MCTS Self-Paced Training Kit (Exam 70-653): Managing and Configuring Remote Access in Windows Small Business Server 2008

Lesson 2: Managing Remote Web Workplace

One incredible out-of-the-box experience is Remote Web Workplace (RWW), a preconfigured Web site that, along with a static IP address and a registered domain name, makes remote network access in Windows Small Business Server a breeze. Being able to use a single Web site as a portal to the Windows Small Business Server network makes life much easier for small business owners and their employees. No longer is there a need to drive to the office on Sunday afternoon to check Monday’s schedule and prepare documents for the next day. Windows Small Business Server users can do it from home on the couch using their wireless laptop computer. If an employee has to stay home to care for a sick family member, it doesn’t mean that work won’t get done. The employee can remotely log on to the office workstation from home and complete a project. This is not only efficient, but truly improves quality of life—especially because only an Internet browser, a certificate, and the proper Web site address and user name and password are required.

For administrators, having happy customers is a great thing, but spending very little effort on administering Remote Web Workplace is priceless!

• Estimated lesson time: 75 minutes

Understanding Remote Web Workplace Prerequisites

Users can access Remote Web Workplace using the single Internet address required to navigate to the Windows SBS 2008 resources. The external address can be a URL (for example, http://remote.contoso.com) or the network’s external IP address (for example, 24.227.13.8). If you have a registered domain, you must run the Internet Address Management Wizard to configure the Internet domain name that will be used by Remote Web Workplace.

By default, Windows Small Business Server assigns the remote prefix to the Remote Web Workplace URL. You can modify this prefix to be anything you like in the Internet Address Management Wizard. In the Store Your Domain Name Information dialog box, click the Advanced Settings link, and then type the new prefix in the Domain Prefix box. For example, type office to make the URL http://office.contoso.com.

Some additional requirements must be met before users can access Remote Web Workplace:

• Users must be members of the Remote Web Workplace Users or Domain Admins security groups. (By default, any standard user is a member of the Remote Web Workplace Users group unless this access right has been removed from the user’s account.)

• The router that connects the server running Windows SBS 2008 to the Internet must allow Internet traffic on ports 80, 443, and 987.

• The Windows SBS 2008 server ports must allow traffic through TCP ports 80, 443, 987, and 3389.

• The client computer must allow traffic through TCP ports 80, 443, 987, and 3389.

• The client computer must run RDP 6.0 client software or later if a desktop connection to an office computer must be established.

• The client browser used to access RWW must accept cookies or RWW will refuse the connection.

If the client computer is a not a member of the Windows Small Business Server domain, it must have the server certificate installed or you will experience Certificate Error “Navigation Blocked” and other errors and will not be able to connect to Remote Web Workplace.

Configuring Remote Web Workplace

You can find most administrative tasks for managing Remote Web Workplace in the Windows SBS Console. As an administrator, you can add, remove, and customize Remote Web Workplace features on the Remote Web Workplace Tasks list. In the Shared Folders And Web Sites tab, click the Web Sites tab, and then click the Remote Web Workplace link to open the Tasks list.

Enable or Disable Remote Web Workplace

By default, access to Remote Web Workplace is enabled, but you might want to modify this setting to prevent remote users from accessing network resources through Remote Web Workplace.

1. Open the Windows SBS Console, and in the Shared Folders And Web Sites tab, click the Web Sites tab.

2. Right-click Remote Web Workplace, and then do one of the following:

   • To enable Remote Web Workplace so that users can remotely access network features, click Enable This Site.

   • To prevent users from accessing Remote Web Workplace, click Disable This Site.

Disabling Remote Web Workplace makes the Web service unavailable. When you select this option, IIS will not serve the /remote login page and will display an HTTP Error 503 message.

You can also enable or disable Remote Web Workplace in the General tab on the Remote Web Workplace Properties page by selecting or clearing the Enable Remote Web Workplace option.

Manage Remote Web Workplace Properties

The Remote Web Workplace home page, shown in Figure 5-5, is the page that greets users who are signed in. You can customize this page using the Remote Web Workplace Properties and Remote Web Workplace Link List Properties pages.

You can access the Remote Web Workplace Properties page in the Windows SBS Console. Under Shared Folders And Web Sites, select Remote Web Workplace, and click View Site Properties in the task pane. On the Remote Web Workplace Properties page, you can manage access, customize the home page look and feel, and access the Link List properties. The following links appear in the left pane:

• General link You can use the General link to enable and disable Remote Web Workplace.

• Permissions link You can use the Permissions link to manage which users have access to Remote Web Workplace. This link is covered in more detail in the section titled “Manage Access to Remote Web Workplace.”

• Home Page Links link You can use the Home Page Links link to select which standard features you want to appear on the Remote Web Workplace home page. This link is discussed in more detail in the next section titled “Manage Remote Web Workplace Link List Properties.” The Home Page Links tab also contains a Manage Links link that opens the Remote Web Workplace Link List Properties page. (Be sure not to confuse the Remote Web Workplace Link List Properties page with the Remote Web Workplace Properties because they look and feel similar.)

• Customization link You can use the Customization link to modify the organization name, change the organization logo, and change the background image on the sign-in and sign-out pages. Remote Web Workplace supports the GIF, PNG, BMP, and JPG image formats. Background image files are stored in the %system%\Program Files\Windows Small Business Server\Bin\webapp\Remote\Images folder on the server.

• Advanced Settings link The Advanced Settings link opens IIS 7.0 Manager.

Manage Remote Web Workplace Link List Properties

When users first log on, the Remote Web Workplace home page displays a variety of links that are enabled by default for all standard users. The following links provide quick access to features on the Windows Small Business Server network:

• Check E-Mail (Outlook Web Access)

• Connect To Computer

• Internal Web Site (Windows SharePoint Services)

• Change Password

• Help

• Organization Links

Additional links are displayed for administrators:

• Connect To Server

• Administration Links

You might find that navigating to the Remote Web Workplace Link List Properties page is cumbersome because it is somewhat hidden in the interface and can easily be overlooked.

You can review and modify the links displayed on the Remote Web Workplace home page. To do so, in the Windows SBS Console, click the Shared Folders And Web Sites tab, and then click Remote Web Workplace. Click View Site Properties in the task pane to open the Remote Web Workplace Properties page. Next, click the Home Page Links link, and click Manage Links to access the Remote Web Workplace Link List Properties page.

The tabs on the Remote Web Workplace Link List Properties page are similar to the links displayed on the Remote Web Workplace Properties page, but they contain different functions. It is a good idea to take the time to explore this part of the Windows SBS Console to familiarize yourself with it.

Here is a description of the tabs you will find on the Remote Web Workplace Link List Properties page:

• General In the General tab, you can enable or disable the Remote Web Workplace Link List containing the Organization Links or Administration Links.

• Permissions In the Permissions tab, you can configure which users can access the Link List as well as who can access the Administration section. Note that this also determines which links are displayed in the Windows Vista Desktop Links gadget.

• Organization Links Use this link to do the following:

  • Remove a link from the list. Select the link, and then click Remove.

  • Add a new link. Type a description and a Web address or path for the new link, and then click Add.

  • Move a link. Click Move Up or Move Down to position the links where you want them to appear in the list. This is also the order in which the links will appear on the Remote Web Workplace home page.

• Administration Links Use this link to do the following:

  • Remove a link from the list. Select the link, and then click Remove.

  • Add a new link. Type a description and a Web address or file path for the new link, and then click Add.

  • Move a link. Click Move Up or Move Down to position the links where you want them to appear in the list. This is also the order in which the links will appear on the Remote Web Workplace home page.

• Customization In the Customization tab, you can modify the titles for the Remote Web Workplace Link List Organization and Administration sections.

Manage Access to Remote Web Workplace

You can assign user access to Remote Web Workplace by using the Manage Permissions task. You can find this task in the Windows SBS Console. Click Shared Folders And Web Sites, and then click the Web Sites tab.

In the Manage Permissions task, click Modify to open the Change Group Membership dialog box. Under Users And Groups, select the user account or group for which you want to grant access, and click Add to add this user account or group to the Windows SBS Remote Web Workplace Users security group. Note that you can add individual user accounts as well as other security groups.

You will find that the Windows SBS Console links allow you to accomplish a single task in different ways. For instance, you can configure access to Remote Web Workplace in the user account properties under the Remote Access link, as shown in Figure 5-6. (You can open the user account properties in the Windows SBS Console by double-clicking the account name in the Users tab under the Users And Groups tab.) Select or clear the User Can Access Remote Web Workplace check box to add or remove the user account from the Windows SBS Remote Web Workplace Users group. Don’t let this confuse you; just be aware that there are different ways to go about achieving the same outcome.

Also under the Remote Access link of the user account properties, you can select a default computer to which users will automatically connect every time they log on to Remote Web Workplace. All the computers to which a user has access are listed in the Default Computer Link In RWW drop-down list. Select the default computer from this list. Computers to which the user does not have access are not shown in the list.

Connecting to Remote Web Workplace

To connect to Remote Web Workplace, type the Internet address into the address box in your browser (for example, type http://remote.contoso.com). You need not use the https:// prefix in the Internet address for a Secure HTTP connection. Instead, you can use the http:// prefix and be sure that port 80 is open on the router and the server running Windows SBS 2008 so that traffic that requests port 80 is redirected to port 447 and switched to a secure connection automatically. Also, be sure to have the server certificate installed on the client computer or you will be blocked from accessing resources.

Check E-Mail

When you are signed in to Remote Web Workplace you have several options, one of which is to check e-mail. Outlook Web Access is a Web-based version of Microsoft Office Outlook that you can access through a Web browser.

The first page in Outlook Web Access verifies your language and time zone settings, and then allows you to access your mailbox. No further authentication is required because Outlook Web Access uses the credentials you provided to sign on to Remote Web Workplace for access.

In Outlook Web Access, you can do the following:

• Check your e-mail, calendar, contacts, and other Outlook folders

• Send e-mail and meeting requests

• Receive notification when e-mail arrives

• Receive meeting reminders

• Attach files, audio clips, or video clips to a message

• Move e-mail messages to other folders

• Remotely reset the password on a mobile device or wipe the device

When you log off Outlook Web Access, you return to the Remote Web Workplace home page.

For more information about configuring Outlook Web Access, see Chapter 6.

Connect to a Computer

Every user has remote access permissions to their own desktop by default. When a client computer is joined to the Windows Small Business Server domain, the user account is automatically added to the client computer’s local Remote Desktop Users group. Also, any user account that is a member of the local Administrators group on the client computer has remote access permissions by default and need not be added to the Remote Desktop Users group.

Therefore, to access a client computer users must be the primary user or a local administrator, or their user account must be added to the Remote Desktop Users group on that client computer. After access permissions are configured on the client computer, users can then use Remote Web Workplace to connect to a computer using the Connect To A Computer link. The first time a user clicks this link, he or she is asked to install the Terminal Services ActiveX Client (which is an RDP client control) on the remote computer. Users can click the notification, select Run ActiveX Control, and then click Run again.

The client requesting the connection will receive a Remote Desktop Connection notice that the Web site wants to start a remote connection. The section titled “Terminal Services Gateway Manager” later in this chapter explains the background process on how the connection is established. Users can click Connect and provide network credentials to authenticate on the resource to which they are trying to connect.

By default, the Clipboard and Printers options are selected so that the client computer on the Windows Small Business Server network can access the resources on the local computer the user is connecting from. Users can leave these default options selected to copy or print items locally while working on the client computer.

When a user attempts to connect to a resource that is currently in use by another user, the Logon Message shown in Figure 5-7 appears. The following things can happen:

• If the user selects Yes on the Logon Message page, the user is asked to wait for the logged-on user’s response.

• The currently logged on user can accept or refuse the Remote Desktop Connection request, as shown in Figure 5-8.

• If the user selects No on the Logon Message page, the request is canceled, the user is disconnected from the resource, and the currently logged on user is not interrupted.

Understand Remote Desktop Connection

Clients intending to connect to a computer on the Windows Small Business Server network through Remote Web Workplace must have Remote Desktop Protocol 6.0 installed. The new version of Remote Desktop Connection (RDC) is native to Windows Vista and Windows Server 2008. For clients running Windows XP, you can download an upgrade at http://support.microsoft.com/kb/925876 to make Remote Desktop compatible with Windows Server 2008 and Windows Vista.

The Remote Desktop version in Windows Vista includes new security features. Network Level Authentication (NLA) ensures that a user performs a standard logon process before the connection to the remote computer on the Windows SBS 2008 network is established, as shown in Figure 5-9. The user name and password provided are passed to the Credential Security Service Provider (CredSSP), which then passes the credentials to the terminal server over a secure channel. Once the credentials are accepted, the remote desktop connections session is built by the server.

If users connect using Windows XP, they still must authenticate to the client computer that they are trying to connect to. The difference is that a session to the client computer is established first, and then the credentials are processed.

When users connect through Remote Web Workplace using the Connect To A Computer link, they do not have control over the Remote Desktop Connection session options and will be directly connected to the remote computer with a fully shared desktop.

Understand Preconfigured RDP-TCP Properties

By default, the Terminal Services configuration on the server running Windows SBS 2008 is set to allow access to all users in the Administrators and Remote Desktop Users security groups. Administrators have Full Control whereas Remote Desktop Users have Guest and User access rights so that they can log on, connect, and query data.

The server authentication is set to the default level, Negotiate, which means that client and server will both use Transport Layer Security (TLS) for server authentication if TLS is supported. If so, the server uses the self-issued certificate (unless you imported a third-party certificate).

The encryption level is set to Client Compatible so that RDP traffic will be encrypted as strongly as a client can support. The server and client are configured so that they can negotiate the highest level of encryption they both support. RDP clients support three levels of encryption: low, high, and FIPS-compliant:

• Low Security This level uses a 56-bit key to encrypt traffic and only encrypts traffic going from the client computer to the server. This level of encryption is not appropriate for any connection that requires a bidirectional flow of data.

• High Security This encryption level uses a 128-bit key to encrypt traffic going both directions. High Security supports server authentication.

• FIPS-Compliant Federal Information Processing Standard (FIPS)–compliant security uses FIPS-compliant algorithms for encrypting the traffic between the client computer and the server. FIPS is not an encryption type but a standard for key generation and management.

The option Allow Connections Only From Computers Running Remote Desktop With Network Level Authentication is not selected on the server running Windows SBS 2008 by default. This option allows access only to client computers that support NLA authentication, namely, computers running Windows Vista and Windows XP SP3.

Understand Terminal Services Gateway Manager

The Connect To A Computer link in Remote Web Workplace uses the Terminal Services Gateway Manager (TS Gateway Manager). The TS Gateway is a server role installed by default on the server running Windows SBS 2008. This server role allows authorized remote users to connect to internal resources using Remote Desktop Protocol (RDP) over Secure HTTP (HTTPS). The TS Gateway transmits RDP traffic to port 443 instead of port 3389 using an HTTP Secure Sockets Layer (SSL) tunnel. This functionality is deliberate because many corporations block port 3389 but leave port 443 open.

Before the TS Gateway establishes the SSL tunnel, it checks the connection authorization policies (CAPs) and resource authorization policies (RAPs) that have been configured using the TS Gateway Manager, as shown in Figure 5-10. Connection authorization policies authenticate and authorize the remote user, and resource authorization policies verify the name of the resource requested against the names of resources (client computers running Windows Small Business Server) listed in the policy.

If the name of the requested resource exists in at least one RAP and the name of the user requesting the connection also exists in at least one RAP, the TS Gateway server authorizes the request. Then, the SSL connection is established between the remote user and the resource.

The remote user must use the standard logon process on the resource to validate his or her identity and access permissions for the requested resource. This is done using Windows Authentication in the Windows Security logon dialog box.

Connect to the Internal Web Site (http://companyweb)

You can connect to http://companyweb through Remote Web Workplace by clicking the Internal Web Site link. The first time you connect you are asked to run an ActiveX control, as shown in Figure 5-11. You can click the notification to allow the ActiveX control to run. The Active-X add-on needs to be run only once.

Thereafter, each time you connect to the internal Web site through Remote Web Workplace you are asked to authenticate against the site to establish your access role and permissions. http://companyweb is served over port 987 externally. If you connect through a Favorites link from a client computer on the internal Windows Small Business Server network, http://companyweb is served over port 80 and no authentication is required.

For more information about configuring http://companyweb, see Chapter 6.

Change a Password Remotely

In Remote Web Workplace, by using the Change Password link, users can change their network password from a remote location. When users click this link, the Change Password dialog box opens and users must enter their user name, the old password, and a new password. This immediately makes the change on the network.

Practice: Managing Remote Web Workplace

By completing the following exercises, you can become familiar with managing and modifying Remote Web Workplace. This practice must be completed on the server running Windows SBS 2008 and a non-domain-joined computer that runs Windows Vista.

Exercise 1 Enable and Disable Remote Web Workplace

In this exercise, you disable and then enable Remote Web Workplace.

1. Log on to the server running Windows SBS 2008 as a network administrator. Use Gregoryw as your user name and P@ssw0rd as your password.

2. Open the Windows SBS Console, click the Shared Folders And Web Sites tab, and then click the Web Sites tab.

3. In the Web Sites tab, click Remote Web Workplace. In the task pane, click Disable This Site.

4. Open Internet Explorer on the server (it’s OK for this exercise), and type https://remote.contoso.com in the address bar. A Service Unavailable page should appear. Minimize the browser.

5. Go back to the Windows SBS Console and enable the site by clicking Enable This Site in the task pane.

6. Switch back to the browser, and press F5. The Remote Web Workplace logon page should open. Close the browser.

Exercise 2 Configure Access to Remote Web Workplace

In this exercise, you manage user access permissions for Remote Web Workplace for specific users and groups.

1. Open the Windows SBS Console.

2. On the navigation bar, click Shared Folders And Web Sites, and then click the Web Sites tab.

3. Right-click Remote Web Workplace, and then click Manage Permissions. The Remote Web Workplace Properties page opens.

4. Click Modify in the permissions pane. The Change Group Membership dialog box opens.

5. Notice that by default all individual users are listed in the Group Members dialog box. Select Stefan Hesse and Don Richardson (hold down the CTRL key as you click the user names), and then click Remove.

6. Click Apply, and then click OK. The dialog box will close, and you can see the permissions pane again.

7. On the computer running Windows Vista, open Internet Explorer.

8. Type https:\\remote.contoso.com in the address bar to open the Remote Web Workplace logon page.

9. Log on with the user name MUH and the password P@ssw0rd. Logon should be successful. Observe all the links and options available on the home page (for the next exercise), and then click Sign Out in the left-hand corner.

10. Click Sign In, and this time use the user name STEFANH and the password P@ssw0rd. The logon should fail because you removed Stefan Hesse from the Remote Web Workplace Users security group. Close the browser but leave the client computer running.

Exercise 3 Customize Remote Web Workplace

In this exercise, you modify Remote Web Workplace and navigate the its properties.

1. On the server running Windows SBS 2008, open the Windows SBS Console, click the Shared Folders And Web Sites tab, and then click the Web Sites tab.

2. Double-click Remote Web Workplace to open the Remote Web Workplace Properties page.

3. Click the Home Page Links link and clear the Connect To Computer, Change Password, and Remote Web Workplace Link List options, and then click OK.

4. Switch to the non-domain-joined client computer, and open Internet Explorer. Type http://remote.contoso.com in the address bar and observe how you are switched to HTTPS on the Sign In page.

5. Sign in with the user name MUH and the password P@ssw0rd. Observe the available links: Only the Check E-Mail, Internal Web Site, and View Help links should be available. Sign out and close the browser but leave the client computer running.

Exercise 4 Modify Remote Web Workplace Link List Properties Access for Individual Users

In this exercise, you modify the Remote Web Workplace Link List and navigate its properties.

1. On the server running Windows SBS 2008, click the Shared Folders And Web Sites tab, and then click the Web Sites tab.

2. Select Remote Web Workplace, and click View Site Properties in the task pane. Click the Home Page Links link, and select the Connect To Computer, Change Password, and Remote Web Workplace Link List options (the options you cleared in the previous exercise).

3. When you activate the Remote Web Workplace Link Lists link, the Manage Links button becomes available. Click the Manage Links button to open the Remote Web Workplace Link List Properties page. Notice that this interface is the same one that you worked with in the Lesson 2 exercises in Chapter 2, “Joining Clients to the Windows Small Business Server Domain.” (The organization and administration links configured for the Remote Web Workplace home page also appear in the Desktop Links gadget.)

4. Click the Permissions link, and under Users Who Can Access The Link List, click Modify.

5. In the Change Group Membership dialog box, remove Mu Han from the Group Members, and click OK. Click OK two more times to close the dialog boxes.

6. Switch to the non-domain-joined client computer, open the browser, and connect to Remote Web Workplace. Sign in with the user name KIMA and the password P@ssw0rd. Note that all links are available to Kim. Sign out.

7. Sign in with the user name MUH and the password P@ssw0rd. Note that the Remote Web Workplace Link List is not available. Sign out and close the browser but leave the client computer running.

Exercise 5 Customize Remote Web Workplace

In this exercise, you customize Remote Web Workplace.

1. On the server running Windows SBS 2008, open the Windows SBS Console, click the Shared Folders And Web Sites tab, and click the Web Sites tab.

2. Double-click Remote Web Workplace to open the Remote Web Workplace Properties page.

3. Below the Home Page Links link, click Customization.

4. In the Organization Name dialog box, type Hamlin, Han, Akers, & Raj. Leave the dialog box open.

5. Click Start, click Computer, and navigate to C:\Windows\web\Wallpaper. Copy server.jpg and paste it in C:\Program Files\Windows Small Business Server\Bin\webapp\Remote\Images.

6. Switch back to the Customization tab of the Remote Web Workplace Properties page. In the Sign-In Page section, for the Background Image, click Choose, and then select the server.jpg file you just copied into the folder.

7. In the Home Page section, for the Organization Logo, click Choose, and then select alert.png. (In this exercise, you use an existing image, but in the real world you would add your company’s logo and branded background image here.) Click OK.

8. Switch back to the client computer and open the browser (or press F5 if you didn’t close it). Connect to Remote Web Workplace.

9. The Sign-In page should display the gray server background image. Sign in with the user name KIMA and the password P@ssw0rd and observe that the company logo is alert.png.

Exercise 6 Check E-Mail

In this exercise, you access Exchange Server mail using Remote Web Workplace.

1. Connect to http://remote.contoso.com on the non-domain-joined client computer and sign in with the user name MUH and the password P@ssw0rd.

2. On the Remote Web Workplace home page, click Check E-Mail. Click OK to accept the Outlook Web Access settings and access the mailbox.

3. In the Outlook Web Access mailbox, click Options to open the Message Options dialog box. Scroll through the options in the left pane and configure as needed. The very last option is a Mobile Devices option that will allow users to remotely wipe the mobile device or reset the password or wipe all data from the device in case the device gets misplaced.

4. Switch back to the Inbox by clicking the mail icon in the left bottom corner, and double-click the Welcome e-mail message to read it. Close the message, and then right-click it to see the available options.

5. Click Log Off, and then click Close Window to get back to the Remote Web Workplace home page.

Exercise 7 Connect to a Computer

In this exercise, you connect to an office workstation through Remote Web Workplace. To complete this exercise, you must start the domain-joined client computer.

1. On the Remote Web Workplace home page, click Connect To A Computer, and then click Connect in the Remote Desktop Connection dialog box.

2. Use the user name MUH and password P@ssw0rd, and then click OK in the Windows Security dialog box. You should be connected to the computer assigned to Mu Han.

3. You should be connected directly through to the Windows Vista desktop. If you switch to the domain-joined client computer, you will notice that the desktop is locked.

4. Switch back to the non-domain-joined computer. You can now work on this desktop just as if you were working on the domain-joined client computer.

5. Note that you can minimize the Remote Desktop Connection and work simultaneously on both computers.

6. If you have documents on the domain-joined computer, you can copy these documents and paste them directly in the non-domain-joined client computer and vice versa.

7. Log off the computer you are connected to remotely. This returns you to the Remote Web Workplace home page.

Exercise 8 Access the Internal Web Site (http://companyweb)

In this exercise, you access http://companyweb through Remote Web Workplace.

1. On the Remote Web Workplace home page, click the Internal Web Site link. You will be asked to authenticate.

2. Use the user name MUH and the password P@ssw0rd, and then click OK. It might take a moment to make the connection and open the http://companyweb page. Note that you can interact with SharePoint Services just as if you were on the network. You can upload files directly from the non-domain-joined client computer.

3. Close http://companyweb and sign out of Remote Web Workplace.