Single Session per User - Remote Desktop

Hi,

On one of the servers I manage there are several application running. They have to run in a session (they are not services) and since they are the worst legacy apps I have ever seen, they need administrator rigths, because they have several .ini files scattered in both program files and windows folders (ouch).

I want to prevent the several operators checking the health of those apps, from login to the console (with the /console or /admin) switches.  Is ther a way to prevent that to an account that is a member of the administrator group?

Its a Windows 2003 Standar server.

Thanx in advance

PS: I want to restrict the use of the console for that account because otherwise I cannot ensure that it has a single session per user.

During my time at Siemens I did alot of software repackaging. I saw alot of bad application requiring admin rights but due to the company police it wasn't allowed to run desktops as admin. So what we always did was to set just the user rights to the resources needed by the application. So Regmon/Filemon and few hours of try and error is what you need to get the app running with user rights. With this strategy we got almost every app running in a NT4 environment.

you may want to look into using Terminal Server - do the apps have to run 24x7 or just on demand?

Terminal Server is part of windows server and can run an appand connect the user to the app so that they have no access to anything you do not want them to have, by use of policy you can remove the start menu, run command and other things.

also the terminal service login can make the app the only thing they can use.

so even if the app has to have some admin privleges you can make the user only have the app and not the whole server.

you may also be able to create a session-connection so that the app is running and they just go back to it if it has to be running when no users are on.

"PS: I want to restrict the use of the console for that account because otherwise I cannot ensure that it has a single session per user."

There is a Group Policy setting which forces a single session per user. That's also the default behaviour of Windows Server 2008.

figuerres said:

you may want to look into using Terminal Server - do the apps have to run 24x7 or just on demand?

Terminal Server is part of windows server and can run an appand connect the user to the app so that they have no access to anything you do not want them to have, by use of policy you can remove the start menu, run command and other things.

also the terminal service login can make the app the only thing they can use.

so even if the app has to have some admin privleges you can make the user only have the app and not the whole server.

you may also be able to create a session-connection so that the app is running and they just go back to it if it has to be running when no users are on.

The app I mention is actually a middleware that handles messaging between to separate systems.  That's why I mentioned that they should run as services no apps in an session.

AndyC said:

"PS: I want to restrict the use of the console for that account because otherwise I cannot ensure that it has a single session per user."

There is a Group Policy setting which forces a single session per user. That's also the default behaviour of Windows Server 2008.

Yep I know, and in fact I set it that way but.  If you log on the server normaly (as opposed to the console) it still lets you log to the console with the same account, with out replacing the another session, which is the behavior you get (and the one I want) when you don't log to the console session.

section31 said:

During my time at Siemens I did alot of software repackaging. I saw alot of bad application requiring admin rights but due to the company police it wasn't allowed to run desktops as admin. So what we always did was to set just the user rights to the resources needed by the application. So Regmon/Filemon and few hours of try and error is what you need to get the app running with user rights. With this strategy we got almost every app running in a NT4 environment.

 

I'd love to! but those are installations that have being working for quite some time now and being critical to the operation (handles lots of $$$) I prefer not to touch them.

But you can bet, new installations are going that way.

not sure if something like application virtualization would fit here:

http://www.microsoft.com/systemcenter/appv/default.mspx

raptor3676 said:

figuerres said:

*snip*

The app I mention is actually a middleware that handles messaging between to separate systems.  That's why I mentioned that they should run as services no apps in an session.

I see ... you have a legacy POC (Pice Of Crap)  to try and manage... and it was not designed to run on a "server" environment... sucks.

so really 1 instance has to run 7x24 no matter who is on the box *BUT* you need a few users to be able to access that app w/o giving that user Admin rights to the server ... is that right?

i am wondering if there is some way to run it in a Virtual Box but capture the screen and keyboard I/O and then write a service around that to then allow you to make it into a proper service that you can attach clients to... a really ugly hack around but might just do what you need to do and give you better ways to deal with it.

figuerres said:

raptor3676 said:

*snip*

I see ... you have a legacy POC (Pice Of Crap)  to try and manage... and it was not designed to run on a "server" environment... sucks.

so really 1 instance has to run 7x24 no matter who is on the box *BUT* you need a few users to be able to access that app w/o giving that user Admin rights to the server ... is that right?

i am wondering if there is some way to run it in a Virtual Box but capture the screen and keyboard I/O and then write a service around that to then allow you to make it into a proper service that you can attach clients to... a really ugly hack around but might just do what you need to do and give you better ways to deal with it.

 

You just nailed it!

And yes to use VM have come across my mind a couple of times, however I need to be careful to minimize any posible impact.

raptor3676 said:

figuerres said:

*snip*

You just nailed it!

And yes to use VM have come across my mind a couple of times, however I need to be careful to minimize any posible impact.

SO I guess here is the "$64,000.00" question: is there any way to screen-scrape a windows app?

we can do things like SendKeys to pipe input into the app but then what about the display?

OR write a custom RDP client app, grab the app window and the child windows and dialogs and show only them in an RDP session.

then you can pipe mouse and keyboard into the app when needed. or make it a Read-Only screen for some uses...

not simple but could be done.

i wonder if there are any screen scrapers that work on windows apps? I know there are some tools that take like vt-100 screens and read the text but this is windows / graphics here...

figuerres said:

raptor3676 said:

*snip*

SO I guess here is the "$64,000.00" question: is there any way to screen-scrape a windows app?

we can do things like SendKeys to pipe input into the app but then what about the display?

OR write a custom RDP client app, grab the app window and the child windows and dialogs and show only them in an RDP session.

then you can pipe mouse and keyboard into the app when needed. or make it a Read-Only screen for some uses...

not simple but could be done.

i wonder if there are any screen scrapers that work on windows apps? I know there are some tools that take like vt-100 screens and read the text but this is windows / graphics here...

Well I'm not sure that screen-scrape is need here all the users need to check is that the app(s) are live and kicking and they can do that just by looking at the UI if it is dead, kill it (Task Man) a restart it no further acction is required.  The rest of the information is (verbosely) logged to files.

I tried alternative solutions here, I even managed to scrap half of those apps.  The part that actually handles the transport and persistance part for 3rd party systems I rewrote it entirely in C#, it can now safely run as a service, I made it more resilient a various levels, it has been in production for quite some time now as smooth as silk.  In fact I earned a gigantic bonus because of that 

However the rest of that suite (POC is a better term), handles the business logic, not to mention that it is supported/maintained by our headquarters in Europe.  And this time I had to agree with my boss and rule out a replacement because it's too risky.  Unexpected behavior for the rest of the solution, and non-company-standard implementation, is on top of my list.

Anyway, I even tried the scrapping-the-damned-POS approach, and took it as far as I could go.  But that still left us struggling with the "really 1 instance has to run 7x24 no matter who is on the box" problem I don't know if that can be accomplished by the RDP client app you mentioned.

raptor3676 said:

figuerres said:

*snip*

Well I'm not sure that screen-scrape is need here all the users need to check is that the app(s) are live and kicking and they can do that just by looking at the UI if it is dead, kill it (Task Man) a restart it no further acction is required.  The rest of the information is (verbosely) logged to files.

I tried alternative solutions here, I even managed to scrap half of those apps.  The part that actually handles the transport and persistance part for 3rd party systems I rewrote it entirely in C#, it can now safely run as a service, I made it more resilient a various levels, it has been in production for quite some time now as smooth as silk.  In fact I earned a gigantic bonus because of that 

However the rest of that suite (POC is a better term), handles the business logic, not to mention that it is supported/maintained by our headquarters in Europe.  And this time I had to agree with my boss and rule out a replacement because it's too risky.  Unexpected behavior for the rest of the solution, and non-company-standard implementation, is on top of my list.

Anyway, I even tried the scrapping-the-damned-POS approach, and took it as far as I could go.  But that still left us struggling with the "really 1 instance has to run 7x24 no matter who is on the box" problem I don't know if that can be accomplished by the RDP client app you mentioned.

I'm confused. Do you only want 1 single copy to possibly run, or only 1 per user that might be trying to run it?

Either way, it can probaly solved most easily with a stub checking whether or not you are running in Session 0 before launching the app. If you only want 1 possible copy, insist that it runs in Session 0 (i.e. via /admin or /console). Otherwise a combination of the GP setting and a refusal to run in Session 0 would do it. It's a dirty hack but it'll sort of work.

The alternative is one big global mutex, or a global mutex which partially incorporates the user name if you only want one copy to launch per user.

Or you could, you know, just tell users not to launch it from within a /console session 'cos it breaks stuff. Us ops guys are kinda used to rubbish software apps that don't behave 100% as they should.

AndyC said:

raptor3676 said:

*snip*

I'm confused. Do you only want 1 single copy to possibly run, or only 1 per user that might be trying to run it?

Either way, it can probaly solved most easily with a stub checking whether or not you are running in Session 0 before launching the app. If you only want 1 possible copy, insist that it runs in Session 0 (i.e. via /admin or /console). Otherwise a combination of the GP setting and a refusal to run in Session 0 would do it. It's a dirty hack but it'll sort of work.

The alternative is one big global mutex, or a global mutex which partially incorporates the user name if you only want one copy to launch per user.

Or you could, you know, just tell users not to launch it from within a /console session 'cos it breaks stuff. Us ops guys are kinda used to rubbish software apps that don't behave 100% as they should.

the thing is a single app instance no matter who and about the script... yep I just did it!

here I post the code in Powershell 1.0, hope is useful for other people.

#############################

[string]$user="HDTS"
[int]$session=0

$p=[System.Diagnostics.Process]::GetCurrentProcess()
[string]$cur_user=[System.Environment]::UserName
[int]$cur_session=$p.SessionId
if($cur_user -eq $user)
{
 if($cur_session -eq $session)
 {
  write-host "Starting Applications"
  & 'C:\prog1.exe'
  & 'C:\prog2.exe'
 }
 else
 {
  [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
  [System.Windows.Forms.MessageBox]::Show(@("The account $user can only be used with MSTSC /CONSOLE or MSTSC /ADMIN"), [System.Environment]::MachineName, [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error);
 }
}
else
{ 
 if($cur_session -eq $session)
 {
  [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
  [System.Windows.Forms.MessageBox]::Show("You just replaced the replace the account of the user $user. Log off inmediately and log on as $user usando MSTSC /CONSOLE o /ADMIN", [System.Environment]::MachineName, [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error);
 }
}