Settings

Settings

Advanced settings using Microsoft Management Console

The initial screen of the Advanced Settings is as follows:

You can set and configure Policies for this AADS Terminal Server.
- You can configure advanced Remote Desktop Settings.
You can add / remove local users and groups on the AADS Terminal Server.
You can view the Windows Eventlog .

Please note: initial it might take a few seconds to show this screen.

Advanced Remote Desktop Settings

You can do some fine-tuning, but you are advised to be carefully with changing the default settings. You might render your system unusable.

When you click on an option, extra text will appear that explains this option. You are advised to read this text carefully prior to changing an option.

Please note: not all Remote Desktop options are implemented. Several Remote Desktop options are displayed because AADS Terminal Server delivers 1 solution for various Windows versions.

Reboot required

Changing an Advanced Setting of the AADS Terminal Server will require a reboot of the Windows System; the change will be in effect after a reboot.

Control Panel

The "Control Panel" button shows the Windows Control Panel, with direct links to every setting that is possible with the Windows Control Panel:

Temp Folder

AADS changes the default Windows Temp folder for the users, because the default Windows Temp folder is not always suitable in case non-western languages like Thai, Japanese, Chinese, Arabic, etc, are used.
The Administrator can choose to use Default Windows Temp folders. For western languages the default Windows Temp folder will usually be OK.

Require membership of the group Remote Desktop Users

Default only users who are member of the group Remote Desktop Users can login. You can remove this requirement by selecting "verified users". A verified user is an user who has a valid username and password defined locally in Windows, or in the Domain.

Note: members of the group Administrators can login, independent of this setting.

Block logins if Windows is reaching a resource limit

AADS Terminal Server contains a thread that detects generic problems. One of those generic problems is an UNDER-sized or UNDER-powered server.

When this thread needs, for example 30 seconds, it indicates that there has been a moment where the cpu was 100% busy with something for this amount of time.
In those 30 seconds, nobody could login, nobody got a moving mouse, maybe tcp/ip connections are dropped because of time-outs, time-outs while writing data to disk, etc.
This implies a failing server. This implies failing basic functionality of Windows.

This "snap time" is something that is build into AADS Terminal Server. It is not really about AADS Terminal Server itself, but we get support emails about it.
There are also events in the Window logging from AADS Terminal Server stating

Windows is exceeding a resource limit

If that happens to often, with no particular cause, then the server is UNDER sized.
If that happens once, for instance because the virusscanner is doing a scan at 02:00, then it can be considered as OK.

Please be advised to check the Windows Event log for warnings and errors.

When you check the option "Block logins if Windows is reaching a resource limit", new logins on this AADS Terminal Server are blocked as long as the server has a "to-high" cpu utilization.

Remote Desktop Users: Audit Logfiles

If required, the AADServer can generate monthly Logfiles containing user activity.

'21 Mar 2020 7:40:03','REMOTE DISCONNECT','WIN10X64I100\luser001'
'21 Mar 2020 7:40:03','SESSION LOCK','WIN10X64I100\luser001'
'21 Mar 2020 7:52:42','CONSOLE DISCONNECT','WIN10X64I100\testuser'
'21 Mar 2020 7:52:42','SESSION LOCK','WIN10X64I100\testuser'
'21 Mar 2020 7:53:01','SESSION LOGOFF','WIN10X64I100\luser001'
'21 Mar 2020 7:53:47','SESSION LOGON','WIN10X64I100\luser001'
'21 Mar 2020 8:01:09','SESSION LOGOFF','WIN10X64I100\luser001'
'21 Mar 2020 8:01:31','SERVER START','WIN10X64I100'
'21 Mar 2020 8:01:34','SESSION LOGON','WIN10X64I100\testuser'
'21 Mar 2020 8:02:07','SESSION LOGON','WIN10X64I100\luser001'
'21 Mar 2020 8:04:34','SESSION LOCK','WIN10X64I100\luser001'
'21 Mar 2020 8:04:49','SESSION UNLOCK','WIN10X64I100\luser001'
'21 Mar 2020 8:14:58','SESSION LOCK','WIN10X64I100\luser001'
'21 Mar 2020 8:21:31','SESSION LOCK','WIN10X64I100\testuser'
'21 Mar 2020 8:21:35','SESSION UNLOCK','WIN10X64I100\testuser'
'21 Mar 2020 8:22:02','SESSION LOGON','WIN10X64I100\luser002'
'21 Mar 2020 8:24:11','SESSION LOGOFF','WIN10X64I100\testuser'
'21 Mar 2020 8:24:13','SESSION LOGOFF','WIN10X64I100\luser001'
'21 Mar 2020 8:24:14','SESSION LOGOFF','WIN10X64I100\luser002'
'21 Mar 2020 8:24:39','SERVER START','WIN10X64I100'
'21 Mar 2020 8:24:46','SESSION LOGON','WIN10X64I100\testuser'
'21 Mar 2020 8:25:51','SESSION LOGON','IPC\domain002'

The logfiles can found in:

Windows x32	C:\Program Files\AADServer\logging
Windows x64	C:\ProgramData\AADServer\logging

Date/Time Ordering

Usually the loglines are ordered by DATE/TIME. However, it is possible that "newer" loglines appear before "older" loglines. This might happen in case 2 or more users logon on almost the exact same moment. Therefore when using or viewing the Audit Logfiles, one should not assume that all loglines are ordered by DATE/TIME.

Date/Time Format

d	Displays the day as a number without a leading zero (1-31)
dd	Displays the day as a number with a leading zero (01-31)
ddd	Displays the day as an abbreviation (Sun-Sat)
dddd	Displays the day as a full name (Sunday-Saturday)
m	Displays the month as a number without a leading zero (1-12). Note: If the m specifier immediately follows an h or hh specifier, the minute rather than the month is displayed
mm	Displays the month as a number with a leading zero (01-12). Note: If the mm specifier immediately follows an h or hh specifier, the minute rather than the month is displayed
mmm	Displays the month as an abbreviation (Jan-Dec)
mmmm	Displays the month as a full name (January-December)
yy	Displays the year as a two-digit number (00-99)
yyyy	Displays the year as a four-digit number (0000-9999)
h	Displays the hour without a leading zero (0-23)
hh	Displays the hour with a leading zero (00-23)
n	Displays the minute without a leading zero (0-59) Note: it is also possible to use a m for minutes, but the m is ambiguous: see month.
nn	Displays the minute with a leading zero (00-59). Note: it is also possible to use a mm for minutes, but the mm is ambiguous: see month.
s	Displays the second without a leading zero (0-59).
ss	Displays the second with a leading zero (00-59).
am/pm	Uses the 12-hour clock for the preceding h or hh specifier, and displays 'am' for any hour before noon, and 'pm' for any hour after noon. The am/pm specifier can use lower, upper, or mixed case, and the result is displayed accordingly.
a/p	Uses the 12-hour clock for the preceding h or hh specifier, and displays 'a' for any hour before noon, and 'p' for any hour after noon. The a/p specifier can use lower, upper, or mixed case, and the result is displayed accordingly.

Timeout "Signing out" message

When an user does a Session Logoff, the user is presented with the message "Signing out". And while this message is shown to the user, the Server stops all user processes, close files, closes applications, close the session, etc, etc.

Since Windows 10 build 1903 it can take 10 seconds before Windows has closed and cleaned up a session. System software like AntiVirus software can also be a reason why it take a long time before the Session is closed and Logged off.
This implies that it can take 10 (very long...) seconds that the user is looking at the message "Signing out", or for 10 (very long...) seconds is looking at a black screen.

AADS offers a Time Out setting. If the Time Out is set to 3 seconds, the user will see the "Signing out" message for 3 seconds.
It might take longer before the session is indeed cleaned-up by Windows, but the user does not have to wait for this; after the short time-out the session is disconnected and the user can continue to work on his/her Client PC.

In case the short timeout for the "Signing out" message does result in problems, choose (system default) and wait for the Session Logoff to finish as long as it is needed...while the Client PC / MAC shows the message "Signing out" or shows a black screen...