number is used by AADS Terminal Server.

Require membership of the group Remote Desktop Users

Default only users who are member of the group Remote Desktop Users can login. You can remove this requirement by selecting “verified users”. A verified user is an user who has a valid username and password defined locally in Windows.

Block logins if Windows is reaching a resource limit

AADS Terminal Server contains a thread that detects generic problems. One of those generic problems is an UNDER-sized or UNDER-powered server.

When this thread needs, for example 30 seconds, it indicates that there has been a moment where the cpu was 100% busy with something for this amount of time.
In those 30 seconds, nobody could login, nobody got a moving mouse, maybe tcp/ip connections are dropped because of time-outs. time-outs while writing data to disk, etc.
This implies a failing server. This implies failing basic functionality of Windows.

This "snap time" is something that is build into AADS Terminal Server. It is not really about AADS Terminal Server itself, but we get support emails about it.
There are also events in the Window logging from AADS Terminal Server stating

Windows is exceeding a resource limit

If that happens to often, with no particular cause, then the server is UNDER sized.
If that happens once, for instance because the virusscanner is doing a scan at 02:00, then it can be considered as OK.

Please be advised to check the Windows Event log for warnings and errors.

When you check the option "Block logins if Windows is reaching a resource limit", new logins on this AADS Terminal Server are blocked as long as the server has a "to-high" cpu utilization.


RDP Client Build

RDP Client Build

An AADServer can be accessed using any modern RDP client running on Windows, OSX, Linux, iOS, Android, etc.
For Windows, the users might prefer to use the AADS Client Software for accessing the Terminal Server(s).

The Administrator can create a "RDP Client Build", which can be installed on the Windows Client PC's. The Client Setup build will be placed on the desktop of the Administrator. From there it can be distributed to the user(s).

Optional you can password-protect the Client Setup build. The user who wishes to install the Client Setup build on his client PC, will be requested for the password while installing the Client Setup build on his client PC.

See Client Software on HowTo use the AADS Client Software.


Disconnect / Logoff

Disconnect / Logoff

Using our program "ViewUsers" it is possible to Disconnect or Logoff other users. Default this ability is only possible for Administrators.

AADS has now a new setting. The IT-Administrator can define a group, on the local AADServer, and members of this group can be allowed to Disconnect or Logoff other users.

Define a new group and make 1 or more users member of this group.

Members of the group "DisconnectLogoff" are allowed to use the tool ViewUsers , and Disconnect or Logoff other users.


Application Control

Application Control

The purpose of AADS Application Control is limit the desktop of the users such that they can do "create problems". The users should only have a limited desktop with only those few applications that they need for their work.

Availability

AADS Application Control is available as follows:

 | Desktop Applications (win32 applications) | Metro Applications / Immersive Shell | Continuum Applications
Windows 10 | Can be controlled | - | Can not be controlled
Windows 8.x | Can not be controlled | Can not be controlled | -
Windows 7 | Can be controlled | - | -
Windows Vista | Can be controlled | - | -
Windows XP | Can be controlled | - | -

Initial Screen

The initial screen is as follows:


Mode and Type

Application control mode and type

Application control mode

Application Control has 3 different modes op operation:

The default mode is “No Application Control”. Every remote user always sees a complete, default Windows desktop.

The second and third option turns on the Application Control. The difference between the second and third option is what a user sees in case no applications are available for the user. The second option will give the user a complete desktop without any restriction. The third option will show the remote user a message that the Administrator has not made any application available for the user. The remote user is not able to continue to work:

Application control type

Strict Application control implies that the user is not allowed to start any other application then those which are assigned to him by AADS Application Control.
Default this is the best, most secure choice.

However, it might happen that some applications do need to start other (sub-) applications. For example, an Office suite that starts the Write-program, or the Spreadsheet program.
The Administrator might not always be able to figure out how many other (sub-) applications are needed to be started by the user. And if the Administrator does not know exactly what the user will be starting, then the Administrator can also not assign those (sub-)applications to the user.
This might be a circumstance where "Relaxed Application control" can be considered.

Please note: when Relaxed Application Control is applied, assigned applications can / are allowed to start other, not-assigned applications. Examples:

  • The Office program can start the separate Help-program when the user presses F1.
    • This is an OK situation.
  • The Browser can start its own separate Updater-program. It will do this when it detects that an update is available for download.
    • This can be OK. However, the Administrator might not want that users or programs do decide for themselves when to install updates.

Administrator and Application Control

Application Control does not apply to the user Administrator. It is important that the user Administrator can not be restricted using Application Control, because if he gets restricted, he can not start the Maintenance program any more in order to fix his restrictions......

Failing Domain or Failing Authorization

Which Applications are available to an user can depend on the Group-membership of the user. In the event of problems related to a Failing Authorization, for example because Windows is failing, or some third party Credential Provider is failing, the AADServer is not able to determine what the Group-membership of the user is. In such an event, it is possible to block all users, except the Administrator, such to prevent that the users do access "the wrong applications". The Administrator must fix the problems related to the Failing Authorization, and after this is fixed, the users can access their assigned applications again.


Start Menu Title

Start Menu Title

It is possible to change the Title of the Start Menu as presented to the user:

2 text-lines can be edited. It is possible to enter some text in each of the 2 lines, whatever you want.

Within the text you can enter "environment variables". If you want to see which "environment variables" are available on an AADServer, open a DOS-BOX and enter the command "set":

Show date/time

It is possible to show the date/time in the Start Menu of the user, using the custom-line of test %DT= xxxx%

The format of the date/time as shown, can be edited as follows:

c | Displays the date using the format given by the ShortDateFormat global variable, followed by the time using the format given by the LongTimeFormat global variable. The time is not displayed if the fractional part of the DateTime value is zero
d | Displays the day as a number without a leading zero (1-31).
dd | Displays the day as a number with a leading zero (01-31).
ddd | Displays the day as an abbreviation (Sun-Sat) using the strings given by the ShortDayNames global variable.
dddd | Displays the day as a full name (Sunday-Saturday) using the strings given by the LongDayNames global variable.
ddddd | Displays the date using the format given by the ShortDateFormat global variable.
dddddd | Displays the date using the format given by the LongDateFormat global variable.
m | Displays the month as a number without a leading zero (1-12). If the m specifier immediately follows an h or hh specifier, the minute rather than the month is displayed.
mm | Displays the month as a number with a leading zero (01-12). If the mm specifier immediately follows an h or hh specifier, the minute rather than the month is displayed.
mmm | Displays the month as an abbreviation (Jan-Dec) using the strings given by the ShortMonthNames global variable.
mmmm | Displays the month as a full name (January-December) using the strings given by the LongMonthNames global variable.
yy | Displays the year as a two-digit number (00-99).
yyyy | Displays the year as a four-digit number (0000-9999).
h | Displays the hour without a leading zero (0-23).
hh | Displays the hour with a leading zero (00-23).
n | Displays the minute without a leading zero (0-59).
nn | Displays the minute with a leading zero (00-59).
s | Displays the second without a leading zero (0-59).
ss | Displays the second with a leading zero (00-59).
t | Displays the time using the format given by the ShortTimeFormat global variable.
tt | Displays the time using the format given by the LongTimeFormat global variable.
am/pm | Uses the 12-hour clock for the preceding h or hh specifier, and displays 'am' for any hour before noon, and 'pm' for any hour after noon. The am/pm specifier can use lower, upper, or mixed case, and the result is displayed accordingly.
a/p | Uses the 12-hour clock for the preceding h or hh specifier, and displays 'a' for any hour before noon, and 'p' for any hour after noon. The a/p specifier can use lower, upper, or mixed case, and the result is displayed accordingly.
ampm | Uses the 12-hour clock for the preceding h or hh specifier, and displays the contents of the TimeAMString global variable for any hour before noon, and the contents of the TimePMString global variable for any hour after noon.
/ | Displays the date separator character given by the DateSeparator global variable.
: | Displays the time separator character given by the TimeSeparator global variable.
'xx'/"xx" | Characters enclosed in single or double quotes are displayed as-is, and do not affect formatting.

The Menu as shown to user can have 3 different "size" formats. See Special Application Control Directives for more information.

$aad Show Small Menu

On the desktop of the user, when he starts a Remote Desktop Session, the result will be as follows:

Only the 1st of the 2 text-lines is shown. The 2th text-line is not shown in case of a Small Start Menu.

$aad Show Medium / Large Menu

In case of Medium or Large Start Menu, both text-lines are shown:


Users, Groups and Applications

Users, Groups and Applications

Example:

The local user with the loginname "luser001" has assigned the following applications:

  • Wordpad
  • Firefox
  • Office/Writer
  • Office/Spreadsheet
  • Office/Presentation

Button bar

The button bar contains the following buttons:

  • The Read button reads the configuration as it is saved in the Registry. Any recent changes the Administrator has made without using the Save button, will be lost when reading the settings from the registry.
    • You can use the Read button to “reset” any changes you just made which should not have been made.
    • You can use the Read button to “re-read” the users and groups in case you made some changes like defining new users.
  • The Verify button checks the consistency of the settings. For example, in case users are deleted, they will be shown with a red cross. In case a File\Pathname of an application does not exist, you will be informed.
  • The Save button will save the configuration including all changes the Administrator has made. Please note that, prior to the actual saving, a Verify will be done. In case of inconsistencies like non-existing applications, these inconsistencies will be fixed automatically.

Note: Older AADS builds did have buttons for "Backup" and "Restore" the Application Control settings to a backup-file. These functions have been moved to the Backup/Restore tabpage.

Adding Applications

The table with Application behaves like a table in your word processor. Using the TAB-key you can jump through the fields. When you use the TAB-key while the cursor is in the most-right, most-bottom location, a new line for a new Application will be made available.

An Application has a name and a Path\Filename. You can use the F3-key or double-click for browsing for executables. The name will be shown in the Startmenu of the remote user.

Do not forget to save the new settings using the Save button.

Selecting Applications

The first column is used for selecting Applications. By clicking on the first column you can (de-) select any Application.
By using the right-mouse on the first column, a small popup menu appears for some smart select options:

Delete Applications

Deleting an Application implies that it will be deleted from the table.
It will not be deleted, removed, un-installed, etc, from the server.

Select the Applications that should be deleted using the first column and click on the Delete button. Example:

App----2 will be deleted from the table.
Do not forget to save the new settings using the Save button.

Assigning Applications to an user or group

  1. Select the Applications
  2. Select the user or group
  3. Click on the Assign button

Example:

App----4, 5 and 9 are selected. The user "luser003" is selected. By clicking on the Assign button, the user gets these Applications assigned.

Do not forget to save the new settings using the Save button.

Removing Applications from user or group

  1. Select the Application.
  2. Click on the Remove button.

Do not forget to save the new settings using the Save button.

Zero / No Assigned Applications

In case the third Application mode is chosen, and the remote user has no assigned Applications, the remote user will see the following message:

One Assigned Application

In case a user has 1 (one) assigned Application, this application will be started directly after a login and will be shown full screen. When the user closes the Application, the remote session will be terminated.
Please note that sometimes an Application can not be shown full screen because the Application does not enable or support full screen. The default calculator of Windows is an example of an Application that can not be shown full screen.

See also Hidden Applications. A Hidden Application does not “count”. In case an user has 1 Application and 3 Hidden Applications, this 1 not-hidden Application will be started directly after the login.

Several Assigned Applications

In case an user has 2 or more assigned Applications, a small Startmenu button will be shown in the upper-left corner of the screen:

This Startmenu button gives the user access to the assigned applications:

Sub menus

Using a \ or a / in the Display name of an application, the System Administrator can create a sub menu. In the example above, the Menu Office is created, with 3 sub-menu items: Spreadsheet, Writer and Presentation.
The menu items can be sorted using the Up- and Down button above the Applications.

Only 1 level of sub menus

Only 1 level of sub menus is possible. Do not specify 2 slashes in an Application name.

Restrictions

In case Strict Application Control is applied, it is not possible for the user to start any application that is not within the list of assigned Applications. In case the user tries to start anything outside the list of assigned Applications, a notification is shown:

Apply strict or relaxed Application Control

Strict Application Control means that your users can only start those programs you have assigned to them. Sometimes this is to strict. It is possible that an application needs to start all kind of other (sub)-applications. When using strict Application Control, this is not allowed.
From a security and stability point of view is strict Application Control desirable; it prevents that unwanted programs are started by users.
However, if strict Application Control is to strict for your applications, the Administrator can select Relaxed Application Control. This still implies that the user only sees the applications that have been assigned to the user. However, if an application tries to start another (sub-)application, it is allowed.
Sometimes this setting is needed for your applications. Please note that from a security and stability point of view it is not as good as strict Application Control.

Next you will find the description of Hidden Applications. By using Hidden Applications, you might be able to avoid the use of relaxed Application Control.

Hidden Applications

Sometimes an Application starts another Applications. These sub-applications should not appear in the Startmenu of the user, but the user should be allowed to run these sub-applications.
Any Application with a name that starts with a $ (dollar sign) is a so called Hidden Application.

Example:

User test2 is allowed to start the default Help-programs of Windows. Those help programs can be started by Notepad or by pressing F1.
Hidden implies that the user can run the Application, but it is not shown in the Startmenu of the remote user.

Command line parameters and Startup Folder

An Application can have a specific Startup Folder. The default Startup folder is the folder where the program is located.

You can also specify 1 or more optional Command Line parameters.

Usually the character “space” is used to separate the parameters. You can use double quotes in case a space is needed within a parameter.

Environment variables in Command line Parameters and Startup folder

If you open a classic Dos-box, you can type the command “set”. It will show you the available “Environment variables”. Most of the environment variables are always available on every windows-system. Sometimes there are a couple of extra environment variables that are only available on your windows-system, because they are the result of some kind of application you installed.

Example of environment variables that are always available:

Examples how to use Environment variables

You can use those environment variables in the command line parameters. Examples:

Command line parameter or Startup folder | Result for user luser003
C:\documents\%username% | C:\documents\luser003
%userprofile%\some folder | C:\Documents and Settings\luser003\some folder

Environment variables , Escape character &

Within a command line parameter you can use the & character for special character in the range $01 .. $FF (hexadecimal between 1 and 255).
The & character is used as a so called escape character. Examples:

Command line parameter or Startup Folder | Result for user luser003
C:\documents\&25username&25 | C:\documents\%username%
C:\documents\&26username&26 | C:\documents\&username&
C:\documents\&22username&22 %username% | C:\documents\”username” luser003
“C:\documents\username” %username% | “C:\documents\username” luser003

Take a good look at the last 2 examples: the first occurrence of username is not considered to be an environment variable because it is not enclosed in %. In the third example it is enclosed in &22. This is the hex-value of the character “, so result will be “username”.
The second occurrence of username is considered as an environment variable because it is enclosed in %. Therefore it is replaced with luser003 in this example.

The &XX appearance in a command line parameter will always be translated to a character:

Command line parameter or Startup Folder | Result for user luser003
C:\documents\&25username&25 | C:\documents\%username%
“C:\documents\&25username&25” | “C:\documents\%username%”
“C:\documents\&26username” | “C:\documents\&username”

Startup Options

An Application can be started as follows:

Autorun | The Application will be started directly after the login of the user. Multiple Applications can be flagged as Autorun.
Maximize | When started, the Application will be initially shown Maximized. The user is able to Restore or Minimize the Application.
Minimize | When started, the Application will be initially shown Minimized. The user is able to Restore or Minimize the Application.
Visible | Default all Applications are shown Visible. An Application can be flagged as “not shown Visible” aka “Hidden”. An user can not interact with a Hidden Application. This option is useful for starting CMD-files which will start another Application. In combination with Autorun, you can start some kind of Hidden Service application for the user, without showing it. For instance, you might use it to start some Anti Virus client software without showing it to the user.
Elevated | The Application will be started "Elevated".

Start an application Elevated

In the example below, calculator is marked for Elevation:

On the client, one can expect the following:

Navigation

Cursor keys | Move the cursor around the table.
TAB key | Move the cursor to the next cell in the table. When TAB is used in the last cell, a new empty line is created in the table.
F3 | Use F3 in the Path\Filename column for browsing.


Demo Nag screen

Demo Nag screen

The demo version of AADS Terminal Server shows a "nag" screen after a login, in case Application Control is used:

This "nag" screen is not shown when using the Full, Paid version of AADS Terminal Server.


Application Control and Explorer / Desktop

Application Control and Explorer / Desktop

When you do not use Application Control as described in the previous chapter, an user does see the default Windows desktop when doing a login on the AADS Terminal Server. Showing the default Windows desktop might be desirable, because this is what the user does expect. However, the desktop should be restricted, because otherwise the users might make a mesh of their desktop.
A special combination of Explorer / Desktop and our Application Control is possible, such that the user sees a default desktop, but everything restricted.
This special combination of Explorer / Desktop and our Application Control does assume that you select "Restrict Application Control":

Assign Explorer.exe

In the following example Explorer.exe is assigned:

A hidden application is defined, called $Desktop. Because of the dollar sign in the name it is hidden. The user "luser001" will not see an entry called “Desktop” in the Start menu.
Whenever an user has Explorer.exe in it's list, it will always be started. It is not required to select the Autostart-option. Explorer.exe will be auto started anyway.

Explorer.exe is always "Auto Started"

You might want Explorer.exe to be optional, like “explorer.exe” with a command-line parameter containing c:\my documents. This is possible and is described a few pages further.
However, when an user is assigned Explorer.exe, it will always be auto started, because when Explorer.exe is started for the first time, it will always create and show a desktop. This is build in Explorer.exe; this is how Explorer.exe is made by Microsoft. Therefore it is not possible to show the user his documents-folder and not having a desktop with a taskbar, etc.

Windows Start Menu of the desktop is replaced by AADS Start Menu

In the example above, the users can only start the assigned applications. The default Windows Start menu is replaced by the restricted AADS Start menu.

Explorer as an AADS menu item

It is possible to mention Explorer.exe in the menu of an user. Example:

The desktop of the user will appear as follows:

  • A menu entry called "My Folder" is assigned to the user.
  • Also, the hidden menu entry $Desktop is assigned.
    • Because of $Desktop (and because of "My Folder"), the user gets an desktop.
  • The menu entry "My Folder" does appear in the AADS Start menu of the user.


Applications and Policies

Applications and Policies

After you have configured AADS Application Control on your AADS Terminal Server, you can do some fine-tuning with Policies. The initial screen for setting Policies is available thru the "Advanced" button:

Some of the policies are not relevant any more when AADS Application Control is applied. For example, all those policies related to the Start menu are not relevant any more because the Windows Start menu is not showed at all.

Which policies are shown can be different. It depends on your Windows-type and version, and which Service Packs are installed.

Do not test it in a production environment

You should test the Policies first on a separate Test environment before trying it in production. For instance, if you apply to many policies or to many restrictions, you might restrict yourself and you might not be able any more to reverse the restrictions. In such case, a reboot of the AADS Terminal Server in Safe Mode is required for attempts to fix the situation. This is a problem you want to avoid in a production environment.


Special Application Control Directives

Special Application Control Directives

AADS Terminal Server does offer Special Application Control Directives for additional control of the User Desktop:

  • $aad Apply Relaxed Control
  • $aad Apply Restrict Control
  • $aad Show Limited Menu
  • $aad Windows Menu
  • $aad DockDesktop menu
  • $aad Show Small Menu
  • $aad Show Medium Menu
  • $aad Show Large Menu
  • $aad Apply Wallpaper
  • $aad Show CPL

$aad Apply Relaxed Control

When this Special Application Control Directives is assigned to an user or a group, it will overrule the global setting as described above in the manual for Strict or Relaxed Application Control.

The global setting is done here:

However, the group "Administrators" have Explorer assigned by the entry $Desktop, and the Directive "$aad Apply Relaxed Control", implying that members of "Administrators" see a normal default Windows desktop and are not limited / restricted by AADS Application Control.

Note: the parameters Program Name, Startup Folder, Command-line and Startup in the columns next to Display name, are irrelevant for $aad Apply Relaxed Control and can be left empty.

$aad Apply Restrict Control

This Special Application Control Directive overrules the global setting. When the global setting is set to “Apply relaxed Application control”, then this Special Application Control Directive can overrule that, and apply strict Application control to an user or group.

$aad Windows Menu

When this Special Application Control Directive is assigned to an user of group, the usual default, normal Windows Menu is shown and not the limited AADS Application menu. However, if strict Application Control is in effect, most of the programs as shown in the default, normal Windows Menu can not be started. Example:

In this example, a default, normal Windows Menu is shown.

However, if strict AADS Application Control is applied, and the user attempts to start an application which is not assigned to him, the following popup message will be shown:

$aad DockDesktop menu

For a full description of DockDesktop, see the separate paragraph on this subject.

When this Special Application Control Directive is assigned to an user of group, the limited menu shown by AADS Application Control is shown using aadDockDesktop.

Example:

The desktop of user luser001 will be as follows:

An empty desktop is shown, with no "clutter" and only the icons of the applications that are assigned to the user.

Multiple $aad DockDesktop menu

There can be multiple Special Application Control Directive for $aad DockDesktop menu. For example:

$aad DockDesktop menu Sales
$aad DockDesktop menu Finances

Each variation can have 2 commandline parameters in the column Commandline:

What those command-line parameters do, is described in more detail in the paragraph about DockDesktop.

The 1th INI-file is a personal INI-File. The user can change the DockDesktop settings that are there in the personal INI-File.
The 2th INI-file is a system INI-File. The settings in the system INI-File do overrule the personal settings, and those settings can not be changed by the user.

The logical group Finan and the logical group Sales do each have their own customized global system INI-file.

$aad Show Limited Menu

The AADS Limited Menu directive gives the user the Limited Menu. The Desktop is empty.
The user gets a only to see a Start-button, without the full taskbar that is usually shown by Windows to the user:

The directive "$aad Show Limited Menu" can have parameters:

Position

The Limited Menu can be positioned on the desktop of the user as follows:

  • Top Left
  • Top Right
  • Bottom Left
  • Bottom Right

Number of columns

It is possible to show the AADS Limited Menu in either 1 or 2 columns. Example 2 columns:

The result is as follows:

Configuring the AADS Limited Menu for 1 column, Bottom Left positioned:

The result is as follows:

$aad Show Small Menu

The user is presented a Start Menu with "small" icons.

$aad Show Medium Menu

The user is presented a Start Menu with "medium size" icons.

$aad Show Large Menu

The user is presented a Start Menu with "large" icons and menu-items. This might be more suitable for touch-devices.

Transparent Start Menu

As shown above here, the Medium and Large Start Menu can be shown (a bit) transparent, using the transparent parameter.

If the transparent parameter is removed:

then the Start Menu is presented to the user without any transparency:

$aad Apply Wallpaper

It is possible to use AADS Application Control to give the user an assigned Wallpaper

The selected wallpaper can be shown as follows:

  • stretch
  • fill
  • fit
  • tile
  • center

The result can be as follows:

$aad Show CPL

It might be feasible that the user has the ability to start 1 or more Control Panel items.

Note: the future of Control Panel items in Windows 10 is uncertain. Microsoft seems to be moving all Settings away from old-style Control Panel items to the settings done by 1 of those "Universal Apps".

The user is presented with a "Mouse Settings" menu item, and is able to change the mouse settings:

Note: be carefull with the $aad Show CPL menu item. The whole point of Application Control is that the user has not the ability to change settings and create problems.....

Use an Application Control Directive multiple times

It is possible and OK to enter an Application Control Directive multiple times. An Example:

In this example, there are 4 different variations of the Application Control Directive "$aad Limited Menu". Each of them can be assigned to a different group of users.

Combining Application Control Directives

The following Application Control Directives are mutual exclusive:

  • $aad Windows Menu, $aad DockDesktop menu and $aad Show Limited Menu are mutual exclusive.
  • $aad Show Small Menu, $aad Show Medium Menu and $aad Show Large Menu are mutual exclusive.
  • $aad Apply Relaxed Control and $aad Apply Restrict Control are mutual exclusive.

The following Application Control Directives can be combined:

  • $aad Windows Menu can be combined with:
    • $aad Show Small Menu, $aad Show Medium Menu or $aad Show Large Menu, transparent or not transparent, 1 or 2 columns.
    • $aad Apply Relaxed Control or $aad Apply Restrict Control
  • $aad Show Limited Menu can be combined with:
    • $aad Show Small Menu, $aad Show Medium Menu or $aad Show Large Menu, transparent or not transparent, 1 or 2 columns.
    • $aad Apply Relaxed Control or $aad Apply Restrict Control
  • $aad DockDesktop menu can be combined with:
    • $aad Apply Relaxed Control or $aad Apply Restrict Control


Session Menu

Session Menu

When Application Control is being applies to the user, the last Menu-item in the Menu as shown to the user, is "Session":

When the user selects "Session", the following popup is shown:

  • Logoff: the user will be logged off.
  • Disconnect: the desktop will be locked and disconnect. At a later moment the user can re-connect to the running session.
  • Lock workstation: the desktop will be locked.
  • Change Password: the user will have the ability to change his/her password:

Change Password

The "Change Password" dialog can also be started as follows:

If needed, the Administrator can create,

  • an item in the Start Menu of the PC,
  • or on the Desktop of the user,
  • or create an AADS Application Control item,

for giving the user a direct link, item, short-cut, etc, to the Change Password dialog.


Webserver

Web server

The integrated web server offers browser based access to an AADS Terminal Server. Remote desktop access is possible using only a browser.

Supported browsers

Unfortunately not any browser can be used; only Microsoft Internet Explorer can be used. This is caused by the fact that the integrated web server is based on Active-X components, and Active-X is only possible using Microsoft Internet Explorer.

  • IE 6
  • IE 7
  • IE 8
  • IE 9
  • IE 10
  • IE 11

Editing the HTML

The demo version of AADS Terminal Server does limit your options for changing the layout of the pages as served by the integrated web server. The full version does give you the possibility to change the layout in any way you want.

Please note: our support is limited to AADS Terminal Server. It is not possible for us to support customers on “how to write HTML, CSS, or other web page issues”. It is OK with us if you change the HTML-pages as served by our web server, but it is your responsibility to ensure you write valid, usable and working HTML-pages.
We do appreciate the books from O'Reilly. Go to their website and search for HTML-books.

http://www.oreilly.com/

Starting the web server

Within our Maintenance Program is tab page for the web server:

When changing a parameter, click on Apply. The parameters will be immediately applied.

  • When you select the checkbox, and click on Apply, the web server will be started right away.

When you click on Apply, the web server will be stopped, and depending on the checkbox started again.
Stopping and starting the web server does NOT affect current remote desktop session with the AADS Terminal Server.

When the checkbox is checked, the web server will also be started when the AADS Terminal Server is rebooted.

Location of the WWW folder

The default folder for the HTML-pages is below the Program Files folder or the ProgramData folder of the AADS Terminal Server:

When you change the location to something else, and click on the Apply button, the default HTML-files will be created in this new location.

Security / Limitations of the integrated web server

The integrated web server is limited to:

  • HTTP Get and Head command. Anything else like HTTP Post is not supported.

This implies that the integrated web server can not be used for "accessing", "updating" or "writing" to the www-folder. There is no logic within the integrated web server to do such thing.

Our integrated web server has nothing to do with Microsoft Internet Information Server (IIS) and is not based on IIS; it does not use any IIS code.
It is a completely self-developed web server. Updates from Microsoft related to IIS are not required for an AADS Terminal Server.

The objects / files in the WWW folder are accessed by the web server using “Read and Share right”. This implies that the WWW folder can be made read-only and that the web server does not try to get write, lock or update access to the WWW folder.
The only exception to the previous statement is, when the web server is restarted with a new WWW folder path, it does write to the WWW folder, because then the www server and Maintenance Program will write the default HTML-objects in the new WWW-folder.

We should mention the following: because of the Active-X object as served by the web server, only the browser Microsoft Internet Explorer is supported. This browser does have its peculiar non-standard, proprietary behavior. For instance, sometimes this browser sends the command OPTIONS to a web server. This command is a non-standard, proprietary command that is used between Microsoft Internet Explorer and Microsoft Internet Information Server (IIS).
Our integrated web server has nothing to do with Microsoft IIS and is not based on IIS. Therefore our integrated web server does not support this non-standard, proprietary OPTIONS command. The result will be 4xx errors in the logfile of our web server.

Indexing a folder

Our web server does not index a folder like IIS or Apache can do. When a client enters an URL which contains a folder and not an object, our web server appends index.html to the URL.
When index.html does not exist in the requested folder, a 404-error is generated.

If you want to have a folder indexed, do create a file called index.html inside this folder and keep it up-to-date with the contents of the folder.

If you do NOT want to index a folder, and do NOT want to confront your users with a 404-error, create an index.html file in every folder. The contents of the index.html can be a nice message and some kind of javascript-refresh statement that loads the default index.html as located in the root of the www-folder.

Traversing

Our web server only serves objects inside or below the WWW-folder as entered in the Maintenance Program. Your users might want to try ../../.. in URL with the objective to traverse beyond the WWW-folder. This is not allowed or supported by our www server.

ContentTypes.cfg

If you change the HTML-pages and starts to serve filetypes like EXE, BIN, DMG, MP3, AVI, SWF, etc, be sure to edit the file ContentTypes.cfg. In case the web server serves an object and its filetype is not found in ContentTypes.cfg, the default filetype reported to the browser of the client is “application/octet-stream”. The impact of this is that the browser will show a message to the user, asking "where to save this file".

Parameters in HTML-pages

It is possible to include parameters within the HTML-pages as served by the web server. The default Error pages do use them and can be interpreted as an example for these parameters.

When you write your own HTML-pages for our integrated webserver, you can use the following parameters.

Parameters are always enclosed in %. Before serving the HTML-page to the client, the integrated webserver will change the parameter to the actual value.

%system datetime% | Current date time of the AADServer, UTC
%client ipaddress% | TCP/IP Address of the client. Please note: due to NAT (network address translation) the reported IP Address might be different then what you expect.
%client portnumber% | The TCP/IP port number of the client.
%server portnumber% | The TCP/IP port number of the server. Default this is 80.
%host request% | The host name as entered by the client in the address bar of the browser. The hostname can have several values. The client can connect by entering an IP Address or a DNS-name. Due to NAT or other network related solutions, the AADServer might be connected in different ways with different hostnames as entered by the client.
%this host% | The netbios name of this AADServer
%this host rdp port% | The Portnumber for the RDP sessions. Default this is 3389.
%uri request% | The full URL as entered by the client on the addressbar. It is the part behind the host name as entered by the client on the addressbar.
%user agent% | The user agent of the browser used by the client.
%http server version% | The version of the integrated web server.
%client utc datetime% | The date time when the client did first connect.
%aad product type% | The AADS product type like aad_19_demo. This value can also be found in HKLM\Software\AADServer
%000-00000002% | Title of the product. This is the translation variable cAppTitle.
%000-00000003% | Name of the product. This is the translation variable cAppName.
%000-00000009% | Type of product. Default value \"Enterprise\"
%000-00000010% | Type of product. Default value \"Classic\"

These variables are related to the translation of AADS Terminal Server.

Logfile

The logfile is called AADServer_www_Server.utf8.log.

The logfile shows the following info:

  • date / time
  • Info, Warning or Error
  • IP Address of the client
  • HTTP-result code:
    • 200 is OK
    • 4XX is an error related to the client
    • 5XX is an error related to the server
  • Hostname as entered by the client in the address bar of the browser:
    • The web server can be accessed using the IP Address of the server, or DNS-name.
  • object served:
    • In case of the Demo version of AADS Terminal Server, the objects are served from internal memory and not from the WWW-folder (although they must exist in the WWW-folder....). Because the objects are served from memory in case of AADS Terminal Server, changing the contents of the WWW-folder will not have an effect.

The logfile is a wrap-around logfile and will overwrite itself. The maximum size is 1 MB. If auditing is important, the Administrator should schedule some kind of automatic backup of this logfile.


IE 6

Internet Explorer 6

The builtin webserver of AADS Terminal Server can be used with Internet Explorer 6. However, it is strongly recommended to upgrade Internet Explorer to the highest version possible for the Client PC. In case the Client PC uses Windows XP, it is possible to install Internet Explorer 8.

First time: Enable Add-on

The first time the built-in webserver is accessed from a Client PC running IE 6, the following might happen:

Click on "to enable the add-on, click here". The following screen will be shown:

Enable the "Microsoft Terminal Services Client Control".
(and while doing this, disable any other that you do not need).

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". This can be verified via "Internet Options", Tabpage "Program" and then the button "Manage Add-ons...."

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.


IE 7

Internet Explorer 7

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 7. However, it is strongly recommended to upgrade Internet Explorer to the highest version possible for the Client PC. In case the Client PC uses Windows XP, it is possible to install Internet Explorer 8.

First time: Enable Add-on

The first time the built-in webserver is accessed from a Client PC running IE 7, the following might happen:

Click on "To enable the add-on, click here". The following screen will be shown:

Enable the "Microsoft Terminal Services Client Control".
(and while doing this, disable any other that you do not need).

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". This can be verified via the "Tools" button:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled:


IE Compatibility View

IE Compatibility View

Introduced in Internet Explorer 8 is an option called "Compatibility View". This can be relevant for the built-in webserver of AADS Terminal Server. It might be required to disable or enable the so called "Compatibility View" when using the built-in webserver of AADS Terminal Server.

For more information about this, please see the Microsoft website:

http://windows.microsoft.com/en-us/internet-explorer/use-compatibility-view


IE 8

Internet Explorer 8

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 8. In case of Windows XP / Server 2003, this is the highest version of Internet Explorer that Microsoft has made for Windows XP / Server 2003.

First time: Run Add-on

The first time the built-in webserver is accessed from a Client PC running IE 8, the following might happen:

The user will need to select "Run Add-on".

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". Using the "Tools" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

The menu item "Manage Add-ons" will show the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

It might be required to disable the " IE Compatibility View " in order to get the best result:

When "IE Compatibility View " is enabled , it might happen that scrollbars are shown while these are not needed:


IE 9

Internet Explorer 9

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 9.

First time: Allow Add-on

The first time the built-in webserver is accessed from a Client PC running IE 9, the following might happen:

Click on "Allow".

Verify the Add-on

It is required to enable the Add-on "Microsoft Terminal Services Client Control". Using the "Tool - shaped" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

Select Manage add-ons shows the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

It might be required to disable the "IE Compatibility View " in order to get the best result:

When "IE Compatibility View " is enabled, it might happen that scrollbars are shown while these are not needed:


IE 10

Internet Explorer 10

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 10.

First time: Allow Add-on

The first time the built-in webserver is accessed from a Client PC running IE 10, the following might happen:

Click on "Allow".

Verify the Add-on

Using the "Tool - shaped" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

Select Manage add-ons shows the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

It will be required to enable the "IE Compatibility View " in order to get the best result:

In case " IE Compatibility View " is disabled, the following error might be shown:

Click on the "IE Compatibility View - button" in the Addressbar and try again to connect to the AADS Terminal Server.

For good measurements you can enable the following option of IE 10:


IE 11

Internet Explorer 11

The built-in webserver of AADS Terminal Server can be used with Internet Explorer 11.

First time: Allow Add-on:

The first time the user connect to the AADS Terminal Server, the following popup might be shown:

Click on "Allow".

Manage Add-ons

Using the "Tool - shaped" button, the user can verify that the Add-on "Microsoft Terminal Services Client Control" is enabled:

Select Manage add-ons shows the following screen:

Be sure to verify that "Microsoft Terminal Services Client Control" is enabled.

IE Compatibility View

Using the "Tool - shaped" button, the user must "add" the AADServer to the list of servers for "Compatibility View ".
Select "Compatibility View " settings" in the following menu:

The following screen will be shown:

In this example the netbios-name of 3 AADS Terminal Servers are "added" and 1 IP Address of an AADS Terminal Server.


Integrated PostScript / PDF Printer

Integrated PostScript / PDF Printer

When the PostScript / PDF printer is enabled, automatically an AADS Printer is created. Users can select and use the printer. Result will be a printed Postscript (PS) or PDF file in their Personal Folder.

When either, or both PostScript and / or PDF is selected, the AADS Printer will be available.
When neither PostScript or PDF is selected, the AADS Printer will be removed.

The location of where the PDF / Postscript files are placed, can be changed.
If this is changes, for instance, on a different server, please note that the user must have create and write rights on this different server.

Printer queue

The printer queue can be viewed in the usual way:

Default printer settings like papersize

Detailed settings can be changed:

Select and use the printer

Users can select the AADS Printer for a printjob:

Result of the print job is a PS (PostScript) and / or PDF file:


Do not install multiple PDF solutions

Do not install multiple PDF-solutions

The built-in PDF printer of AADS Terminal Server is based in open source code: Ghostscript

https://www.aads-worldwide.hk/faqs/index.htm#page=Other_licenses.htm

If you would investigate this, you will learn that all most ALL PDF writers are always based on Ghostscript.
If you install 2 or more PDF printers on the same server, there is the possibility that a Ghostscript version problem is created.
Therefore it is recommend not to install 2 or more PDF-printer solutions on 1 server at the same time.


RDP Firewall

RDP Firewall

Default the built-in RDP Firewall is enabled and has the following settings:

Default only connections from Local IP Addresses are accepted:

  • 10.0.0.0 - 10.255.255.255
  • 172.16.0.0 - 172.31.255.255
  • 192.168.0.0 - 192.168.255.255
  • 169.254.0.0 - 169.254.255.255

Allow Temporary RDP Connections from Public IP Addresses

It is possible to Allow Temporary RDP Connections from Public IP Addresses . The Administrator can configure who is allowed to enable this.

The objective of Allow Temporary RDP Connections from Public IP Addresses is that normally access from Public IP Addresses is blocked, but once in a while a remote administrator might need to do "some work" and the owner of the AADServer can temporary allow the remote administrator to connect and to login for the next few hours.

PortNumber

You can change the default port number which is used by the AADS Terminal Server for listening for Remote Desktop Sessions. The default number is TCP port number 3389.
The range of the custom value is 1000 – 65534. Although a number lower then 1000 might be technical possible, this is disabled in order to prevent problems.

If you change the port number to another value:

  • You will also have to change your firewall settings.
  • If you use some kind of router to connect to the Internet, most likely you have defined a NAT-entry in your router in order to forward a port to the AADS Terminal Server. You must also update this NAT-entry in your router.
  • You must inform all you users, because the client software they use for connecting to the AADS Terminal Server needs to know about the changed port number.

Reboot required

A reboot is required before the new port number is used by AADS Terminal Server.

Failed Logins

Well known names / Other, self defined names

The Firewall will block Clients when it is detected that the Client has done 5 failed logon attempts.

When it is about "failed logon attempts", it can be about those zombie-hacked-PC's in a botnet out there on the internet, that do attempt to hack into the AADServer with the Administrator userID. Or it can be about, for example, a former employee, or a visitor to the company office, who knows the userIDs of the employees, and attempts to hack into the AADServer with the usernames / userIDs as defined for the employees.
Either hack-attempts is blocked by the AADS RDP Firewall.

There are however circumstances where it is not really required to block Client PCs which do multiple failed logon attempts with specific company usernames / userIDs. For example, Point Of Sales systems that do automatically login on the AADServer, with a specific username like "POSClient123" (example of an username), and a password that nobody knows. Login is done automatically when booting the POS Client PC. And in the event that the remote POS Client PC makes an error, for example because the barcode reader is disconnected, it might not be needed to block the remote POS Client PC in the Firewall, but just fix the error. In such a case the IT Administrator of the AADServer can choose to handle only failed login / hack attempts when it is done with a well known user names like Administrator, but do not block a Client in the Firewall in case the failed login attempt is done with other, self defined user names.
However, if it is chosen not the block such failed login attempts, a rough (ex-)employee for example, might start some trouble with login attempts, using those usernames like "POSClient123". Therefore it is recommended always to enable Notifications, specifically the Notification for a failed logon attempt.

Default setting is to block Clients in any case. Wether the failed login / hack attempt is done with a well known username like Administrator, or a specific username that is known only on this AADServer, the Client will be blocked after 5 failed login / hack attempts.

Number of Failed Logon Attempts

Default a Client will be blocked after 5 Failed Login attempts.

Deny Period

When it is attempted to do a Remote Login from a specific IP Address, and there are 5 Failed Attempts within the configured Deny-period of 7 days, the IP Address of the Remote PC / Client is entered on the Temporary Blocked list for the next 7 days.

The Client PC will be removed automatically from the Temporary Blocked list when it has not been seen for 7 days. The 7 days are counted down to 0 from the last moment that the Client PC has contacted the AADServer. Any attempt to login again in those 7 days, will prolong the 7 days.


Public IP Addresses

Public IP Addresses: not Accepted

Default connections from Public IP Addresses are not accepted.

If you need to connect Clients from the Internet, we do strongly recommend to use our Enterprise AADS Terminal Server with the built-in SSL Gateway.
RDP connections are vulnerable for man-in-the-middle attacks, and are not as good encrypted as with our built-in SSL Gateway. See our Enterprise version for more details on this SSL Gateway.

  • RDP connections should only be used internally within the company.
  • For anything coming from the Internet, SSL should be used.

If you decide to accept plain RDP-connections from the Internet, then do at least change the default RDP port from 3389 to something else, because hack-attempts from the Internet are default attempted by attacking the Terminal Server on port 3389.

Note: it might be required that a "remote administrator" does connect once in a while to do "his job". If this is the requirement, then you can choose not to enable connections from Public IP Addresses, but use the tool Allow Temporary RDP Connections from Public IP Addresses which only allows access from Public IP Addresses for a limited amount of time.


Failed Logon

Failed Logon

A List of Failed Logon is shown:

From the IP Address 192.168.200.48 it has been attempted twice to do a Logon with the Administrator user-ID and the Logon has failed.

Delete Failed Logon Events

By clicking on the "Date/Time" column, 1 or more Failed Logon Events can be selected.
Using the "Delete"-button, those Events can be deleted. Do not forget to click on the "Save"-button.

The point of this, is that it might happen that an OK / normal user accidentally has done some Failed Logons,
for example because the caps-lock key of the keyboard was locked, and the user does not notice this,
and the user attempts to login multiple times.
And when there are, for example, 4 Failed Logons from the Client-PC of this user, and the number of Number of Failed Logon Attempts is 5,
then all the user needs to do in the next week, is 1 Failed Logon and he/she gets blocked for the next 7 days.

The main purpose of the Firewall is to stop hack-attempts; not to stop an OK user who makes a silly typo error when entering the username and password.
Therefore it is possible for the Administrator to delete the Events Failed Logon Attempts (after he has informed the silly but OK user that he should not do 5 failed attempts to enter his name and password......)

If the user has attempted to logon with something else then his/her own username, it is recommended not to delete the Events Failed Logon Attempt,
but first to figure what or why the user has attempted to do a logon with some other userID then his/her normal userID.

Copy to Black or White list

Using the button for the Black or White list, the administrator can directly copy the IP Address of the offender to the Black List, or to the White list in case it is not an offender. When doing this, be sure to switch to the Black or White list after the "copy" and save the Black or White list.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar / click on "Date/Time" column | Select / de-select an entry.


Temporary Blocked

Temporary Blocked

When there are "to many" Failed Logon attempts from an IP Address, the IP Address will be entered on the Temporary Blocked list.
The Number of Failed Logon Attempts defines what is "to many".

When a Client is on the Temporary Blocked List,

  • The connection between the Client and the Server will be disconnected.
  • If the Deny-period is 7 days, any attempt in the next 7 days will be blocked. The Client is not allowed to connect for 7 days.
  • Every time the Client attempts to connect and login again, the block time of 7 days will be prolonged. The Client will be blocked for 7 days, counted from the last date / time moment that the Client did attempt to connect and login in to the AADS Terminal Server.
  • After the Client has not be seen in 7 days, automatically the IP Address of the Client will be cleared from the Temporary Blocked List.

Note:

  • If the user attempts to connect a 2th time from the same Client PC, from the same IP Address, and the user does many Failed Logons,
    but there is already an active session from the IP Address of the Client PC, because the user did correctly a logon some time ago,
    then this existing, active session will be not be disconnected.
    The blocking only applies to new connect and logon attempts.
  • 2th note: after the moment the user does a logoff from this existing, active session, he will have to wait for 7 days, the Deny Period , before he can logon again on the AADS Terminal Server......

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-button, those Client IP Addresses can be deleted and are allowed once again to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

Copy to Black or White list

Using the button for the Black or White list, the administrator can directly copy the IP Address of the offender to the Black List, or to the White list in case it is not an offender. When doing this, be sure to switch to the Black or White list after the "copy" and save the Black or White list.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar / click on "Date/Time" column | Select / de-select an entry.


White List

White List

Automatic White List

The Automatic White List contains all local IP Addresses of this AADS Terminal Server.

Manual White List

The Administrator can enter IP Addresses or ranges of IP Addresses:

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-button, those Client IP Addresses can be deleted and do loose their privilege of always to be allowed to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

White List overrules

Whatever is entered on the White List, Automatic and Manual, is always allowed to connect to the AADS Terminal Server.
The White List overrules:

  • the Black List
  • the Temporary Blocked List.

Subnet mask / Range

It is possible to enter 1 IP Address, by leaving the Subnet Mask / Range empty.

A Range can be entered by

  • "begin" IP Address and "end" IP Address. See the Thin Clients Sales Department as an example.
  • /1 to /31. See Range Example 1.
  • /n1.n2.n3.n4. See Range Example 2.

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


Black List

Black List

The Administrator can enter IP Addresses or ranges of IP Addresses:

Delete

By clicking on the "Date/Time" column, 1 or more Client IP Addresses can be selected.
Using the "Delete"-button, those Client IP Addresses can be deleted and are allowed once again to connect to the AADS Terminal Server.
Do not forget to click on the "Save"-button.

Subnet mask / Range

It is possible to enter 1 IP Address, by leaving the Subnet Mask / Range empty.

A Range can be entered by

  • "begin" IP Address and "end" IP Address. See the Thin Clients Sales Department as an example.
  • /1 to /31. See Range Example 1.
  • /n1.n2.n3.n4. See Range Example 2.

If you enter IP ranges on the Black List, these IP ranges will be blocked unless they are overruled with IP ranges on the White List.

"Everthing-range"

It is possible to enter an "Everything-range":

The initial result of this, is that indeed every IP Address is blocked.
The next step would be that you enter a few IP Addresses on the "White list", or 1 or more network ranges.
Those on the "White list" are allowed because the "White list" overrules the "Black list".

Navigation

Cursor keys | Move the cursor around the list.
Spacebar or click on "Date/Time" column | Select / de-select an entry.
TAB or Down | When the cursor is in the last row, a new empty row will be added and made available.


Logging

Logging

The "Disconnected" logline shows that a connection between the Client and the Server was disconnected, at the moment that the Server has seen 5 Failed Logon Attempts (and quite possible while the Client was busy with attempt nr. 6 to login)

The "Deny" logline shows that the Client did connect again some time later, but the connection was immediately denied.

The Tabpage with the "username" shows what the logged-in user/administrator currently has done with AADS Maintenance Control:

An "interesting" line is the selected line: The Administrator has deleted the IP Address 192.168.200.21 from the Temp Blocklist. Following that the Administrator has "saved" the Temp Blocklist. And the Temp Blocklist is now empty: 0 records are written.

Navigation

Cursor keys Move the cursor around the list.


Allow Temporary RDP Connections from Public IP Addresses

Allow Temporary RDP Connections from Public IP Addresses

Default RDP Connections from Public IP Addresses are not accepted. RDP connections are vulnerable for man-in-the-middle attacks, and are not as good encrypted as with our built-in SSL Gateway. See our Enterprise version for more details on this SSL Gateway.

The objective of "Temporary RDP Connections from Public IP Addresses" is that normally access from Public IP Addresses is blocked, but once in a while a remote administrator might need to do "some work" and the owner of the AADServer can temporary allow the remote administrator to connect and to login for the next few hours.

Configuration

Be sure to configure that Temporary RDP Connections from Public IP Addresses are allowed:

Program: Temporary RDP Connections from Public IP Addresses are allowed

The Application folder of an AADS Terminal Server contains the following program:

Any user can start this program, although it depends on the configuration as shown above here, if the user can do something with the program.

The user can select an amount of time between 1 and 48 hours, and click on the Apply button. If he selects, for example, 3 hours, it shows as follows:

The end-date and time is shown. For the next 3 hours it is possible to do RDP connections from Public IP Addresses.

When the remote administrator is done with his job, the user can optional click on the Stop-button, and the period for allowing RDP connections from Public IP Addresses is terminated immediately.

Note; when the user clicks on Stop, the current active session of the remote administrator will not be disconnected. However, if the remote administrator attempts to connect again, that attempt will be denied.

If the AADS Terminal Server is configured that it is not allowed to enable temporary RDP Connections from public IP Addresses:

then the user can not set a temporary period:


Completely disable RDP connections from Public IP Addresses

Completely disable RDP connections from Public IP Addresses

Completely disable RDP connections from Public IP Addresses does make your AADS Terminal Server more secure. This can be accomplished as follows:

De-select both permanent and the temporary options for Public IP Addresses.


Client Software

Client Software

An AADServer can be accessed using any modern RDP client running on Windows, OSX, Linux, iOS, Android, etc.
For Windows, the users might prefer to use the AADS Client Software for accessing the Terminal Server(s).

  • Install AADS Client for Windows
  • Use AADS Client


Install AADS Client for Windows

Install AADS Client for Windows

See RDP Client Build for creating the AADS Client Build. Copy the Client Build to the Windows PC. On the Client PC the file

aad_RDP_ClientSetup.exe

needs to be executed with Administrator rights.

Installation OK

When installed on the Client PC, a simple popup is shown that the installation has been successful:

Start Menu entry

In the Start Menu of the PC, an entry is placed.

Add / Remove software

An entry is created for the Uninstall of the Client Software.

Installation fails

If the installation fails, the user will be informed, and on the desktop of the user, a Client ZIP Support File is created:


Use AADS Client

Use AADS Client

Authorization

Windows

Note: AADS Client does share its functionality with AADS Enterprise Version. However, Enterprise functionality is not available in AADS Small.

Enter the required information to login on the AADS Terminal Server. Optional you can select to save your password, such that the next time you use the AADS Client, it will be filled in.

Save my password

When you select "Save my password", the password will be saved in a local INI-file. Encryption is being used for saving the password.


Settings

Settings

Client Settings for Windows

Desktop Size

You can select the size of the Remote Desktop.

  • The option "Full Screen" will show the Remote Desktop indeed Full Screen, on the current monitor of the client.
    • If the Client has 2 or more monitors, the Remote Desktop will be shown Full Screen on the current monitor onto which the AADS Client is running.
  • The option "Full Screen - taskbar" will make sure that the taskbar of the Client will remain visible while working with the Remote Desktop.

Full screen on all monitors

AADS Client for Windows is "monitor aware". When the AADS Client detects that the Client PC has 2 or more monitors, it behaves as follows:

  • The option Full screen implies that the AADS Client will be Full screen on the monitor it is currently running. Example:
    • If you want the AADS Client to show a Full screen Remote Desktop session on monitor 3, move the AADS Windows to monitor 3 before you click on "Connect", and the Remote Desktop will be shown Full screen on monitor 3.
  • If you want the AADS Client to be Full screen on all monitors, select the option "Full screen on all monitors".

Example: Client will be Full screen on Monitor 3

The Remote Desktop in this example will be shown Full screen on Monitor 3, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 3, so it will do the Remote Desktop on Monitor 3:

Example: Client will be Full screen on Monitor 2

The Remote Desktop in this example will be shown Full screen on Monitor 2, because prior to clicking on the Connect button, the AADS Client is being shown on Monitor 2, so it will do the Remote Desktop on Monitor 2:

Example: Full screen on all monitors

The Remote Desktop in this example will be shown Full screen on all Monitors:

Full screen limitations Windows

There are technical limitations in the ability of Windows Client PCs to do Full Screen. It depends on the version of the Microsoft Remote Desktop Client software as it is installed on the Client PC.

  • First it is attempted by the AADS Client software to show the Remote Desktop as big as possible.
  • If it is not possible to show the Remote Desktop as big as possible, it is attempted to show the Remote Desktop with a width of 1600 px.
  • If it is not possible to show the Remote Desktop with a width of 1600 px, it is attempted to show the Remote Desktop with a width of 1280 px.

When you notice that the maximum width of the Remote Desktop Window is limited to 1600 px or 1280 px, you can attempt the following:

  • Upgrade the Remote Desktop software on the Client PC with the latest Remote Desktop Client software from Microsoft.

Connection Bar

Show, or show not the connection bar in the Remote Desktop Session.

Remaining settings

The remaining settings are similar to the settings in the Default RDP Client software from Microsoft.


Connections

Connections

The AADS Client software is able to handle multiple connections to multiple AADS Terminal Servers:

  • The Folder button can be used to change the location of the multiple RDP-files.
  • The Duplicate button can be used to copy the selected "Connection" to a new one.
  • The Rename button can be used to rename the selected "Connection".
  • The Delete button can be used to delete the selected "Connection".

When "Multiple connection usage" is selected, in the first tabpage you select which "Connection" you want to use:

RDP Files

The settings of each "Connection" are written in a RDP file. These RDP-connection-files are placed in the selected folder.

In case a "Connection" is for a connection to an AADS Terminal Server -Farm, there will also be a v001_c003-file for that connection:

The connection "Server Sales" is a connection to an AADS Terminal Server -Farm. The details of this AADS-Farm (how many servers, ip addresses, etc) are stored in the file "Server Sales.aad_farm_v001_c003.txt".


Support

Support

In case there are issues with the AADS Client Software, the tabpage Support contains a ZIP Support Button. By clicking on the button, a Client-ZIP-Support-File will be created on the desktop:


Monitor Information

Monitor Information

The tabpage Monitor shows the details of the Monitors on the Client PC. This can be relevant in case the Client PC has more then 1 monitor, and the user wants to have a RDP-session on a specific monitor, or across all monitors.


Command Line parameters

Command line parameters

The AADS Client understands 4 command line parameters:

1 | RDP file | Personal RDP-file for the user. | Read / Write access
2 | v001c003 file | Personal v001c003 file which indicates an AADS Farm | Read / Write access
3 | RDP file | Master RDP file | Read access
4 | v001c003 file | Master v001c003 file | Read access

Example how to use these 4 command line parameters:

The following 2 shortcuts on the desktop of the user can be created for accessing Farm 1 and Farm 2:

aadWin32client.exe %homepath%\farm1.rdp %homepath%\farm1_v001c003.txt G:\master\farm1.rdp G:\master\farm1_v001c003.txt

aadWin32client.exe %homepath%\farm2.rdp %homepath%\farm2_v001c003.txt G:\master\farm2.rdp G:\master\farm2_v001c003.txt

(the examples above are 1 long command line with 4 command line parameters)

Farm 1 explained:

1 | RDP file | %homepath%\farm1.rdp This will be the personal RDP file for the user. The environment variable will be expanded. However, the very first time, this file does not exist. In that case the master file in command line parameter 3 will be used.
2 | v001c003 file | %homepath%\farm1_v001c003.txt Personal v001c003 file which indicates Farm 1. This fill will be created and updated. The very first time this file does not exist. In that case the master file in command line parameter 4 will be used, and the user will not be prompted for an IP Address of a server in the Farm.
3 | RDP file | G:\master\farm1.rdp This RDP file should contain correct initial values for the users of Farm1. It will only be red, once, when the personal RDP file as indicated by command line parameter 1 does not exist.
4 | v001c003 file | G:\master\farm1_v001c003.txt This v001c003 farm file should contain initial values for the users of Farm1. It will only be red, once, when the personal v001c003 file as indicated by command line parameter 2 does not exist.

The Administrator can create several shortcuts for accessing the multiple Farms.

  • Each shortcut can have its own 4 command line parameters.
  • Each shortcut can have its own 2 master files in command line parameter 3 and 4.


Backup/Restore

Backup/Restore

Using Backup/Restore, the Administrator can create a Backup-File with all the relevant AADServer settings.

The Backup-File will be a ZIP-File, and it will be placed on the desktop of the Administrator:

In the name of the Backup-File you will find the date-time stamp of the Backup.

The Backup-File can be used to restore all AADServer settings on this AADServer. It can also be used to quickly copy all AADServer settings to another AADServer; use the Restore function on this other AADServer for importing all AADS-Settings as they are placed in this Backup-File.


Backup

Backup

What can (and can not) be placed in the backup, is shown:

  • All settings related to Application Control .
  • AADS Firewall, the Manual White List and the Black List. Other FW Lists are created and filled automatically and do not need to be in a backup/restore.
  • All settings and files related to the built-in WebServer .
  • All the AADS Settings.

The disabled options are related to AADS Enterprise. AADS Classic does not have the disabled functions.

Optional the Backup-File can be protected with a password.


Restore

Restore

The first step is to select a Backup-File. When a Backup-File is selected, depending on the contents of the Backup-File, the Restore-options will be enabled:

Note: after a Restore, it might happen that AADS Maintenance Control does restart itself.

Password

When the Backup-File is protected with a password, it will be required to enter the Password, before any Restore option becomes available.

Check all Settings after a Restore

It is strongly recommended that after a Restore, the Administrator uses AADS Maintenance Control, and checks if all settings are OK, because, for example:

The Backup-File might be 1 year old. Therefore it might contain settings that are not expected anymore. For example, it might contain www-pages that are 1 year old and are out-dated. Or it might contain Application Control settings for applicationa that are not being used or installed anymore on the AADServer.


DockDesktop

DockDesktop

In the folder Program Files\AADServer the tool aadDockDesktop is installed. Purpose of aadDockDesktop is to show the desktop icons at a different location on the screen then as default done by Windows:

  • The icons shown by aadDockDesktop are those that are visible on the default Windows desktop of the user.
  • On each corner, aadDockDesktop has a small docking arrow / button. By clicking on this small docking arrow / button, aadDockDesktop will dock itself to that specific location on the screen.
  • The small docking arrows / buttons can also be used to resize aadDockDesktop, or to move it along the screen-edge where it is docked.

Hide resize / move arrows-buttons

If you click on the “no arrow / button” -button, the small arrows / buttons will disappear. Doing so will prevent that the user does accidentally resize or move aadDockDesktop:

Close DockDesktop

By clicking on the close-button, aadDockDesktop will terminate:

DockDesktop setting

The config-button shows the configuration options:

Auto ReSize if to small

In case aadDockDesktop is to small, such that not all icons are shown, such that there is a vertical and / or horizontal scrollbar visible, aadDockDesktop will enlarge itself until all icons are visible.

No Close

The close button will disappear and it will not be possible to terminate aadDockDesktop.
Also the option Do not show on Taskbar will be checked, and disabled.

Hide icons on normal desktop

When un-checked the default Windows desktop does also show the usual desktop icons
When checked, the default Windows desktop does not show any icon. Example:

Show those standard desktop icons

when checked, those standard desktop icons like My Computer, Recycle Bin, etc, are shown. When un-checked, only the icons in the personal desktop of the user are shown.

The personal desktop is a setting / location that can be changed by the administrator. Default the personal desktop is located in %USERPROFILE%\Desktop.
If the user has no icons in %USERPROFILE%\Desktop, aadDockDesktop will be empty.
The example here above has the option "Show those standard desktop icons" checked.

Do not show on Taskbar

if checked, the taskbar will not show an item for aadDockDesktop.
If un-checked, the Taskbar will show an item for aadDockDesktop:

Show Full Screen, do not Align icons at Top

DockDesktop can position itself Full Screen. When Show Full Screen is combined with the option Align icons at Top, unchecked, then aadDockDesktop mimics the default Windows desktop:

Show Full Screen, Align icons at Top

Popup when moving mouse in me

Popup when moving mouse in me or desktop

When one of these options is checked, aadDockDesktop will show itself “on top” when the mouse is moved over it.

Read only / No right click / No popup menu

When checked, the default right-click options that do exist on those desktop icons, are disabled. The only right-click that is available, is right-click on the Recycle bin. When doing so, the usual popup asking "Empty the Recycle Bin, yes / no" is shown.

Auto run after login

When checked, DockDesktop will create an entry for itself in the RUN-key in the registry / profile of the user, such that it will be started every time after a login.
When unchecked, the entry in the RUN-key in the registry / profile of the user will be deleted.

Note: when aadDockDesktop is started using AADS Application Control, then this setting is not required.

Show transparent when not active

aadDockDesktop is shown transparent onto the desktop:

Windows Menu

The small Windows-button shows a session menu:

INI-file

aadDockDesktop maintains an INI-file for the user in “Application Data”-folder beneath the personal folder of the user. Which folder that exactly is, can vary and is determined by the Operating System, or by specific settings done by the Administrator.

The INI-file is called aadDockDesktop.ini.

The various config-settings are saved in this INI-file. All possible settings in an INI-file:

Left=340
Top=0
Height=340
Width=460
Dock position=right-top
Auto size=no
Do not close=yes
Hide icons on MS desktop=yes
Do show standard Desktop icons=yes
Hide from taskbar=yes
Popup when moving mouse over me=no
Popup when moving mouse over me or desktop=no
Do Transparancy if not Active=yes
Align icons at Top=yes
Percentage Transparancy=20
Show Full Screen=no
Read only. No right click. No popup menu=yes
Autostart for this user after login=no
Do Resize and Dock=yes
Path=

Path

Path is the only setting in the INI-File that can not be set using the Configuration-panel of aadDockDesktop.

In case Path is empty, aadDockDesktop will show the default Global Desktop as offered by Windows, or the personal desktop of the user in case the option “Show those standard desktop icons” is not checked.

When the setting Path has a value, then aadDockDesktop does expect to find icons in this folder. Examples:

Path=\\server\groups\sales\AppGroup1

Path=c:\icongroups\sales\AppGroup1

It is expected that the folder AppGroup1 contains icons / shortcuts which will be shown by aadDockDesktop.

Note: possible the second example, where Path points towards drive C:, is a better example, because Windows might show the user a warning when attempting to access an icon / link in a folder on a network drive.

Normally Path is never used, but an Administrator might use it in special cases where aadDockDesktop needs to show a special set of icons for the user.

Command-line parameters

It is not required to start DockDesktop with any command-line parameter. However, if done so, 1 or 2 parameters are possible. All parameters should be am INI-file.
The first command-line parameter / INI-file will be the user INI-file. It will replace the default INI-file for the user as described above here.
The second command-line parameter / INI-file will be the system INI-file.
DockDesktop will open the second, system INI-file with only read-access. Whatever config-setting is set in the system INI-file will overrule the config-setting in the user INI-file.

Example:

aadDockDesktop “%userprofile%\aadDockDesktop.ini” “c:\globalsettings\aadDockDesktop.ini”

The 1th INI-file will be in the user-folder.
The 2th INI-file will be a global INI-file with some settings that do apply for every user.

Content of c:\globalsettings\aadDockDesktop.ini

There are only 5 settings in the system INI-file. These 5 settings will overrule the 5 settings in the user INI-file. All other settings in the user INI-file can be changed by the user.

The result of this example is as follows:

The settings which are placed in the system INI-file are all applied, and the user can not change those settings.
Only the settings which are not placed in the system INI-file can be changed by the user.


ViewUsers

ViewUsers

The tool aadViewUsers is installed in the folder \program files\aadServer on the server.

When it is started by an user which does not have Administrator Rights, it is shown as follows:

When it is started by an Administrator, is shows more options:

When it is started in the Console of the AADS Terminal Server, the button for Control is not available.

What can you do with ViewUsers

  • Users are able to send messages to each other.
  • Administrators are able Disconnect or Logoff an user.
  • Administrators who are not working on the Console of the AADS Terminal Server are able to Remote Control a session:

Remote Control of another user

  • Be sure that you are self logged in with Administrator rights.
  • Select another user.
  • Select a preferred hot-key combination that can be used to disconnect the Remote Control Session.
  • Click on Control.

The "Target" user get to see a popup on his desktop with the question if he/she will accept the Remote Control action:

If accepted by the user, the Administrator can view the Desktop of the user.

In the upper-right corner of the Remote Controlled Session, a small button is shown as an indication that the session of the user is being Remote Controlled:


Uninstall

Uninstall

The first tab page of AADS Maintenance Control can be used for Uninstall:

Prior to uninstalling this notification is shown:

Uninstall does not solve problems

Before you consider to uninstall AADS Terminal Server, you should know that uninstall AADS Terminal Server does not solve any problem.
Uninstall AADS Terminal Server does only do:

  • uninstall:
    • delete all AADS files.
    • delete all AADS settings.
    • restore default Windows single logon, single desktop settings.

If you want to fix some kind of AADS Terminal Server problem, all you have to do is re-install AADS Terminal Server. Do not uninstall AADS Terminal Server. Re-install AADS Terminal Server on top of the current installation.

No other users should be active while uninstalling

Be sure that nobody is logged in except for the Administrator. In case other users are logged in, system files and settings are locked and can not be restored by AADS Terminal Server uninstall.

Do not manually remove AADS Program Files

In case there is some "other problem" with an AADS Terminal Server, and because of this you want to Uninstall AADS, you might be tempted to delete AADS Program Files, hoping that this will also remove AADS and fix this "other problem". It is not recommended to delete AADS Program Files. AADS is part of the Operating System, and deleting AADS Program Files will not solve any problem, but cause more problems.

If you want to Uninstall AADS Terminal Server, it can always be done as follows:

  • Boot Windows into Save Mode.
  • While running Windows in Save Mode, use AADS Maintenance Control, the Uninstall button, for Uninstalling AADS Terminal Server.

Manual activity after uninstall

After the uninstall of AADS Terminal Server you should perform the following actions:

  • Configure your firewall in such a way that remote desktop sessions are not possible.
  • Remove all users form the group Remote Desktop users.


Copyrights

Previous

Copyrights

All contents copyrighted by:

AADS WorldWide LTD
Miramar Tower
132 Nathan Road
Tsimshatsui Kowloon
Hong Kong

Other products

All products mentioned are copyrighted by their respective owners.

Other licenses

Lazarus and Free Pascal

Lazarus is a Integrated Development Environment (IDE) for Pascal and is distributed using GPL. Lazarus can be found here:

http://www.lazarus.freepascal.org/

Using Lazarus it is possible to develop programs based on Pascal. Free Pascal is distributed using GPL, and can be found here:

http://www.freepascal.org/

Both Lazarus and Free Pascal do come with libraries. These libraries can be obtained by downloading either Lazarus and / or Free Pascal.

rDesktop

rDesktop is a linux implementation of a RDP-client, and is distributed using GPL. rDesktop can be found here:

http://www.rdesktop.org/

FreeRDP

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. FreeRDP can be found here:

http://www.freerdp.com/

GhostScript

Ghostscript is an interpreter for the PostScript language and for PDF. Ghostscript is distributed using GPL, and can be found here:

http://pages.cs.wisc.edu/~ghost/

OpenSSL

The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library, and can be found here:

http://www.openssl.org/

The OpenSSL license can be found here:

http://www.openssl.org/source/license.html

GPL

Information about GPL, the GNU General Public License, can be found here:

http://www.gnu.org/licenses/gpl.html

Apache License

Information about the Apache License, can be found as follows:

https://www.google.com/search?q=apache+license

Copyright 2016 AADS WorldWide LTD, Hong Kong. AADS Terminal Server | Application Server | Remote Desktop solutions

Previous