Homegroup and Remote Desktop

[FreakyFerret]

My homegroup is setup properly. I can access files and all that stuff. What I'd like to be able to do is use homegroup security to allow Remote Desktoping into my PC on the LAN.

I go to the Remote Desktop settings from Computer Properties. I have a user account set to allow RD in. I wanted to add the HomeUsers group as well, but it isn't listed. Additionally typing it in doesn't work either. Tells me not a valid user/group (though it does exist on my system). I then add the HomeGroupUser$ user instead.

Doesn't work. I have to provide credentials in line with the actual account on the PC I'm remoting in to. Is this how it's supposed to work or am I doing something wrong?


Edit: Does anyone know of a technical article on Home Groups somewhere for system administrators to read? From what I can, pretty much the meat of it is a hidden user account called "HomeUserGroup$" and a not hidden group called "Home Users". Pretty much all 7 does is if a connecting computer is a part of the homegroup, it substitutes the connecting account's information with the HomeUserGroup$ account.

 

[johngalt]

Dunno - the first time I enabled HG it redid my special folder moves (back in build 7000) so that I had duplicate Download, Documents, etc folders - those on my D drive and those that it physically re-created under the Users tree....

Since then I Have not tried it. However, I have 2 machines running build 7077, one 32bit and 1 64bit, and I can set the laptop back up and try to work out what you're doing right now and see if I an get it working on my end....

 

[FreakyFerret]

Let me know if you get anywhere, John.

I have 4 computers set up with Win 7 right now (well, 3, and 1 with Windows Server 2008 R2 enterprise). The homegroup doesn't work on R2, obviously, but all other features of Homegroup seem to be fine. Not that big a deal for the remote desktop using the Homegroup securities instead of account priviledges, I guess.

 

[jimbo45]

Hi there
why not "attack" this from a slightly different perspective.

Share your data as before by sharing "Libraries". This only works with Home Groups (a pity as this could have been great for Non W7 machines in a network -- but that's a story for another time).

Now consider why you actually NEED RDP. -- You might be better off making the desktop you want to RDP a "Home Server" instead which can be done without having to buy any server software. I'd suggest at looking at making your own VPN -- OK it's a bit fiddly but more secure and should still give you access to software you need. (also multiple users could access it).

Another solution is to set up your own web server (WAMP - Apache, MySQL, Php on Windows). If you use something like No-IP (No-IP - Dynamic DNS, Static DNS for Your Dynamic IP) you could even access it from outside your ISP and not have to worry about blocked ports etc from a work LAN - a lot of workplaces now block RDP ports anyway.

A BIG problem (at least a big problem as I can see with RDP) is that if you are using a Router you need to know the actual IP address (internal one on your LAN (e.g 192.168.2.x or 10.10.x.x etc) to allow your router to port forward to the correct machine. (Might not be a problem if you only ever RDP to a particular machine on your network).

For simple file access etc why not use something really easy like FTP. Most people I know merely use RDP for accessing files on the remote machine or sending EMAIL. Running an application like Photoshop CS4 on a remote machine on a typical Home ISP won't be a very pleasant experience -- even with FAST Download speeds the upload speeds are usually AWFUL.

I've often mentioned that I can live without 50 MB/s download but would really LOVE even 15 MB/s upload -- that makes a remote LAN much more worthwhile. - We usually don't get a choice however -- they push the download speeds but don't do much about upload.

I've attached an old FTP program (WS_FTP) has been working as far back as Windows 95 -- still fast and simple for file transfer.

Cheers
jimbo

 

[Digger]

so basically if i understand you, you want a desired login for RDP, with certain security permissions setup for that account? Or are you just wanting to be able to login from any account.

Jimbo has some good points there, but Jim, i dont think its just about his files, as he says all that is fine. One would need to figure out that as a problem. The use of RDP would be used for the user settings or "getting into" that pc for whatever reason besides getting a file. Either maintenance or whatever.

There is a great thread about RDP somewheres on the 7 forum here. Goes into length about ports forwarded, multiple outside RDP account setup on same machine (workaround registry fix) and so on.

If you have the same password on your account for pc #1 as pc #2, there is no need for credentials if on same homegroup under 7. Unless logging into the same username with different pass or logging into a different user and pass.

 

[FreakyFerret]

jimbo, thanks for your input. And yeah, WS-FTP was great. I don't think you're understanding what I'm doing fully though, allow me to give more detail.

I'm not going out over the internet. All of this is occuring on the LAN only.

I have 3 machines at the moment I'm using. Rather than having to get up and go to each machine, I use Remote Desktop to remote into 2 of them and use them that way. These 2 are also mounted on a rack without a keyboard or mouse and no chair.

For example, I have one computer I use for burning optical discs at the moment. I have a large collection of files I won't access regularly (if ever again), but I do wan to archive them. I'm doing so much burning, the drive actually heats up a bit from it. I have to pause about 3 to 5 minutes between discs with the drawer open to create effective cooling and prevent overheat that leads to failed burns. Since I'm using (abusing?) the burner so much, I'm trying to decrease the possibility of failed burns even more by having this computer do only burns. By using Remote Desktop, I can sit at my main computer and do all the UI stuff comfortably. It's a box sitting on a rack. Remote Desktop is great!

The other machine I'm using right now for Shareaza (peer to peer) stuff. I remote into it and do all the work I want with it. Since I'm usualyl transferring a lot of file, Shareaza tends to be very processor intensive. By having a dedicated machine, I don't have to worry about having my other work (like playing a first person shooter) being affected performace wise.

Now, what I was hoping to do was use Windows 7 Home Group to provide the credentials to remote into these computers rather than having to provide a user name and password stored locally on the other compuers. This isn't working though. From what I can tell, it's not so much a limitation of the Home Group but Remote Desktop. RD creates a login session on the other computer complete with everything that normally goes into a user login and interaction. In order to do this, I guess it needs an actual user space and not just ephemeral user. If that makes sense.


Edit: Digger, yeah different accounts on the main pc from the other 2 PCs. Not so much about security issues as an organizing thing. Rather than have half a dozen accounts on the remote machines for the various people in the house, I created a "generic" account for everyone to use. Basically it was my attempt at a type of home group system back in the XP days. Since the remote machines didn't need to maintain individual user settings and preferance but just provide security credentials, I just gave out the one user name and pass on the remote machines to everyone in the house. If they needed a file on the remote machines, they just entered that into Windows Explorer when prompted. It's carried over to the present.

 

[Digger]

first i would say to ween yourself off of shareaza, hehehe. horrible on the resources as you know of.

Secondly, just setup the user/pass on all 3 pcs as the same. You should then have no problem.

And lastly, depending on your layout and lan and how you like or want things, you may want also look into the possibility of using a kvm switch. There are switches that can control up to 4 pcs i think nowadays. Using just the single monitor. Using a key like pause/break to switch between pcs. Would depend on proximity of course and space.

 

[FreakyFerret]

Thanks, Digger. I like Shareaza actually. I've tried other P2P programs, and it does everything I want and exactly how I want it. That's rare. It only uses a lot of resources when I have a lot of transfers and searching going on. Which, granted, is usually often.

A KVM wouldn't really help me out. Using a KVM on my main PC would impact the responsiveness of my input devices. Since I play a first person shooter, I need those extra milliseconds. Since I paid a lot of money for higher end input devices, I don't want to waste that money. Also the other 2 remote machines are located in another room entirely. Running KVM lines is not practical.

And yeah, there are KVM switches that'll control up to 4 PCs, complete with buttons on the switch itself to make it even easier to switch. We had them at work. Worked very nicely.

I could setup the same user pass on all machines, but that would defeat the purpose of trying to use Home Group for it. Also, to keep things organized better when viewing files and folders across the network, I prefer having multiple user names. Since each account would actually have its own GUID on each computer, the only time similar account names would help would be in network access restriction.

Sadly, I think I won't be able to use RD with HG. Where was that article on RD you mentioned? Here on the 7 forums or elsewhere on the net?

 

[Digger]

that thread was here on this forum.

I guess my next question is, why or what problems are you having then? You should be able to RDP in to any machine and do whatever it is that you want. Without having to make ONE account for the use of RDP. You can set it up to have different credentials for different logins on the desired security set account. Also I would think that you know that you can only have that one session under that ONE account on that pc.

So if i understand you right, you are just nagged by the "click ok" screen, instead of it auto-logging you in? Ever tried an RDP gadget to do this work? Some will save/cache your login details.

 

[FreakyFerret]

Remote Desktop in Win7 works great. It saves my credentials fine. I also like the new jumplists for it on the taskbar.

My problem is I added "HomeGroupUser$" as "Remote Desktop User" on the remote machines. Checking the "Local Users and Groups" item shows this user as a member of the RDU group. By my understanding of Home Group security, I should be able to remote into the PC using any account on the local computer without the need to provide any credentials. However, this does not work. Providing the credentials for the account on the local computer also does not work. In order to remote into the computer, I have provide credentials pointing to an account local on the PC I am remoting into.

On my local machine, I have account Ferret. On the remote computer I have account Freaky. On the remote computer, members of the "Remote Desktop Users" group are Freaky and HomeGroupUser$. I can use Ferret to access files on the remote computer because HomeGroup accepts that as a valid account. I cannot use Ferret to remote into the remote computer though. I must use the Freaky account name and password to gain remote desktop access.

Does that clear it up? Sorry I haven't explained it well.

 

[Digger]

I have only done some limited searching on this, and only recall seeing this "HomeGroupUser$" maybe once or twice. So for my memory, where are you seeing this? I am under RD, select users, advanced, then did a find. I dont have this "HomeGroupuser$" shown.

 

[Digger]

the best direction i can point you in is to go to start and type in control userpasswords2 (with space in between, as typed). Root around in there, as i just remembered and came across this, yet to explore it... again, lol, like i was going to the first time i ran across this.

Hope this helps out some.

 

[jimbo45]

Hi there
I'm still a bit confused as why you still need RDP for things like burning CD's / DVD's / archiving data on remote machines.

You can still do this by "Bog standard" File sharing -- it's no problem to share a device such as a CD / DVD drive between different machines on a network (after all Virtual Machines do this all the time).

I'm not saying RDP is of no use -- just for your application I can't see why you even need to logon to the remote machine if all you need is for an authorised user to be able to access its resources.

It *Might* possibly consume less resources to run the application on the remote machine (such as the DVD burning application) but with a decently powered machine simple device sharing might work just as well - especially as you are on a LAN with physical access to all the machines.

(Of course from time to time you WILL need to be on the other machine such as to apply updates / re-boot or whatever - but that's another whole ballpark).

Cheers
jimbo

 

[Digger]

Remote Desktop in Win7 works great. It saves my credentials fine. I also like the new jumplists for it on the taskbar.

My problem is I added "HomeGroupUser$" as "Remote Desktop User" on the remote machines. Checking the "Local Users and Groups" item shows this user as a member of the RDU group. By my understanding of Home Group security, I should be able to remote into the PC using any account on the local computer without the need to provide any credentials. However, this does not work. Providing the credentials for the account on the local computer also does not work. In order to remote into the computer, I have provide credentials pointing to an account local on the PC I am remoting into.

On my local machine, I have account Ferret. On the remote computer I have account Freaky. On the remote computer, members of the "Remote Desktop Users" group are Freaky and HomeGroupUser$. I can use Ferret to access files on the remote computer because HomeGroup accepts that as a valid account. I cannot use Ferret to remote into the remote computer though. I must use the Freaky account name and password to gain remote desktop access.

Does that clear it up? Sorry I haven't explained it well.

How would you be able to login to a particular account, switching back and forth without providing credentials to a certain desktop? there is no user desktop named as such HomegroupUser... say you have 5 user accounts on that pc. and say user 3 didnt wish to share his files with the rest of the homegroup, or set as private. How would trying to login under a HomegroupUser deal with any kind of security or permission restrictions setup on any other given account. Time restrictions, permission levels, software restrictions. And even if admin account, still the privacy issue of any docs not put on the homegroup. Theorectically, it sounds like you want a superAdmin account to see and do all of the entire pc, no matter what account could be affected. Under what desktop would you pop up on or use if you use a login as HomegroupUser$ when there is no such username on the network? Its not like a hidden admin account or guest.

With your given scenario and thinkings, then if you have .net anything installed, try logging in under ASPNET(users) or ALPHAUSER$(homeuser).... wont work either for you.

 

[Digger]

try also going to user accounts and family safety/ credential manager.

[edit] also cmd / lusrmgr (little more advanced)

 

[FreakyFerret]

Digger, yeah, that's what I'm figuring too (about accounts). Only reason I tried it was cause as I was reading some documentation on HomeGroups (some part of the Win7 help file, don't remember where), it mentioned using HomeGroups with Remote Desktops. Seemed odd to me for reasons you mentioned in last post, but thought I'd give it a try. Was only reason I even setup a HomeGroup on my LAN actually. Since I couldn't get it to work, I thought I was doing something wrong. Your insight backs up my own initial concerns and now I'll consider my curiousity satisfied. Thanks.

Jimbo, I could share the burner across the network and then use burning software on the local computer to use it.

However, that would still require me to run the burning software on the local machine.

It would require me not to reboot or power down the local machine.

Depending on how resource intensive the software is, it could impact performance enough to matter to me. Remember, my local machine is my gaming rig which has had every possible tweak done to it to gain performance. I don't even install Adobe Reader on here cause of the very small launcher process it loads at boot. I just remote into the other PC and read PDFs there. With the newest 7 build, I found out I can actually play videos on the remote machine and watch them with equal FPS as if I played them locally.

And then there's the network clog. The files I want to burn are local to the burning computer. If I made the burner shared, and the drive with files shared, I'd be pulling the files to this computer, then pushing them right back again to the burner.


I agree to simply access resources, network shares are the way to go. Absolutely. In this case, the resource I want to access is the processing power of the other machines. Remote Desktop is the network share I'm using for this.

I'm liking this discussion with you though, Jimbo. It's giving me ideas for a few other projects. Any other advice or suggestions you can give?

 

[FreakyFerret]

Digger, if you go to the user credential vault, you'll see listing for the remote computer's network share and "TERMSRV" (which is terminal server). You'll see the network shares use account "HomeGroupUser$".

If you want to see the account exactly, right click "Computer" and select "Manage". Go to "Local Users and Groups". In users you'll see "HomeGroupUser$". In groups you'll see "Home Users" which consists of local accounts and the HomeGroupUser$ account and Administrator account. I'm guessing one is supposed to use "Home Users" when giving rights rather than HomeGroupUser$.

If you don't have those listed, you might need to setup a Home Group first. I don't recall seeing them before, but I never really poked around in that part of computer management in 7 much.


Edit: And I just tried to remote in using HomeGroupUser$ and the homegroup password. Didn't work absolutely.

 

[Digger]

right, thats because "HomeGroupUser$" is not an actual account. I believe the $ is the giveaway. Lots more ppl on here know more about what i'm trying to speak on. I believe that the HomeGroupUser$ is an association of type. For example, not every user on the same local pc has to be a member of THE Homegroup, or any homegroup for that matter. That person has to manually join, also choosing what files to share on the Homegroup, thus making them a HomeGroupUser. If not, then they would just fall under User or User$. I would think the same goes for the other said accounts, like AlphaUser$ would fall under the admins, or group i should say, into what permissions and security levels.

 

[johngalt]

I suppose it is a sort of administrative share, much like the C$ on machines since Windows XP....

 

[hoffies4]

I dont want to sound dumb here, but have you tried to rdp to those computers as the administrator of said pc?