Home

Hey guys, I really didn't want to start a discussion...

I haven't at any point said this would work over RDP if the other user is logged on to the console. Can you point out where I say so? And I have now answered to you several times that YES you can't do that over RDP.

What I am saying is that when everyone agreed that this can't be done you started saying this can't be done because of "authentication" or something like that. And someone even answered "thanks for clearing that out". That is not true. Windows Client only allows one interactive session (unless you have Multipoint service like school classes - where this will work from RDP session to another). On a server the licensing says that you can have multiple interactive sessions and this will work as long as the clients connect with RDP to RDS or Citrix (not if one user is logging on from the server console which apparently is something you want to point out although I believe no one does this - uses a server as a client or would logon to RDS console or Citrix console as an end user). You can do this from an RDP session to another even without RDS for 50 users as long as both are logging on to the server with RDP. 

If the ultimate question is "Why can't I have an RDP session to Windows 10 workstation and take over another users session that is already logged on to the machine?" The answer is "Because the client license will not allow multiple sessions at the same time".

And like I said early on in the comments, that won't work. But it is not an RDP issue but a difference in Workstation vs Server. It does work on a client that uses multipoint services, even with RDP as there the license allows this.

You need to be running in an RDP session yourself. In my video both windows are RDP-sessions and not the physical KVM-connection. 
 

please test it so that you take two sessions via mstsc.exe to that brand new server of yours with the RDS. And not from you VmWare console.

https://1drv.ms/v/s!AspOCmNF4_bZrbR25lkEL5z_nkwsNw?e=fBvVYZ

Try on a server 2019 that has RDS like I said. Server 2019 licensing allows only one console session at a time - just like the client.

With no disrespect Leos but you are incorrect. And yes I have tried this via RDP. I didn't mention RDP at any point of the article and wasn't even talking about it so I don't really understand the need to point out that it wouldn't work with something I didn't even talk about... 

The reason why it doesn't work against a Windows 10 workstation is because of licensing. Windows workstation versions only allow one interactive user at a time - Either locally or remote. This works fine via RDP against a server that has RDS and is not a limitation of RDP not allowing this - It's really just licensing.

Why I chose not to talk about RDP in this is because currently most security aware companies don't use RDP for connecting to end user desktops. First because of the security issues with RDP but even more because Remote Desktop will lock out the user while you connect to it --> Some other mechanism like SCCM Remote Control, TeamViewer or Bomgar are needed anyway, and my tip works on those. So I did not use RDP here as an example because I never really logon to workstations with it.

You can also use other tools if the SERVER-service is not running. You can use Process Hacker (malicious by most antimalware) or you can use SC.exe to build a service to do this. PSEXEC is just the easiest.

From this instruction here "launch VBoxWindowsAdditions.exe" It assumes the guest OS is a windows box too. What happens if the guest OS is a Linux Box instead?

None in the post will work. 

How to install a third-party software inside a guest OS using WAC

In my environment I have a service account I created and applied the permissions to it and a dedicated OU for newly imaged machines as described in your post. I've also tried the delegation wizard and specifically making the user domain admin. I don't think it's a big deal, but the only way I can get machines to join the domain with this service account is by using the following properties in the customsettings.ini:

JoinDomain=contoso.com

UserDomain=contoso.com

UserID=service_ba

UserPassword=C0mplexP@ssw0rd

Any idea why the DomainAdmin,DomainPassword,DomainAdminDomain, properties will not allow the user to join users to the domain through MDT? I can join machines manually after the deployment fails with the account. When I look in the deployment log it shows that it's trying to join the domain, but cannot locate DNS (DHCP has correct DNS settings, and DNS records are correct obviously since I can join machines manually). Also the ZTI log shows it has tried too many time to join the domain count=4. I'd appreciate your thoughts.