Normally, Windows treats all USB devices attached to a computer are as system-wide resource. They are visible to all users. This becomes a problem when working in multi-user environment of Terminal Server. Although Windows provides means to control access to the system objects, including devices, this is generally not enough to assign a particular device to a particular RDP session.
All USB devices connected through USB Redirector RDP Edition act like they are attached directly to the server computer. This means that these devices are available system-wide and visible to every user.
With the help of Per-session USB Device Isolation feature, it is possible to partially solve the problem. USB Redirector RDP Edition can isolate users' USB devices in their corresponding RDP sessions, effectively preventing other users from accessing them.
Isolation is currently supported for the following devices:
•Mass Storage devices (e.g. USB Flash Drives, USB Hard Drives, etc.)
•HID devices (e.g. USB Signature Pads, USB Shipping Scale, USB Swipe Readers, USB Footpedals, some USB Fingerprint Readers, some USB Smart Card Readers, USB Keyboards, USB Mouses, USB Touchpads, etc.)
•Video devices (e.g. USB Webcams, USB Video Capture, etc.) which use Microsoft's standard usbvideo.sys driver.
•USB-Serial devices (e.g. USB to Serial converters and other USB devices which appear as Serial COM Ports) which use Microsoft's standard usbser.sys driver.
•Some other specific USB devices.
Composite USB device is a device with multiple functions. A good example are Multi-function Printers which include Printer, Scanner and Copier functions. Another example is a mobile phone, which can act as a Mass Storage device and Modem at the same time.
USB Redirector RDP Edition does it's best to provide as much isolation as it can. It will isolate those functions of the device for which isolation is supported. For example, if you have connected a USB Smart Phone which has Mass Storage and Modem functions, the USB Redirector RDP Edition will isolate the Mass Storage part and won't isolate Modem part.
Currently, the following limitations apply to the Mass Storage device isolation:
•All USB drives redirected to server are visible to all users, but only the user who connected the drive can access it.
•The number of USB drives that can be connected simultaneously is limited by the number of available drive letters on the Terminal Server (up to 26).
These devices are fully isolated. All the input is routed to the owner's session and the device is not visible or accessible from other sessions.
Currently, the following limitations apply to the Video device isolation:
•Only those devices which use Microsoft's standard usbvideo.sys driver are isolated.
•For composite devices with both Video and Audio function, only video part is isolated, while audio part is not accessible in RDP session due to Windows limitations.
Currently, the following limitations apply to the USB-Serial devices isolation:
•Only those devices which use Microsoft's standard usbser.sys driver are isolated.
•Different users can not use identical COM port numbers. COM port numbers are not per-user, they are assigned by the system and remain global for the system.
To see current isolation status, open USB Device Properties window on the Terminal Server side. USB Redirector RDP Edition can show whether the device is fully isolated in the RDP session or only some functions of the device are isolated.
Note. Isolation status may change from Not Active to Active state during USB device driver installation.