Thin Desktop® Frequently Asked Questions
- What is Thin Desktop?
- What is the value of Thin Desktop over buying a Thin Client?
- Why can't I simply lock down the PC myself instead of using Thin Desktop?
- Do I need a Microsoft VDA License if I use Thin Desktop on my PC?
- Are there any advantages to using a Thin Client over Thin Desktop?
- Does Thin Desktop support Win7 32 and 64 bit OS's?
- Does Thin Desktop work with Windows Embedded Standard 7 and XP-E?
- Does Thin Desktop work with Win TPC and Win FLP?
- Does Thin Desktop work with ultra-mini and Nettop computers?
- Does the end user still see the Windows Desktop with the Start button?
- What if the user inserts a USB drive or CD into a PC running Thin Desktop?
- Can I configure Thin Desktop to launch more than one application?
- Will Windows Update and my Antivirus software still function?
- Can I install Thin Desktop onto a PC that is joined to a domain?
- Can Thin Desktop create a domain account on install instead of a local account?
- Are Microsoft Updates and Antivirus updates required?
- Can I easily change the application the Thin Desktop is launching on boot?
- Will a terminal emulation application work?
- Can I easily disable Thin Desktop once it is enabled?
- What do I do if my Thin Desktop device (the PC Thin Desktop is running on) fails or I need to re-image it?
- How do I deploy Thin Desktop?
- What does Thin Desktop do when it is installed?
- ThinDesktopUser is logged in, how do I get to the administrator screen?
- When installing Thin Desktop, what are some typical "paths" to the locked down application?
- Can I configure Thin Desktop to launch an application other that the ICA or RDP client?
- Can I use Thin Desktop to connect to my Terminal Services machines automatically?
- How do I change the background, add a printer, etc. for a user?
- How do I get to Technical Support?
- How does Thin Desktop function as an Internet Kiosk?
Thin Desktop® is an application which transforms a PC into a single purpose device, much like a Thin Client. For instance, Thin Clients are generally configured to start up and launch either an ICA connection to a Citrix desktop or an RDP connection to a Terminal Services Server, or an RDP connection to a Virtual Machine (VM). One benefit of Thin Clients is that when they are configured to launch a designated session, that session is all the user has access to. The end user doesn't have access to the Operating System to make changes and potentially cause the Thin Client to stop functioning. With Thin Desktop, the same advantage can be enjoyed on a PC. When starting a PC with Thin Desktop enabled, the end user only has access to the application configured in Thin Desktop.
What is the value of Thin Desktop over buying a Thin Client?
- Since you already own the PC, you will save 90% over the cost of the Thin Client.
- Since your PC's have full Microsoft OS's with which to run the Thin Desktop application, VDA cost is much lower for the PC than for the Thin Client. In the case of customers with Microsoft SA, the existing PC has rights to access virtual machines in the data center. The cost of the 3-year VDA subscription for the Thin Client is $300.00, doubling the cost of a Thin Client.
- Since you already own the tools and know the process to deploy an application to a PC, there are no new applications, tools, or processes to learn, lowering the cost to deploy the locked down devices, as well as speeding up the project.
Why can't I simply lock down the PC myself instead of using Thin Desktop?
A variety of methods currently exist to provide various levels of lockdown. Most companies already lock down their PCs to some degree using one of these methods. Generally, a great deal of time could be spent configuring group policy or registry settings to the point where the end user had no access to the local desktop, or had access to only a single application. The ability to enable the application to be continually monitored and automatically restarted were it to be closed would entail additional development and testing. Thin Desktop eliminates the need for any of this and offers a simple, low cost and convenient way to accomplish the goal of limiting certain users to a specific connection or application.
Do I need a Microsoft VDA License if I use Thin Desktop on my PC?
If you are a Microsoft SA customer, and the PC's you currently own are on SA, you do not need a VDA License to run Thin Desktop, as Thin Desktop is an application that installs on an existing Microsoft OS. If you were to run Thin Desktop on an XPE or WES 7 Thin Client, you would need to purchase a VDA License for the Client Device. Your Microsoft Representative can address your specific question, and here are some key links:
http://www.microsoft.com/licensing/software-assurance/windows-virtualization.aspx
(Click on Software Assurance Desktop Virtualization brochure under More Resources at the bottom of the page.
http://www.microsoft.com/licensing/software-assurance/windows-thin-pc.aspx
Are there any advantages to using a Thin Client over Thin Desktop?
The only advantage (we are aware of) that holds true regarding existing PC's is that of power utilization. It is true that 5 years ago desktop PC's used over 225 watts of power. Today it is more in the range of 150 watts, and the PC's "power savings" settings dramatically lower the power usage. Thin Clients typically use 5-15 watts of power. Lately many PC manufacturers have begun selling low power-usage devices called Ultra Mini PC's or Nettops. These devices have a similar footprint to the frugal power usage of the Thin Client, but can be ordered with a full Microsoft Operating System, lowering or eliminating the VDA cost of the Thin Client (based on whether the Company has Microsoft SA or not). The VDA savings over a 3-year period make the Thin Client more expensive than buying a new PC and running the Thin Desktop application.
A second argument will be made by Thin Client Vendors regarding security and viruses, that their proprietary or Linux-based or Zero-Client devices are much more secure and do not require Virus Protection or Operating System updates. The number of such devices installed throughout the world is quite small, and we would agree there probably are not too many hackers trying to break into and modify their code for malicious reasons. The downside to the proprietary or Linux OS is higher cost for Microsoft VDA Licensing, a waiting period for updates or no updates at all to new client side features, a complete reliance for new features on a third party, and a requirement for you to learn new management tools and/or procedures for managing and updating the software features. The Microsoft skill sets and tools are already in place with regard to Thin Desktop.
Does Thin Desktop support Win7 32 and 64 bit OS's?
Yes, the standard evaluation download supports Microsoft 32 bit Operating Systems. Please contact info@thinlaunch.com if you need a 64 bit copy. Or, when you request an evaluation make a comment in the Questions/Comments section of the download section on the web site.
Note: For Windows 7 implementations UAC (User Account Controls) must be disabled and the OS re-booted prior to installing Thin Desktop. Once installed, UAC may be turned back on. Generally when registry errors show up during a WIN7 installation, it is because UAC has not been disabled.
Does Thin Desktop work with Windows Embedded Standard 7 and XP-E?
Yes. "Write filter" must be disabled and the system re-booted prior to installing Thin Desktop.
Note: If using Wyse NetXClean.exe, it needs to be disabled to install Thin Desktop.
Does Thin Desktop work with Win TPC and Win FLP?
Yes, Thin Desktop has been tested and operates normally with both Win TPC and Win FLP.
Does Thin Desktop work with ultra-mini and Nettop computers?
Yes, so long as the device has a full Microsoft Operating System (Professional/Business, Enterprise, and Ultimate). Many customers have a mix of PC's, Thin Clients and small form PC's using the Thin Desktop application. The user experience is exactly the same.
Does the end user still see the Windows Desktop with the Start button?
No. The end user only sees the application that Thin Desktop has been configured to launch. The end user has no access to anything other than the configured application.
What if the user plugs a Printer or USB drive into a PC running Thin Desktop?
Thin Desktop runs and monitors a single application and keeps the user from any local resources- unless that application allows access. In an ICA or RDP or PCoIP session- if the administrator of the virtual machine allows access to a local printer, then it can be easily set up. If the administrator does not allow access to the printer or usb ports, the application would not see the devices and the user would not be able to access the devices. Managing access to local resources can be controlled by the desktop administrator. For additional detail, see the FAQ question: "How do I change the background, add a printer, etc. for a user?"
Can I configure Thin Desktop to launch more than one application?
Not at this time. If the end user is connecting to a Citrix or Terminal Services environment, they can launch all applications necessary in that session. In the case of a Virtual XP-Pro session, all of the user's applications and data would be accessible via the RDP connection to that Virtual session.
Will Windows Update and my Antivirus software still function?
Yes. Windows continues to run normally in the background. All services and background processes remain unmodified by Thin Desktop. Administrators can modify the settings for updates and anti-virus.
Can I install Thin Desktop onto a PC that is joined to a domain?
Yes. The PC itself can be joined to a domain and will have all of the Group Policy that is assigned to it.
Can Thin Desktop create a domain account on install instead of a local account?
This is scheduled for the next major release in August, 2011. For a more detailed discussion of domain accounts, please contact ThinLaunch Software.
Are Microsoft Updates and Antivirus updates required?
Yes. They are still required because the PC is still running Windows XP or Windows 7. You can use your existing management tools to accomplish these tasks. Nothing is changed by Thin Desktop that would prevent any other installed software from functioning on the PC. Microsoft has addressed some of these security issues with Win TPC. See their new Write Filter feature.
Can I easily change the application the Thin Desktop is launching on boot?
Yes. The path to the executable launched by Thin Desktop is stored in the registry, and can be easily changed using your PC management tool. The appropriate registry keys are documented in the Thin Desktop User Guide.
Will a terminal emulation application work?
For those users who simply need access to an emulation session from their PC, Thin Desktop works well, too. Configure Thin Desktop to launch the locally installed emulation package on the PC and you have quickly and securely turned the PC into a device running a Terminal Emulation package, with no access to any other applications or settings on the Personal Computer. The caveat is that Thin Desktop is not an application security product, so the desktop administrator must ensure any "back doors" out of the Terminal Emulation (or any other application) software is not available to the user.
Can I easily disable Thin Desktop once it is enabled?
Yes. Assuming you are logged in as user with the appropriate permissions, it can be disabled locally or by using your PC management tool by using the standard uninstall procedure.
What do I do if my Thin Desktop device (the PC Thin Desktop is running on) fails or I need to re-image it?
Please contact info@thinlaunch.com Software maintenance subscription (Support and Updates) includes activation release so the license can be moved to a different machine.
There are options for deploying Thin Desktop. In an evaluation environment, you can use the interactive installer to setup Thin Desktop directly. This is not reasonable for mass deployment. As Thin Desktop is bundled into a standard Windows Installer Package (MSI file), you can deploy it with whatever management tool you currently use to deploy applications to your PCs. Once the installer is deployed, it may be installed silently by executing the following command:
msiexec /i ThinDesktop2.3.2.msi /qn LAUNCHCOMMAND="Location of the program Thin Desktop should launch" LICENSEKEY= "Your License Key"
In the case of bundling a machine image with Thin Desktop, this command can be used at the end of sysprep to install and configure Thin Desktop with no user intervention.
What does Thin Desktop do when it is installed?
During installation, Thin Desktop creates a local user account named ThinDesktopUser and places the newly created account into the Users group. Thin Desktop then updates the registry so that the newly created user is automatically logged-on every time the PC boots. When the system boots with Thin Desktop installed, Thin Desktop has complete control of the PC and monitors which user logs on to the PC. If the user is ThinDesktopUser as expected (which will happen automatically if an administrator doesn't stop this from happening), Thin Desktop will launch the configured command, instead of the standard Windows shell. Thin Desktop then monitors the PC to ensure that the designated application continues to run. If for any reason the designated application exits (user closes the application, the application fails, etc.), Thin Desktop will immediately launch it again. If the end user attempts CTRL-ALT-DEL, the only choices they will have is to Logoff (ThinDesktopUser would be immediately logged back in and the designated application restarted) or Cancel, returning them to the running application. If Thin Desktop sees any user other than ThinDesktopUser log into the system, Windows will operate normally.
ThinDesktopUser is logged in, how do I get to the administrator screen?
When logged in as ThinDesktopUser, press CTRL-ALT-DEL and choose Log Off while holding the left Shift key. Continue holding the Shift key until the logon dialog appears. This will allow a local account such as administrator to log on normally.
When installing Thin Desktop, what are some typical "paths" to the locked down application?
Microsoft's RDP/RDA- C:\WINDOWS\system32\mstsc.exe
VMware View- C:\Program Files\VMware\VMware View\Client\bin\wswc.exe
Citrix ICA- C:\Program Files\Citrix\ICA Client\test.ica
Citrix ICA- C:\Program Files\Citrix\ICA Client\wfica32.exe C:\test.ica
Note: Now that all Citrix products are under the XenDesktop name, there are a variety of implementation options. Please contact info@thinlaunch.com (or make comments in the comments section when you download the evaluation software) to ensure we address the specifics of your Citrix environment.
Can I configure Thin Desktop to launch an application other that the ICA or RDP client?
Yes. Thin Desktop can be configured to launch and monitor any single application installed on the PC. All of Citrix's ICA (XenDesktop) configurations (including Kaviza), VMware's View PCoIP and RDP connections and Microsoft's RDP technologies are tested and work as an application on a 32 or 64 bit Microsoft Operating System. The above three use cases are the primary intended use, however any application can be started and monitored by Thin Desktop. The caveat with launching any application is that Thin Desktop does NOT lock down the application or any of its features. Application security is not a function Thin Desktop addresses. So if there are back door ways a user might have access to PC resources, these must be closed off by the Desktop Administrator.
Companies might have a customer service application or call center application that is both secure AND is the only thing the end user is allowed to run. (The user has no access to the underlying OS or other applications on the PC). Thin Desktop is a perfect fit for that use case.
Can I use Thin Desktop to connect to my Terminal Services machines automatically?
Yes. Thin Desktop can be configured to launch MSTSC.exe (RDP client) at boot to connect to your terminal services environment.
How do I change the background, add a local printer, etc. for a user?
While many companies have a standard image for their users, we have heard this request many times, and we address this by using Explore.exe. Here are the directions:
- These directions assume the OS is Microsoft XP
- Ctrl + Alt + Del
- Log off holding down the left shift key
- You should get the local Windows log in dialog showing the user as "thindesktopuser" and a blank password
- Change the local user account to the local administrator and enter the local admin password
- This gets you back to the local desktop / account for the administrator on that device
- Start=> programs => ThinDesktop => Thin Desktop Configuration
- When the configuration dialog appears, use the browse function to find C:\WINDOWS\explorer.exe
- Save and exit.
- Start => Shutdown=> Logoff as administrator.
- Thin Desktop will Auto log on as ThinDesktop user and show you the local explorer shell for thindesktopuser.
- Start=> My Computer => Settings
- This should give you access to all of the settings for thindesktopuser
- Make your changes/ appropriate setup for the local printer or whatever settings you need to configure. Be sure to save all changes.
- Ctrl + Alt + Del
- Log off holding down the left shift key
- You should get the local Windows log in dialog showing the user as "thindesktopuser" and a blank password
- Change the user to the local administrator and enter the local admin password
- This gets you back to the local desktop / account for the administrator on that device
- Start=> programs => Thindesktop => Thin Desktop Configuration
- Reenter the information for the previous launch and monitor dialog command
- Save and exit
- Start => Shutdown=> Logoff as administrator.
- Thin Desktop should Auto log on and run the launch command and have the attributes you configured.
How do I get to Technical Support?
Technical Support is best reached at support@thinlaunch.com. Include information on the issue you are running into, including screen shots. Include your phone number so our support folks can call if they need to get more information.
How does Thin Desktop function as an Internet Kiosk?
Configure Thin Desktop to launch IE, Kiosk Mode. The end user would then be able to use IE, but will not be able to access the local operating system. This makes deploying a PC as an Internet Kiosk much faster, easier, and more secure. You will still need to use Windows Kiosk options to lock down the browser to your satisfaction as Thin Desktop relies on the MS Kiosk options to lock down the browser itself.
To really simplify the management of Internet Explorer, you can look at the ThinLaunch "Thin Browse" product. It is a user shell which sits on top of IE, greatly simplifying the configuration settings for the end user's access. Thin Browse also has a Kiosk mode, and can be locked down with Thin Desktop to control access to the underlying Microsoft OS.
