tj2419 Posted January 30, 2012 Posted January 30, 2012 Hi Guys, I am starting to look at allowing remote access for certain users. Just wondering if there are any free or cheap ways of doing it? We are on Server 2003 for our cc4 network. We do have server 2008 on our VLE server. I've seen people mentioning VPN's and terminal services but not sure what advantages/disadvantages each gives. Any help would be great thanks.
FN-GM Posted January 30, 2012 Posted January 30, 2012 We use a Sonicwall SLL VPN appliance. The user goes to a web interface and logs in. They then see links to home area, shared area, intranet and the Terminal Servers. The good think about terminal servers is that it can give the user the exact same experience as they would have in school. They get all the apps etc. Well worth doing to be honest. 1
tj2419 Posted January 30, 2012 Author Posted January 30, 2012 We use a Sonicwall SLL VPN appliance. The user goes to a web interface and logs in. They then see links to home area, shared area, intranet and the Terminal Servers. The good think about terminal servers is that it can give the user the exact same experience as they would have in school. They get all the apps etc. Well worth doing to be honest. So with your setup the users are able to open network applications like SIMS, office or photoshop? How much did this cost to setup? Do you know how many connections you roughly have + size of your school? Sorry for all the questions this is a steep learning curve for me Thanks
FN-GM Posted January 30, 2012 Posted January 30, 2012 (edited) So with your setup the users are able to open network applications like SIMS, office or photoshop? Yes, exactly. But you might find photoshop struggling over the internet. i no longer work at the school but the data is still good. The SSL VPN, licenses for 100 concurrent users & support for 3 years cost 1,500 pounds (sorry no pound key on this keyboard). I can have 100 users use the box at anyone time, when they log off that license is freed up for someone else to use. Then there is the cost of your Terminal Server if you want one. You can use the SSL VPN for file sharing and accessing internal webpage as well as terminal servers so you might not need one. Here is a demo of the product. https://sslvpn.demo.sonicwall.com/cgi-bin/welcome - By the way you can get rid of all that junk you see after you login Edited January 30, 2012 by FN-GM
dhicks Posted January 30, 2012 Posted January 30, 2012 For remoting in via RDP to my home system, I use SSH port forwading. Each authenticated user gets given an SSH key on a USB stick along with a copy of PuTTY and a small program I wrote to automatically open the SSH connection and start Remote Desktop How much did this cost to setup? SSH itself costs nothing, you can also look at something like OpenVPN. How the various software you use is licensed for use over Terminal Services from offsite is between you and the vendor of each peice of software - for instance, each client machine will need to be licensed for Microsoft Office if the user on that machine wishes to use it.
tj2419 Posted January 30, 2012 Author Posted January 30, 2012 For remoting in via RDP to my home system, I use SSH port forwading. Each authenticated user gets given an SSH key on a USB stick along with a copy of PuTTY and a small program I wrote to automatically open the SSH connection and start Remote Desktop SSH itself costs nothing, you can also look at something like OpenVPN. How the various software you use is licensed for use over Terminal Services from offsite is between you and the vendor of each peice of software - for instance, each client machine will need to be licensed for Microsoft Office if the user on that machine wishes to use it. Would this licensing be different than say if I had an ees licensing agreement it wouldn't cover the external machine if it connected?
MYK-IT Posted January 30, 2012 Posted January 30, 2012 EES (or EVS-OS) does not cover you for Remote Desktop Services (RDS) by default so I have been advised. You need to purchase RDS User CALS. There are 2 options for Staff. If you purchase the same amount of RDS CALS as your FTE Count, then that will cover all Staff/Pupils RDS usage within the school, and Staff only externally. You can alternatively purchase RDS CALS for the staff if you require less than your FTE Count, but these cost a bit more and only cover Staff within school and externally (no students). There are different RDS User CALs for Students for External use, and these to need to be purchased for every Student requiring external access. This is what I have been advised after enquiring about EES/OVS-ES licensing from various suppliers.
sonofsanta Posted January 31, 2012 Posted January 31, 2012 If it's only for certain staff users - e.g. a couple of members of SMT - I've just used LogMeIn on a handful of computers to allow remote access to Facility. Works well enough and is free. Obviously a pain to scale up but is a handy tool for a few people.
localzuk Posted January 31, 2012 Posted January 31, 2012 Another Sonicwall SSL VPN user here. They go to the web page to install the first time, after that they just launch the client on their machine and they are connected in and have access to their drives etc... At the moment, all teaching staff have laptops so we don't have a terminal server solution. However, we're also looking at moving to a desktop for teacher solution, with a small pool of laptops. If we do this, a terminal server is likely going to be put in for things like SIMS.net etc...
tj2419 Posted January 31, 2012 Author Posted January 31, 2012 Our LA block logmein. Teamviewer works but isn't really stable enough for large numbers of access just for the technicians to login.
dhicks Posted January 31, 2012 Posted January 31, 2012 Would this licensing be different than say if I had an ees licensing agreement it wouldn't cover the external machine if it connected? The best people to ask are probably going to be your software supplier - your Microsoft reseller should be able to go through all the various licensing options with you. You could look at an external connector license, which seems to be available at a good price for schools. Bear in mind that after sorting licensing for Windows, RDS and MS Office you'll still have to check licensing for any other software you use.
jonnykewell1 Posted January 31, 2012 Posted January 31, 2012 does sonic wall connect to the server and run like a virtual session and then same docs into their mapped areas, or does it need to connect straight into their machine at work?
localzuk Posted January 31, 2012 Posted January 31, 2012 does sonic wall connect to the server and run like a virtual session and then same docs into their mapped areas, or does it need to connect straight into their machine at work? Sonicwall SSL VPNs work by providing a secure tunnel between the connecting computer and the network at school. So, it is as if the computer is locally connected to the network. It doesn't provide any virtual sessions etc... It can be set to run a script on login though, to map drives etc... should you want it to.
pantscat Posted January 31, 2012 Posted January 31, 2012 I'm currently looking at Microsoft DirectAccess... looks like it might be user-proof! Using Windows 7 Direct Access to connect teachers to your school network securely - Microsoft UK Schools blog - Site Home - MSDN Blogs
Oaktech Posted January 31, 2012 Posted January 31, 2012 would HAP+ and adding a link to eportal to it... help?
FN-GM Posted January 31, 2012 Posted January 31, 2012 Sonicwall SSL VPNs work by providing a secure tunnel between the connecting computer and the network at school. So, it is as if the computer is locally connected to the network. It doesn't provide any virtual sessions etc... It can be set to run a script on login though, to map drives etc... should you want it to. It can also be done through a web interface without any client to be installed. This is what we do for all staff and students. We dont use the VPN client at all.
chazzy2501 Posted January 31, 2012 Posted January 31, 2012 I'm currently looking at Microsoft DirectAccess... looks like it might be user-proof! Using Windows 7 Direct Access to connect teachers to your school network securely - Microsoft UK Schools blog - Site Home - MSDN Blogs I'm also looking into this but I'm waiting for swgfl / updata to let me know if this is possible as you need to not be behind a NAT. So you also have to put your windows 2008 server directly onto the internet!
gshaw Posted January 31, 2012 Posted January 31, 2012 Doesn't DirectAccess require everything to be ipv6? We want to do Remote Access as well but the RDS Web Access component in Server 2008 R2 is awful from an end-user perspective especially on XP SP3 clients... needs 2-3 updates \ patches and MS still expect people to log in with DOMAIN\username format... user friendly much?
pantscat Posted January 31, 2012 Posted January 31, 2012 No... it needs ipv6 to function, but it doesn't require you to go purely ipv6 on your internal network.
tj2419 Posted January 31, 2012 Author Posted January 31, 2012 Has anyone implemented a citrix solution? How much did it roughly cost? Thanks
zag Posted January 31, 2012 Posted January 31, 2012 We want to do Remote Access as well but the RDS Web Access component in Server 2008 R2 is awful from an end-user perspective especially on XP SP3 clients... needs 2-3 updates \ patches and MS still expect people to log in with DOMAIN\username format... user friendly much? I've got this installed on 2003 server R2 and its brilliant. User just logs in to a web page and its exactly like a remote desktop session. Staff love it. Nothing different than logging on in school. Takes a couple of minutes to setup on Windows server and costs nothing. 1
MYK-IT Posted January 31, 2012 Posted January 31, 2012 Takes a couple of minutes to setup on Windows server and costs nothing. RDS CALS for Staff and Students are required though..
gshaw Posted January 31, 2012 Posted January 31, 2012 No... it needs ipv6 to function, but it doesn't require you to go purely ipv6 on your internal network. Just had a look for the requirements... one or more DirectAccess servers running Windows Server 2008 R2 with two network adapters: one that is connected directly to the Internet, and a second that is connected to the intranet. on the DirectAccess server, at least two consecutive, public IPv4 addresses assigned to the network adapter that is connected to the Internet. DirectAccess clients running Windows 7 (Ultimate and Enterprise editions only). at least one domain controller and Domain Name System (DNS) server running Windows Server 2008 SP2 or Windows Server 2008 R2. public key infrastructure (PKI) to issue computer certificates. Bit pointless as a Remote Access solution for non-domain computers then... how many staff are using Enterprise or Ultimate... although I guess MS would argue that's not the usage scenario they've designed it for but even so...
vikpaw Posted January 31, 2012 Posted January 31, 2012 We had VPN, then couldn't get it to work through the new CISCO setup, so have been using Logmein, now with the free iphone app as per http://www.edugeek.net/forums/netbooks-pda-phones/89269-logmein-provides-free-app-iphone-ipad.html I'm also looking into this but I'm waiting for swgfl / updata to let me know if this is possible as you need to not be behind a NAT. So you also have to put your windows 2008 server directly onto the internet! @chazzy2501 - Regarding the NAT limitation, I've just seen this posted on Capita's Supportnet forum, i've asked for more info, so can report back if i hear anything: Here at xxxyyy School we are the only school in the world to have Sims at home via DirectAccess and we would like to share our knowledge with you. The reason this is so spectacular is that we are behind a NAT. According to Microsoft and everyone else on the internet it is impossible to have DirectAccess working behind a NAT but we have figured it out. We have also integrated offline files with the laptops so users work is instantly backed up here at work when they are working from home. We can also filter the internet when the user is at home as well. And all this happens without the user having to press a button. As soon as the laptop is on they are automatically connected to our school and will receive all new GPO’s snd all network programs. It really is a work computer at home. If you would like to find out more please don’t hesitate to contact us. It does read quite like spam, but removed school name in case they don't want to be identified.
gshaw Posted January 31, 2012 Posted January 31, 2012 (edited) I've got this installed on 2003 server R2 and its brilliant. User just logs in to a web page and its exactly like a remote desktop session. Staff love it. Nothing different than logging on in school. Takes a couple of minutes to setup on Windows server and costs nothing. What clients are your staff running? Does your login process go something like this... - IE only browser support (quelle surprise) - login to https://yourdomain/rdweb - have to enter DOMAIN\username format credentials, completely different to OWA where they only need to enter their standard network username (I've edited the login page to add the DOMAIN part) - on XP SP3 the ActiveX control is often disabled by the OS so you need a Microsoft FixIt tool to enable it via registry - user then sees a list of RemoteApps displayed along with the Remote Desktop icon for a direct session - great - but when loading a RemoteApp you get a warning box about the publisher (even with SSL all sorted out) that you have to dismiss - if loading the Remote Desktop session you get prompted for credentials a second time (at least in 7 it remembers the username but not with XP). Hotfix is available for 7 but again it's another patch to install. If using XP SP3 clients you have to make sure they have RDC 7.0 installed or WebSSO doesn't work and RemoteApp asks for credentials a 2nd time. I also found unless CredSSP is enabled it can be a bit flaky (patch + reboot required) If yours works more smoothly I'd love to know how as MS haven't made any suggestions to fix any of the above on Technet Just noticed you mentioned Server 2003, think it's a different setup on there from what I remember... Edited January 31, 2012 by gshaw
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now