Microsoft Windows Server 2008 R2 Remote Desktop Services Resource Kit Christa Anderson and Kristin L. Griffin with the Remote Desktop Virtualization Team
Acknowledgments Introduction xv xvii Chapter 1 Introducing Remote Desktop Services 1 Where Did RDS Come From? 2 Citrix MultiWin 2 Windows NT, Terminal Server Edition 2 Windows 2000 Server 3 Windows Server 2003 3 Windows Server 2008 4 Windows Server 2008 R2 and RDS 4 The Evolving Remote Client Access Experience 6 What Can You Do with RDS? 7 Improved Security for Remote Users 8 Provisioning New Users Rapidly 9 Enabling Remote Work 9 Bringing Windows to PC-Unfriendly Environments 10 Business Continuity and Disaster Recovery 11 Supporting Green Computing 11 Improved Command-Line Support 12 RDS for Windows Server 2008 R2: New Features 12 The Changing Character of RD Session Host Usage 13 New RDS Technology in Windows Server 2008 R2 19 RDS Roles in Windows Server 2008 R2 24 How Other Services Support RDS 32 The Client Connection 33 Hosting VMs 34 Authenticating Servers with Certificates 34 Enabling WAN Access and Displaying Remote Resources 34 Updating User and Computer Settings 35 Functionality for RDS Scripters and Developers 35 Summary 35 Additional Resources 36 What do you think of this book? We want to hear from you! Microsoft is interested in hearing your feedback so we can continually improve our books and learning resources for you. To participate in a brief online survey, please visit: microsoft.com/learning/booksurvey vii
Chapter 2 Key Architectural Concepts for Remote Desktop Services 39 Know Your Application Delivery System 40 RD Session Host Servers 40 RD Virtualization Host Servers 40 Relevant Windows Server 2008 R2 Internals 41 Windows Server 2008 R2 Is 64-Bit Only 41 How Does an RD Session Host Server Dole Out Processor Cycles? 43 How Do RD Session Host Servers Use Memory More Efficiently? 45 How Does Disk Affect Application Delivery? 56 How Does Virtualization Affect Resource Usage? 59 Determining System Requirements for RD Session Host Servers 66 Designing a Live Test 69 Executing the Tests 70 Using the RD Load Simulation Tool 77 An Alternative to Full Testing: Extrapolation 91 Other Sizing Questions 95 Supporting Client Use Profiles 99 Client Hardware: PC or Thin Client? 99 What's the Best License Model? 100 What Applications Can I Run on an RD Session Host Server? 101 What Version of Remote Desktop Connection Do I Need? 109 What Role Services Do I Need to Support My Business? 114 Summary 114 Additional Resources 115 Chapter 3 Deploying a Single Remote Desktop Session Host Server 117 How RD Session Host Servers Work 117 Services Supporting RD Session Host 117 Creating and Supporting a Session 119 Installing an RD Session Host Server 134 Installing an RD Session Host Server Using the Administrative Tools Interface 134 Installing an RD Session Host Server from the Command Line 142 Essential RD Session Host Configuration 144 Allocating Processor Time 145 Enabling Plug and Play Redirection with the Desktop Experience 150 Adjusting Server Settings with Remote Desktop Configuration 150 Installing Applications on an RD Session Host Server 164 Which Applications Will Work? 165 Storing Application-Specific Data 168 Avoiding Overwriting User Profile Data 170 Populating the Shadow Key 171 viii
Summary 174 Additional Resources 174 Chapter 4 Deploying a Single Remote Desktop Visualization Host Server 175 WhatlsVDI? 175 How Microsoft VDI Works 178 The Central Role of the RD Connection Broker 179 Discovering a VM 181 Brokering a Connection 182 Orchestrating a VM 184 Connecting to a VM Pool 185 Connecting to a Disconnected Session 186 Rolling Back a VM 186 Connecting to a Personal Desktop 187 Installing Supporting Installing Roles for VDI 188 the RD Visualization Host 190 Installing RD Virilization Host Role Service via Windows PowerShell 192 Installing RD Connection Broker 193 Configuring RD Web Access 195 Configuring the RD Connection Broker Server 197 Setting Up VMs 203 Creating Pools 209 Assigning Personal Desktops 212 Configuring Personal and Pooled VM Properties 216 Using RemoteApp for Hyper-V for Application Compatibility 218 Configuring RemoteApp on Hyper-V 220 Can You Use RemoteApp for Hyper-V Without RDS? 222 Summary 224 Additional Resources 224 Chapter 5 Managing User Data in a Remote Desktop Services Deployment 225 How Profiles Work 226 Types of Profiles 227 How Profiles Are Created 228 Profile External to the Registry 233 Storing Profiles 239 Providing a Consistent Environment 241 Design Guidelines for User Profiles 242 Balance Flexibility and Lockdown 243 Use Folder Redirection 244 Compartmentalize When Necessary 244 Prevent Users from Losing Files on the Desktop 245 Upload Profile Registry Settings in the Background 246 ix
Speed Up Logons 246 Deploying Roaming Profiles with Remote Desktop Services 248 Creating a New Roaming Profile 248 Converting an Existing Local Profile to a Roaming Profile 254 Customizing a Default Profile 255 Using Group Policy to Manage Roaming Profiles 257 Using Group Policy to Define the Roaming Profile Share 267 Speeding Up Logons 268 Centralizing Personal Data with Folder Redirection 275 Sharing Personal Folders Between Local and Remote Environments 278 Sharing Folders Between Windows Server 2003 and Windows Server 2008 R2 Roaming Profiles 279 Setting Standards with Mandatory Profiles 281 Converting Existing Roaming Profiles to Mandatory Profiles 283 Creating a Single Mandatory Profile 284 Creating a Safe Read-Only Desktop 286 Decrease Logon Times with Local Mandatory Profiles 286 Profile and Folder Redirection Troubleshooting Tips 287 Summary 288 Additional Resources 289 CHAPTER 6 Customizing the User Experience 291 How Remoting Works 291 What Defines the Remote Client Experience? 293 The Foundation of RDP: Virtual Channels and PDUs 296 Basic Graphics Remoting 299 Advanced Graphics Remoting 305 Moving the Client Experience to the Remote Session 307 Which Client Devices Can You Add to the Remote Session? 307 Pros and Cons of Redirecting Resources 313 Device and File System Redirection 314 Playing Audio 326 How the RDC Version Affects the User Experience or Doesn't 330 Printing with RDP 334 Printing to a Directly Connected Printer 335 Printing via Redirected Printers 337 Printing from Remote Desktop Services 344 When You Cannot Use RD Easy Print 350 Controlling Printer Redirection 354 Troubleshooting Printing Issues 358 Summary 359 Additional Resources 360 Chapter 7 Molding and Securing the User Environment 363 Locking Down the Server 364
Restricting Device and Resource Redirection 365 Preventing Users from Reconfiguring the Server 367 Preventing Access to the Registry 368 Closing Back Doors on RD Session Host Servers 369 Controlling Libraries 375 Preventing Users from Running Unwanted Applications 376 Using Software Restriction Policies 378 Using AppLocker 381 Creating a Read-Only Start Menu 391 Keeping the RD Session Host Server Available 393 Allowing or Denying Access to the RD Session Host Server 393 Limiting the Number of RD Session Host Server Connections 393 Setting Session Time Limits 394 Taking Remote Control of User Sessions 394 Summary 398 Additional Resources 398 Chapter 8 Securing Remote Desktop Protocol Connections 401 Core Security Technologies 402 Transport Layer Security 402 Credential Security Service Provider 405 Using RDP Encryption 409 Understanding Encryption Settings 409 Choosing Encryption Settings 410 ' Authenticating Server Identity (Server Authentication) 410 Establishing a Kerberos Farm Identity 411 Creating Test Certificates for a Server Farm 411 Authenticating Client Identity with Network Level Authentication (NLA) 415 Speeding Logons with Single Sign-on. 416 Configuring the Security Settings on the RD Session Host Server 417 Configuring Connection Security Using RD Session Host Configuration 417 Configuring Connection Security Using Group Policy 419 Summary 420 Additional Resources 421 Chapter 9 Multi-Server Deployments 423 Key Concepts for Multi-Server Deployments 423 RD Session Host Farms 424 RemoteApp Internals 424 Server-Side Components 426 Client-Side Components 427 RemoteApp Programs and Multiple Monitors 428 Creating and Deploying a Farm 431 xi
Distributing Initial Farm Connections Connection Brokering in a Farm Scenario RDS Farm Connection Brokering in Action Deploying RD Session Host Farms 439 Permit RD Session Host Servers to Join RD Connection Broker 440 432 433 434 Join RD Session Host Servers to a Farm 447 Publishing and Assigning Applications Using RemoteApp Manager 454 Adding Applications to the Allow List 455 Configuring Global RemoteApp Deployment Settings 457 Editing RemoteApp Properties 464 Maintaining Allow List Consistency Across the Farm 469 Configuring Timeouts for RemoteApp Sessions 471 Signing Already-Created RDP Files Setting Signature Policies Distributing RemoteApp Programs Distributing RDP Files Distributing MSI Files Delivering RemoteApp Programs and VMs Through RD Web Access 478 Summary RD Web Access Sources Installing the RD Web Access Role Service 481 Configuring RD Web Access 482 Customizing RD Web Access 488 Troubleshooting RD Web Access Permissions 496 Using the RD Web Access Website Using RemoteApp And Desktop Connections Additional Resources 472 474 475 475 476 478 497 502 505 506 Chapter 10 Making Remote Desktop Services Available from the Internet 507 How RD Gateway Works Understanding RD Gateway Authorization Policies 509 RD Gateway Requirements 510 Installing RD Gateway Installing RD Gateway Using Windows PowerShell Creating and Maintaining RD Gateway Authorization Policies 515 Creating an RD CAP Creating an RD RAP Modifying an Existing Authorization Policy 521 Configuring RD Gateway Options Tuning RD Gateway Properties 522 Using RD Gateway Computer Groups to Enable Access to a Server Farm 530 Bypassing RD Gateway for Internal Connections 533 Using Group Policy to Control RD Gateway Authentication Settings 533 Monitoring and Managing Active RD Gateway Connections 534 507 512 515 516 519 521
Creating a Redundant RD Gateway Configuration 537 Using NLB to Load-Balance RD Gateway Servers 537 Preventing Split SSL Connections on RD Gateway 542 Maintaining Identical Settings Across an RD Gateway Farm 543 Using NAP with RD Gateway 554 Troubleshooting Declined Connections 573 Placing RD Web Access and RD Gateway 576 RD Web Access for External Access 576 RD Gateway Inside the Private Network 578 RD Gateway in the Perimeter Network 579 RD Gateway in the Internal Network and Bridged 581 Summary 586 Additional Resources 586 Chapter 11 Managing Remote Desktop Sessions 589 Introducing RD Session Host Management Tools 590 The Remote Desktop Services Manager 591 Command-Line Tools 595 Connecting Remotely to Servers for Administrative Purposes 598 Managing RD Session Host Servers from Windows 7 599 Organizing Servers and VMs in the Remote Desktop Services Manager 600 Monitoring and Terminating Processes 602 Monitoring Application Use 603 Terminating Applications 604 Monitoring and Ending User Sessions 605 Switching Between Sessions 606 Closing Orphaned Sessions 608 Providing Help with Remote Control 610 Enabling Remote Control via Group Policy 612 Enabling Remote Control via RD Session Host Configuration 614 Shadowing a User Session 615 Troubleshooting Session Shadowing 617 Preparing for Server Maintenance 619 Disabling New Logons 619 Sending Messages to Users 621 Shutting Down and Restarting RD Session Host Servers 624 Applying RDS Management Tools 631 Differentiating RemoteApp Sessions from Full Desktop Sessions 631 Auditing Application Usage 633 Auditing User Logons 639 Closing Unresponsive Applications 640 Summary 641 Additional Resources 642 xiii
Chapter 12 Licensing Remote Desktop Services 643 The RDS Licensing Model 644 RDS Licensing 644 VDI Licensing 646 License Tracking and Enforcement 648 How RD License Servers Assign RDS CALs 648 Setting Up the RDS Licensing Infrastructure 651 Installing RD License Server 652 RD License Server Connection Methods 653 Activating the License Server 653 Background: How RDS CALs Are Tied to an RD License Server 657 Adding License Servers to AD DS 660 Installing RDS CALs 660 Configuring RD Session Host Servers to Use RD License Servers 662 Configuring RD License Servers to Allow Communication From RD Session Host Servers 663 Migrating RDS CALs from One License Server to Another 663 Rebuilding the RD License Server Database 665 Backing Up an RD License Server and Creating Redundancy 665 Managing and Reporting License Usage 667 Revoking RDS CALs 670 Restricting Access to RDS CALs 671 Preventing License Upgrades 673 Using the Licensing Diagnosis Tool 673 Summary 675 Additional Resources 675 Index 677 What do you think of this book? We want to hear from you! Microsoft is interested in hearing your feedback so we can continually improve our books and learning resources for you. To participate in a brief online survey, please visit: microsoft.com/learning/booksurvey