IIIIII in. Windows NTV2000 Thin Client Solutions: Implementing Terminal Services and Citrix MetaFrame. Todd W. Mathers.

Transcription

1 Windows NTV2000 Thin Client Solutions: Implementing Terminal Services and Citrix MetaFrame Todd W. Mathers HLuHB Darmstadt IIIIII in? > _,

2 Contents at a Glance Introduction 1 Part I An Overview of Terminal Server and MetaFrame 9 1 Going Thin with Terminal Server 11 2 Microsoft Windows Terminal Server 25 3 Citrix MetaFrame 67 Part II Planning a Terminal Server Implementation Project Management Considerations Network Planning Client Planning Server Hardware Planning Server Management Planning Software Planning 265 Part III Implementing Terminal Server and MetaFrame Terminal Server Installation MetaFrame Installation Terminal Server Configuration and Tuning RDP Client Installation and Configuration ICA Client Installation and Configuration Web Computing with MetaFrame Group and System Policy Configuration User Profile and Account Configuration Server Operations and Support Application Integration 621 Part IV Appendixes 687 A Terminal Server/MetaFrame Command Reference 689 B Network Primer 721 C File and Folder Security Primer 729 D Terminal Server System and Application Volume Security Permissions 745 E Registry Security Primer 753 F Terminal Server Registry Security Permissions 763 Index 775

3 Contents Introduction 1 What's New? 2 The Contents 2 Part I: An Overview of Terminal Services and MetaFrame 3 Part II: Planning a Terminal Server Implementation 3 Part III: Implementing Terminal Server and MetaFrame 4 Part IV: Appendixes 5 Conventions Used in this Book 5 Naming Conventions 6 General Conventions 7 Part I An Overview of Terminal Server and MetaFrame 9 1 Going Thin with Terminal Server 11 The Total Cost of Ownership 12 Hard Costs 12 Soft Costs 14 Implementation Flexibility 19 Reusing Existing Technology 20 Centralized System Management 20 Scalability 22 Enhancing Security 22 2 Microsoft Windows Terminal Server 25 What Is Windows Terminal Server? 26 The History of Terminal Server 27 Application Servers Versus BackOffice Servers 29 Multiuser Support 31 Hardware Requirements 37 Remote Administration Mode 39 Remote Desktop Protocol (RDP) 39 RDP Basics 39 RDP Encryption 41 RDP Client Features 42 Scalability 45 Network Load Balancing (NLB) 45 NCD ThinPATH Load Balancing 47 Scalability Criteria 50 Terminal Server Management Tools 52 Terminal Services Configuration 52 Terminal Services Manager 54 Windows 2000 Active Directory Users and Computers 54 Windows 2000 Computer Management 55

4 Windows NT 4.0/2000 Terminal Server User Manager for Domains 55 Terminal Services Licensing 57 Application Security Registration ;...58 Terminal Server Clients 59 Terminal Services Client Application 59 Client Connection Manager 60 Terminal Server Session Versus the Local Desktop 61 Terminal Server Licensing Requirements 64 3 Citrix MetaFrame 67 What Is MetaFrame? 68 Advantages of MetaFrame 68 Independent Computing Architecture (ICA) 71 ICA Browser Service 71 ICA Gateways 76 ICA Encryption 80 ICA Client Features 81 Anonymous User Accounts 92 Scalability 94 Citrix Load Balancing 94 Scalability Criteria 97 Citrix Server Farms 98 Single Sign-On 99 Published Application "Push" 99 Server Farm User Authentication 100 Managing a Server Farm 103 Multiple Server Farms 103 MetaFrame Management Tools 104 Activation Wizard 105 Citrix Connection Configuration 106 Citrix Server Administration 106 Citrix Licensing 108 ICA Client Update Configuration 109 Load Balancing Administration 110 Published Application Manager 112 Shadow Taskbar 113 The ICA Client 114 Remote Application Manager 114 Program Neighborhood 115 Web and Java Clients 116 MetaFrame Licensing 117

5 vi Windows NT/2000 Thin Client Solutions 9 Part II Planning a Terminal Server Implementation Project Management Considerations 121 Implementation Requirements 121 Documentation 123 Leveraging Desktop Deployment Flexibility 124 Defining the Scope of Terminal Server in Your Business 125 Enlisting Executive Sponsors 126 Don't Promise What You Can't Deliver 127 Business Process Management 128 Developing the "As-Is" Model 129 Developing the "To-Be" Model 130 Policies and Procedures 132 Selecting Policies to Implement Network Planning 135 Terminal Server and Your Network 135 Terminal Server Placement in Your LAN 139 WAN Considerations 141 Single Points of Failure 144 Latency and Network Utilization on Client Performance 144 RDP and ICA 148 Client-Generated Server Lists 149 Multihomed Terminal Servers 150 Supported Protocols 152 Printing Considerations 153 Remote WAN Printing 154 Remote LAN Printing 155 Redirected Client Printing 155 Dial-up Access 157 Internet Access 158 Security 158 Connection Availability 162 TCP/UDP Ports Client Planning 163 The Thin Client 164 Desktop Replacement 164 Desktop Integration 166 Application Replacement 167 RDP Client Support 169 Win32 Client 171 Winl6 Client 171 Non-Windows Clients 172 ICA Client Support 172 Win32 Client 174 Winl6 Client 174 WinCE Client 175

6 Contents vii DOS Client 175 Macintosh Client 176 UNIX/Linux Client 177 Web Client 178 Java Client 181 Windows-Based Terminals 181 Deployment Scenarios with RDP and ICA 185 Desktop Replacement 185 Application Replacement 187 Desktop Integration 189 Client Deployment and Support Planning 191 Managing Terminal Server Expectations 191 User Deployment Considerations 193 Deployment Exceptions 200 Client Testing 200 User Training 201 Support Staff Training 204 User Profile, Policy, and Account Planning 206 Server Hardware Planning 207 The Assessment Process 208 Determining the Requirements 209 User Capacity Requirements 209 Application Requirements 211 System Availability 213 Risk Tolerance 214 Sizing the Users per Server 216 Hardware Sizing 216 Processors 217 RAM 219 Disk Subsystem 221 Network Interface Cards 222 Servers Versus Workstations 223 Load Testing 223 User and Application Testing 224 Automated Server Load Testing 228 Determining the Number of Required Servers 228 Server Management Planning 231 The Model for Terminal Server Management 231 The Theory of Terminal Server Management 233 Build-on-Demand Management 234 Virtual Server Management 235 Security Management 239 Limiting Administrative Privileges 240 Connection Security 242 File Security 245

7 VIII i Windows NT/2000 Thin Client Solutions Registry Security 250 Auditing 256 Domain-Level and Local Security Policies 259 Application Management 260 Server Reboot Scheduling 260 Test and Pilot Server Management Software Planning 265 Software Planning Overview 265 Administration and System Support Software 266 Service Packs and Hotfixes 267 Load Balancing 268 Cloning and Server Replication 268 Application Deployment 269 Registry and File Replication 270 Server Monitoring and Health Checking 271 Antivirus Software 273 Windows Server Resource Kit 274 Scripting Tools 275 Application Software 276 Application Installation Standards 277 Change Management 280 Planning for Testing and Pilot Users 280 Software Testing 282 Release Management 287 Part III Implementing Terminal Server and MetaFrame Terminal Server Installation 291 Before You Begin 291 Installation Checklist 292 Upgrading an Existing Operating System 293 Windows NT Server 4.0, Terminal Server Edition Installation 294 Veteran NT Administrator's Summary 295 Part 1: Beginning the Setup 298 Part 2: The GUI Setup 301 Part 3: Configuring Network Components 303 Part 4: Finishing the Setup 305 Windows 2000 Terminal Services Installation 306 Veteran Windows 2000 Administrator's Summary 307 Part 1: Beginning the Setup 311 Part 2: The GUI Setup MetaFrame Installation 317 Before You Begin 317 Installing MetaFrame 318 Unattended Setup Mode 325 Uninstalling MetaFrame 327

8 Contents ix 12 Terminal Server Configuration and Tuning 329 Before You Begin 330 Preventing Client Connections 330 Domain Membership 332 Performing Systematic Changes 332 Service Packs and Hotfixes 332 Terminal Server Windows MetaFrame 333 Determining Hotfix and Service Pack Versions 334 Terminal Server Licensing Configuration 335 Windows 2000 Terminal Services Licensing 335 MetaFrame License Installation and Activation 338 Terminal Server Stability and Availability 341 Configure the Pagefile 341 Increase the Registry Size 342 Disable Dr Watson 344 Suppress Hard Error Messages 346 Configure the Server Recovery Options 347 Set Up Scheduled Reboots 348 Disable MetaFrame Client Auto-Updating 349 Turn Off Network Interface Card Auto-Detect 350 Add the User and Server Name in the My Computer Icon Terminal Server Performance Tuning 352 Disable Active Desktop 352 Disable NT Executive Paging 353 Disable Last Access Time Update on Directory Listings 354 Adjust L2 Cache Settings 354 Disable Roaming User Profile Caching 354 Modify Server Optimization Setting 355 Modify Foreground Thread Timeslices 356 Increase Idle Connections 358 Enable MetaFrame SuperCache 359 Terminal Server Security Configuration 360 Local Security Groups and Users 360 File Security 361 Registry Security 362 Security Auditing 362 User Rights 370 Group and System Policies 372 Connection Configuration 372 TS 2000 Connection Creation 372 TSE 4.0 Connection Creation 378 Additional Connection Security Features 381

9 .^Windows NT/2000 Thin Client Solutions Additional MetaFrame Configuration Options 382 ICA Browser Configuration and Tuning 382 ICA Gateways 385 Citrix Load Balancing 386 Server Farm Membership 389 NetWare Drive-Mapping Conflicts 391 Printer Drivers 393 Network Printer Drivers 394 Client Printer Mapping RDP Client Installation and Configuration 401 RDP Client Installation 401 Creating Client Installation Disks 402 Creating a Client Distribution Share Point 403 Disk-Based or Share Point Client Installation 403 Client Distribution with Active Directory 404 RDP Client Applications 405 Terminal Services Client 405 Client Connection Manager 406 RDP Client Configuration 407 Desktop-Replacement Connections 407 Application-Replacement Connections 411 Desktop-Integration Connections 413 RDP Client Deployment Options ICA Client Installation and Configuration 417 ICA Client Installation 417 Creating ICA Client Installation Disks 419 Installing the MetaFrame Client 419 ICA Client Applications 420 Common ICA Client Properties 421 Remote Application Manager 426 Program Neighborhood 428 ICA Client Configuration 433 Desktop-Replacement Connections 433 Application-Replacement Connections 443 Desktop Integration Connections 446 Deploying the ICA Client 447 ICA Client Settings The APPSRV.INI and PN.INI Files 447 Customizing the ICA Client Installation 449 Automatic Client Update Web Computing with MetaFrame 459 Component Overview 460 Application Launching and Embedding 461 Application Launching 462 Application Embedding 462

10 Contents xi Citrix NFuse: Program Neighborhood for the Web 463 Citrix ICA Web Client Configuration 467 ICA Client Version Requirements 469 Installing an ALE Client 470 ICA Java Client 471 Supported Web Browsers 479 Configuring the Web Browser 481 MetaFrame Server Configuration for Web Computing 483 NFuse MetaFrame Server Configuration 484 Web Server Configuration 488 MIME Type Configuration 489 ICA Java Client Configuration 490 NFuse Web Server Configuration 490 Developing the HTML Page 493 MetaFrame and Firewall Considerations 506 Published Application Accessibility Requirements 507 Sample Configuration with Checkpoint FireWall Group and System Policy Configuration 519 Introduction to Policies 519 Environment Preparation 520 Domain Security Groups 520 Network Policy Share 521 Terminal Server Organizational Units 522 Creating and Managing NT 4.0 System Policies 522 Creating the Local Terminal Server Policy 523 Creating the Default User Policies 526 Creating Group-Specific User Policies 528 Defining Policy Priorities 531 Using System Policy Editor Templates '. 532 Creating and Managing Windows 2000 Group Policies 533 Creating the Terminal Server Organizational Unit 535 Creating the Terminal Server Computer Policy 536 Defining the Default User Policy 542 Creating Group-Specific Terminal Server User Policies 545 Setting Group Policy Priorities 547 Group Policy Templates User Profile and Account Configuration 549 Introduction to Profiles 549 Local Profiles 550 Roaming Profiles 552 Roaming Profile and Home Directory Preferences 555 Mandatory Roaming Profiles 557

11 XII ^Windows NT/2000 Thin Client Solutions Environment Preparation 559 Profile/Policy Implementation Options 559 Domain Security Groups 560 Profile Directory Share 561 Home Directory Share 562 Creating and Managing User Profiles 563 Creating Template User Accounts 564 Configuring the Local Default Profile 564 Assigning Roaming Profiles 567 Managing Group-Specific Default Roaming Profiles 568 Managing Changes in a Roaming Profile 570 Creating and Assigning Mandatory Roaming Profiles 572 Managing Changes in a Mandatory Roaming Profile Server Operations and Support 577 Terminal Server Operations 577 Server and User Session Management 578 Terminal Services Manager 579 Citrix Server Administration 584 Command-Line Tools 589 Server Health Monitoring 591 Citrix Resource Management Services 592 NetlQ AppManager 598 Performance Monitor 606 Server Maintenance 612 Disk Defragmentation 612 Windows Server Resource Kit and Support Tools 615 Server Cloning Application Integration 621 The Challenge of Application Integration 622 Terminal Server Application Support Features 624 The User Home Drive and Root Drive 624 Application Compatibility Scripts 629 Installation and Execution Modes 637 Program Compatibility Flags 640 Temporary Directories 646 Application Integration Tools and Techniques 649 Windows 2000/NT Server Resource Kit 650 Registry and File Monitoring 650 Scripting 652 Registry and File Security Auditing 653 Software Packaging and Deployment 654 The Application Integration Process 655 Preparation 656 Installation 658

12 Contents xiii Deployment 664 Application Installation Examples 670 Installation Order 670 MDAC ODBC Connection Configuration 671 Internet Explorer Norton AntiVirus Adobe Acrobat Reader Microsoft Office Hummingbird Exceed Custom Visual Basic Application 686 Part IV Appendixes 687 A Terminal Server/MetaFrame Command Reference 689 ACLCHECK (TSE 4.0/MetaFrame) 689 ACLSET (TSE 4.0/MetaFrame) 690 ALTADDR (TSE 4.0/MetaFrame)(TS 2000/MetaFrame) 691 APP (TSE 4.0/MetaFrame) (TS 2000/MetaFrame) 691 APPSEC (TSE 4.0)(TS 2000) 693 AUDITLOG (TSE 4.0/MetaFrame)(TS 2000/MetaFrame) 693 CHANGE CLIENT (TSE 4.0/MetaFrame) (TS 2000/MetaFrame) 695 CHANGE LOGON (TSE 4.0)(TS 2000) 696 CHANGE PORT (TSE 4.0)(TS 2000) 696 CHANGE USER (TSE 4.0)(TS 2000) 697 CLTPRINT (TSE 4.0/MetaFrame)(TS 2000/MetaFrame) 698 CNVRTUC (TSE 4.0) 699 CONNECT (TSE 4.0) 699 CPROFILE (TSE 4.0)(TS 2000) 700 DISCONN (TSE 4.0) 701 DOSKBD (TSE 4.0) 702 FLATTEMP (TSE 4.0)(TS 2000) 703 ICAPORT (TSE 4.0/MetaFrame)(TS 2000/MetaFrame) 704 KILL (TSE 4.0) 706 LOGOFF (TSE 4.0)(TS 2000) 706 MSG (TSE 4.0)(TS 2000) 707 NDSPSVR (TSE 4.0/MetaFrame)(TS 2000/MetaFrame) 708 PERUSER (TSE 4.0) 708 QUERY ACL (TSE 4.0/MetaFrame) (TS 2000/MetaFrame) 709 QUERY LICENSE (TSE 4.0/MetaFrame) (TS 2000/MetaFrame) 709 QUERY PROCESS (TSE 4.0)(TS 2000) 709 QUERY SERVER (TSE 4.0/MetaFrame) (TS 2000/MetaFrame) 710

13 xiv A Windows NT/2000 Thin Client Solutions QUERY SESSION (TSE 4.0)(TS 2000) 712 QUERY TERMSERVER (TSE 4.0)(TS 2000) 713 QUERY USER (TSE 4.0)(TS 2000) 714 QUERY WINSTA (TSE 4.0) (TS 2000) 714 REGISTER (TSE 4.0)(TS 2000) 715 RESET SESSION (TSE 4.0)(TS 2000) 715 RESET WINSTA (TSE 4.0)(TS 2000) 716 RMVICA (TSE 4.0/MetaFrame)(TS 2000/MetaFrame) 716 SHADOW (TSE 4.0/MetaFrame)(TS 2000) 716 SHUTDOWN (TSE 4.0) 717 TSCON (TS 2000) 718 TSDISCON (TS 2000) 718 TSKILL (TS 2000) 718 TSPROF (TSE 4.0)(TS 2000) 718 TSSHUTDN (TS 2000) 719 B Network Primer 721 The OSI Model 721 Communications Protocols 724 Physical and Logical Networks 725 LANs 725 WANs 726 C File and Folder Security Primer 729 Windows NT 4.0 File System Security 729 Windows NT 4.0 File Permissions 730 Windows NT 4.0 Directory Permissions 732 Windows 2000 File System Security 734 Allow and Deny Permissions 736 Windows 2000 File Permissions 737 Windows 2000 Folder Permissions 738 Calculating Permissions 740 D Terminal Server System and Application Volume Security Permissions 745 Windows NT 4.0, Terminal Server Edition 745 System Volume Permissions 746 Application Volume Permissions 748 Windows 2000 Terminal Services 750 E Registry Security Primer 753 The Need for Registry Security 753 Registry Components 753 Registry Security Permissions 756 Windows 2000 Allow and Deny 757 Windows 2000 Permission Inheritance 758 Calculating Permissions 761

14 Contents xv Registry Hive Files 761 REGEDT32 and REGEDIT 761 Terminal Server Registry Security Permissions 763 Windows NT 4.0, Terminal Server Edition 763 Windows 2000 Terminal Services 771 Index 775