BrettRobi's questions

Is there any way to make Remote Desktop v6 open on a specific monitor in a dual monitor setup?

I know it supports dual monitors and it is easy to make it use both monitors, but what I really want is for all of my RDP sessions to open on my secondary monitor. I save all of my frequently used connections in .RDP files and currently I have a mish-mash where some open on my primary and other on my secondary monitor.

In browsing through the RDP file I can't discern what setting is controlling this (I suspect it is not in this file).

So, how do I control this? I'm running Win7 as my client by the way, and connecting almost exclusively to Server 2008 R2 machines.

We are developing a product that runs on Windows Server 2008. This product gets installed into a customers environment running on dedicated hardware (that we own or at least service) using Server 2008. We consider this an 'appliance', though it is basically a set of X high-end machines running Server 2008. Anyway, we need to remotely manage these servers in the customers environment and are looking of the easiest secure way of managing them.

A VPN is the obvious solution but because each customer implements their own choice of VPN it makes it very hard for us to support that (we'd need many different VPN software setups here to remote in). Another choice is having the customer open a port for RDP traffic so we can just remote in to our servers. But that of course is risky (even if we choose a non-standard port) and customer IT guys really don't like that.

So recently I was reading about TS Gateway (now RD Gateway in R2). I am wondering if it might be the perfect solution for us. If we set this up on one of our servers in the customer site and then had them open up port 443 directly to that server, would this be a secure mechanism for us to RDP into all of our servers at the customer site? It seems like their IT guys might be more receptive to this.

Note that our 2008 servers in the customer environment are not domain joined, they are a simple workgroup.

Thoughts? Am I missing something? Are there better solutions out there?

Can anyone point me at very specific details of what the limitations of the Web Edition of Windows Server 2008 are? I have seen the higher level comparisson charts of the various editions but no detailed specifics.

I understand they removed the inability to install SQL Server and significantly raised the RAM and CPU limits. But a little googling indicates that in Server 2003 the Web Edition has a limit of 10 inbound UNC connections to keep people from using it as a file server. Does this limit still exist in Server 2008? Are there other limits?

I am trying to enable mutual authentication for my WebService hosted in IIS7. I have the server side cert setup and working but cannot figure out how to get a Certificate Trust List created and setup in IIS7 so that I can require and validate client side certificates.

All of my client side certs are signed by my own root cert so I need to create a CTL that contains just my root cert and then have IIS validate client provided certs against the CTL.

Can anyone shed some light on how to do this? IIS6 had a UI for assigning a CTL, but I can find nothing similar in IIS7.

Update: I have now successfully used MakeCTL in wizard mode to create a CTL with a Friendly Name. However I don't have adsutil support on my IIS7 box so via other posts elsewhere I am trying to use the 'netsh http add sslcert' command to assign the CTL to my site.

Before I could use this command I had to remove the existing SSL cert that was assigned to my site for server authentication. Then in my netsh command I specify the thumbprint of that very same SSL cert I removed, plus a made up appid, plus 'sslctlidentifier=MyCTL sslctlstorename=CA'. The resulting command is:

netsh http add sslcert ipport=10.10.10.10:443 certhash=adfdffa988bb50736b8e58a54c1eac26ed005050 appid={ffc3e181-e14b-4a21-b022-59fc669b09ff} sslctlidentifier=MyCTL sslctlstorename=CA

(the IP addr is munged), but I am getting this error:

SSL Certificate add failed, Error: 1312 A specified logon session does not exist. It may already have been terminated.

I am sure the error is related to the CTL options because if I remove them it works (though no CTL is assigned of course).

Can anyone help me take this last step and make this work?

UPDATE 01-07-2010: I never resolved this with IIS 7.0 and have since migrated our app to IIS 7.5 and am giving this another try. Per the response from Taras Chuhay I installed IIS6 Compatibility on my test server and tried the steps he documented using adsutil.vbs (which can also be found here). I immediately ran into this error:

ErrNumber: -2147023584 Error trying to SET the Property: SslCtlIdentifier

when running this command:

adsutil.vbs set w3svc/1/SslCtlIdentifier MyFriendlyName

I then went on to try the next adsutil.vbs command documented and it failed with the same error.

I have verified that the CTL I created has a Friendly Name of MyFriendlyName and that it exists in the 'Intermediate Certification Authorities\Certificate Trust List' store of LocalComputer.

So once again I am at a dead standstill. I don't know what else to try. Has anyone ever gotten CTL's to work with IIS7 or 7.5? Ever? Am I beating a DEAD horse. Google turns up nothing but my own posts and other similar stories.

Update 2/23/10 - I've confirmed with Microsoft that this is a bug with IIS 7.5, but it does work with IIS 7. Check out this link for details: http://rethinker.net/Geek/Configuration/IIS7-CTLs.htm

Update 6/08/10 - I can now confirm that KB981506 resolves this issue. There is a patch associated with this KB that must be applied to Server 2008 R2 machines to enable this functionality. Once that is installed all works flawlessly for me.