When dealing with remote office setups using Windows 7 Pro workstations joined to a domain, we often encounter the inefficiency of manual RDP session initiation. The current process requires users to:

1. Log in to their local workstation using domain credentials
2. Locate and double-click an RDP shortcut
3. Wait for connection establishment

We can implement an automated solution using these components:

• Windows Logon Scripts (Group Policy)
• Pre-configured RDP files with partial credentials
• PowerShell automation

First, create a customized RDP file (auto_connect.rdp) with these parameters:

screen mode id:i:2
use multimon:i:0
desktopwidth:i:1280
desktopheight:i:800
session bpp:i:32
winposstr:s:0,1,0,0,800,600
full address:s:your_rdp_server.domain.com
username:s:%USERNAME%@domain.com

Create a PowerShell script (LaunchRDP.ps1) to handle the connection:

$rdpPath = "\\domain\netlogon\auto_connect.rdp"
$rdpExec = "mstsc.exe"

# Check if RDP file exists
if (Test-Path $rdpPath) {
    # Launch RDP session
    Start-Process $rdpExec -ArgumentList "/v:your_rdp_server.domain.com /f /public"
} else {
    Write-Host "Configuration error: RDP file not found"
}

Deploy this solution through Group Policy:

1. Open Group Policy Management Console
2. Navigate to: User Configuration → Policies → Windows Settings → Scripts → Logon
3. Add the PowerShell script to the logon scripts list

While thin clients could provide a similar experience, they require:

• Additional hardware investment
• Different management infrastructure
• Potential user retraining

The scripted solution maintains existing hardware while achieving the desired automation.

Important security measures to implement:

# Set NTFS permissions on the RDP file
icacls "\\domain\netlogon\auto_connect.rdp" /inheritance:r
icacls "\\domain\netlogon\auto_connect.rdp" /grant "DOMAIN\Domain Users":R

Remember to:

• Never store passwords in RDP files
• Use Network Level Authentication
• Configure appropriate session timeouts

---

In our multi-office environment with VPN-connected Windows 7 Pro workstations (domain-joined), users currently authenticate locally then manually initiate RDP sessions to the Remote Desktop Server. While functional, this workflow creates several inefficiencies:

• Double authentication (local workstation + RDP server)
• Manual RDP connection initiation
• Training overhead for non-technical staff

Here are three approaches to automate this process while maintaining security:

1. Startup Script with Saved RDP Credentials

Create a batch script that leverages cmdkey and mstsc:

@echo off
:: Store credentials (domain user must have permission to run cmdkey)
cmdkey /generic:TERMSRV/rdserver.yourdomain.com /user:%USERDOMAIN%\%USERNAME% /pass:%PASSWORD%

:: Launch RDP connection
start mstsc /v:rdserver.yourdomain.com /f

Note: This requires storing credentials which may violate security policies.

2. Group Policy Configuration

Configure these GPO settings under User Configuration > Policies > Windows Settings > Scripts > Logon:

1. Create a VBS script that launches RDP:

Set objShell = CreateObject("WScript.Shell")
objShell.Run "mstsc.exe /v:rdserver.yourdomain.com", 1, False

2. Deploy via Group Policy Preferences to map RDP file to startup folder

3. Thin Client Alternative

For a more robust solution, consider these thin client configurations:

Approach	Pros	Cons
Windows Embedded	Familiar interface	Still requires some config
Linux Thin Client	Lightweight	Learning curve
Dedicated ThinOS	Auto-connects	Hardware cost

When implementing automated credential passing:

• Use Restricted Groups to limit local workstation access
• Implement RDP Gateway for additional security layer
• Configure Network Level Authentication (NLA)
• Set session timeouts in RDP Server properties

If connections fail, check:

:: Test basic connectivity
ping rdserver.yourdomain.com

:: Verify RDP port accessibility
telnet rdserver.yourdomain.com 3389

:: Check credential storage
cmdkey /list