Can't deploy RDS services

On new 2012 R2 server cannot deploy RDS (Quick start) option. The installation times out.
The problem was - in the customer AD GPO (in my case "Default Domain Policy" differed from original default version) did not include under (Computer Configuration - Policies - Windows Settings - Security Settings - Local Policies/User Rights Assignment - Log on as a service) "NT Service\ALL SERVICES" account. The account is needed to configure "Windows Internal Database" service. By default the service running under "NT SERVICE\MSSQL$MICROSOFT##WID" account and if the account does not have rights for logon the service will fail to start.

GPO processing 1006 1030 errors on terminal server.

issue: Some users accounts randomly stop process GPO.
solution:

1. Make the user account memeber of "domain admin" group.
2. Login to TS with the account.
3. From CMD run "rundll32.exe keymgr.dll,KRShowKeyMgr" command.
4. Delete everything from "Stored User Names and Passwordds" GUI.
5. Remove the user from "domain admin" group.

Terminal server - Symantec anti-virus and office

You need to disable smc.exe process running by default for each user, the key is:

LaunchSmcGui dword should be 0

You need to prevent ctfmon.exe pro.cess to run too (reference to office installation on the terminal server).

Windows 2008 Terminal services

To configure access:

1. Create AD group, for example: "TS Users"
2. Put the group in local "Remote Desktop Users" group on the terminal server.
3. Put the terminal server in local "Terminal Server Computers" group on the "TS licensing" server to enable to read licensing information.
4. Put the terminal server in separate OU and create a GPO. The GPO "Security Filtering" should include the terminal server itself and "TS Users" group. This will disable all limitation for administrators. Do not include administrators in "TS Users". Remove "All Authenticated" group from the GPO "Security Filtering"

Usefull command line utilities

I decided to put some command line utilities what I use and always forgot here. I will update the list:
Terminal services
works on Vista
qwinsta - query terminal services connection
rwinsta - logoff terminal services connection or any local session

General:
Works on Vista and Windows 2008
query { PROCESS SESSION TERMSERVER USER }

Network:
netstat - Displays protocol statistics and current TCP/IP network connections

* all utilities have help just add /? after the utility name or Google it.

Customise Citrix Client Installation.

It is pretty simple, run:
msiexec /a c:\temp\ica32pkg.msi
it will create administrative installation point in a shared directory (you can copy all directory to any shared location after, if needed).
Chose your options including the server path, the path should include exact location of web site dedicated for PNAgent functions (in my case: http://rcm-ts01/citrix/pnagent/config.xml ) and whats all.

Adobe Flash player and Citrix (WTS)

Install Flash Player as ActiveX with "change user /install" mode, edit permissions on the keys (below) and deleted IE application and published it again:

HKEY_CLASSES_ROOT\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}

HKEY_CLASSES_ROOT\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}

1. Right-click the key, select "Permissions"
2. In the Permissions Dialog click the "Advanced" button
3. Click "Add"
4. Enter "Everyone" and click "OK" to accept
5. Select "Allow" for the "Query Value", "Enumerate Subkeys", "Notify" and "Read Control" permissions.

WTS registry adjustments

1. Configure the Server Service’s Memory Management. This setting will benefit the server to maximize memory for Network services and can be found :

Local Area Network properties > File and printer sharing > server optimization > than check “maximize data throughput for network applications”

these settings can be modified with registry key

HKLM\CurrentControlSet\Control\Session manager\memory management > “LargeSystemCache” = “0”

HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters > “Size” = “3”

2. Disable Dr. Watson popup

HKLM\CurrentControlSet\Controls\Windows> “ErrorMode” = “2”

3. Disable paging of the Windows NT executive.

Microsoft Article Q184419, Q323608

4. Disable print events from the Event log.

HKLM\System\CurrentControlSet\Control\Print\Providers >

For no printer logging set “EventLog” = dword:00000000

To log errors only, set “EventLog” = dword:00000001 (I usually do errors only)

5. Disable roaming Profile Cache

HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon >

“DeleteRoamingCache” = dword:00000001

6. Disable the printer beep to reduce bandwidth and increase performance.

HKLM\System\CurrentControlSet\Control\print >

“beepEnabled” = dword:00000000

Office 2003 installation on WTS

1. Create administrative installation
2. Use office 2003 resource kit - Custom Installation Wizard to create MST file, outlook profile setting in the end - exchange server name and %username%
3. Install on WTS with transform
4. Use Custom maintanance Wizard to create CMW file with same settings as MST before.
5. Apply this by MaintWiz.exe to the WTS.

Internet Explorer setttings in profile

A terminal server user gets old proxy settings in Internet Explorer. Solution is to delete "\\%termserver%\c$\Documents and Settings\%username%\Application Data\Microsoft\Internet Explorer\Custom Settings" or/and "\\%termserver%\c$\Documents and Settings\%username%\Local Settings\Application Data\Microsoft\Internet Explorer\Custom Settings" directories. If it is not help delete user.dat file and after profile will be recreated copy all directories from the old profile, outlook settings you will need to recreate manually.

MS Terminal Server 2000/2003

If a client can not access the terminal server and you have a message:
"The remote session was disconnected because the local computer's client access license could not be upgraded or renewed. Please contact the server administrator."
Delete the key HKLM\SOFTWARE\Microsoft\MSLicensing