PC World Komputer 2010 April/PCWorld0410.iso/WindowsServerTrial/server.iso/sources/install.wim/2/Windows/PolicyDefinitions/en-US/TerminalServer.adml

Extensible Markup Language | 2008-01-19 | 98KB | 940 lines

<?xml version="1.0" encoding="utf-8"?>
<!--  (c) 2006 Microsoft Corporation  -->
<policyDefinitionResources xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
  <displayName>enter display name here</displayName>
  <description>enter description here</description>
  <resources>
    <stringTable>
      <string id="TS_SUPPORTED_Vista_SP1">At least Windows Vista with Service Pack 1</string>
      <string id="TS_SUPPORTED_Win2k">At least Microsoft Windows 2000 Terminal Services</string>
      <string id="TS_SUPPORTED_Win2k3">At least Microsoft Windows Server 2003</string>
      <string id="TS_SUPPORTED_Win2k3_Sp1">At least Microsoft Windows Server 2003 with SP1</string>
      <string id="TS_SUPPORTED_Win2k3_Sp1_Only">Microsoft Windows Server 2003 with Service Pack 1 only</string>
      <string id="TS_SUPPORTED_Win2k3_Sp2">At least Microsoft Windows Server 2003 with Service Pack 2</string>
      <string id="TS_SUPPORTED_WindowsXP">At least Microsoft Windows XP</string>
      <string id="SUPPORTED_WindowsNET_Enterprise">At least Microsoft Windows Server 2003, Enterprise Edition</string>
      <string id="TS_SUPPORTED_WindowsXP_Win2K3_only">Windows XP Professional or Windows Server 2003 family only</string>
      <string id="TS_TERMINAL_SERVER">Terminal Server</string>
      <string id="TS_TERMINAL_SERVER_Help">Controls configuration of a terminal server</string>
      <string id="TS_LICENSE_SERVER">TS Licensing</string>
      <string id="TS_CONNECTIONS">Connections</string>
      <string id="TS_CONNECTIONS_Help">Controls connection settings on a terminal server</string>
      <string id="TS_PRINT_REDIRECTION">Printer Redirection</string>
      <string id="TS_PRINT_REDIRECTION_Help">Controls printer configuration for Terminal Services sessions</string>
      <string id="TS_SESSION_TIME_LIMITS">Session Time Limits</string>
      <string id="TS_SESSION_TIME_LIMITS_Help">Controls time limits for Terminal Services sessions on a terminal server</string>
      <string id="TS_PROFILES">Profiles</string>
      <string id="TS_PROFILES_Help">Controls roaming profile and home directory settings for Terminal Services sessions</string>
      <string id="TS_15_bit">15 bit</string>
      <string id="TS_16_bit">16 bit</string>
      <string id="TS_24_bit">24 bit</string>
      <string id="TS_8_bit">8 bit</string>
      <string id="TS_32_bit">32 bit</string>
      <string id="TS_AUDIOMAP_EXPLAIN">Specifies whether users can choose where to play the remote computer's audio output during a Terminal Services session (audio redirection).

Users can use the "Remote computer sound" option on the Local Resources tab of Remote Desktop Connection to choose whether to play the remote audio on the remote computer or on the local computer. Users can also choose to disable the audio.

By default, users cannot apply audio redirection when connecting via Terminal Services to a server running Windows Server 2003. Users connecting to a computer running Windows XP Professional can apply audio redirection by default.

If the status is set to Enabled, users can apply audio redirection.

If the status is set to Disabled, users cannot apply audio redirection.

If the status is set to Not Configured, audio redirection is not specified at the Group Policy level. However, an administrator can still enable or disable audio redirection by using the Terminal Services Configuration tool.</string>
      <string id="TS_AUTO_RECONNECT">Automatic reconnection</string>
      <string id="TS_AUTO_RECONNECT_EXPLAIN">Specifies whether to allow Remote Desktop Connection clients to automatically reconnect to Terminal Services sessions if their network link is temporarily lost. By default, a maximum  of twenty reconnection attempts are made at five second intervals.

If the status is set to Enabled, automatic reconnection is attempted for all clients running Remote Desktop Connection whenever their network connection is lost.

If the status is set to Disabled, automatic reconnection of clients is prohibited.

If the status is set to Not Configured, automatic reconnection is not specified at the  Group Policy level. However, users can configure automatic reconnection using the "Reconnect if connection is dropped" checkbox on the Experience tab in Remote Desktop Connection.
</string>
      <string id="TS_CLIENT">Remote Desktop Connection Client</string>
      <string id="TS_CLIENT_AUDIO">Allow audio redirection</string>
      <string id="TS_CLIENT_CLIPBOARD">Do not allow clipboard redirection</string>
      <string id="TS_CLIENT_COM">Do not allow COM port redirection</string>
      <string id="TS_Client_Compatible">Client Compatible</string>
      <string id="TS_CLIENT_DEFAULT_M">Do not set default client printer to be default printer in a session</string>
      <string id="TS_CLIENT_DEFAULT_EXPLAIN_M">This policy setting allows you to specify whether the client default printer is automatically set as the default printer in a Terminal Services session.

By default, Terminal Services automatically designates the client default printer as the default printer in a Terminal Services session. You can use this policy setting to override this behavior.

If you enable this policy setting, the default printer is the printer specified on the remote computer.

If you disable this policy setting, the terminal server automatically maps the client default printer and sets it as the default printer upon connection.

If you do not configure this policy setting, the default printer is not specified at the Group Policy level. However, an administrator can configure the default printer for client sessions by using the Terminal Services Configuration tool.</string>

      <string id="TS_CLIENT_DISABLE_PASSWORD_SAVING">Do not allow passwords to be saved</string>
      <string id="TS_CLIENT_DISABLE_PASSWORD_SAVING_MACHINE_EXPLAIN">Controls whether passwords can be saved on this computer from Terminal Services clients.

If you enable this setting the password saving checkbox in Terminal Services clients will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using the Terminal Services client and saves his settings, any password that previously existed in the RDP file will be deleted.

If you disable this setting or leave it not configured, the user will be able to save passwords using the Terminal Services client.</string>
      <string id="TS_CLIENT_DISABLE_PASSWORD_SAVING_USER_EXPLAIN">Controls whether a user can save passwords using a Terminal Services client.

If you enable this setting the password saving checkbox in Terminal Services clients will be disabled and users will no longer be able to save passwords. When a user opens an RDP file using the Terminal Services client and saves his settings, any password that previously existed in the RDP file will be deleted.

If you disable this setting or leave it not configured, the user will be able to save passwords using the Terminal Services client.</string>
      <string id="TS_CLIENT_DRIVE_EXPLAIN_M">Specifies whether to prevent the mapping of client drives in a Terminal Services session (drive redirection).

By default, Terminal Services maps client drives automatically upon connection. Mapped drives appear in the session folder tree in Windows Explorer or My Computer in the format <driveletter> on <computername>. You can use this setting to override this behavior.

If the status is set to Enabled, client drive redirection is not allowed in Terminal Services sessions.

If the status is set to Disabled, client drive redirection is always allowed.

If the status is set to Not Configured, client drive redirection is not specified at the Group Policy level. However, an administrator can still disable client drive redirection by using the Terminal Services Configuration tool.</string>
      <string id="TS_CLIENT_DRIVE_M">Do not allow drive redirection</string>
      <string id="TS_CLIENT_HELP">Controls Remote Desktop Connection client settings</string>
      <string id="TS_CLIENT_LPT">Do not allow LPT port redirection</string>
      <string id="TS_CLIENT_PNP">Do not allow supported Plug and Play device redirection</string>
      <string id="TS_CLIENT_PRINTER">Do not allow client printer redirection</string>
      <string id="TS_CLIPBOARDMAP_EXPLAIN">Specifies whether to prevent the sharing of clipboard contents (clipboard redirection) between a remote computer and a client computer during a Terminal Services session.

You can use this setting to prevent users from redirecting clipboard data to and from the remote computer and the local computer. By default, Terminal Services allows this clipboard redirection.

If the status is set to Enabled, users cannot redirect clipboard data.

If the status is set to Disabled, Terminal Services always allows clipboard redirection.

If the status is set to Not Configured, clipboard redirection is not specified at the Group Policy level. However, an administrator can still disable clipboard redirection using the Terminal Services Configuration tool.</string>
      <string id="TS_COLOR_EXPLAIN">This policy setting allows you to specify the maximum color resolution (color depth) for Terminal Services connections.

You can use this policy setting to set a limit on the color depth of any connection to a terminal server or Remote Desktop. Limiting the color depth can improve connection performance, particularly over slow links, and reduce server load.

If you enable this policy setting, the color depth that you specify is the maximum color depth allowed for a userΓÇÖs Terminal Services connection. The actual color depth for the connection is determined by the color support available on the client computer. If you select ΓÇ£Client Compatible,ΓÇ¥ the highest color depth supported by the client will be used.

Note: A color depth of 24 bit is only supported on Windows XP Professional and Windows Server 2003.

If you disable or do not configure this policy setting, the color depth for connections is determined by the "Limit Maximum Color Depth" setting on the Client Settings tab in the Terminal Services Configuration tool, unless a lower level is specified by the user at the time of connection.</string>
      <string id="TS_COLORDEPTH">Limit maximum color depth</string>
      <string id="TS_Comp_Help">Controls Terminal Services configuration and properties of client sessions for individual computers or groups of computers.</string>
      <string id="TS_COMPORTMAP_EXPLAIN">Specifies whether to prevent the redirection of data to client COM ports from the remote computer in a Terminal Services session.

You can use this setting to prevent users from redirecting data to COM port peripherals or mapping local COM ports while they are logged on to a Terminal Services session. By default, Terminal Services allows this COM port redirection.

If the status is set to Enabled, users cannot redirect server data to the local COM port.

If the status is set to Disabled, Terminal Services always allows COM port redirection.

If the status is set to Not Configured, COM port redirection is not specified at the Group Policy level. However, an administrator can still disable COM port redirection using the Terminal Services Configuration tool.</string>
      <string id="TS_DEVMAP_EXPLAIN">This policy setting allows you to control the redirection of supported Plug and Play devices, such as Windows Portable Devices, to the remote computer in a Terminal Services session.

By default, Terminal Services allows redirection of supported Plug and Play devices. Users can use the ΓÇ£MoreΓÇ¥ option on the Local Resources tab of Remote Desktop Connection to choose the supported Plug and Play devices to redirect to the remote computer.

If you enable this policy setting, users cannot redirect their supported Plug and Play devices to the remote computer.

If you disable this policy setting or do not configure this policy setting, users can redirect their supported Plug and Play devices to the remote computer.

Note: You can also disallow redirection of supported Plug and Play devices on the Client Settings tab in the Terminal Services Configuration tool. You can disallow redirection of specific types of supported Plug and Play devices by using the ΓÇ£Computer Configuration\Administrative Templates\System\Device Installation\Device Installation RestrictionsΓÇ¥ policy settings.</string>
      <string id="TS_DISABLE_CONNECTIONS">Allow users to connect remotely using Terminal Services</string>
      <string id="TS_DISABLE_CONNECTIONS_EXPLAIN">This policy setting allows you to configure remote access to computers using Terminal Services.

If you enable this policy setting, users who are members of the Remote Desktop Users group on the target computer can connect remotely to the target computer using Terminal Services.

If you disable this policy setting, users cannot connect remotely to the target computer using Terminal Services. The target computer will maintain any current connections, but will not accept any new incoming connections.

If you do not configure this policy setting, Terminal Services uses the Remote Desktop setting on the target computer to determine whether remote connection is allowed. This setting is found on the Remote tab in System Properties. By default, remote connection is not allowed.

Note: You can limit which clients are able to connect remotely using Terminal Services by configuring the "Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security\Require user authentication for remote connections by using Network Level Authentication" policy setting. You can limit the number of users who can connect simultaneously by configuring the "Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Connections\Limit number of connections" policy setting or by configuring the "Maximum Connections" option on the Network Adapter tab in the Terminal Services Configuration tool.</string>
      <string id="TS_DISABLE_REMOTE_DESKTOP_WALLPAPER">Enforce Removal of Remote Desktop Wallpaper</string>
      <string id="TS_DISABLE_REMOTE_DESKTOP_WALLPAPER_EXPLAIN">Specifies whether desktop wallpaper is displayed to remote clients connecting via Terminal Services.

You can use this setting to enforce the removal of wallpaper during a remote session. By default, Windows XP Professional displays wallpaper to remote clients connecting through Remote Desktop, depending on the client configuration (see the Experience tab in the Remote Desktop Connection options for more information). Servers running Windows Server 2003 do not display wallpaper by default to remote sessions.

If the status is set to Enabled, wallpaper never appears to a Terminal Services client.

If the status is set to Disabled, wallpaper might appear to a Terminal Services client, depending on the client configuration.

If the status is set to Not Configured, the default behavior applies.</string>
      <string id="TS_DRIVE_G">G:</string>
      <string id="TS_DRIVE_H">H:</string>
      <string id="TS_DRIVE_I">I:</string>
      <string id="TS_DRIVE_J">J:</string>
      <string id="TS_DRIVE_K">K:</string>
      <string id="TS_DRIVE_L">L:</string>
      <string id="TS_DRIVE_M">M:</string>
      <string id="TS_DRIVE_N">N:</string>
      <string id="TS_DRIVE_O">O:</string>
      <string id="TS_DRIVE_P">P:</string>
      <string id="TS_DRIVE_Q">Q:</string>
      <string id="TS_DRIVE_R">R:</string>
      <string id="TS_DRIVE_S">S:</string>
      <string id="TS_DRIVE_T">T:</string>
      <string id="TS_DRIVE_U">U:</string>
      <string id="TS_DRIVE_V">V:</string>
      <string id="TS_DRIVE_W">W:</string>
      <string id="TS_DRIVE_X">X:</string>
      <string id="TS_DRIVE_Y">Y:</string>
      <string id="TS_DRIVE_Z">Z:</string>
      <string id="TS_SECURITY">Security</string>
      <string id="TS_SECURITY_Help">Controls security settings on a terminal server</string>
      <string id="TS_ENCRYPTION_CLIENT_COMPATIBLE">Client Compatible</string>
      <string id="TS_ENCRYPTION_EXPLAIN">Specifies whether to require the use of a specific encryption level to secure communications between clients and terminal servers during Remote Desktop Protocol (RDP) connections.

If you enable this setting, all communications between clients and terminal servers during remote connections must use the encryption method specified in this setting. By default, the encryption level is set to High. The following encryption methods are available:

* High: The High setting encrypts data sent from the client to the server and from the server to the client by using strong 128-bit encryption. Use this encryption level in environments that contain only 128-bit clients (for example, clients that run Remote Desktop Connection). Clients that do not support this encryption level cannot connect to terminal servers.

* Client Compatible: The Client Compatible setting encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this encryption level in environments that include clients that do not support 128-bit encryption.

* Low: The Low setting encrypts only data sent from the client to the server using 56-bit encryption.

If you disable or do not configure this setting, the encryption level to be used for remote  connections to terminal servers is not enforced through Group Policy. However, you can configure a required encryption level for these connections by using Terminal Services Configuration.

Important
FIPS compliance can be configured through the "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" setting in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options) or through the "FIPS Compliant" setting in Terminal Server Configuration. The FIPS Compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140-1 encryption algorithms, using Microsoft cryptographic modules. Use this encryption level when communications between clients and terminal servers require the highest level of encryption.  If FIPS compliance is already enabled through the Group Policy "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing" setting, that setting overrides the encryption level specified in this Group Policy setting or in Terminal Services Configuration.</string>
      <string id="TS_ENCRYPTION_HIGH_LEVEL">High Level</string>
      <string id="TS_ENCRYPTION_LOW_LEVEL">Low Level</string>
      <string id="TS_ENCRYPTION_POLICY">Set client connection encryption level</string>
      <string id="TS_FALLBACK_DEFAULT">Do nothing if one is not found.</string>
      <string id="TS_FALLBACK_PCL">Default to PCL if one is not found.</string>
      <string id="TS_FALLBACK_PCL_PS">Show both PCL and PS if one is not found.</string>
      <string id="TS_FALLBACK_PS">Default to PS if one is not found.</string>
      <string id="TS_FALLBACKPRINTDRIVERTYPE">Specify terminal server fallback printer driver behavior</string>
      <string id="TS_FALLBACKPRINTER_EXPLAIN">This policy setting allows you to specify the terminal server fallback printer driver behavior.

By default, the terminal server fallback printer driver is disabled. If the terminal server does not have a printer driver that matches the client's printer, no printer will be available for the terminal server session.

If you enable this policy setting, the fallback printer driver is enabled, and the default behavior is for the terminal server to find a suitable printer driver. If one is not found, the client's printer is not available. You can choose to change this default behavior. The available options are:

"Do nothing if one is not found" - If there is a printer driver mismatch, the server will attempt to find a suitable driver. If one is not found, the client's printer is not available. This is the default behavior.

"Default to PCL if one is not found" - If no suitable printer driver can be found, default to the Printer Control Language (PCL) fallback printer driver.

"Default to PS if one is not found" - If no suitable printer driver can be found, default to the PostScript (PS) fallback printer driver.

"Show both PCL and PS if one is not found" - If no suitable driver can be found, show both PS and PCL-based fallback printer drivers.

If you disable this policy setting, the terminal server fallback driver is disabled and the terminal server will not attempt to use the fallback printer driver.

If you do not configure this policy setting, the fallback printer driver behavior is off by default.

Note: If the "Do not allow client printer redirection" setting is enabled, this policy setting is ignored and the fallback printer driver is disabled.</string>
      <string id="TS_FORCIBLE_LOGOFF">Deny logoff of an administrator logged in to the console session</string>
      <string id="TS_FORCIBLE_LOGOFF_EXPLAIN">This policy setting determines whether an administrator attempting to connect remotely to the console of a server can log off an administrator currently logged on to the console.

This policy is useful when the currently connected administrator does not want to be logged off by another administrator. If the connected administrator is logged off, any data not previously saved is lost.

If you enable this policy setting, logging off the connected administrator is not allowed.

If you disable or do not configure this policy setting, logging off the connected administrator is allowed.</string>
      <string id="TS_GATEWAY">TS Gateway</string>
      <string id="TS_GATEWAY_Help">Controls configuration to access a TS Gateway server</string>
      <string id="TS_GATEWAY_BASIC">Ask for credentials, use Basic protocol</string>
      <string id="TS_GATEWAY_LOGGED_ON_CREDS">Use locally logged-on credentials</string>
      <string id="TS_GATEWAY_NTLM">Ask for credentials, use NTLM protocol</string>
      <string id="TS_GATEWAY_POLICY_AUTH_METHOD">Set TS Gateway authentication method</string>
      <string id="TS_GATEWAY_POLICY_AUTH_METHOD_HELP">Specifies the authentication method that clients must use when attempting to connect to a terminal server through a TS Gateway server. You can enforce this policy setting or you can allow users to overwrite this policy setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these TS Gateway server settings" option on the client.

To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users can specify an alternate authentication method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate authentication method, the authentication method that you specify in this policy setting is used by default.

If you disable or do not configure this policy setting, the authentication method that is specified by the user is used, if one is specified. If an authentication method is not specified, the NTLM protocol that is enabled on the client or a smart card can be used for authentication.</string>
      <string id="TS_GATEWAY_POLICY_ENABLE">Enable connection through TS Gateway</string>
      <string id="TS_GATEWAY_POLICY_ENABLE_HELP">If you enable this policy setting, when Terminal Services clients cannot connect directly to a remote computer (a terminal server or a computer with Remote Desktop enabled), the clients will attempt to connect to the remote computer through a TS Gateway server. In this case, the clients will attempt to connect to the TS Gateway server that is specified in the "Set TS Gateway server address" policy setting.

You can enforce this policy setting or you can allow users to overwrite this setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these TS Gateway server settings" option on the client.

Note: To enforce this policy setting, you must also specify the address of the TS Gateway server by using the "Set TS Gateway server address" policy setting, or client connection attempts to any remote computer will fail, if the client cannot connect directly to the remote computer. To enhance security, it is also highly recommended that you specify the authentication method by using the "Set TS Gateway authentication method" policy setting. If you do not specify an authentication method by using this policy setting, either the NTLM protocol that is enabled on the client or a smart card can be used.

To allow users to overwrite this policy setting, select the "Allow users to change this setting" check box. When you do this, users on the client can choose not to connect through the TS Gateway server by selecting the "Do not use a TS Gateway server" option. Users can specify a connection method by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify a connection method, the connection method that you specify in this policy setting is used by default.

If you disable or do not configure this policy setting, clients will not use the TS Gateway server address that is specified in the "Set TS Gateway server address" policy setting. If a TS Gateway server is specified by the user, a client connection attempt will be made through that TS Gateway server.</string>
      <string id="TS_GATEWAY_POLICY_SERVER">Set TS Gateway server address</string>
      <string id="TS_GATEWAY_POLICY_SERVER_HELP">Specifies the address of the TS Gateway server that clients must use when attempting to connect to a terminal server. You can enforce this policy setting or you can allow users to overwrite this policy setting. By default, when you enable this policy setting, it is enforced. When this policy setting is enforced, users cannot override this setting, even if they select the "Use these TS Gateway server settings" option on the client.

Note: It is highly recommended that you also specify the authentication method by using the "Set TS Gateway authentication method" policy setting. If you do not specify an authentication method by using this setting, either the NTLM protocol that is enabled on the client or a smart card can be used.

To allow users to overwrite the "Set TS Gateway server address" policy setting and connect to another TS Gateway server, you must select the "Allow users to change this setting" check box and users will be allowed to specify an alternate TS Gateway server. Users can specify an alternative TS Gateway server by configuring settings on the client, using an RDP file, or using an HTML script. If users do not specify an alternate TS Gateway server, the server that you specify in this policy setting is used by default.

Note: If you disable or do not configure this policy setting, but enable the "Enable connections through TS Gateway" policy setting, client connection attempts to any remote computer will fail, if the client cannot connect directly to the remote computer. If a TS Gateway server is specified by the user, a client connection attempt will be made through that TS Gateway server.</string>
      <string id="TS_GATEWAY_SMARTCARD">Use smart-card</string>
      <string id="TS_GP_NODE">Terminal Services</string>
      <string id="TS_JOIN_SESSION_DIRECTORY">Join TS Session Broker</string>
      <string id="TS_JOIN_SESSION_DIRECTORY_EXPLAIN">This policy setting allows you to specify whether the terminal server should join a farm in TS Session Broker. TS Session Broker tracks user sessions and allows a user to reconnect to their existing session in a load-balanced terminal server farm. To participate in TS Session Broker, the Terminal Server role service must be installed on the server.

If the policy setting is enabled, the terminal server joins the farm that is specified in the "TS Session Broker Farm Name" setting. The farm exists on the TS Session Broker server that is specified in the "TS Session Broker Server" policy setting.

If you disable this policy setting, the server does not join a farm in TS Session Broker, and user session tracking is not performed. If the setting is disabled, you cannot use either the Terminal Services Configuration tool or the Terminal Services WMI provider to join the server to TS Session Broker.

If the policy setting is not configured, the setting is not specified at the Group Policy level. In this case, you can configure the server to join TS Session Broker by using the Terminal Services Configuration tool or the Terminal Services WMI provider.

Notes:

1. If you enable this setting, you must also enable the "TS Session Broker Farm Name" and "TS Session Broker Server" policy settings, or configure these settings by using either the Terminal Services Configuration tool or the Terminal Services WMI provider.

2. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.

3. A Windows Server 2008-based terminal server can only use a Windows Server 2008-based TS Session Broker server.</string>
      <string id="TS_KEEP_ALIVE">Configure keep-alive connection interval</string>
      <string id="TS_KEEP_ALIVE_EXPLAIN">This policy setting allows you to enter a keep-alive interval to ensure that the session state on the terminal server is consistent with the client state.

After a terminal server client loses the connection to a terminal server, the session on the terminal server might remain active instead of changing to a disconnected state, even if the client is physically disconnected from the terminal server. If the client logs on to the same terminal server again, a new session might be established (if Terminal Services is configured to allow multiple sessions), and the original session might still be active.

If you enable this policy setting, you must enter a keep-alive interval. The keep-alive interval determines how often, in minutes, the server checks the session state. The range of values you can enter is 1 to 999,999.

If you disable or do not configure this policy setting, a keep-alive interval is not set and the server will not check the session state.</string>
      <string id="TS_LICENSING">Licensing</string>
      <string id="TS_LICENSING_Help">Controls configuration of TS Licensing settings on a terminal server</string>
      <string id="TS_LICENSE_SECGROUP">License server security group</string>
      <string id="TS_LICENSE_SECGROUP_HELP">This policy setting allows you to specify the terminal servers to which a Terminal Services license server will offer Terminal Services client access licenses (TS CALs).

You can use this policy setting to control which terminal servers are issued TS CALs by the Terminal Services license server. By default, a license server issues a TS CAL to any terminal server that requests one.

If you enable this policy setting and this policy setting is applied to a Terminal Services license server, the license server will only respond to TS CAL requests from terminal servers whose computer accounts are a member of the Terminal Server Computers group on the license server.

By default, the Terminal Server Computers group is empty.

If you disable or do not configure this policy setting, the Terminal Services license server issues a TS CAL to any terminal server that requests one. The Terminal Server Computers group is not deleted or changed in any way by disabling or not configuring this policy setting.

Note: You should only enable this policy setting when the license server is a member of a domain. You can only add computer accounts for terminal servers to the Terminal Server Computers group when the license server is a member of a domain.</string>
      <string id="TS_LICENSE_SERVERS">Use the specified Terminal Services license servers</string>
      <string id="TS_LICENSE_SERVERS_Help">Controls configuration of a Terminal Services license server</string>
      <string id="TS_LICENSE_SERVERS_EXPLAIN">This policy setting allows you to specify the order in which a terminal server attempts to locate Terminal Services license severs.

If you enable this policy setting, a terminal server first attempts to locate the license servers that you specify. If the specified license servers cannot be located, the terminal server will attempt automatic license server discovery.

In the automatic license server discovery process, a terminal server in a Windows Server-based domain attempts to contact a license server in the following order:

1. License servers that are specified in the Terminal Services Configuration tool
2. License servers that are published in Active Directory Domain Services
3. License servers that are installed on domain controllers in the same domain as the terminal server

If you disable or do not configure this policy setting, the terminal server uses the license server discovery mode specified in the Terminal Services Configuration tool.</string>
      <string id="TS_LICENSE_TOOLTIP">Hide notifications about TS Licensing problems that affect the terminal server</string>
      <string id="TS_LICENSE_TOOLTIP_EXPLAIN">This policy setting determines whether notifications are displayed on a terminal server when there are problems with TS Licensing that affect the terminal server.

By default, notifications are displayed on a terminal server after you log on as a local administrator, if there are problems with TS Licensing that affect the terminal server. If applicable, a notification will also be displayed that notes the number of days until the licensing grace period for the terminal server will expire.

If you enable this policy setting, these notifications will not be displayed on the terminal server.

If you disable or do not configure this policy setting, these notifications will be displayed on the terminal server after you log on as a local administrator.</string>
      <string id="TS_LICENSING_MODE">Set the Terminal Services licensing mode</string>
      <string id="TS_LICENSING_MODE_EXPLAIN">This policy setting allows you to specify the type of Terminal Services client access license (TS CAL) that is required to connect to this terminal server.

You can use this policy setting to select one of two licensing modes: Per User or Per Device.

Per User licensing mode requires that each user account connecting to this terminal server have a TS Per User CAL.

Per Device licensing mode requires that each device connecting to this terminal server have a TS Per Device CAL.

If you enable this policy setting, the licensing mode that you specify takes precedence over the licensing mode that is specified during the installation of Terminal Services or specified in the Terminal Services Configuration tool.

If you disable or do not configure this policy setting, the licensing mode that is specified during the installation of Terminal Services or specified in the Terminal Services Configuration tool is used.</string>
      <string id="TS_LICENSING_MODE_PER_DEVICE">Per Device</string>
      <string id="TS_LICENSING_MODE_PER_USER">Per User</string>
      <string id="TS_LPTPORTMAP_EXPLAIN">Specifies whether to prevent the redirection of data to client LPT ports during a Terminal Services session.

You can use this setting to prevent users from mapping local LPT ports and redirecting data from the remote computer to local LPT port peripherals. By default, Terminal Services allows this LPT port redirection.

If the status is set to Enabled, users in a Terminal Services session cannot redirect server data to the local LPT port.

If the status is set to Disabled, LPT port redirection is always allowed.

If the status is set to Not Configured, LPT port redirection is not specified at the Group Policy level. However, an administrator can still disable local LPT port redirection using the Terminal Services Configuration tool.</string>
      <string id="TS_MAX_CON_EXPLAIN">Specifies whether Terminal Services limits the number of simultaneous connections to the server.

You can use this setting to restrict the number of remote sessions that can be active on a server. If this number is exceeded, addtional users who try to connect receive an error message telling them that the server is busy and to try again later. Restricting the number of sessions improves performance because fewer sessions are demanding system resources. By default, terminal servers allow an unlimited number of remote sessions, and Remote Desktop for Administration allows two remote sessions.

To use this setting, enter the number of connections you want to specify as the maximum for the server. To specify an unlimited number of connections, type 999999.

If the status is set to Enabled, the maximum number of connections is limited to the specified number consistent with the version of Windows and the mode of Terminal Services running on the server.

If the status is set to Disabled or Not Configured, limits to the number of connections are not enforced at the Group Policy level.

Note: This setting is designed to be used on terminal servers (that is, on servers running Windows with Terminal Server installed).</string>
      <string id="TS_MAX_CON_POLICY">Limit number of connections</string>
      <string id="TS_NoDisconnectMenu">Remove "Disconnect" option from Shut Down dialog</string>
      <string id="TS_NoDisconnectMenu_Help">This policy setting allows you to remove the "Disconnect" option from the Shut Down Windows dialog box on Terminal Services clients.

You can use this policy setting to prevent users from using this familiar method to disconnect their client from a terminal server.

If you enable this policy setting, "Disconnect" does not appear as an option in the drop-down list in the Shut Down Windows dialog box.

If you disable or do not configure this policy setting, "Disconnect" is not removed from the drop-down list in the Shut Down Windows dialog box.

Note: This policy setting affects only the Shut Down Windows dialog box. It does not prevent users from using other methods to disconnect from a Terminal Services session. This policy setting also does not prevent disconnected sessions at the server. You can control how long a disconnected session remains active on the server by configuring the ΓÇ£Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits\Set time limit for disconnected sessionsΓÇ¥ policy setting.</string>
      <string id="TS_NoSecurityMenu">Remove Windows Security item from Start menu</string>
      <string id="TS_NoSecurityMenu_Help">Specifies whether to remove the Windows Security item from the Settings menu on Terminal Services clients. You can use this setting to prevent inexperienced users from logging off from Terminal Services inadvertently.

If the status is set to Enabled, Windows Security does not appear in Settings on the Start menu. As a result, users must type a security attention sequence, such as CTRL+ALT+END, to open the Windows Security dialog box on the client computer.

If the status is set to Disabled or Not Configured, Windows Security remains in the Settings menu.</string>
      <string id="TS_on_the_Local_machine">On the Local machine</string>
      <string id="TS_On_the_Network">On the Network</string>
      <string id="TS_PASSWORD">Always prompt for password upon connection</string>
      <string id="TS_PreventLicenseUpgrade">Prevent license upgrade</string>
      <string id="TS_PreventLicenseUpgrade_Help">This policy setting allows you to specify which version of Terminal Services client access license (TS CAL) a Terminal Services license server will issue to clients connecting to terminal servers running other Windows-based operating systems.

A license server attempts to provide the most appropriate TS CAL for a connection. For example, a Windows Server 2008 license server will try to issue a Windows Server 2008 TS CAL for clients connecting to a terminal server running Windows Server 2008, and will try to issue a Windows Server 2003 TS CAL for clients connecting to a terminal server running Windows Server 2003.

By default, if the most appropriate TS CAL is not available for a connection, a Windows Server 2008 license server will issue a Windows Server 2008 TS CAL, if available, to the following:

* A client connecting to a Windows Server 2003 terminal server
* A client connecting to a Windows 2000 terminal server

If you enable this policy setting, the license server will only issue a temporary TS CAL to the client if an appropriate TS CAL for the terminal server is not available. If the client has already been issued a temporary TS CAL and the temporary TS CAL has expired, the client will not be able to connect to the terminal server unless the TS Licensing grace period for the terminal server has not expired.

If you disable or do not configure this policy setting, the license server will exhibit the default behavior noted earlier.</string>
      <string id="TS_PRINTERMAP_EXPLAIN">This policy setting allows you to specify whether to prevent the mapping of client printers in Terminal Services sessions.

You can use this policy setting to prevent users from redirecting print jobs from the remote computer to a printer attached to their local (client) computer. By default, Terminal Services allows this client printer mapping.

If you enable this policy setting, users cannot redirect print jobs from the remote computer to a local client printer in Terminal Services sessions.

If you disable this policy setting, users can redirect print jobs with client printer mapping.

If you do not configure this policy setting, client printer mapping is not specified at the Group Policy level. However, an administrator can still disable client printer mapping by using the Terminal Services Configuration tool.</string>
      <string id="TS_PROMPT_PASSWORD_EXPLAIN">Specifies whether Terminal Services always prompts the client for a password upon connection.

You can use this setting to enforce a password prompt for users logging on to Terminal Services, even if they already provided the password in the Remote Desktop Connection client.

By default, Terminal Services allows users to automatically log on by entering a password in the Remote Desktop Connection client.

If the status is set to Enabled, users cannot automatically log on to Terminal Services by supplying their passwords in the Remote Desktop Connection client. They are prompted for a password to log on.

If the status is set to Disabled, users can always log on to Terminal Services automatically by supplying their passwords in the Remote Desktop Connection client.

If the status is set to Not Configured, automatic logon is not specified at the Group Policy level. However, an administrator can still enforce password prompting by using the Terminal Services Configuration tool.</string>
      <string id="TS_REDIRECTION">Device and Resource Redirection</string>
      <string id="TS_REDIRECTION_Help">Controls access to devices and resources on a client computer in Terminal Services sessions</string>
      <string id="TS_RemoteControl">Set rules for remote control of Terminal Services user sessions</string>
      <string id="TS_RemoteControl_0">No remote control allowed</string>
      <string id="TS_RemoteControl_1">Full Control with user's permission</string>
      <string id="TS_RemoteControl_2">Full Control without user's permission</string>
      <string id="TS_RemoteControl_3">View Session with user's permission</string>
      <string id="TS_RemoteControl_4">View Session without user's permission</string>
      <string id="TS_RemoteControl_EXPLAIN">This policy setting allows you to specify the level of remote control permitted in a Terminal Services session.

You can use this policy setting to select one of two levels of remote control: View Session or Full Control. View Session permits the remote control user to watch a session. Full Control permits the administrator to interact with the session. Remote control can be established with or without the user's permission.

If you enable this policy setting, administrators can remotely interact with a user's Terminal Services session according to the specified rules. To set these rules, select the desired level of control and permission in the Options list. To disable remote control, select ΓÇ£No remote control allowed.ΓÇ¥

If you disable or do not configure this policy setting, remote control rules are determined by the setting on the Remote Control tab in the Terminal Services Configuration tool. By default, remote control users have full control of the session with the user's permission.

Note: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence.</string>
      <string id="TS_RPC_ENCRYPTION">Require secure RPC communication</string>
      <string id="TS_RPC_ENCRYPTION_EXPLAIN">Specifies whether a Terminal Server requires secure RPC communication with all clients or allows unsecured communication.

You can use this setting to strengthen the security of RPC communication with clients by allowing only authenticated and encrypted requests.

If the status is set to Enabled, the Terminal Server accepts requests from RPC clients that support secure requests, and does not allow unsecured communication with untrusted clients.

If the status is set to Disabled, the Terminal Server always requests security for all RPC traffic. However, unsecured communication is allowed for RPC clients that do not respond to the request.

If the status is set to Not Configured, unsecured communication is allowed.

Note: The RPC interface is used for administering and configuring Terminal Services.</string>
      <string id="TS_SD_ClustName">Configure TS Session Broker farm name</string>
      <string id="TS_SD_ClustName_Explain">This policy setting allows you to specify the name of a farm to join in TS Session Broker. TS Session Broker uses the farm name to determine which terminal servers are in the same terminal server farm. Therefore, you must use the same farm name for all terminal servers in the same load-balanced farm. The farm name does not have to correspond to a name in Active Directory Domain Services.

If you specify a new farm name, a new farm is created in TS Session Broker. If you specify an existing farm name, the server joins that farm in TS Session Broker.

If you enable this policy setting, you must specify the name of a farm in TS Session Broker.

If you disable or do not configure this policy setting, the farm name is not specified by Group Policy. In this case, you can adjust the farm name by using the Terminal Services Configuration tool or the Terminal Services WMI provider.

Note:

For Windows Server 2008, this policy setting is supported on at least Windows Server 2008, Standard Edition.

A Windows Server 2008-based terminal server can only use a Windows Server 2008-based TS Session Broker server.

This setting is not effective unless both the "Join TS Session Broker" and the "Configure TS Session Broker server name" settings are enabled and configured by using Group Policy, the Terminal Services Configuration tool, or the Terminal Services WMI provider.
</string>
      <string id="TS_SD_EXPOSE_ADDRESS">Use IP Address Redirection</string>
      <string id="TS_SD_EXPOSE_ADDRESS_Explain">This policy setting allows you to specify the redirection method to use when a client device reconnects to an existing Terminal Services session in a load-balanced terminal server farm. This setting applies to a terminal server that is configured to use TS Session Broker; not to the TS Session Broker server.

If you enable this policy setting, a Terminal Services client queries TS Session Broker and is redirected to their existing session by using the IP address of the terminal server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to terminal servers in the farm.

If you disable this policy setting, the IP address of the terminal server is not sent to the client. Instead, the IP address is embedded in a token. When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct terminal server in the farm. Only disable this setting when your network load-balancing solution supports the use of TS Session Broker routing tokens and you do not want clients to directly connect by IP address to terminal servers in the load-balanced farm.

If you do not configure this policy setting, the "Use IP address redirection" setting in the Terminal Services Configuration tool is used. By default, this setting in the Terminal Services Configuration tool is enabled.

Notes:

1. For Windows Server 2008, this policy setting is supported on at least Windows Server 2008 Standard.

2. A Windows Server 2008-based terminal server can only use a Windows Server 2008-based TS Session Broker server.</string>
      <string id="TS_SD_Loc">Configure TS Session Broker server name</string>
      <string id="TS_SD_Loc_Explain">This policy setting allows you to specify the TS Session Broker server that the terminal server uses to track and redirect user sessions for a load-balanced terminal server farm. The specified server must be running the Terminal Services Session Broker service. All terminal servers in a load-balanced farm should use the same TS Session Broker server.

If you enable this policy setting, you must specify the TS Session Broker server, using either its host name, IP address, or fully qualified domain name. If you specify a name or IP address for the TS Session Broker server that is not valid, an error message is logged in Event Viewer on the terminal server.

If you disable or do not configure this policy setting, you can adjust the TS Session Broker server name or IP address by using the Terminal Services Configuration tool or the Terminal Services WMI provider.

Note:

For Windows Server 2008, this policy setting is supported on at least Windows Server 2008, Standard Edition.

A Windows Server 2008-based terminal server can only use a Windows Server 2008-based TS Session Broker server.

This policy setting is not effective unless the "Join TS Session Broker" policy setting is enabled or the terminal server is configured to join TS Session Broker by using the Terminal Services Configuration tool or the Terminal Services WMI provider.

To be an active member of a TS Session Broker-enabled terminal server farm, the computer account for each terminal server in the farm must be a member of the "Session Directory Computers" local group on the TS Session Broker server.
</string>
      <string id="TS_SD_Node">TS Session Broker</string>
      <string id="TS_SD_Node_Help">Controls configuration of a terminal server that is a member of a load-balanced terminal server farm</string>
      <string id="TS_SECURITY_LAYER_EXPLAIN">Specifies whether to require the use of a specific security layer to secure communications between clients and terminal servers during Remote Desktop Protocol (RDP) connections.

If you enable this setting, all communications between clients and terminal servers during remote connections must use the security method specified in this setting. The following security methods are available:

* Negotiate: The Negotiate method enforces the most secure method that is supported by the client. If Transport Layer Security (TLS) version 1.0 is supported, it is used to authenticate the terminal server. If TLS is not supported, native Remote Desktop Protocol (RDP) encryption is used to secure communications, but the terminal server is not authenticated.

* RDP: The RDP method uses native RDP encryption to secure communications between the client and terminal server. If you select this setting, the terminal server is not authenticated.

* SSL (TLS 1.0): The SSL method requires the use of TLS 1.0 to authenticate the terminal server. If TLS is not supported, the connection fails.

If you disable or do not configure this setting, the security method to be used for remote  connections to terminal servers is not enforced through Group Policy. However, you can configure a required security method for these connections by using Terminal Services Configuration.</string>
      <string id="TS_SECURITY_LAYER_NEGOTIATE">Negotiate</string>
      <string id="TS_SECURITY_LAYER_POLICY">Require use of specific security layer for remote (RDP) connections</string>
      <string id="TS_SECURITY_LAYER_RDP">RDP</string>
      <string id="TS_SECURITY_LAYER_SSL">SSL (TLS 1.0)</string>
      <string id="TS_Session_End_On_Limit">Terminate session when time limits are reached</string>
      <string id="TS_SESSION_END_ON_LIMIT_EXPLAIN">Specifies whether to terminate a timed-out Terminal Services session instead of disconnecting it.

You can use this setting to direct Terminal Services to terminate a session (that is, the user is logged off and the session is deleted from the server) after time limits for active or idle sessions are reached. By default, Terminal Services disconnects sessions that reach their time limits.

Time limits are set locally by the server administrator or in Group Policy. See the "Set time limit for active Terminal Services sessions" and "Set time limit for active but idle Terminal Services sessions" settings.

If the status is set to Enabled, Terminal Services terminates any session that reaches its time-out limit.

If the status is set to Disabled, Terminal Services always disconnects a timed-out session, even if specified otherwise by the server administrator.

If the status is set to Not Configured, Terminal Services disconnects a timed-out session, unless specified otherwise in local settings.

Note: This setting only applies to time-out limits that are deliberately set (in the Terminal Services Configuration tool or Group Policy Object Editor), not to time-out events that occur due to connectivity or network conditions. Also note that this setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides.</string>
      <string id="TS_SESSIONS">Remote Session Environment</string>
      <string id="TS_SESSIONS_Comp_Help">Controls configuration of the user interface in Terminal Services sessions </string>
      <string id="TS_SESSIONS_Disconnected_Timeout">Set time limit for disconnected sessions</string>
      <string id="TS_SESSIONS_DISCONNECTED_TIMEOUT_EXPLAIN">This policy setting allows you to configure a time limit for disconnected Terminal Services sessions.

You can use this policy setting to specify the maximum amount of time that a disconnected session is kept active on the server. By default, Terminal Services allows users to disconnect from a remote session without logging off and ending the session.

When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected. By default, these disconnected sessions are maintained for an unlimited time on the server.

If you enable this policy setting, disconnected sessions are deleted from the server after the specified amount of time. To enforce the default behavior that disconnected sessions are maintained for an unlimited time, select ΓÇ£NeverΓÇ¥. If you have a console session, disconnected session time limits do not apply.

If you disable or do not configure this policy setting, disconnected sessions are maintained for an unlimited time. You can specify time limits for disconnected sessions on the Sessions tab in the Terminal Services Configuration tool.

Note: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence.</string>
      <string id="TS_SESSIONS_Idle_Limit">Set time limit for active but idle Terminal Services sessions</string>
      <string id="TS_SESSIONS_IDLE_LIMIT_EXPLAIN">This policy setting allows you to specify the maximum amount of time that an active Terminal Services session can be idle (without user input) before it is automatically disconnected.

If you enable this policy setting, you must select the desired time limit in the Idle session limit drop-down list.  Terminal Services will automatically disconnect active but idle sessions after the specified amount of time. The user receives a warning two minutes before the session disconnects, which allows the user to press a key or move the mouse to keep the session active. If you have a console session, idle session time limits do not apply.

If you disable or do not configure this policy setting, Terminal Services allows sessions to remain active but idle for an unlimited time. You can specify time limits for active but idle sessions on the Sessions tab in the Terminal Services Configuration tool.

If you want Terminal Services to terminateΓÇöinstead of disconnectΓÇöa session when the time limit is reached, you can configure the ΓÇ£Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits\Terminate session when time limits are reachedΓÇ¥ policy setting.

Note: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence.</string>
      <string id="TS_SESSIONS_Limits">Set time limit for active Terminal Services sessions</string>
      <string id="TS_SESSIONS_LIMITS_EXPLAIN">This policy setting allows you to specify the maximum amount of time that a Terminal Services session can be active before it is automatically disconnected.

If you enable this policy setting, you must select the desired time limit in the Active session limit drop-down list. Terminal Services will automatically disconnect active sessions after the specified amount of time. The user receives a warning two minutes before the Terminal Services session disconnects, which allows the user to save open files and close programs. If you have a console session, active session time limits do not apply.

If you disable or do not configure this policy setting, Terminal Services allows sessions to remain active for an unlimited time. You can specify time limits for active sessions on the Sessions tab in the Terminal Services Configuration tool.

If you want Terminal Services to terminateΓÇöinstead of disconnectΓÇöa session when the time limit is reached, you can configure the ΓÇ£Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Session Time Limits\Terminate session when time limits are reachedΓÇ¥ policy setting.

Note: This policy setting appears in both Computer Configuration and User Configuration. If both policy settings are configured, the Computer Configuration policy setting takes precedence.</string>
      <string id="TS_SESSIONS_User_Help">Controls time limits for Terminal Services sessions on a terminal server</string>
      <string id="TS_SINGLE_SESSION">Restrict Terminal Services users to a single remote session</string>
      <string id="TS_SINGLE_SESSION_EXPLAIN">This policy setting allows you to restrict users to a single remote Terminal Services session.

If you enable this policy setting, users who log on remotely using Terminal Services will be restricted to a single session (either active or disconnected) on that server. If the user leaves the session in a disconnected state, the user automatically reconnects to that session at next logon.

If you disable this policy setting, users are allowed to make unlimited simultaneous remote connections using Terminal Services.

If you do not configure this policy setting, the ΓÇ£Restrict each user to one sessionΓÇ¥ setting in the Terminal Services Configuration tool will determine if users are restricted to a single remote session.</string>
      <string id="TS_SMART_CARD">Do not allow smart card device redirection</string>
      <string id="TS_SMART_CARD_EXPLAIN">This policy setting allows you to control the redirection of smart card devices in a Terminal Services session.

If you enable this policy setting, Terminal Services users cannot use a smart card to log on to a Terminal Services session.

If you disable or do not configure this policy setting, smart card device redirection is allowed. By default, Terminal Services automatically redirects smart card devices on connection.

Note: The client computer must be running at least Microsoft Windows 2000 Server or at least Microsoft Windows XP Professional and the target server must be joined to a domain.</string>
      <string id="TS_START_PROGRAM">Start a program on connection</string>
      <string id="TS_START_PROGRAM_EXPLAIN">Configures Terminal Services to run a specified program automatically upon connection.

You can use this setting to specify a program to run automatically when a user logs on to a remote computer.

By default, Terminal Services sessions provide access to the full Windows desktop, unless otherwise specified with this setting, by the server administrator, or by the user in configuring the client connection. Enabling this setting overrides the "Start Program" settings set by the server administrator or user. The Start menu and Windows Desktop are not displayed, and when the user exits the program the session is automatically logged off.

To use this setting, in Program path and file name, type the fully qualified path and file name of the executable file to be run when the user logs on. If necessary, in Working Directory, type the fully qualified path to the starting directory for the program. If you leave Working Directory blank, the program runs with its default working directory. If the specified program path, file name, or working directory is not the name of a valid directory, the terminal server connection fails with an error message.

If the status is set to Enabled, Terminal Services sessions automatically run the specified program and use the specified Working Directory (or the program default directory, if Working Directory is not specified) as the working directory for the program.

If the status is set to Disabled or Not Configured, Terminal Services sessions start with the full desktop, unless the server administrator or user specify otherwise. (See "Computer Configuration\Administrative Templates\System\Logon\Run these programs at user logon" setting.)

Note: This setting appears in both Computer Configuration and User Configuration. If both settings are configured, the Computer Configuration setting overrides.</string>
      <string id="TS_TEMP">Temporary folders</string>
      <string id="TS_TEMP_DELETE">Do not delete temp folder upon exit</string>
      <string id="TS_TEMP_DELETE_EXPLAIN">Specifies whether Terminal Services retains a user's per-session temporary folders at logoff.

You can use this setting to maintain a user's session-specific temporary folders on a remote computer, even if the user logs off from a session. By default, Terminal Services deletes a user's temporary folders when the user logs off.

If the status is set to Enabled, users' per-session temporary folders are retained when the user logs off from a session.

If the status is set to Disabled, temporary folders are deleted when a user logs off, even if the administrator specifies otherwise in the Terminal Services Configuration tool.

If the status is set to Not Configured, Terminal Services deletes the temporary folders from the remote computer at logoff, unless specified otherwise by the server administrator.

Note: This setting only takes effect if per-session temporary folders are in use on the server. That is, if you enable the "Do not use temporary folders per session" setting, this setting has no effect.</string>
      <string id="TS_TEMP_EXPLAIN">This policy setting allows you to prevent Terminal Services from creating session-specific temporary folders.

You can use this policy setting to disable the creation of separate temporary folders on a remote computer for each session. By default, Terminal Services creates a separate temporary folder for each active session that a user maintains on a remote computer. These temporary folders are created on the remote computer in a Temp folder under the userΓÇÖs profile folder and are named with the "sessionid".

If you enable this policy setting, per-session temporary folders are not created. Instead, a userΓÇÖs temporary files for all sessions on the remote computer are stored in a common Temp folder under the userΓÇÖs profile folder on the remote computer.

If you disable this policy setting, per-session temporary folders are always created, even if you specify otherwise in the Terminal Services Configuration tool.

If you do not configure this policy setting, per-session temporary folders are created unless you specify otherwise in the Terminal Services Configuration tool.</string>
      <string id="TS_TEMP_Help">Controls creation and deletion of temporary folders for Terminal Services sessions</string>
      <string id="TS_TEMP_PER_SESSION">Do not use temporary folders per session</string>
      <string id="TS_TIME_1MIN">1 minute</string>
      <string id="TS_TIME_5MIN">5 minutes</string>
      <string id="TS_TIME_10MIN">10 minutes</string>
      <string id="TS_TIME_15MIN">15 minutes</string>
      <string id="TS_TIME_30MIN">30 minutes</string>
      <string id="TS_TIME_1HR">1 hour</string>
      <string id="TS_TIME_2HR">2 hours</string>
      <string id="TS_TIME_3HR">3 hours</string>
      <string id="TS_TIME_6HR">6 hours</string>
      <string id="TS_TIME_8HR">8 hours</string>
      <string id="TS_TIME_12HR">12 hours</string>
      <string id="TS_TIME_16HR">16 hours</string>
      <string id="TS_TIME_18HR">18 hours</string>
      <string id="TS_TIME_1DAY">1 day</string>
      <string id="TS_TIME_2DAY">2 days</string>
      <string id="TS_TIME_3DAY">3 days</string>
      <string id="TS_TIME_4DAY">4 days</string>
      <string id="TS_TIME_5DAY">5 days</string>
      <string id="TS_TIME_NEVER">Never</string>
      <string id="TS_TIME_ZONE">Allow time zone redirection</string>
      <string id="TS_TIME_ZONE_EXPLAIN">This policy setting determines whether the client computer redirects its time zone settings to the Terminal Services session.

If you enable this policy setting, clients that are capable of time zone redirection send their time zone information to the server. The server base time is then used to calculate the current session time (current session time = server base time + client time zone).

If you disable or do not configure this policy setting, the client computer does not redirect its time zone information and the session time zone is the same as the server time zone.

Note: Time zone redirection is possible only when connecting to at least a Microsoft Windows Server 2003 terminal server with a client using RDP 5.1 and later.</string>
      <string id="TS_TSCC_EXPLAIN">Specifies whether to disable the administrator rights to customize security permissions in the Terminal Services Configuration tool.

You can use this setting to prevent administrators from making changes to the user groups on the Permissions tab in the Terminal Services Configuration tool. By default, administrators are able to make such changes.

If the status is set to Enabled, the Permissions tab in the Terminal Services Configuration tool cannot be used to customize per-connection security descriptors or to change the default security descriptors for an existing group. All of the security descriptors are Read Only.

If the status is set to Disabled or Not Configured, server administrators have full Read/Write privileges to the user security descriptors on the Permissions tab in the Terminal Server Configuration tool.

Note: The preferred method of managing user access is by adding a user to the Remote Desktop Users group.</string>
      <string id="TS_TSCC_PERMISSIONS_POLICY">Do not allow local administrators to customize permissions</string>
      <string id="TS_TURNOFF_SINGLEAPP">Always show desktop on connection</string>
      <string id="TS_TURNOFF_SINGLEAPP_EXPLAIN">This policy setting determines whether the desktop is always displayed after a client connects to a remote computer or an initial program can run. It can be used to require that the desktop be displayed after a client connects to a remote computer, even if an initial program is already specified in the default user profile, Remote Desktop Connection, Terminal Services Client, or through Group Policy.

If you enable this policy setting, the desktop is always displayed when a client connects to a remote computer. This policy setting overrides any initial program policy settings.

If you disable or do not configure this policy setting, an initial program can be specified that runs on the remote computer after the client connects to the remote computer. If an initial program is not specified, the desktop is always displayed on the remote computer after the client connects to the remote computer.

Note: If this policy setting is enabled, then the "Start a program on connection" policy setting is ignored.</string>
      <string id="TS_USER_AUTHENTICATION_EXPLAIN">This policy setting allows you to specify whether to require user authentication for remote connections to the terminal server by using Network Level Authentication. This policy setting enhances security by requiring that user authentication occur earlier in the remote connection process.

If you enable this policy setting, only client computers that support Network Level Authentication can connect to the terminal server.

To determine whether a client computer supports Network Level Authentication, start Remote Desktop Connection on the client computer, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. In the About Remote Desktop Connection dialog box, look for the phrase "Network Level Authentication supported."

If you disable or do not configure this policy setting, Network Level Authentication is not required for user authentication before allowing remote connections to the terminal server.

You can specify that Network Level Authentication be required for user authentication by using Terminal Services Configuration or the Remote tab in System Properties.

Important: Disabling or not configuring this policy setting provides less security because user authentication will occur later in the remote connection process.
</string>
      <string id="TS_USER_AUTHENTICATION_POLICY">Require user authentication for remote connections by using Network Level Authentication</string>
      <string id="TS_User_Help">Controls configuration of Terminal Services technologies that enable access to a server running Windows-based programs or the full Windows desktop</string>
      <string id="TS_USER_HOME">Set TS User Home Directory</string>
      <string id="TS_USER_HOME_EXPLAIN">Specifies whether Terminal Services uses the specified network share or local directory path as the root of the user's home directory for a Terminal Services session.

To use this setting, select the location for the home directory (network or local) from the Location drop-down list. If you choose to place the directory on a network share, type the Home Dir Root Path in the form \\Computername\Sharename, and then select the drive letter to which you want the network share to be mapped.

If you choose to keep the home directory on the local computer, type the Home Dir Root Path in the form "Drive:\Path" (without quotes), without environment variables or ellipses. Do not specify a placeholder for user alias, because Terminal Services automatically appends this at logon.

Note: The Drive Letter field is ignored if you choose to specify a local path. If you choose to specify a local path but then type the name of a network share in Home Dir Root Path, Terminal Services places user home directories in the network location.

If the status is set to Enabled, Terminal Services creates the user's home directory in the specified location on the local computer or the network. The home directory path for each user is the specified Home Dir Root Path and the user's alias.

If the status is set to Disabled or Not Configured, the user's home directory is as specified at the server.</string>
      <string id="TS_USER_PROFILES_EXPLAIN">This policy setting allows you to specify the network path that Terminal Services uses for roaming user profiles.

By default, Terminal Services stores all user profiles locally on the terminal server. You can use this policy setting to specify a network share where user profiles can be centrally stored, allowing a user to access the same profile for sessions on all terminal servers that are configured to use the network share for user profiles.

If you enable this policy setting, Terminal Services uses the specified path as the root directory for all user profiles. The profiles are contained in subfolders named for the account name of each user.

To configure this policy setting, type the path to the network share in the form of \\Computername\Sharename. Do not specify a placeholder for the user account name, because Terminal Services automatically adds this when the user logs on and the profile is created. If the specified network share does not exist, Terminal Services displays an error message on the terminal server and will store the user profiles locally on the terminal server.

If you disable or do not configure this policy setting, user profiles are stored locally on the terminal server. You can configure a userΓÇÖs profile path on the Terminal Services Profile tab on the userΓÇÖs account Properties dialog box.

Notes:
1. The roaming user profiles enabled by the policy setting apply only to Terminal Services connections. A user might also have a Windows roaming user profile configured. The Terminal Services roaming user profile always takes precedence in a Terminal Services session.
2. To configure a mandatory Terminal Services roaming user profile for all users connecting remotely to the terminal server, use this policy setting together with the "Use mandatory profiles on the terminal server" policy setting located in Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Profiles. The path set in the "Set path for TS Roaming User Profile" policy setting should contain the mandatory profile.</string>

      <string id="TS_USER_MANDATORY_PROFILES_EXPLAIN">This policy setting allows you to specify whether Terminal Services uses a mandatory profile for all users connecting remotely to the terminal server.

If you enable this policy setting, Terminal Services uses the path specified in the "Set path for TS Roaming User Profile" policy setting as the root folder for the mandatory user profile. All users connecting remotely to the terminal server use the same user profile.

If you disable or do not configure this policy setting, mandatory user profiles are not used by users connecting remotely to the terminal server.

Note:

For this policy setting to take effect, you must also enable and configure the "Set path for TS Roaming User Profile" policy setting.
</string>

      <string id="TS_USER_PROFILES">Set path for TS Roaming User Profile</string>
      <string id="TS_USER_MANDATORY_PROFILES">Use mandatory profiles on the terminal server</string>
      <string id="TS_CERTIFICATE_TEMPLATE_POLICY">Server Authentication Certificate Template</string>
      <string id="TS_CERTIFICATE_TEMPLATE_EXPLAIN">This policy setting allows you to specify the name of the certificate template that determines which certificate is automatically selected to authenticate a terminal server.

A certificate is needed to authenticate a terminal server when SSL (TLS 1.0) is used to secure communication between a client and a terminal server during RDP connections.

If you enable this policy setting, you need to specify a certificate template name. Only certificates created by using the specified certificate template will be considered when a certificate to authenticate the terminal server is automatically selected. Automatic certificate selection only occurs when a specific certificate has not been selected.

If no certificate can be found that was created with the specified certificate template, the terminal server will issue a certificate enrollment request and will use the current certificate until the request is completed. If more than one certificate is found that was created with the specified certificate template, the certificate that will expire latest and that matches the current name of the terminal server will be selected.

If you disable or do not configure this policy setting, a self-signed certificate will be used by default to authenticate the terminal server. You can select a specific certificate to be used to authenticate the terminal server on the General tab of the Terminal Services Configuration tool.

Note: If you select a specific certificate to be used to authenticate the terminal server, that certificate will take precedence over this policy setting.</string>
      <string id="TS_CLIENT_ALLOW_UNSIGNED_FILES">Allow .rdp files from unknown publishers</string>
      <string id="TS_CLIENT_ALLOW_UNSIGNED_FILES_MACHINE_EXPLAIN">This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from unknown publishers on the client computer.

If you enable or do not configure this policy setting, users can run unsigned .rdp files and .rdp files from unknown publishers on the client computer. Before a user starts an RDP session, the user receives a warning message and is asked to confirm whether they want to connect.

If you disable this policy setting, users cannot run unsigned .rdp files and .rdp files from unknown publishers on the client computer. If the user tries to start an RDP session, the user receives a message that the publisher has been blocked.
</string>
      <string id="TS_CLIENT_ALLOW_UNSIGNED_FILES_USER_EXPLAIN">This policy setting allows you to specify whether users can run unsigned Remote Desktop Protocol (.rdp) files and .rdp files from unknown publishers on the client computer.

If you enable or do not configure this policy setting, users can run unsigned .rdp files and .rdp files from unknown publishers on the client computer. Before a user starts an RDP session, the user receives a warning message and is asked to confirm whether they want to connect.

If you disable this policy setting, users cannot run unsigned .rdp files and .rdp files from unknown publishers on the client computer. If the user tries to start an RDP session, the user receives a message that the publisher has been blocked.
</string>
      <string id="TS_CLIENT_ALLOW_SIGNED_FILES">Allow .rdp files from valid publishers and user's default .rdp settings</string>
      <string id="TS_CLIENT_ALLOW_SIGNED_FILES_MACHINE_EXPLAIN">This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one that is issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. This policy setting also controls whether the user can start an RDP session by using default .rdp settings (for example, when a user directly opens the Remote Desktop Connection [RDC] client without specifying an .rdp file).

If you enable or do not configure this policy setting, users can run .rdp files that are signed with a valid certificate. Users can also start an RDP session with default .rdp settings by directly opening the RDC client. When a user starts an RDP session, the user is asked to confirm whether they want to connect.

If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked.

Note: You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected.
</string>
      <string id="TS_CLIENT_ALLOW_SIGNED_FILES_USER_EXPLAIN">This policy setting allows you to specify whether users can run Remote Desktop Protocol (.rdp) files from a publisher that signed the file with a valid certificate. A valid certificate is one issued by an authority recognized by the client, such as the issuers in the client's Third-Party Root Certification Authorities certificate store. This policy setting also controls whether the user can start an RDP session by using default .rdp settings (for example, when a user directly opens the Remote Desktop Connection [RDC] client without specifying an .rdp file).

If you enable or do not configure this policy setting, users can run .rdp files that are signed with a valid certificate. Users can also start an RDP session with default .rdp settings by directly opening the RDC client. When a user starts an RDP session, the user is asked to confirm whether they want to connect.

If you disable this policy setting, users cannot run .rdp files that are signed with a valid certificate. Additionally, users cannot start an RDP session by directly opening the RDC client and specifying the remote computer name. When a user tries to start an RDP session, the user receives a message that the publisher has been blocked.

Note: You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, all users on the computer are affected.
</string>
      <string id="TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS">Specify SHA1 thumbprints of certificates representing trusted .rdp publishers</string>
      <string id="TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_MACHINE_EXPLAIN">This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remote Desktop Protocol (.rdp) file publishers.

If you enable this policy setting, any certificate with an SHA1 thumbprint that matches a thumbprint on the list is trusted. If a user tries to start an .rdp file that is signed by a trusted certificate, the user does not receive any warning messages when they start the file. To obtain the thumbprint, view the certificate details, and then click the Thumbprint field.

If you disable or do not configure this policy setting, no publisher is treated as a trusted .rdp publisher.

Notes:

You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user.

This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting.

If the list contains a string that is not a certificate thumbprint, it is ignored.
</string>
      <string id="TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_USER_EXPLAIN">This policy setting allows you to specify a list of Secure Hash Algorithm 1 (SHA1) certificate thumbprints that represent trusted Remote Desktop Protocol (.rdp) file publishers.

If you enable this policy setting, any certificate with an SHA1 thumbprint that matches a thumbprint on the list is trusted. If a user tries to start an .rdp file that is signed by a trusted certificate, the user does not receive any warning messages when they start the file. To obtain the thumbprint, view the certificate details, and then click the Thumbprint field.

If you disable or do not configure this policy setting, no publisher is treated as a trusted .rdp publisher.

Note:

You can define this policy setting in the Computer Configuration node or in the User Configuration node. If you configure this policy setting for the computer, the list of certificate thumbprints trusted for a user is a combination of the list defined for the computer and the list defined for the user.

This policy setting overrides the behavior of the "Allow .rdp files from valid publishers and user's default .rdp settings" policy setting.

If the list contains a string that is not a certificate thumbprint, it is ignored.
</string>

      <string id="TS_PROMT_CREDS_CLIENT_COMP">Prompt for credentials on the client computer</string>
      <string id="TS_PROMT_CREDS_CLIENT_COMP_EXPLAIN">This policy setting determines whether a user will be prompted on the client computer to provide credentials for a remote connection to a terminal server.

If you enable this policy setting, a user will be prompted on the client computerΓÇöinstead of on the terminal serverΓÇöto provide credentials for a remote connection to a terminal server. If saved credentials for the user are available on the client computer, the user will not be prompted to provide credentials.

Note: If you enable this policy setting and a user is prompted on both the client computer and on the terminal server to provide credentials, go to Terminal Services Configuration on the terminal server, and in the Properties dialog box for the connection, clear the "Always prompt for password" check box on the Log on Settings tab.

If you disable or do not configure this policy setting, the version of the operating system on the terminal server will determine when a user is prompted to provide credentials for a remote connection to a terminal server.  For Windows 2000 and Windows Server 2003, a user will be prompted on the terminal server to provide credentials for a remote connection. For Windows Server 2008, a user will be prompted on the client computer to provide credentials for a remote connection.</string>


      <string id="TS_SERVER_AUTH">Configure server authentication for client</string>
      <string id="TS_SERVER_AUTH_NONE">Always connect, even if authentication fails</string>
      <string id="TS_SERVER_AUTH_REQUIRE">Do not connect if authentication fails</string>
      <string id="TS_SERVER_AUTH_ATTEMPT">Warn me if authentication fails</string>
      <string id="TS_SERVER_AUTH_EXPLAIN">This policy setting allows you to specify whether the client will establish a connection to the terminal server when the client cannot authenticate the terminal server. If you enable this policy setting, you must specify one of the following settings:

Always connect, even if authentication fails: The client connects to the terminal server even if the client cannot authenticate the terminal server.

Warn me if authentication fails: The client attempts to authenticate the terminal server. If the terminal server can be authenticated, the client establishes a connection to the terminal server. If the terminal server cannot be authenticated, the user is prompted to choose whether to connect to the terminal server without authenticating the terminal server.

Do not connect if authentication fails: The client establishes a connection to the terminal server only if the terminal server can be authenticated.

If you disable or do not configure this policy setting, the authentication setting that is specified in Remote Desktop Connection or in the .rdp file determines whether the client establishes a connection to the terminal server when the client cannot authenticate the terminal server.
</string>

    <string id="TS_SERVER_COMPRESSOR">Set compression algorithm for RDP data</string>
    <string id="TS_SERVER_COMPRESSOR_EXPLAIN">This policy setting allows you to specify which Remote Desktop Protocol (RDP) compression algorithm to use.

By default, servers use an RDP compression algorithm that is based on the server's hardware configuration.

If you enable this policy setting, you can specify which RDP compression algorithm to use. If you select the algorithm that is optimized to use less memory, this option is less memory-intensive, but uses more network bandwidth. If you select the algorithm that is optimized to use less network bandwidth, this option uses less network bandwidth, but is more memory-intensive. Additionally, a third option is available that balances memory usage and network bandwidth.

If you disable or do not configure this policy setting, the default RDP compression algorithm will be used.
</string>
 <string id="TS_SERVER_COMPRESSOR_NCRUSH">Balances memory and network bandwidth</string>
 <string id="TS_SERVER_COMPRESSOR_XCRUSH">Optimized to use less network bandwidth</string>
 <string id="TS_SERVER_COMPRESSOR_MPPC">Optimized to use less memory</string>

    </stringTable>
    <presentationTable>
      <presentation id="TS_COLORDEPTH">
        <dropdownList refId="TS_Color_Depth" noSort="true" defaultItem="0">Color Depth</dropdownList>
      </presentation>
      <presentation id="TS_ENCRYPTION_POLICY">
        <dropdownList refId="TS_ENCRYPTION_LEVEL" defaultItem="1">Encryption Level</dropdownList>
        <text>Choose the encryption level from the drop-down list.</text>
      </presentation>
      <presentation id="TS_FALLBACKPRINTDRIVERTYPE">
        <dropdownList refId="TS_FALLBACK_OPTIONS" noSort="true" defaultItem="0">When attempting to find a suitable driver:</dropdownList>
      </presentation>
      <presentation id="TS_GATEWAY_POLICY_AUTH_METHOD">
        <checkBox refId="TS_GATEWAY_OVERRIDE">Allow users to change this setting</checkBox>
        <dropdownList refId="TS_GATEWAY_AUTH_MODE" noSort="true">Set TS Gateway authentication method</dropdownList>
      </presentation>
      <presentation id="TS_GATEWAY_POLICY_ENABLE">
        <checkBox refId="TS_GATEWAY_OVERRIDE">Allow users to change this setting</checkBox>
      </presentation>
      <presentation id="TS_GATEWAY_POLICY_SERVER">
        <checkBox refId="TS_GATEWAY_OVERRIDE">Allow users to change this setting</checkBox>
        <textBox refId="TS_GATEWAY_SERVER">
          <label>Set TS Gateway server address</label>
        </textBox>
      </presentation>
      <presentation id="TS_KEEP_ALIVE">
        <decimalTextBox refId="TS_KEEP_ALIVE_INTERVAL">Keep-Alive interval:</decimalTextBox>
      </presentation>
      <presentation id="TS_LICENSE_SERVERS">
        <textBox refId="TS_LICENSE_EDIT">
          <label>License servers to use:</label>
        </textBox>
        <text>Separate license server names with commas.</text>
        <text>Example: Server1,Server2.example.com,192.168.1.1</text>
      </presentation>
      <presentation id="TS_LICENSING_MODE">
        <dropdownList refId="TS_LICENSING_NAME" noSort="true" defaultItem="0">Specify the licensing mode for the terminal server.</dropdownList>
      </presentation>
      <presentation id="TS_MAX_CON_POLICY">
        <decimalTextBox refId="TS_Maximum_Connections_allowed">TS Maximum Connections allowed</decimalTextBox>
        <text>Type 999999 for unlimited connections.</text>
      </presentation>
      <presentation id="TS_RemoteControl_1">
        <dropdownList refId="TS_RemoteControl_Levels" noSort="true" defaultItem="0">Options:</dropdownList>
      </presentation>
      <presentation id="TS_RemoteControl_2">
        <dropdownList refId="TS_RemoteControl_Levels" noSort="true" defaultItem="0">Options:</dropdownList>
      </presentation>
      <presentation id="TS_SD_ClustName">
        <textBox refId="TS_SD_ClustName">
          <label>TS Session Broker farm name:</label>
        </textBox>
      </presentation>
      <presentation id="TS_SD_Loc">
        <textBox refId="TS_SD_Loc">
          <label>TS Session Broker server name:</label>
        </textBox>
      </presentation>
      <presentation id="TS_SECURITY_LAYER_POLICY">
        <dropdownList refId="TS_SECURITY_LAYER" defaultItem="1">Security Layer</dropdownList>
        <text>Choose the security layer from the drop-down list.</text>
      </presentation>
      <presentation id="TS_SESSIONS_Disconnected_Timeout_1">
        <dropdownList refId="TS_SESSIONS_EndDisconnected" noSort="true" defaultItem="0">End a disconnected session</dropdownList>
      </presentation>
      <presentation id="TS_SESSIONS_Disconnected_Timeout_2">
        <dropdownList refId="TS_SESSIONS_EndDisconnected" noSort="true" defaultItem="0">End a disconnected session</dropdownList>
      </presentation>
      <presentation id="TS_SESSIONS_Idle_Limit_1">
        <dropdownList refId="TS_SESSIONS_IdleLimitText" noSort="true" defaultItem="0">Idle session limit:</dropdownList>
      </presentation>
      <presentation id="TS_SESSIONS_Idle_Limit_2">
        <dropdownList refId="TS_SESSIONS_IdleLimitText" noSort="true" defaultItem="0">Idle session limit:</dropdownList>
      </presentation>
      <presentation id="TS_SESSIONS_Limits_1">
        <dropdownList refId="TS_SESSIONS_ActiveLimit" noSort="true" defaultItem="0">Active session limit :</dropdownList>
      </presentation>
      <presentation id="TS_SESSIONS_Limits_2">
        <dropdownList refId="TS_SESSIONS_ActiveLimit" noSort="true" defaultItem="0">Active session limit :</dropdownList>
      </presentation>
      <presentation id="TS_START_PROGRAM_1">
        <textBox refId="TS_PROGRAM_NAME">
          <label>Program path and file name</label>
        </textBox>
        <textBox refId="TS_WORKDIR">
          <label>Working Directory</label>
        </textBox>
      </presentation>
      <presentation id="TS_START_PROGRAM_2">
        <textBox refId="TS_PROGRAM_NAME">
          <label>Program path and file name</label>
        </textBox>
        <textBox refId="TS_WORKDIR">
          <label>Working Directory</label>
        </textBox>
      </presentation>
      <presentation id="TS_USER_HOME">
        <dropdownList refId="TS_USER_HOME_LOCATION" noSort="true">Location:</dropdownList>
        <textBox refId="TS_HOME_DIR">
          <label>Home Dir Root Path:</label>
        </textBox>
        <text>If home path is on the network, specify drive letter for the mapped drive.</text>
        <dropdownList refId="TS_DRIVE_LETTER" defaultItem="19">Drive Letter</dropdownList>
      </presentation>
      <presentation id="TS_USER_PROFILES">
        <textBox refId="TS_PROFILE_PATH">
          <label>Profile path</label>
        </textBox>
        <text>Specify the path in the form, \\Computername\Sharename</text>
      </presentation>
      <presentation id="TS_CERTIFICATE_TEMPLATE_POLICY">
        <textBox refId="TS_CERTIFICATE_TEMPLATE_NAME">
          <label>Certificate Template Name</label>
        </textBox>
      </presentation>
      <presentation id="TS_TRUSTED_CERTIFICATE_THUMBPRINTS_1">
        <textBox refId="TRUSTED_CERTIFICATE_THUMBPRINTS">
          <label>Comma-separated list of SHA1 trusted certificate thumbprints:</label>
        </textBox>
       </presentation>
      <presentation id="TS_TRUSTED_CERTIFICATE_THUMBPRINTS_2">
        <textBox refId="TRUSTED_CERTIFICATE_THUMBPRINTS">
          <label>Comma-separated list of SHA1 trusted certificate thumbprints:</label>
        </textBox>
       </presentation>
      <presentation id="TS_SERVER_AUTH">
        <dropdownList refId="TS_SERVER_AUTH_LEVEL" defaultItem="0" noSort="true">Authentication setting:</dropdownList>
      </presentation>
      <presentation id="TS_SERVER_COMPRESSOR">
        <dropdownList refId="TS_COMPRESSOR_LEVELS" noSort="true" defaultItem="0">RDP compression algorithm:</dropdownList>
      </presentation>
    </presentationTable>
  </resources>
</policyDefinitionResources>