Comment Feed for Single Session per User - Remote Desktop (TechOff on Channel 9)

Re: Re: Re: Re: Re: Re: Re: Re: Single Session per User - Remote Desktop

raptor3676 — Tue, 14 Jul 2009 15:34:58 GMT

the thing is a single app instance no matter who and about the script... yep I just did it!

here I post the code in Powershell 1.0, hope is useful for other people.

#############################

[string]$user="HDTS"
[int]$session=0

$p=[System.Diagnostics.Process]::GetCurrentProcess()
[string]$cur_user=[System.Environment]::UserName
[int]$cur_session=$p.SessionId
if($cur_user -eq $user)
{
if($cur_session -eq $session)
{
  write-host "Starting Applications"
  & 'C:\prog1.exe'
  & 'C:\prog2.exe'
}
else
{
  [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
  [System.Windows.Forms.MessageBox]::Show(@("The account $user can only be used with MSTSC /CONSOLE or MSTSC /ADMIN"), [System.Environment]::MachineName, [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error);
}
}
else
{
if($cur_session -eq $session)
{
  [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
  [System.Windows.Forms.MessageBox]::Show("You just replaced the replace the account of the user $user. Log off inmediately and log on as $user usando MSTSC /CONSOLE o /ADMIN", [System.Environment]::MachineName, [System.Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Error);
}
}

Re: Re: Re: Re: Re: Re: Re: Single Session per User - Remote Desktop

AndyC — Tue, 14 Jul 2009 05:21:56 GMT

I'm confused. Do you only want 1 single copy to possibly run, or only 1 per user that might be trying to run it?

Either way, it can probaly solved most easily with a stub checking whether or not you are running in Session 0 before launching the app. If you only want 1 possible copy, insist that it runs in Session 0 (i.e. via /admin or /console). Otherwise a combination of the GP setting and a refusal to run in Session 0 would do it. It's a dirty hack but it'll sort of work.

The alternative is one big global mutex, or a global mutex which partially incorporates the user name if you only want one copy to launch per user.

Or you could, you know, just tell users not to launch it from within a /console session 'cos it breaks stuff. Us ops guys are kinda used to rubbish software apps that don't behave 100% as they should.

Re: Re: Re: Re: Re: Re: Single Session per User - Remote Desktop

raptor3676 — Tue, 14 Jul 2009 00:24:51 GMT

Well I'm not sure that screen-scrape is need here all the users need to check is that the app(s) are live and kicking and they can do that just by looking at the UI if it is dead, kill it (Task Man) a restart it no further acction is required. The rest of the information is (verbosely) logged to files.

I tried alternative solutions here, I even managed to scrap half of those apps. The part that actually handles the transport and persistance part for 3rd party systems I rewrote it entirely in C#, it can now safely run as a service, I made it more resilient a various levels, it has been in production for quite some time now as smooth as silk. In fact I earned a gigantic bonus because of that [H]

However the rest of that suite (POC is a better term), handles the business logic, not to mention that it is supported/maintained by our headquarters in Europe. And this time I had to agree with my boss and rule out a replacement because it's too risky. Unexpected behavior for the rest of the solution, and non-company-standard implementation, is on top of my list.

Anyway, I even tried the scrapping-the-damned-POS approach, and took it as far as I could go. But that still left us struggling with the "really 1 instance has to run 7x24 no matter who is on the box" problem ;) I don't know if that can be accomplished by the RDP client app you mentioned.

Re: Re: Re: Re: Re: Single Session per User - Remote Desktop

figuerres — Mon, 13 Jul 2009 22:32:52 GMT

SO I guess here is the "$64,000.00" question: is there any way to screen-scrape a windows app?

we can do things like SendKeys to pipe input into the app but then what about the display?

OR write a custom RDP client app, grab the app window and the child windows and dialogs and show only them in an RDP session.

then you can pipe mouse and keyboard into the app when needed. or make it a Read-Only screen for some uses...

not simple but could be done.

i wonder if there are any screen scrapers that work on windows apps? I know there are some tools that take like vt-100 screens and read the text but this is windows / graphics here...

Re: Re: Re: Re: Single Session per User - Remote Desktop

raptor3676 — Sun, 12 Jul 2009 23:18:10 GMT

You just nailed it!

And yes to use VM have come across my mind a couple of times, however I need to be careful to minimize any posible impact.

Re: Re: Re: Single Session per User - Remote Desktop

figuerres — Sun, 12 Jul 2009 21:55:48 GMT

I see ... you have a legacy POC (Pice Of Crap) to try and manage... and it was not designed to run on a "server" environment... sucks.

so really 1 instance has to run 7x24 no matter who is on the box *BUT* you need a few users to be able to access that app w/o giving that user Admin rights to the server ... is that right?

i am wondering if there is some way to run it in a Virtual Box but capture the screen and keyboard I/O and then write a service around that to then allow you to make it into a proper service that you can attach clients to... a really ugly hack around but might just do what you need to do and give you better ways to deal with it.

Re: Single Session per User - Remote Desktop

William Stacey — Sun, 12 Jul 2009 18:15:04 GMT

not sure if something like application virtualization would fit here:

http://www.microsoft.com/systemcenter/appv/default.mspx

Re: Re: Single Session per User - Remote Desktop

raptor3676 — Fri, 10 Jul 2009 19:34:31 GMT

I'd love to! but those are installations that have being working for quite some time now and being critical to the operation (handles lots of $$$) I prefer not to touch them.

But you can bet, new installations are going that way.

Re: Re: Single Session per User - Remote Desktop

raptor3676 — Fri, 10 Jul 2009 19:30:32 GMT

Yep I know, and in fact I set it that way but. If you log on the server normaly (as opposed to the console) it still lets you log to the console with the same account, with out replacing the another session, which is the behavior you get (and the one I want) when you don't log to the console session.

Re: Re: Single Session per User - Remote Desktop

raptor3676 — Fri, 10 Jul 2009 19:25:59 GMT

The app I mention is actually a middleware that handles messaging between to separate systems. That's why I mentioned that they should run as services no apps in an session.

Re: Single Session per User - Remote Desktop

AndyC — Tue, 07 Jul 2009 19:02:57 GMT

"PS: I want to restrict the use of the console for that account because otherwise I cannot ensure that it has a single session per user."

There is a Group Policy setting which forces a single session per user. That's also the default behaviour of Windows Server 2008.

Re: Single Session per User - Remote Desktop

figuerres — Tue, 07 Jul 2009 18:31:11 GMT

you may want to look into using Terminal Server - do the apps have to run 24x7 or just on demand?

Terminal Server is part of windows server and can run an appand connect the user to the app so that they have no access to anything you do not want them to have, by use of policy you can remove the start menu, run command and other things.

also the terminal service login can make the app the only thing they can use.

so even if the app has to have some admin privleges you can make the user only have the app and not the whole server.

you may also be able to create a session-connection so that the app is running and they just go back to it if it has to be running when no users are on.

Re: Single Session per User - Remote Desktop

section31 — Tue, 07 Jul 2009 17:22:33 GMT

During my time at Siemens I did alot of software repackaging. I saw alot of bad application requiring admin rights but due to the company police it wasn't allowed to run desktops as admin. So what we always did was to set just the user rights to the resources needed by the application. So Regmon/Filemon and few hours of try and error is what you need to get the app running with user rights. With this strategy we got almost every app running in a NT4 environment.