Rawns Posted October 20, 2009 Posted October 20, 2009 I have been looking into RDP settings and have found out that you can Enable RDP to act like VNC (ie - see the other person using the PC, take control etc) but it's disabled by default. Open the Group Policy snap-in (Gpedit.msc). In the left pane, under the Computer Configuration branch, expand the Administrative Templates branch. Expand the Windows Components branch. Click the Terminal Services folder. In the right pane, double-click Sets rules for remote control of Terminal Services user sessions. On the Setting tab, click Enabled. In the Options box, click Full Control with users' permission, and then click OK. I guess that it is modifying the registry in some area but can't see where. My plan is that if I can find the key its adding/changing, I can create a batch file, distribute to multiple servers/workstations and enable it on all devices. Any suggestions on how I can proceed?
powdarrmonkey Posted October 20, 2009 Posted October 20, 2009 Any suggestions on how I can proceed? Enable it in a group policy object and apply it to your choice of clients.
Rawns Posted October 20, 2009 Author Posted October 20, 2009 Enable it in a group policy object and apply it to your choice of clients. It needs to be enabled via a script as there are 250+ servers on different domains and each server has between 20 and 100 workstations connected to each.
powdarrmonkey Posted October 20, 2009 Posted October 20, 2009 No it doesn't, this is the whole point of group policy. On each domain, create a policy object and apply to it everything. Every machine will pick it up without any further effort from you.
Rawns Posted October 20, 2009 Author Posted October 20, 2009 No it doesn't, this is the whole point of group policy. On each domain, create a policy object and apply to it everything. Every machine will pick it up without any further effort from you. That still means creating a policy object on 250+ domains. Using CentraStage, I can create a batch file to add a key to the registry to enable Shadow mode using RDP, and distribute the file to every single device within one click. A 10 second job. I just need to find the correct key entry in the registry.
srochford Posted October 20, 2009 Posted October 20, 2009 Don't know where the registry key is, but if you use sysinternals process explorer it can capture all registry changes in real time. It's probably going to be explorer making the change and it's likely to be a section of the registry with Microsoft in the name so that should help narrow down the search (process explorer can be a bit verbose ...)
Cools Posted October 20, 2009 Posted October 20, 2009 you have 250+ domains or 250+ computers what are you StarBucks??
Rawns Posted October 20, 2009 Author Posted October 20, 2009 you have 250+ domains or 250+ computers what are you StarBucks?? 250+ servers all on their own domains. Each domain has 1 or 2 servers and between 20 and 100 workstations. No, I'm not Starbucks.
Michael Posted October 20, 2009 Posted October 20, 2009 It needs to be enabled via a script as there are 250+ servers on different domains and each server has between 20 and 100 workstations connected to each. So taking an average of 50 machines per domain multiplied by 250 domains = 12,500 machines. Your best option/method is without a doubt setting it on 250 domains using GPOs. Even if you created a script, you'd still need to copy that script to 250 servers.
PiqueABoo Posted October 20, 2009 Posted October 20, 2009 250+ domains I believe we're talking about Remote Assistance? If so you'll have problems authenticating unless your workstation is in the same domain as the target. This may or may not be fixable somehow (haven't looked hard yet).
Rawns Posted October 20, 2009 Author Posted October 20, 2009 Even if you created a script, you'd still need to copy that script to 250 servers. Hence why I'd be using CentraStage to distribute it. Every device has CentraStage installed on it which connects each device to the CentraStage server. Using the CentraStage interface, I can select a script (bat, vbs etc), choose which devices to send it to and it will automaticly copy the script file to every device I choose and run it.
Michael Posted October 20, 2009 Posted October 20, 2009 Sounds all very big-scale and complex. The best advice I can offer is do some research, but you're right, the policy will be changing a registry entry somewhere on the system.
p858snake Posted October 20, 2009 Posted October 20, 2009 Offtopic: If you don't mind me asking why do you have so many separate domains?
Geoff Posted October 20, 2009 Posted October 20, 2009 Your domains should be under the same forest. You then link the GPO in at Forest level and it'll propergate down into each domain and therefore each server/client. You will need Enterprise Admin rights to achieve this. If your domains are not under the same forest, the whole question is moot as you will not be able to authenticate correctly cross-domain. Stick with VNC.
Rawns Posted October 20, 2009 Author Posted October 20, 2009 Offtopic: If you don't mind me asking why do you have so many separate domains? Each School has it's own domain.
powdarrmonkey Posted October 20, 2009 Posted October 20, 2009 Right, after some digging through some truly baffling policy templates, the key you're looking for appears to be a DWORD value called Shadow at: HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services Values: 0: No remote control allowed 1: Full Control with user's permission 2: Full Control without user's permission 3: View session with user's permission 4: View session without user's permission But if you set this with a script, the policy engine is going to come along and change it during a user session anyway, so I still think you're wasting your time. 1
Rawns Posted October 20, 2009 Author Posted October 20, 2009 Right, after some digging through some truly baffling policy templates, the key you're looking for appears to be a DWORD value called Shadow at: HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services Values: 0: No remote control allowed 1: Full Control with user's permission 2: Full Control without user's permission 3: View session with user's permission 4: View session without user's permission But if you set this with a script, the policy engine is going to come along and change it during a user session anyway, so I still think you're wasting your time. Many thanks powdarrmonkey. I'll give this a go and see what happens.
powdarrmonkey Posted October 20, 2009 Posted October 20, 2009 I love reverse-engineering at lunchtime
Cools Posted October 20, 2009 Posted October 20, 2009 What client does this work on? i have tryed XP clients and it logs the user off when i login.
powdarrmonkey Posted October 20, 2009 Posted October 20, 2009 Terminal servers. Edit: good point. Rawns, you are still wasting your time.
Cools Posted October 20, 2009 Posted October 20, 2009 Coz i know theres a way to watch a PC boot and see the desktop from 2003 r2 server.. never realy looked in to it just seen it at my mates old job..
Cools Posted October 20, 2009 Posted October 20, 2009 dam powdarrmonkey you watching my laptop.. lol that was fast.
powdarrmonkey Posted October 20, 2009 Posted October 20, 2009 Coz i know theres a way to watch a PC boot and see the desktop from 2003 r2 server.. never realy looked in to it just seen it at my mates old job.. Probably Intel vPro.
Cools Posted October 20, 2009 Posted October 20, 2009 next yrs project shoot teachers.. might have to do TS for access at home and ease of use in school for teachers...
localzuk Posted October 20, 2009 Posted October 20, 2009 Many thanks powdarrmonkey. I'll give this a go and see what happens. As I'm in Somerset I thought I'd chip in I'm assuming this is for the Primaries/First schools (as us middle and secondary schools would create the policy for you). Have you considered using Powershell scripting? It is capable of manipulating GPOs easily, without directly needing to manipulate registry settings. The way I'd be doing it would be to create a GPO in a domain, export it/back it up, and then via PowerShell import it into all the disparate domains. Windows Administration: Simplify Group Policy Administration with Windows PowerShell Group Policy: Automating Group Policy Management with Windows PowerShell
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now