How Does TS Agent for Citrix Terminal Server Identify User Login Events?
How does the Terminal Server (TS) agent for Citrix Terminal Server identify user login events?
When a user logs into Citrix Terminal Server, the TS agent gets notified through the windows API.
The TS agent puts this new login event into a queue and processes allocating port ranges.
Then it pushes the logged in User-ID down to the TS agent kernel driver where sessions are intercepted and the source port is altered.