• Protect the WMS 2012 system disk
• Create virtual desktops on Win 7 or 8

6. Verification of users rights

6.1. Checking the update of the MultiPoint Server 2012 groups

To apply the previously defined group policies to your MultiPoint server, you must restart it or type this command as an administrator :

Batch

gpupdate /force

To verify that our users will receive the correct rights, we will first see if our Active Directory groups appear in the right groups of Windows MultiPoint Server 2012.

As expected, our Active Directory groups have been added to the right groups of MultiPoint 2012.

As a reminder, here is where our test users were :

6.2. Checking the rights of our standard user (a student)

To begin, we login with the Student1 user who is a standard user.
During his first login, he receives a notification about the monitoring of his session by the system administrator (thanks to the MultiPoint Dashboard).

We accept this monitoring by clicking on : Accept and continue using this computer.

We arrive on the touch interface of "Windows 8".

By right-clicking, we click on "All applications" and we try to open Hyper-V Manager.
Since we are a standard user, we are not allowed to manage the virtual machines on the server and the window is empty.

In the "start menu", we also see the shortcuts for the MultiPoint programs : MultiPoint Dashboard and MultiPoint Manager.

But of course, we will not have access to them.
Indeed, to use the MultiPoint Dashboard, we must be members of the WmsOperators group.
This is consistent with what we have seen in the groups used by MultiPoint Server 2012.

For the MultiPoint Manager, we will not have access either because you have to be a server administrator to use it.

Standard users therefore have limited rights and will not be able to change the settings of your MultiPoint 2012 server.

By logging on to another PC with the local Administrator account, we will even be able to monitor this user, even if he is an Active Directory user and not a local user.

Always log out from Windows to release the CAL license used for your Windows session.

6.3. Checking the rights of our dashboard user (a teacher)

Now we login with the Teacher user who is a dashboard user.

Despite our research and several trials, we were not been able to disable session monitoring for Active Directory users.
Although they are exactly in the same groups as the users created locally.

Even disabling the "remote control" setting available in the Active Directory user settings did not change anything.

In short, we accept this monitoring because we have no choice.

To start, we try to launch Hyper-V Manager, but the window is empty since we are not allowed to manage the virtual machines of the server.

To launch the MultiPoint Dashboard, right-click and click "All Applications".
Then, start the MultiPoint Dashboard program.

As expected, the program is displayed.

Note : no user session is displayed because we are the only user logged in at this time.

However, since we are not a server administrator, we will not be able to launch the MultiPoint Manager.

As previously explained, the server administrator will be able to monitor all connected Active Directory users on a MultiPoint server, although this is not the case for dashboard users created locally on the MultiPoint server.

Log out properly from Windows.

6.4. Checking the rights of our administrator user (an IT Manager)

Finally, we login with our WmsITAdmin user who is an administrator user and as before, we must accept this monitoring (which is not necessary).

Since we are a server administrator, you will see that we will have access to everything.

We will be able to manage virtual desktops (virtual machines) with Hyper-V Manager.

We will be able to monitor users with the MultiPoint Dashboard.

Note : no other users are currently connected to our MultiPoint server.

For the MultiPoint Manager, you will simply have to accept its launch as an administrator.
But, you will have access to it without having to use other identifiers.

If you have virtual desktops on your MultiPoint server, this window may appear.
If this is the case, enter the administrator account IDs of the concerned virtual desktop.

In our case, the administrator of this virtual desktop is : Admin.

As you saw earlier (in Hyper-V Manager), the win8-vm-1 virtual machine was not running.
So, the MultiPoint Manager is not able to connect to this virtual desktop at this moment.

As previously explained, all users can be monitored via the MultiPoint Dashboard, although this is not the case for administrators created locally on the MultiPoint server.

Log out.