I recently implemented a Microsoft-based Virtual Desktop Infrastructure (VDI) solution. With the release of Windows 2008 R2 you now have a pure-Microsoft VDI stack. It includes all of the previously-named Terminal Services components and a bunch of new functionality to enable the two key scenarios of Personal Virtual Desktops and Virtual Desktop Pools. Microsoft’s proof-of-concept implementation documentation takes you through the entire process of installing and configuring the solution. It’s great documentation except that it focuses on Windows 7 clients. I had to provide Windows XP virtual desktops running as PVD and VDP and ran into a snag in the configuration process.

When you get to the point “To add RDP protocol permissions to a virtual machine” in Step 2: Installing and Configuring Virtual Machines you’ll quickly realize the command-lines included don’t work on Windows XP:

wmic /node:localhost RDPERMISSIONS where TerminalName="RDP-Tcp" CALL AddAccount "contoso\rdvh-srv$",1
wmic /node:localhost RDACCOUNT where "(TerminalName='RDP-Tcp' or TerminalName='Console') and AccountName='contoso\\rdvh-srv$'" CALL ModifyPermissions 0,1
wmic /node:localhost RDACCOUNT where "(TerminalName='RDP-Tcp' or TerminalName='Console') and AccountName='contoso\\rdvh-srv$'" CALL ModifyPermissions 2,1
wmic /node:localhost RDACCOUNT where "(TerminalName='RDP-Tcp' or TerminalName='Console') and AccountName='contoso\\rdvh-srv$'" CALL ModifyPermissions 9,1

After a bit of searching I found various PowerShell and VB Scripts to configure the settings but none seemed to work as-is. Also, PowerShell wasn’t available on the Windows XP images I was using and I didn’t have the freedom to add it. I tried to simplify the things and ended up with the following two scripts to configure the RDP protocol permissions on Windows XP. You need to replace %DOMAIN% and %ACCOUNT% with the Remote Desktop Virtualization Host domain and computer account name, i.e., “CONTOSO” and “RDHV-SRV$” as per the proof-of-concept documentation. Note the first occurrence has a single backslash but the second one has two. Copy them into a .vbs file and execute them by double-clicking or with cscript from the command-prompt.

set objWMI = GetObject("winmgmts:\\.\root\cimv2")
set colItems = objWMI.ExecQuery("Select * from Win32_TSPermissionsSetting")
for each objItem in colItems
   intRC = objItem.AddAccount("%DOMAIN%\ACCOUNT%", 1)
   if intRC then
      WScript.Echo "Error adding " & strAccount & " to " & _
                   objItem.TerminalName
   else
      WScript.Echo "Successfully added " & strAccount & " to " & _
                   objItem.TerminalName
   end if
next

set objWMI = GetObject("winmgmts:\\.\root\cimv2")
set colItems = objWMI.ExecQuery ("Select * from Win32_TSAccount Where AccountName='%DOMAIN%\\%ACCOUNT%'")
for each objItem in colItems
    intRC = objItem.ModifyPermissions(0,True)
    intRC = objItem.ModifyPermissions(2,True)
    intRC = objItem.ModifyPermissions(9,True)
    if intRC then
       WScript.Echo "Error setting permissions for " & strAccount
    else
       WScript.Echo "Set permissions for " & strAccount
    end if
next

Download Configure_XP.vbs