PubForum Tritsch TSInternals

Category: Entertainment

Presentation Description

No description available.


Presentation Transcript

Terminal Server Internals for Vambeers : 

Terminal Server Internals for Vambeers PubForum 2005, Nice, France Bernhard Tritsch

About Bernhard Tritsch: 

About Bernhard Tritsch Author of Microsoft Windows Server 2003 Terminal Services (Microsoft Press) Microsoft Most Valuable Professional (MVP) Windows Server – Terminal Server Chief System Architect at visionapp in Frankfurt/Main, Germany Author of

Session Motivation: 

Session Motivation Car Industry DaimlerChrysler, BMW, Volkswagen, Audi, ... International Motor Show (IAA) Cars in Frankfurt Geneva International Motor Show Terminal Server Industry Microsoft, Citrix, triCerat, AppSense, visionapp, ... Microsoft ITforum in Barcelona Citrix iForum in Las Vegas MTV's

What the Heck are Vambeers?: 

What the Heck are Vambeers? Vambeers are people who usually don't care if it's day or night, because they work with their Terminal Servers in dark rooms, sometimes in huge data centers Only sometimes, when it's dark outside, Vambeers want to go out to drink beer Vambeers belong to the species commonly known as "server nerds" PubForum is a natural habitat for Vambeers

What's under the Hood?: 

What's under the Hood? Pimp my Terminal Server, Vambeers!

But before modifying and tuning terminal servers, it is good to know some system details...: 

But before modifying and tuning terminal servers, it is good to know some system details...

Required Components: 

Required Components A multi-user environment consists of the following components: Access software on a client: Software on a thin client, a Web browser, or a standard PC that enables access to a terminal server over the network Communications protocol: A key component is the RDP protocol enabling remote clients to access the terminal server Terminal server: Windows Server with Terminal Services installed that permits simultaneous user sessions

The RDP Clients: 

The RDP Clients

Standard Win32 RDP Clients: 

Standard Win32 RDP Clients

Standard Win32 RDP Clients: 

Standard Win32 RDP Clients Two different clients Remote Desktop Connection: Start – All Programs – Accessories – Communications Remote Desktop MMC Snap-in: Start – All Programs – Administrative Tools – Remote Desktop One common component Mstscax.dll: RDP Client ActiveX Control

vRD from 

vRD from

The RDP Protocol: 

The RDP Protocol

RDP Protocol Features: 

RDP Protocol Features Based on the standards ot the T.120 protocol family and related to Microsoft NetMeeting Supports up to 64,000 channels Screen is transmitted as raster graphics Adaptive to client capabilities (bitmaps, color table, character commands, caching, ...) Compression and encryption (up to 128-bit) Support of Virtual Channels to extend functionality

The Terminal Server: 

The Terminal Server

Standard User Session Processes: 

Standard User Session Processes Start – Administrative Tools – Terminal Services Manager

Standard User Session Processes: 

Standard User Session Processes Csrss.exe: Win32/64 subsystem controlling the execution of Windows processes and threads Winlogon.exe: Controls the interactive user logon and communicates with the security subsystem Explorer.exe: Graphical interface presented to the user after logon (the "shell") Rdpclip.exe: Executable for file copy, allowing you to copy and paste between terminal server and client Ctfmon.exe: Monitors the active windows and provides text input service support for alternative user input

Task Manager: 

Task Manager

Subsystems in User Mode: 

Subsystems in User Mode These processes run in the system context Csrss.exe: Win32/64 Subsystem, one instance is executed per user session Services.exe: Administrative instance for background processes (Windows Services), controlling multiple service hosts (svchost.exe) Lsass.exe: Local Security Authority Subsystem; used to authenticate users and monitor the degree of security of the other subsystems Smss.exe: Session Manager; this is the first process in user mode created after system start

Windows Services: 

Windows Services Start – Administrative Tools – Services

Terminal Server Service: 

Terminal Server Service Process name: "svchost.exe -k termsvcs" The terminal server service is responsible for Session management: listening for connections, assigning connected users to sessions Initiation and termination of user sessions Session event notification Runs as system service, utilizes the System Global name space The service is entirely protocol independent Uses Rdpwsx.dll for protocol-specific extensions


System Support Processes User Applications Executive Services Object Mgr. Process Mgr. Cache Window- Manager Local Proc. Calls Virtual Memory Mgr. Login Screen Kernel Hardware Abstraction Layer Graphics Device Drivers File System Network Devices Security Mgr. Win32 Subsystem (Csrss) Hardware Kernel Mode User Mode Windows on Windows / Virtual DOS Machine Service Processes

Terminal Server Device Drivers: 

Terminal Server Device Drivers Start – Administrative Tools – Computer Manager – Device Manager – Non-PNP Drivers Start – Administrative Tools – Computer Manager – Device Manager – System Devices

Drivers, drivers, drivers: 

Drivers, drivers, drivers Termdd.sys: General Terminal Server Driver Kbdclass.sys: Terminal Server Keyboard Driver Mouclass.sys: Terminal Server Mouse Driver Rdpcdd.sys: RDP miniport display driver Rdpwd.sys: RDP WinStation Driver, RDP stack driver for TCP/IP Tdtcp.sys: TCP/IP Transport Driver Rdpdr.sys: Terminal Server Device Redirector

System Information: 

System Information Start – Run... – "msinfo32.exe"


Namespaces Namespaces are responsible for identifying objects and are controlled by the Object Manager Two namespaces are available on terminal servers: User-specific namespace, managing objects related to applications that originated in the same session System-wide namespace, visible to all applications across the system System-wide namespace is linked to console-session namespace


Terminal Server Device Driver Termdd.sys Rdpwd.sys Winlogon Rdpwsx Smss Rdpdd.sys Display Driver Terminal Server Service Win32k.sys Kernel Csrss Per- Session Apps Video Mouse, Keyboard User Sessions (WinSta) 1 - n System-wide Tdtcp.sys User Mode Kernel Mode

WTS Configurator: 

WTS Configurator Download from

Thank you: 

Thank you

authorStream Live Help