In the latest release of Windows 2008 R2, Terminal Services has been renamed Remote Desktop Services (RDS). There are many enhancements in this release including enhanced multimedia performance and the ability to publish custom applications sets to specific users through Remote Desktop Web Access. The Web Access role as the name suggests allows users to access Remote Desktop applications through a web site. This feature is official known as RemoteApp. The new name for the core Terminal Server running in application mode for user sessions is Remote Desktop Session Host.
In my environment I will configure the Remote Desktop Session Host and Web Access roles on the same server. I will also install the Remote Desktop Licensing role on a dedicated server so that any additional Session Hosts I add in the future can share this service. The License Server role can be installed on your Session Host server if desired. All of my servers are members of an Active Directory domain.
Install Remote Desktop Licensing Role
To start go into the Server Manager on the server that will host the Licensing role service.
Under Roles Summary select “Add Roles”.
Click Next.
Check Remote Desktop Services and click Next.
Click Next.
Check Remote Desktop Licensing and select Next.
Discovery scopes are no longer used for licensing with Windows 2008 R2 Remote Desktop, we can assign these to our Remote Desktop Session Host manually or through a group policy. There is a 120 day grace period allowed for connections to a Remote Desktop Session Host before a license server needs to be activated. Click Next.
Confirm the settings and click Install. Then click Close once the install is completed.
Install Remote Desktop Session Host and Web Access Roles
Now switch to the server that will be our Remote Desktop Session Host and Web Access server. Start Server Manager.
Select “Add Roles”.
Check Remote Desktop Services and click Next.
Check the RD Session Host and RD Web Access services. When you add Web Access you’ll be prompted:
Click Add Required Role Services to accept to install the prerequisites. Then click Next back at the Add Roles Wizard.
At this time I’ll select “Do not required Network Level Authentication”. There are some issues using NLA if we have Windows XP SP3 clients, but there is a registry fix available. Click Next.
I’ll choose Per User licensing mode and click Next.
Now we can add additional groups of users to have access to applications on the Session Host. The local Administrator group on the server is included by default. I’ll add additional groups later so for now I’ll click Next.
I’ll check all of the available check boxes to provide for an enhanced client experience on this Session Host. This will allow for capabilities such as playing multimedia through the RD session and Windows Aero if we publish a full desktop on this server. This all sound great, but be aware that these features will consume additional resources on your Session Host. Click Next.
Click Next, then click Install at the confirmation screen that follows. The server should prompt for a reboot when the installation is complete.
Configure Session Host to Use Licensing Server
After you reboot and log on to your Session Host and go to Start > Administrative Tools > Remote Desktop Services > Remote Desktop Session Host Configuration.
In the middle pane under Licensing double click “Remote Desktop license servers”.
Click Add.
Your license server should appear under known license servers. If not, enter the FQDN or IP address of the server and click Add. If you are not logged on as a Domain Administrator and the License server is on a different server in your domain it will give you a warning about being unable to verify, it should be okay to simply click through this message. Click OK.
Add Users for Remote Desktop on the Session Host
Now we’ll go into Computer Management and add the additional users group(s) that we want to allow access to Remote Desktop sessions on the Session Host. Go to Start > Administrative Tools > Computer Management.
Open up “Local Users and Groups” on the left pane, then highlight the Groups sub-folder. Double click the “Remote Desktop Users” group in the center.
I’ll add the Domain Users group. Click Add.
I will allow all of my domain users access to Remote Desktop sessions, so I’ll type Domain Users, click Check Names, then click OK. Click OK through the remaining dialog windows, and close Computer Management.
Publish a Remote Desktop RemoteApp Program
Now it’s time to publish a test application. Go to Start > Administrative Tools > Remote Desktop Services > RemoteApp Manager. Click “Add RemoteApp Programs” in the right Actions pane.
Click Next.
I’ll test using the Calculator, so check that and click Next. At the confirmation window click Finish.
Test Newly Published RemoteApp Program
Now I’ll log on to a client machine in my domain to test the newly published Calculator. On the client open up Internet Explorer and enter “http://YourWebAccessServer/rdweb”.
Click “Continue to this website” in the browser window.
You may receive a warning about the ActiveX control not being installed. I’ve generally only seen this on Windows XP clients. To fix this reset your IE internet settings by clicking Tools > Internet Options.
Click the Advanced tab. Then click the Reset button. Click through the dialog boxes. Once you’re back at the IE browser windows, close IE and reopen it. Now you go back to “http://YourWebAccessServer/rdweb” and click through the certificate warning you should be presented with the RD Web Access log on screen.
When a user with standard privileges on the client accesses the RD Web Access site for the first time they will receive a warning about installing the Remote Desktop ActiveX Control. Confirm that you trust the web site address you are contacting. You probably will because you should be accessing your own server!
Click the warning message at the top and select Run Add On.
Now click Run.
Log on with a user you’ve given access to Remote Desktop sessions. The administrator should automatically be given access. Be sure and specify the domain first if you are using a domain account.
You’ll receive a warning about unable to identify the remote connection publisher, click Connect.
It will now ask for you to log on to the the RD session. Enter the user name in the Domain\Username format.
And another warning will appear about identity verification, click Yes. We’ll set up a new certificate from a trusted certificate authority later to eliminate this message. The RemoteApp should now launch.
Eliminate Certificate Warnings (optional)
Now let’s work to eliminate the multiple certificate warnings we receive when accessing our Remote Desktops and RemoteApp programs. In this example I will make use of an enterprise certificate authority configured in my AD domain, of which my RD Session Host/Web Access server is a member.
Note that this process will only eliminate the warnings if my clients and RDS server are members of the AD domain since they will automatically trust the AD enterprise certificate authority. If you have non-domain clients that connect to your RDS server you’ll need to export and import your CA root certificate into the certificate store on these systems so the IIS and RDS certificates are trusted. Page 1 of the post Configuring Non-Domain Windows IIS Servers has details on how to do this.
Eliminate RD Web Access/IIS Certificate Warning
First if you have not done so in your environment already, Install an Enterprise Certificate Authority in Windows 2008 R2.
Next, Configure a Server Certificate for IIS/RD Web Access.
These two steps should take care of the warning we receive when we access the RD Web Access web site.
Eliminate RemoteApp Certificate Warning
Now let’s remove the first RemoteApp certificate warning. On the Session Host navigate to Start > Administrative Tools > Remote Desktop Services > RemoteApp Manager.
Under Overview click Change after the Digital Signature Settings heading.
Under the Digital Signature tab check the box for “Sign with a digital certificate”. Then click the Change button.
Select the certificate published from our enterprise CA. I’ll use the certificate I requested for my IIS/RD Web Access service. Be sure and choose the certificate issued by the CA and not the self signed certificate. Click OK.
Click OK back at the RemoteApp Deployment Settings box.
Once a certificate from a trusted certificate authority is configured, the RemoteApp session should pass through the authentication credentials entered on the RD Web Access page and the second log on to the Session Host will no longer be necessary. Yes!
Eliminate Remote Desktop Connection Certificate Warning
I have noticed that this step is not needed with Windows 7 domain member clients, but for good measure I wanted to make sure that all of my potential clients are cleared of certificate warning messages. On the Session Host go to Start > Admin Tools > Remote Desktop Services > Remote Desktop Session Host Configuration.
In the center pane under Connections double click the RDP-Tcp connection.
In the General tab under Certificate click the Select button.
Again I’ll use the certificate I published for the IIS/Web Access role. Click OK.
Back at the RDP-Tcp Properties box click OK. We should now be configured to access our RemoteApps without any more annoying certificate warnings!
In my environment I will configure the Remote Desktop Session Host and Web Access roles on the same server. I will also install the Remote Desktop Licensing role on a dedicated server so that any additional Session Hosts I add in the future can share this service. The License Server role can be installed on your Session Host server if desired. All of my servers are members of an Active Directory domain.
Install Remote Desktop Licensing Role
To start go into the Server Manager on the server that will host the Licensing role service.
Under Roles Summary select “Add Roles”.
Click Next.
Check Remote Desktop Services and click Next.
Click Next.
Check Remote Desktop Licensing and select Next.
Discovery scopes are no longer used for licensing with Windows 2008 R2 Remote Desktop, we can assign these to our Remote Desktop Session Host manually or through a group policy. There is a 120 day grace period allowed for connections to a Remote Desktop Session Host before a license server needs to be activated. Click Next.
Confirm the settings and click Install. Then click Close once the install is completed.
Install Remote Desktop Session Host and Web Access Roles
Now switch to the server that will be our Remote Desktop Session Host and Web Access server. Start Server Manager.
Select “Add Roles”.
Check Remote Desktop Services and click Next.
Check the RD Session Host and RD Web Access services. When you add Web Access you’ll be prompted:
Click Add Required Role Services to accept to install the prerequisites. Then click Next back at the Add Roles Wizard.
At this time I’ll select “Do not required Network Level Authentication”. There are some issues using NLA if we have Windows XP SP3 clients, but there is a registry fix available. Click Next.
I’ll choose Per User licensing mode and click Next.
Now we can add additional groups of users to have access to applications on the Session Host. The local Administrator group on the server is included by default. I’ll add additional groups later so for now I’ll click Next.
I’ll check all of the available check boxes to provide for an enhanced client experience on this Session Host. This will allow for capabilities such as playing multimedia through the RD session and Windows Aero if we publish a full desktop on this server. This all sound great, but be aware that these features will consume additional resources on your Session Host. Click Next.
Click Next, then click Install at the confirmation screen that follows. The server should prompt for a reboot when the installation is complete.
Configure Session Host to Use Licensing Server
After you reboot and log on to your Session Host and go to Start > Administrative Tools > Remote Desktop Services > Remote Desktop Session Host Configuration.
In the middle pane under Licensing double click “Remote Desktop license servers”.
Click Add.
Your license server should appear under known license servers. If not, enter the FQDN or IP address of the server and click Add. If you are not logged on as a Domain Administrator and the License server is on a different server in your domain it will give you a warning about being unable to verify, it should be okay to simply click through this message. Click OK.
Add Users for Remote Desktop on the Session Host
Now we’ll go into Computer Management and add the additional users group(s) that we want to allow access to Remote Desktop sessions on the Session Host. Go to Start > Administrative Tools > Computer Management.
Open up “Local Users and Groups” on the left pane, then highlight the Groups sub-folder. Double click the “Remote Desktop Users” group in the center.
I’ll add the Domain Users group. Click Add.
I will allow all of my domain users access to Remote Desktop sessions, so I’ll type Domain Users, click Check Names, then click OK. Click OK through the remaining dialog windows, and close Computer Management.
Publish a Remote Desktop RemoteApp Program
Now it’s time to publish a test application. Go to Start > Administrative Tools > Remote Desktop Services > RemoteApp Manager. Click “Add RemoteApp Programs” in the right Actions pane.
Click Next.
I’ll test using the Calculator, so check that and click Next. At the confirmation window click Finish.
Test Newly Published RemoteApp Program
Now I’ll log on to a client machine in my domain to test the newly published Calculator. On the client open up Internet Explorer and enter “http://YourWebAccessServer/rdweb”.
Click “Continue to this website” in the browser window.
You may receive a warning about the ActiveX control not being installed. I’ve generally only seen this on Windows XP clients. To fix this reset your IE internet settings by clicking Tools > Internet Options.
Click the Advanced tab. Then click the Reset button. Click through the dialog boxes. Once you’re back at the IE browser windows, close IE and reopen it. Now you go back to “http://YourWebAccessServer/rdweb” and click through the certificate warning you should be presented with the RD Web Access log on screen.
When a user with standard privileges on the client accesses the RD Web Access site for the first time they will receive a warning about installing the Remote Desktop ActiveX Control. Confirm that you trust the web site address you are contacting. You probably will because you should be accessing your own server!
Click the warning message at the top and select Run Add On.
Now click Run.
Log on with a user you’ve given access to Remote Desktop sessions. The administrator should automatically be given access. Be sure and specify the domain first if you are using a domain account.
You’ll receive a warning about unable to identify the remote connection publisher, click Connect.
It will now ask for you to log on to the the RD session. Enter the user name in the Domain\Username format.
And another warning will appear about identity verification, click Yes. We’ll set up a new certificate from a trusted certificate authority later to eliminate this message. The RemoteApp should now launch.
Eliminate Certificate Warnings (optional)
Now let’s work to eliminate the multiple certificate warnings we receive when accessing our Remote Desktops and RemoteApp programs. In this example I will make use of an enterprise certificate authority configured in my AD domain, of which my RD Session Host/Web Access server is a member.
Note that this process will only eliminate the warnings if my clients and RDS server are members of the AD domain since they will automatically trust the AD enterprise certificate authority. If you have non-domain clients that connect to your RDS server you’ll need to export and import your CA root certificate into the certificate store on these systems so the IIS and RDS certificates are trusted. Page 1 of the post Configuring Non-Domain Windows IIS Servers has details on how to do this.
Eliminate RD Web Access/IIS Certificate Warning
First if you have not done so in your environment already, Install an Enterprise Certificate Authority in Windows 2008 R2.
Next, Configure a Server Certificate for IIS/RD Web Access.
These two steps should take care of the warning we receive when we access the RD Web Access web site.
Eliminate RemoteApp Certificate Warning
Now let’s remove the first RemoteApp certificate warning. On the Session Host navigate to Start > Administrative Tools > Remote Desktop Services > RemoteApp Manager.
Under Overview click Change after the Digital Signature Settings heading.
Under the Digital Signature tab check the box for “Sign with a digital certificate”. Then click the Change button.
Select the certificate published from our enterprise CA. I’ll use the certificate I requested for my IIS/RD Web Access service. Be sure and choose the certificate issued by the CA and not the self signed certificate. Click OK.
Click OK back at the RemoteApp Deployment Settings box.
Once a certificate from a trusted certificate authority is configured, the RemoteApp session should pass through the authentication credentials entered on the RD Web Access page and the second log on to the Session Host will no longer be necessary. Yes!
Eliminate Remote Desktop Connection Certificate Warning
I have noticed that this step is not needed with Windows 7 domain member clients, but for good measure I wanted to make sure that all of my potential clients are cleared of certificate warning messages. On the Session Host go to Start > Admin Tools > Remote Desktop Services > Remote Desktop Session Host Configuration.
In the center pane under Connections double click the RDP-Tcp connection.
