Have something to say?

Tell us how we could make TSplus products even more useful to you.

Display Remaining Login Attempts After Failed Authentication

Feature Request It would be beneficial if TSplus could display a warning message after each failed login attempt, informing the user how many login attempts remain before they are temporarily blocked by Brute Force Defender. For example, after the first failed attempt: Warning: Login unsuccessful. You have 9 login attempts remaining before you are temporarily blocked. Please check your username and password before trying again. Ideally, the remaining attempt count would update dynamically based on the configured Brute Force Defender threshold, rather than being hard-coded. It would also be useful if administrators could optionally include a link to documentation or a custom help page explaining the organisation's login policy. Benefits Reduces users unintentionally triggering Brute Force Defender. Decreases avoidable support requests caused by temporary account blocks. Makes users aware that repeated failed attempts have consequences. Improves the overall login experience by providing clear feedback instead of only reporting that authentication failed. Many users assume they can continue trying different passwords indefinitely. By the time they realise they have been blocked, they contact IT for assistance, even though the lockout could have been avoided with a simple warning indicating the number of remaining attempts.

Ryan Gilbert about 1 hour ago

Custom icon

Remote Access Feature Request

Granular "Open URLs on Client Side" Policy

The "Open URLs on Client Side" feature is very useful, but its current global configuration creates two important limitations. SSO compatibility: Some business applications require web-based authentication within the remote session. Redirecting these URLs to the local browser breaks the SSO workflow. Multi-tenant environments: On shared TSplus servers, some customers need client-side URL redirection while others do not. Since the setting is global, there is no way to configure it per user or group. Requested enhancement: Allow "Open URLs on Client Side" to be configured per user and/or per group (AD/local). Additionally, support an exclusion mode for URL rules, allowing administrators to redirect all URLs to the client except specific domains (e.g. *.company.com), which should remain in the remote session. This would provide much greater flexibility for shared environments while preserving compatibility with SSO-based business applications.

François Duriez about 4 hours ago

Custom icon

Remote Access Feature Request

Start ShellAppRuntime.exe during session initialization so Microsoft 365 sign-in works in published applications (ref ticket #142934)

The alternate shell is typically what the TSplus HTML5 web client uses, so this affects anyone accessing their session through a browser as well as conventional published applications. In both cases Microsoft 365 sign-in fails inside the TSplus session. Office apps show error 7q6ch and the underlying error is 0x80040154 (Class not registered). OneDrive is affected in the same way. The root cause is that modern Office builds authenticate exclusively through Windows Web Account Manager (WAM). The WAM broker is hosted by ShellAppRuntime.exe, which is normally started as part of the Explorer shell during logon. In a TSplus session that launches a published application or alternate shell instead of Explorer, ShellAppRuntime.exe is never started, so the WAM broker is unavailable and every Microsoft 365 sign-in attempt fails. The old workaround of forcing Office back to the legacy ADAL stack and disabling WAM no longer works. Microsoft has deprecated ADAL and current Office builds (we confirmed on Office 2408) ignore the DisableAADWAM registry setting, so WAM is now mandatory. There is no supported way to avoid it going forward. We confirmed the fix in our environment: launching ShellAppRuntime.exe at session initialization, without starting Explorer, restores the WAM broker and Microsoft 365 and OneDrive sign-in then works normally in published applications. We currently do this via a GPO logon script, but that is a per-customer workaround that has to be discovered, deployed and maintained by each admin independently. One thing to be aware of when implementing this: starting shell initialization in this way also causes any applications registered under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to launch in the session, which would not normally happen without Explorer as the shell. Admins should review what is in that key before rolling this out, and it is worth TSplus considering whether that behaviour should be controllable as part of the feature. The request is for TSplus to start ShellAppRuntime.exe as part of its own session initialization for published application and alternate shell sessions. This would benefit every customer who publishes applications without a full desktop, since they will all hit this as Windows and Office updates roll through their estates. It also removes a very hard to diagnose failure mode, because the error codes give no hint that a missing shell process is the cause. Full technical details, process traces and the confirmed workaround are documented in support ticket #142934, which your support team have reviewed and agreed reflects the correct direction for modern environments.

s1j0-2002 1 day ago

Custom icon

Remote Access Feature Request

Approved

Post-Installation Success & Quick Start Guide

To enhance the user onboarding experience and reduce initial support queries, I would like to propose a new feature request for our product installation process. The Proposal: Once a user successfully completes the TSplus installation, they should be automatically redirected to a dedicated landing page (similar to the attached screenshot). This page will serve as a Quick Reference Guide to help users get started immediately without any confusion. Key Elements to Include on the Page: Success Confirmation: A clear, prominent message stating "The installation was successful." Video Tutorial: An embedded short overview or "Getting Started" video. Quick Links/Tabs: Easy navigation tabs for User Guide and FAQ. Essential First Steps: Direct links to core configurations, such as: Getting Started with TSplus Configure Remote Access Manage Users & Permissions Publish Applications Monitoring & Reports Resource Footer: Quick links to our Knowledge Base, Community Forum, Downloads, and Support Contact. Why this will help: Improved User Experience (UX): Users get instant guidance right when they need it most. Many basic configuration questions (like user creation or app publishing) can be solved upfront by this guide. It highlights core features of TSplus immediately after installation. I have attached a reference image showcasing the layout and structure for your review Thank you for considering this feature request

akash.pratap@tsplus.net 20 days ago

1
Custom icon

Remote Access Feature Request

In Progress

Allow configuring the Remote Computer (Full Address) independently from the RD Gateway address

This feature request is related to our support ticket #141578, which contains the technical background and discussion. When generating a Windows client configured to use Remote Desktop Gateway (RDG), the Client Generator currently sets the RDP Full Address to 127.0.0.2. This causes Windows to use TERMSRV/127.0.0.2 for NTLM authentication and NLA identity verification. Many enterprise customers enforce the Group Policy "Restrict NTLM: Outgoing NTLM traffic to remote servers (Deny All)". In these environments, administrators must create explicit exceptions. They generally do not accept exceptions for TERMSRV/127.0.0.2, as they require hostnames or FQDNs instead of loopback IP addresses. We would like the Client Generator to provide two independent configuration fields, similar to the native Microsoft Remote Desktop client: RD Gateway address Remote Computer (Full Address) This would allow administrators to specify a hostname such as backend1.company.com as the Remote Computer while continuing to use the TSplus RD Gateway normally. Benefits Better compatibility with enterprise security policies. Support for environments where outbound NTLM is restricted. Eliminates the need to create exceptions for TERMSRV/127.0.0.2. Aligns the TSplus Client Generator with the behavior of the native Microsoft Remote Desktop client (mstsc). Thank you for considering this enhancement.

TaricTrans 20 days ago

Custom icon

Remote Access Feature Request

Feature Request: Password Protection for TSplus Advanced Security

Dear Support and Development Team, I am writing to formally request the addition of a "Password Protection" feature to safeguard the application's sensitive settings, core modules, and uninstallation process. I firmly believe this enhancement would significantly elevate the security posture of your product. Justification and Key Benefits: Prevention of Malware Tampering: Many types of malware and ransomware specifically target security software to disable protection or modify rules upon infiltration. Implementing password protection would act as a critical barrier, preventing malicious processes or scripts from turning off the service without explicit user authentication.

ehsan ghadiri 21 days ago

1
Custom icon

Advanced Security Feature Request

Approved

Temporary 2FA Bypass for Specific User

We need to temporarily disable 2FA for a user (after verifying their ID) so they can log in if their mobile phone/ 2FA device has been damaged, lost, stolen, or left at home! We currently modify the user’s entry in the following twofactorauth.ini file to enabled=no, escort them through the login process, and then reinstate enabled=yes : C:\Program Files (x86)\TSplus\Clients\webserver\twofa\twofactorauth.ini This is a dangerous practice that is vulnerable to editing mistakes on an important .ini file. Ideally, we need two disable options in the Admin Tool for a specific user: Disable 2FA for next login Disable 2FA until specific date We do not want the ability to permanently disable the 2FA for a user because that would encourage bad practice that would invalidate our cyber security insurance … “no 2FA, no insurance”.

Chris Edge 26 days ago

1
Custom icon

Remote Access Feature Request

Stop resetting text used for 2FA login text with every update

In this zero trust world, we only support authenticator app-based 2FA, as SMS and email codes are more vulnerable to interception, for example, through SIM swapping or compromised email accounts. So, it would be great if we did not have to remember to make the following text change after every update so that our users are not prompted for 2FA via SMS or email ! Change line 38 of "C:\Program Files (x86)\Tsplus\Clients\www\software\lang.js" From: translations['en']['Validate your verification code'] = 'Validate your verification code obtained by SMS, e-mail or via your 2FA app'; To: translations['en']['Validate your verification code'] = 'Validate your verification code obtained via your 2FA app (Microsoft Authenticator recommended)';

Chris Edge 26 days ago

1
Custom icon

Remote Access Feature Request

More License Activation Options

Hi Team, Sometimes the client, especially resellers, have multiple of the same license specs in their portal (ex. 3× 5-user Desktop licenses each with their own support). When they go to activate one of these licenses, they do not know which one they are activating. Would it be possible to add some differentiators or identification fields inside the activation menu? Could be Order ID, or customer comment, which they would add before activating. Additionally I am not sure about the usefulness of the No Updates/Support button, as each license that is being activated should have a support license regardless (new license will always have it, rehosting a license is done through another window). Allowing this option only creates confusion, however we need to figure out selecting which support to attach as discussed in the first paragraph. Hoping we can create a deeper connection with the License portal on this one and offer more options when activating a license. Renaming the titles from: TSplus → Remote Access TSplus Advanced Security → Advanced Security etc. also makes sense to me. Let me know your thoughts. Thanks!

Daniel Dvorsky 2 months ago

1
Custom icon

License Portal Feature Request

Approved

2FA: "Remember this device" option

Would it be possible to add an option for TSplus 2FA to remember a trusted device for a number of days (e.g. 7, 14, 30, X days)? After the first successful 2FA verification, subsequent logins from the same device would bypass the 2FA prompt until the trust period expires. At the moment, users are prompted for their 2FA code every time they log in via the HTML interface. This includes situations where the user simply navigates away from the page or closes their browser and reopens it later, which forces them to complete 2FA again even though they are on the same trusted device. This would make the login process smoother for regular users while maintaining security controls.

peejay 3 months ago

Custom icon

Remote Access Feature Request