RDS Setup ( Remote desktop services )
Add roles to the servers for session host, connection broker and web access. This is required for a basic deployment:
New-RDSessionDeployment -ConnectionBroker "RDCB.Contoso.com" -WebAccessServer "RDWA.Contoso.com" -SessionHost @("RDSH01.Contoso.com","RDSH02.Contoso.com")
Add an RD Gateway server to the deployment:
Add-RDServer -Server "Gateway.Contoso.com" -Role "RDS-GATEWAY" -ConnectionBroker "RDCB.Contoso.com" -GatewayExternalFqdn "ExternalFQDN.NorthWindTraders.com"
Add other roles using the same command:
- RDS-VIRTUALIZATION. Remote Desktop Virtualization Host (RD Virtualization Host).
- RDS-RD-SERVER. Remote Desktop Session Host (RD Session Host).
- RDS-CONNECTION-BROKER. RD Connection Broker.
- RDS-WEB-ACCESS. Remote Desktop Web Access (RD Web Access).
- RDS-GATEWAY. RD Gateway.
- RDS-LICENSING. Remote Desktop Licensing (RD Licensing).
Other commands available here: MS Learn Documentation
To remove an RDS server from the deployment you can use the following command with the same parameters as the add command:
Remove-RDServer -Server "RDVH.Contoso.com" -Role "RDS-VIRTUALIZATION" -ConnectionBroker "RDCB.Contoso.com"
Certificates for RDS
Add certificate already imported to the server roles:
Set-RDCertificate -Role RDRedirector -Thumbprint <cert thumbprint> -ConnectionBroker "<FQDN of connection broker server>"
The acceptable values for this parameter are:
- RDGateway
- RDWebAccess
- RDRedirector
- RDPublishing
RDS certificates for host authentication
Use following guide to setup rds host certificates with internal ca certificates through group policy and certificate templates:
https://woshub.com/securing-rdp-connections-trusted-ssl-tls-certificates/
Get Assigned RDS CAL from User objects
powershell to get assigned user cals from the user objects in AD:
Get-ADUser -Filter {(msTSManagingLS -like '*' -and msTSLicenseVersion -like '*') -or (terminalServer -like '*')} -Properties * | fl -Property Name,sAMAccountName,msTS*
RDS licencing error
If you are getting an error with a session host not finding a licence server make sure the following settings are enabled in local group policy:
Computer Configuration\ Administrative Templates\ Windows Components\ Remote Desktop Services\ Remote Desktop Session Host\ Licensing
Use the specified Remote Desktop license servers Enabled
Set the Remote Desktop licensing mode Enabled
RDS Lockdown for end users
See this post for details:
http://www.it.ltsoy.com/windows/lock-down-remote-desktop-services-server-2012/
RDS Licencing for citrix error
Citrix sessions require RDS licences and if the RDS licence server is not online then an error will occur on user login
Use this to find the location of all RDS licence servers in the domain, run on domain controller:
- Get-ADObject -Filter {objectClass -eq 'serviceConnectionPoint' -and Name -eq 'TermServLicensing'} | fl
Customize RDS deployment
Rename the Workspace:
import-module remotedesktop
Set-RDWorkspace -Name "Your own RD Farm"
to change the look of the login page you can change the images in the following location:
c:\windows\web\rdweb\pages\images
Change the following images for a simple change to the theme:
Banner_01 (banner at the top)
Bg_globe_01 (background)
Desktop logo logo_02 (logo next to workspace name)
Remote desktop licencing issues
Check licencing server being used:
$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting
$obj.GetSpecifiedLicenseServerList()
check time left on grace period:
$obj = gwmi -namespace "Root/CIMV2/TerminalServices" Win32_TerminalServiceSetting
$obj.GetGracePeriodDays()
Reset Grace period (violates MS terms of service) Delete the following reg key. To do this you will need to take ownership of the key as its owner is the network service.
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod" #get the keys from grace period
Remove-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\GracePeriod" -name <name of timebomb key obtained previously>
check reg key for licencing type:
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core
#2 = Per Device, 4 = per user, 5 = not set
Set licencing mode to per user:
$RDSCALMode = 4
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\RCM\Licensing Core\" -Name "LicensingMode" -Value $RDSCALMode
https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-remoteconnectionmanager-licensingmode Check Licensing keypacks:
Get-WmiObject Win32_TSLicenseKeyPack
Remove license pack:
wmic /namespace:\\root\CIMV2 PATH Win32_TSLicenseKeyPack CALL UninstallLicenseKeyPackWithId <ID>
Details on License usage:
Per user CAL not being applied to AD user objects:
After server 2019 you may need to allow SELF permissions to terminal server attributes on the user objects. In AD on the OU that contrians the users delegate the permissions to SELF to read and write terminal server license server.
Integrate Remote Desktop Gateway with network policy server NPS and Entra ID
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-rdg