How to Setup a Remote Desktop Session Host Farm using NLB on Server 2008 R2 (Part 2)

In a earlier post I went through installing a single remote desktop session host server. The post can be found here. The screenshots shown below overview the installation of the RDSH role.
As this is a test lab, I will not be installing a Licensing Server.

VIEW SLIDE SHOW DOWNLOAD ALL

So, install the RDSH role on both servers and add ‘Domain Users’ to the local ‘Remote Desktop Users’ group.
RDSH Certificates Template
We now need to configure the RDSH servers to use machine certificates obtained from an enterprise CA. All servers involved in the provision of remote applications to connecting clients require machine certificates. Each server will obtain its own machine certificate from an Enterprise CA. This will be used for remote desktop connections. However, I have found that you will need to share a signing certificate amongst both RDSH and RDCB servers (this certificate originated from RDSH1). I will show you how to create a suitable certificate template on the CA which we will use to enrol a needed certificate on each RDSH server.

1. On the Enterprise CA, under the Certificate Template Node, select Manage and duplicate a Web Server certificate. Select Windows 2008.
2. Give the certificate an appropriate name.
3. On the Security tab, ensure that all servers involved are placed on the security ACL tab with 'Read' and 'Enrol' permissions.
4. On the Request Handling tab, ensure that the Allow Private Key to be Exported is selected
5. On the Subject Name tab, ensure the Supply in the Request radio button is selected.
6. Select the Certificate Template Node, right click and select New. Locate the duplicated certificate just created and ensure that it is listed in the Certificate Template list.

VIEW SLIDE SHOW DOWNLOAD ALL

 
Now that you have created a new certificate template that will be used by the Remote Desktop servers, you should define revocation information on certificates your CA will publish. This is detailed in an earlier post (See Step 1 Configure Enterprise CA to Support AIA Extension to Support OCSP). This post will also explain the importance of OSCP in overcoming any revocation errors that you might receive when connecting externally.

---

The next logical step would be to obtain suitable machine certificates for the RDS servers.
Manually Obtain Machine Certificates on Your RDS Servers
Now that the RDS certificate template and the correct revocation settings have been made, you can now obtain the necessary machine certificates. Use the following procedure:

1. On your RDS servers, log on as Administrator
   
2. Type MMC in Run
   
3. Select File, Add Remove Snap-in
   
4. Under Available snap-ins, select Certificates and click Add
   
5. Select Computer account and click next
   
6. Select Local computer and click finish and click Ok
   
7. On the Certificates snap-in, select the Personal node, right click and select All Tasks, Request New Certificate
   
8. Click Next on the Before You Begin window and click Next again
   
9. Select the certificate template created above and select the blue hyperlink
   
10. Under the Subject tab type a suitable Common Name. If the certificate is to be used and sent externally (on the Internet) then you should use a public DNS name. Click Add.
    
11. Under Alternative name, select DNS and add names corresponding to both public DNS and any private FQDNs. The DNS name should also include the name of the farm that you intend to use (plan wisely!). At this point, you should add the host record (mapping farm name to an IP address) to your internal DNS server. The IP address used will be the IP used for your NLB cluster (more on this later!)
    
12. Under General tab, write a suitable name and description for the certificate.
    
13. Under Private Key select make Private Key Exportable. You may need to copy the certificate to other servers at some point (that is certificate and private key)
    
14. Click Apply and OK to finish the wizard
    
15. You should repeat this procedure on both RDSH, RDCB servers and for the RDWA server (with suitable external and internal names).

Once you complete the certificate request, you should see your certificate in your certificate MMC personal store. Now you have them, now you need to assign them correctly.
Configuration of Remote Desktop Session Host Configuration and its Certificate (Do this on each RDS server)

1. Select Admin Tools, RDS and then open Remote Desktop Session Host Configuration.
   
2. Under Connections select RDP-TCP properties
   
3. On the General tab you will probably find the Certificate is set to Default. Using the select key make sure you define the certificate you installed above.

This should be done for each RDS server (each server should use its own certificate obtained from the Enterprise CA).
To configure a certificate used to digitally sign the RDP file (Do this on both RDSH servers farm members)
I have found that it helps to use the same machine certificate across both RDSH servers and on the RDCB server. You will have to export the certificate with private key (therefore a .pfx file) from RDSH1 to RDSH2 and to RDCB. To export the certificate, just right click on the personal machine certificate in a MMC and select Export. Then import the certificate onto the other machines using a MMC once more. Once the certificate has been  exported/imported you can now deal with configuring that certificate to digitally sign the RDP file.
First, configure a certificate used to digitally sign the RDP file by using RemoteApp Manager.

1. Log on to RDSH1 as Domain\Administrator.
   
2. Click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.
   
3. Under the Overview section, click Change next to Digital Signature Settings.
   
4. Select the Sign with a digital certificate check box.
   
5. Click Change.
   
6. On the Confirm Certificate page, select the appropriate certificate, and then click OK.
   
7. Click OK to close the RemoteApp Deployment Settings dialog box.

Certificates and Domain Joined Clients
Domain joined clients will automatically have the CA root certificates stored in their trusted root store. They will not need personal machine certificates only the trusted root certificate in order to validate certificates received from the RDSH servers.

Configure the RD Connection Broker server (RDCB server)

On a separate member server, install the RD Connection Broker role service. Import the digital certificate used by RDSH server to the Personal certificate store of the computer (remembering to import a PFX file). Then configure the imported certificate used to digitally sign the RDP file.

1. Open Remote Desktop Connection Manager. To open Remote Desktop Connection Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Connection Manager.
   
2. Under the Virtual Desktops: Resources and Configuration heading, click Specify next to Digital Certificate.
   
3. On the Digital Signature tab, select the Sign with a Digital Certificate check box.
   
4. Click Select.
   
5. In the Confirm Certificate dialog box, click the certificate that you want to use for signing the RDP files, and then click OK.

Configure the RD Web Access server (RDWA server)

On a separate member server, install the RD Web Access role service.You will need to obtain a certificate for this server like you obtained a certificate for the RDSH server from the Enterprise CA. 

---

Setting Up Authorization
A chain of authorization needs to be set up. The RDSH servers needs to authorize the RDCB and in turn the RDCB will authorize the RDWA server. You must add Web Access and Connection Broker Servers to TS Web Access Group on Session Host Servers (RDSH1 & RDSH2)

• On each of your RD Session Hosts go to Start > Administrative Tools > Computer Management.

• Open Local Users and Groups and select the Groups sub-folder on the left, then double click the “TS Web Access Computers”  group in the center.
  
• Add the names of your RD Web Access and Connection Broker servers.

Add Web Access Servers to TS Web Access Group on Connection Broker Server.
Now on the Connection Broker add the Web Access servers to the TS Web Access group.  You can do this through Computer Management like above or you can do it using the RD Connection Manager. 

• Go to Start > Admin Tools > Remote Desktop Services > Remote Desktop Connection Manager.

• On the Actions pane, click Add RD Web Access Server.

• Enter the FQDNs of any RDWA servers

Add Session Hosts to Session Broker Computers Group on Connection Broker
Now we need to add our Session Hosts to a group to give them the ability to use the Connection Broker.  Add them to the local group in Computer Management.

• Add each RDSH server to the list

---

Configure Session Hosts to Use Connection Broker (RD1 & RD2)
Now all of our Session Hosts need to be configured to use the Connection Broker’s services.  On each RDSH:

• Select Admin Tools, Remote Desktop Service, Remote Desktop Session Host Configuration.

• Double-click ‘Member of Farm in RD Connection Broker’ which is under ‘RD Connection Broker’

• Under the RD Connection Broker tab click the Change Settings button.

• In the resulting RD Connection Broker Settings window, you specify how this RD Session Host server will interact with RD Connection Broker—that is, what the relationship is. Choose Farm Member and then enter the RD Connection Broker server FQDN and the farm name in the input boxes (see above). You should use the FQDN rather than flat NetBIOS name. This name should be one of the subject names used in the certificate created.
  
• Click OK and you will be back on the RD Connection Broker Properties tab. The check box next to Participate in Connection Broker Load Balancing is selected by default. Leave it selected.
  
• The weight describes its capacity relative to the other RD Session Host servers in the farm. Although all RD Session Host servers should be configured identically, not all will necessarily have the same amount of
  memory or the same number of processor cores. For example, if a server is only 75% as powerful as other servers in the farm, then you can reduce its weight to allow it only 75% as many connections as the other servers. The default value is 100.
  
• Also by default, the redirection method—how a client connects to the RD Session Host server once RD Connection Broker decides which server should accommodate the connection—is set to Use IP Address Redirection. If the initial load balancer allows clients to connect directly to RD Session Host servers in the farm, keep this default
  setting. Unless you have a good reason, you should leave Use IP Address Redirection.
  
• In the bottom section of this page, select the IP address that will be used for reconnections to this server. NOTE If you have more than one network adapter that you want to use, you can choose them all by checking the box next to each network adapter.
  
• Perform this process for each member of the farm, taking care to use the same farm name and the same redirection method on all farm members.

---

Configure RemoteApp to Connect to RD Server Farm
We need to provide the RD farm address so that clients will connect to it when running RemoteApps.  On each Session Host:

• Select Start, Admin Tools, Remote Desktop Services and RemoteApp Manager

• Next to RD Session Host Server Settings click Change.

• In the RD Session Host Server tab type the FQDN of the farm then click OK.
  

---

Configure Connection Broker for RemoteApp Programs Source
Now it’s time to configure a RemoteApp source for the Connection Broker.  On the Connection Broker :

• Select Start Admin Tools, Remote Desktop Services, Remote Desktop Connection Manager.

• Click RemoteApp Sources in the left hand tree, then choose Add RemoteApp Source in the right Actions pane.

• Type the DNS name for the RD server farm then click Add.

---

Configure Web Access Servers to Use Connection Broker RemoteApp Source
If you have come this far your doing well! We need to make sure the Web Access Server is configured to use Connection Broker as the source for our RemoteApps.  On each Web Access server :

• Select Start, Admin Tools, Remote Deskt0p Services, Remote Desktop Web Access Configuration.

• Supply Domain Admin credentials and sign-in.

• Click the Configuration tab heading.  Then for “Select the source to use:” choose “An RD Connection Broker server”.  Then type in the Connection Broker server name in the “Source name:” field.  Click OK. Remember, the RD Connection Broker server has been added to the TS Web Access Computers group on each farm member (RDSH1 and RDSH2).Also we have added the RD Web Access computer account to the TS Web Access Computers group on the RD Connection Broker.

---

Configuration of NLB
We now need to consider our method of initial load balancing. Remember, clients don’t talk to the RD Connection Broker role service directly; they connect to a farm, which sends this connection to the RD Connection Broker to let it find the right endpoint. So, the farm is connected to first  (lets call it the initial connection) and then the connection broker, and then to RD Session Host server in the farm! We will use NLB as our method of load balancing the initial connection to the RDSH farm.
NLB distributes incoming connections evenly across each load-balanced server on the principle that if the incoming requests are evenly distributed, the traffic should be, too. NLB is best for load-balancing servers when the connections are very short, like web servers, or in this case, the initial connection in a farm that is participating in RD Connection Broker load balancing. NLB is more complicated to set up than RR DNS, but it’s capable of detecting when a server is no longer available and will not attempt to send connections to it.
To configure an NLB cluster, you need to complete the following steps.

1. If you have a network adapter dedicated to NLB, you need to configure it with static IP and subnet mask
2. Install the NLB Manager on a host node or other management machine. To do
   this, open Server Manager and select the Features section. Click Add Features, select the check box next to Network Load Balancing, and click Install.
3. Configure the NLB cluster.

• Open NLB Manager on one of the farm members from Start, All Programs, Administrative Tools, Network Load Balancing Manager or by typing nlbmgr in the Run text box on the Start menu. Right-click Network Load Balancing Clusters and choose New Cluster.
• In the Host input box, enter the name of one of the NLB hosts (one of the RD Session Host server farm members) and click Connect. All available network adapters on that server show up in the lower pane. Select the NLB network adapter and click Next (I am using only a single adapter on each RDSH machine)
• The IP address and subnet mask assigned to the network adapter will show up in the next window. The priority number is a unique number that differentiates the servers. Accept the default value. If you need to make any changes to the address, click Edit and make your changes. Leave the Initial Host State as Started, and click Next.
• On the next screen, click Add and add a unique IP address and subnet mask that will be shared by all cluster members, and then click OK. When users request access to the farm, they will be sent to this address instead of a specific RD Session Host server. This is the ‘Cluster Address’
• On the Cluster Parameters page, accept the defaults, including Unicast for the Cluster Operation Mode setting, and click Next. All cluster host adapters must use the same operation mode or NLB will not function.
• On the New Cluster: Port Rules page, you need to make a few changes to the default settings. Click Edit, and then change the starting and ending port range to 3389 (in both the To and From fields) because you will be using this cluster to load-balance RDP traffic only. In the Protocols section, select TCP. In the Filtering Mode section, choose
  Multiple Hosts to allow multiple hosts to handle traffic for this port rule. For Affinity, you have three choices; none, single and network. Choose Affinity: None so that incoming connections can be sent to any member of the farm. (There’s no reason to set affinity when the connections are being redirected, and doing so could make your load-balancing efforts useless by sending repeated connection requests to the same server.)

     4.  Add a DNS entry mapping the farm name to the cluster IP address.

How to Setup a Remote Desktop Session Host Farm using NLB on Server 2008 R2 (Part 1)

A RD Session Host server farm consists of two or more RD Session Host servers with the same software configuration (for example, security settings and device redirection policies) and application sets, all represented under a single farm name so that they appear to the client as a single server. Server farms are load-balanced so that the workload is distributed evenly among all farm members. Because the servers are configured the same way, it does not matter to users which server they get directed to. All servers should provide the same user experience.

When a client connects to RDSH farm, the client makes an initial connection to a particular RDSH server which redirects the client to a Remote Desktop Connection Broker (RDCB) which then brokers a connection to an individual RDSH of the farm. Initial connections can be load balanced in three main ways:

1. DNS Round Robin
2. Network Load Balancing
3. Dedicated RDSH Redirector

DNS RR is not so clever. By creating multiple host records for each member of the farm, you distribute client connections to the farm. If however a farm member goes down, DNS will continue to hand the host record out to requesting clients despite the fact that a member server is down.

A dedicated redirector is an RD Session Host server whose sole role is to redirect initial connection requests to RDCB. To avoid asking working RD Session Host farm servers to handle incoming connections, you can dedicate a server to do this work. The only catch to using a dedicated redirector is that it represents a single point of failure.

We will configure initial connection load balancing by using load Network Load Balancing (NLB):

As you can see in the diagram above, the client makes an initial connection via the RD Web Access server to RDSH 1. This could be infact to RDSH1 or RDSH2 as these two servers will be in a NLB cluster. Either server will then redirect the connection to the RDCB. The RD Connection Broker finds the most suitable endpoint for the connection request and gets its IP address. The result is passed back to the RDSH and then back to the client. The client then connects directly to the RDSH that the RD Connection Broker has deemed most suitable.

If an RDSH server goes offline how does the RDCB know? It monitors whether the connections it redirects are successful. If redirection fails the RDCB begins pinging the suspect RDSH server and if this fails then the RDSH is removed from its database.

Part Two

Create a Client Configuration File for RemoteApp and Desktop Connection

Another method that allows you to launch applications from the client that applies specifically to Windows 7 clients is the use of configuration files. The previous post relies on the client visiting a website and is especially useful when you have a mixed bag of clients. The configuration file is a little like the .rdp and .msi methods of remote application distribution. To start, log on to your RDCB server:

To create a configuration file

1. On the RD Connection Broker server, open Remote Desktop Connection Manager. To open Remote Desktop Connection Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Connection Manager.
   
2. In the left pane, click Remote Desktop Connection Manager:, where is the name of the Remote Desktop Connection Broker (RD Connection Broker) server.
   
3. On the Action menu, click Create Configuration File.
   
4. In the Create Configuration File dialog box, in the RAD Connection feed URL box, enter the RemoteApp and Desktop Connection URL that specifies the Remote Desktop Web Access (RD Web Access) server that provides RemoteApp and Desktop Connection resources to users. When you specify the URL, use the fully qualified domain name (FQDN) of the RD Web Access server. For example, enter https://rdwaserver/RDWeb/Feed/webfeed.aspx.
   

   Note
   RDWeb is the default virtual directory name used by RD Web Access. If your implementation of RD Web Access uses a different virtual directory name, provide that name in the URL.

   
   
5. Click Save, specify a file name and a folder location, and then click Save.
   
6. Distribute the configuration file to the end users.
7. Allow users to run the webfeed program
   

End users will be able to see the remote applications by going to All Programs, RemoteApps and Desktop Connections.
To update the list of programs on the client in the event of adding new remote applications on RDSH server do the following:

1. Launch Control Panel on your Windows 7 client
2. Go to RemoteApp and Desktop Connections (if using 'Category' view type this in)
3. Click Properties
4. Under Update click Update Now

Running the Remote Applications from the Client (RDS Pt4)

To verify the functionality of a RemoteApp program deployment, log on as a domain user and connect to the RemoteApp program by using Remote Desktop Web Access (RD Web Access).
To connect to the RemoteApp program

1. Log on to the domain joined Windows 7 client asan ordinary domain user
   
2. Click Start, point to All Programs, and then click Internet Explorer.
   
3. In the Address bar, type https://rdwa.compulinx.local/RDWeb and then press ENTER.
   
4. In the Domain\user name box, type Domain\UserName
   
5. In the Password box, type the password that you specified for the account and click Sign in.
   

   Note
   In you receive a prompt asking you to install the Microsoft Remote Desktop Services Web Access Control, click Run Add-on, and then click Run.

   
   
6. Click Calculator, and then click Connect.
   

Well done chaps! If you find you get certificate warnings then make sure you have correctly added the certificate thumbprint to the Default Domain Group Policy setting and ran a Gpudate/force (for both RDSH and RDWA servers)

Installing and Configuring RemoteApp (RDS Pt3)

Ensure that 'Domain Users' are included in the local group on 'Remote Desktop Users' on the RDSH server. A chain of authorization is set up. The RDSH server will use the RDCB as a web access server and in turn the RDCB will use the RDWA server.
You must add the RDCB server computer account object to the TS Web Access Computers security group on RDSH server.

 To add RDCB server to the TS Web Access Computers group on RDSH server

1. Log on to RDSH server as Domain\Administrator.
   
2. Click Start, point to Administrative Tools, and then click Computer Management.
   
3. Expand Local Users and Groups, and then click Groups.
   
4. Right-click TS Web Access Computers, and then click Add to Group.
   
5. Click Add.
   
6. In the Select Users, Computers, Service Accounts, or Groups dialog box, click Object Types.
   
7. In the Object Types dialog box, select the Computers check box, and then click OK.
   
8. In the Enter the object names to select box, type the rdcb server name and then click OK.
   
9. Click OK to close the TS Web Access Computers dialog box.
   

Next, you must add the RDWA server computer account object to the TS Web Access Computers security group on the RDCB server computer.

To add RDWA server to the TS Web Access Computers group on RDCB server

1. Log on to RDCB server as Domain\Administrator.
   
2. Click Start, point to Administrative Tools, and then click Computer Management.
   
3. Expand Local Users and Groups, and then click Groups.
   
4. Right-click TS Web Access Computers, and then click Add to Group.
   
5. Click Add.
   
6. In the Select Users, Computers, Service Accounts, or Groups dialog box, click Object Types.
   
7. In the Object Types dialog box, select the Computers check box, and then click OK.
   
8. In the Enter the object names to select box, type the rdwa server account and then click OK.
   
9. Click OK to close the TS Web Access Computers dialog box.
   

Next, you must add a RemoteApp program to RDSH server by using RemoteApp Manager.

To add a RemoteApp program by using RemoteApp Manager

1. Log on to RDSH server as Domain\Administrator.
   
2. Click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.
   
3. In the Action pane, click Add RemoteApp Programs.
   
4. On the Welcome to the RemoteApp Wizard page, click Next.
   
5. On the Choose programs to add to the RemoteApp Program list page, select the Calculator check box, and then click Next.
   
6. On the Review Settings page, click Finish.
   

 You can add Office 2007/2010 to the list. Do not install from the CD. This important! Go to the Contrrol Panel and type 'Install'. Select 'Install Application on Remote Desktop Server'. Also with Server 2008 R2, you can select a listed program and under properties and define 'user assignment' where you define which users can run the particular program.

Next, assign a RemoteApp source on the RD Web Access server (RDWA server). The calculator application is not running on the RDWA server. This is just a front-end interface for applications used by clients. So,

To assign a RemoteApp source on RDWA-SRV

1. Log on to RDWA server as Domain\Administrator.
   
2. Click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Web Access Configuration.
   
3. Click Continue to this website (not recommended).
   

   Important
   You should see a warning because of the use of 'Localhost'. This is normal because the certificate defines the name using the FQDN. However, you may get problems such as not being able to display the web site. If this happens, within IIS, select the default Web Site and make sure that the bindings are set correctly to use the certificate obtained from the CA. Do not use self-signed certificate!

   
   
4. In the Domain\user name box, type Domain\Administrator.
   
5. In the Password box, type the password that you specified for Domain\Administrator, and then click Sign in.
   
6. On the Configuration page, click An RD Connection Broker server.
   
7. In the Source name box, type the name of the RDCB server and then click OK.
   

Finally, you must add a RemoteApp source on the RDCB server by using Remote Desktop Connection Manager. The broker needs to locate RDSH server to offer the applications to the RDWA server.

To add a RemoteApp source by using Remote Desktop Connection Manager

1. Log on to RDCB server as Domain\Administrator.
   
2. Click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Connection Manager.
   
3. Click RemoteApp Sources, and then in the Actions pane, click Add RemoteApp Source.
   
4. In the RemoteApp source name box, type the name of the RDSH server and then click Add.
   

Deploying Remote Desktop Web Access with Remote Desktop Connection Broker (RDS Pt2)

For this exercise, you will need a suitable certificate infrastructure in place. Some thought is needed. We will be deploying our remote desktop service to internal domain clients so certificate revocation checks should work by default. Consider the following certificate requirements:

• The certificate must be trusted explicitly or from a trusted root certificate.
  
• The certificate name or the Subject Alternative Name must match the fully-qualified domain name of the server.
  
• The certificate must support Server Authentication or Remote Desktop Authentication Extended Key Usage.
  
• Indirect certificate revocation lists are not supported.
  
• Certificate revocation checks are performed by default.
  
• When you use CredSSP, you can turn off certificate revocation checks by configuring the following registry entry to a value of 1: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Credssp\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors
  
• When you use Transport Layer Security (TLS), you can turn off certificate revocation checks by configuring the following registry entries to a value of 0: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Terminal Server Client\ CertChainRevocationCheck and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Terminal Server Client\ CertChainRevocationCheck

The last two points are not necessary to configure. What I recommend is constructing a certificate template based on Web Server (I seem to always use this!). The subject name should be set to be 'supplied in the request' and the remote desktop session host (RDSH) server should be listed on the ACL with enroll and read permissions. Also allow the private key to be exported. When the RDSH server makes the request from the CA using certificate snapin, you can supply the internal DNS name and external DNS names using the subject alternative name. Don't forget to supply the correct CRL locations on the CA itself BEFORE you make the certificate request. You might need to add a new CRL location perhaps to a DMZ web server. I will write a post on this later.

Once the RDSH server has a certificate do the following:
First, configure a certificate used to digitally sign the RDP file by using RemoteApp Manager.

To configure a certificate used to digitally sign the RDP file

1. Log on to SRV1 as Domain\Administrator.
   
2. Click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.
   
3. Under the Overview section, click Change next to Digital Signature Settings.
   
4. Select the Sign with a digital certificate check box.
   
5. Click Change.
   
6. On the Confirm Certificate page, select the appropriate certificate, and then click OK.
   
7. Click OK to close the RemoteApp Deployment Settings dialog box.

You must add the thumbprint of the certificate used to digitally sign the RDP file to the Default Domain Group Policy setting. This is required so that the trusted publisher warning dialog box is not shown to the user each time the RemoteApp program is started.

To add the certificate thumbprint to the Default Domain Group Policy setting

1. Log on to a domain controller as Domain\Administrator.
   
2. Open the GPMC. To open the GPMC, click Start, point to Administrative Tools, and then click Group Policy Management.
   
3. Expand Forest: compulinx.local, expand Domains, and then expand compulinx.local
   
4. Right-click Default Domain Policy, and then click Edit.
   
5. Navigate to Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Connection Client.
   
6. Double-click Specify SHA1 thumbprints of certificates representing trusted .rdp publishers.
   
7. Select the Enabled option.
   
8. In the Comma-separated list of SHA1 trusted certificate thumbprints box, type the certificate thumbprint used to digitally sign the RDP file, and then click OK.
 

Configure the domain joined client computer (Windows 7)

To configure the client computer, you must:Import the digital certificate used by RDSH server to the Trusted Root Certification Authorities certificate store of the computer account. You must import a PFX certificate file that includes the private key. I export the certficate first to a shared location and then import on the client machine using the certificate snapin.

 

Configure the RD Connection Broker server (RDCB server)

On a separate member server, install the RD Connection Broker role service. Import the digital certificate used by RDSH server to the Personal certificate store of the computer account (remebering to import a PFX certificate like you did above). Configure a certificate used to digitally sign the RDP file.

To configure a certificate used to digitally sign the RDP file

1. Open Remote Desktop Connection Manager. To open Remote Desktop Connection Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Connection Manager.
   
2. Under the Virtual Desktops: Resources and Configuration heading, click Specify next to Digital Certificate.
   
3. On the Digital Signature tab, select the Sign with a Digital Certificate check box.
   
4. Click Select.
   
5. In the Confirm Certificate dialog box, click the certificate that you want to use for signing the RDP files, and then click OK.
   

Configure the RD Web Access server (RDWA server) 

On a separate member server, install the RD Web Access role service.You will need to obtain a certificate for this server like you obtained a certificate for the RDSH server. You can duplicate the 'Web Server' template as before,making sure the ACL is correct etc. 
Add the thumbprint of the certificate used for the RD Web Access server to the Default Domain Group Policy setting by using the GPMC as also done above under the configuration of RDSH server.

Installing Remote Desktop Session Host (RDS Pt1)

The next four posts will demonstrate how to setup remote desktop services so that clients can run specific remote applications using a web browser. This will involve running the applications on a Remote Desktop Session Host (RDSH) server (once called a Terminal server). A Remote Desktop Connection Broker (RDCB) will be used to connect the RDSH with the Remote Desktop Web Application server (RDWA). The use of the RDCB will be useful later when we try clustering servers. For this exercise we are not concerned with clustering. You will need 4 servers and a Windows 7 client, all in a single AD domain.

To install the RD Session Host role service

1. Log on to a member server as domain\Administrator.
   
2. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.
   
3. Under Roles Summary, click Add Roles.
   
4. On the Before You Begin page of the Add Roles Wizard, click Next.
   
5. On the Select Server Roles page, select the Remote Desktop Services check box, and then click Next.
   
6. On the Remote Desktop Services page, click Next.
   
7. On the Select Role Services page, select the Remote Desktop Session Host check box, and then click Next.
   
8. On the Uninstall and Reinstall Applications for Compatibility page, click Next.
   
9. On the Specify Authentication Method for Remote Desktop Session Host page, click Require Network Level Authentication, and then click Next.
   

   Note
   If client computers that are running Windows® XP will use this RD Session Host server, select Do not require Network Level Authentication.

   
   
10. On the Specify Licensing Mode page, select Configure later, and then click Next.
    

    Note
    For the purposes of this class, a Remote Desktop licensing mode is not configured. For use in a production environment, you must configure a Remote Desktop licensing mode.

    
    
11. On the Select User Groups Allowed Access To This Remote Desktop Session Host Server page, click Next.
    
12. On the Configure Client Experience page, click Next.
    
13. On the Confirm Installation Selections page, verify that the RD Session Host role service will be installed, and then click Install.
    
14. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then click Yes to restart the server.
    
15. After the server restarts and you log on to the computer as Domain\Administrator, the remaining steps of the installation finish. When the Installation Results page appears, confirm that installation of the RD Session Host role service succeeded, and then click Close to close the RD Session Host configuration window. Also, close Server Manager.

Add Domain Users to the Remote Desktop Users group

1. Log on to the RDSH server as Domain\Administrator.
   
2. Click Start, point to Administrative Tools, and then click Computer Management.
   
3. Expand Local Users and Groups, and then click Groups.
   
4. Right-click Remote Desktop Users, and then click Add to Group.
   
5. In the Remote Desktop Users dialog box, click Add.
   
6. In the Select Users, Computers, Service Accounts, or Groups dialog box, in the Enter the object names to select box, type Domain Users and then click OK.
   
7. Click OK to close the Remote Desktop Users dialog box.