RDS

RDS Setup ( Remote desktop services )

Add roles to the servers for session host, connection broker and web access. This is required for a basic deployment:

New-RDSessionDeployment -ConnectionBroker "RDCB.Contoso.com" -WebAccessServer "RDWA.Contoso.com" -SessionHost @("RDSH01.Contoso.com","RDSH02.Contoso.com")

Add an RD Gateway server to the deployment:

Add-RDServer -Server "Gateway.Contoso.com" -Role "RDS-GATEWAY" -ConnectionBroker "RDCB.Contoso.com" -GatewayExternalFqdn "ExternalFQDN.NorthWindTraders.com"

Add other roles using the same command:

• RDS-VIRTUALIZATION. Remote Desktop Virtualization Host (RD Virtualization Host).
• RDS-RD-SERVER. Remote Desktop Session Host (RD Session Host).
• RDS-CONNECTION-BROKER. RD Connection Broker.
• RDS-WEB-ACCESS. Remote Desktop Web Access (RD Web Access).
• RDS-GATEWAY. RD Gateway.
• RDS-LICENSING. Remote Desktop Licensing (RD Licensing).

Other commands available here: MS Learn Documentation

To remove an RDS server from the deployment you can use the following command with the same parameters as the add command:

Remove-RDServer -Server "RDVH.Contoso.com" -Role "RDS-VIRTUALIZATION" -ConnectionBroker "RDCB.Contoso.com"

Certificates for RDS

Add certificate already imported to the server roles:

Set-RDCertificate -Role RDRedirector -Thumbprint <cert thumbprint> -ConnectionBroker "<FQDN of connection broker server>"

The acceptable values for this parameter are:

• RDGateway
• RDWebAccess
• RDRedirector
• RDPublishing

RDS certificates for host authentication

Use following guide to setup rds host certificates with internal ca certificates through group policy and certificate templates:

https://woshub.com/securing-rdp-connections-trusted-ssl-tls-certificates/

Get Assigned RDS CAL from User objects

powershell to get assigned user cals from the user objects in AD:

Get-ADUser -Filter {(msTSManagingLS -like '*' -and msTSLicenseVersion -like '*') -or (terminalServer -like '*')} -Properties * | fl -Property Name,sAMAccountName,msTS*

RDS licencing error

If you are getting an error with a session host not finding a licence server make sure the following settings are enabled in local group policy:

Computer Configuration\ Administrative Templates\ Windows Components\ Remote Desktop Services\ Remote Desktop Session Host\ Licensing

Use the specified Remote Desktop license servers Enabled

Set the Remote Desktop licensing mode Enabled

RDS Lockdown for end users

See this post for details:

http://www.it.ltsoy.com/windows/lock-down-remote-desktop-services-server-2012/

RDS Licencing for citrix error

Citrix sessions require RDS licences and if the RDS licence server is not online then an error will occur on user login

Use this to find the location of all RDS licence servers in the domain, run on domain controller:

• Get-ADObject -Filter {objectClass -eq 'serviceConnectionPoint' -and Name -eq 'TermServLicensing'} | fl

Customize RDS deployment

Rename the Workspace:

import-module remotedesktop
Set-RDWorkspace -Name "Your own RD Farm"

to change the look of the login page you can change the images in the following location:

c:\windows\web\rdweb\pages\images

Change the following images for a simple change to the theme:

Banner_01 (banner at  the top)

Bg_globe_01  (background)

Desktop logo logo_02 (logo next to workspace name)

Remote desktop licencing issues

https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/troubleshoot-rds-licensing-guidance

Check licencing server being used:

$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting
$obj.GetSpecifiedLicenseServerList()

check time left on grace period:

$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting
$obj.GetGracePeriodDays()

Reset Grace period (violates MS terms of service) Delete the following reg key. To do this you will need to take ownership of the key as its owner is the network service.

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod" #get the keys from grace period
Remove-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod" -name <name of timebomb key obtained previously>

check reg key for licencing type:

HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core

#2 = Per Device, 4 = per user, 5 = not set

Set licencing mode to per user:

$RDSCALMode = 4
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core\" -Name "LicensingMode" -Value $RDSCALMode

https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-remoteconnectionmanager-licensingmode Check Licensing keypacks:

Get-WmiObject Win32_TSLicenseKeyPack

Remove license pack:

wmic /namespace:\\root\CIMV2 PATH Win32_TSLicenseKeyPack CALL UninstallLicenseKeyPackWithId <ID>

Details on License usage:

https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-client-access-license

Integrate Remote Desktop Gateway with network policy server NPS and Entra ID

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-rdg