Step by Step Windows 2012 R2 Remote Desktop Services – Part 1


A step by step guide to build a Windows 2012 R2 Remote Desktop Services deployment.

Part 1 – Deploying a single server solution.

Although it is called a single server installation, we will need 2 servers as shown below.
RDS Deployment - Single Server 

Software used in this guide:
Windows Server 2012 R2 ISO (evaluation can be downloaded here:
http://technet.microsoft.com/en-us/evalcenter/dn205286.aspx)
SQL Server 2012 SP1 Express x64 With tools (free version can be downloaded here: http://www.microsoft.com/en-us/download/details.aspx?id=35579. After clicking the download button select SQLEXPRWT_x64_ENU.exe)
SQL Server 2012 SP1 Native Client (free version can be downloaded here: http://www.microsoft.com/en-us/download/details.aspx?id=35580. After clicking the download button select ENU\x64\sqlncli.msi)
And a certificate. I got mine for free from https://startssl.com. This certificate needs to contain the FQDN you will use as the RD Web Access URL (mine is gateway.it-worxx.nl in this guide). It needs to be in .pfx format and you need to have the private key in it.

This guide will not focus on building a domain using a single domain controller and adding the second server as a member server to this domain.

Also some basic knowledge is assumed in this guide. I will not detail how to create a Security Group and adding a computer account to it. I will also not detail how to install SQL Express, or adding logins to a SQL Server Instance security context. If you need extra help with this, Bing it or drop me a mail with details, and I will provide steps to continue.

I will be using Hyper-V 3.0 on my Windows 8.1 laptop and I have prepared 2 servers:
ITWDC01 (1 vCPU, 512MB memory, dynamic, 60GB Harddisk)
Installed Windows IPv4 192.168.66.20/24
Added .NET Framework 3.5 as a feature
Added Active Directory Domain Services as a role
Configured this server as a Domain Controller in a new forest: itw.test

ITWRDS01 (1 vCPU, 512MB memory, dynamic, 60GB Harddisk)
Installed Windows
Added .NET Framework 3.5 as a feature
IPv4 192.168.66.21/24, DNS server 192.168.66.20
Configured it as a member server in the itw.test domain

Installing the Remote Desktop Services Roles
Log on to the Domain Controller, and in Server Manager right-click the All Servers node and add the second server using the Add Servers command (or select the All Servers node, click Manage and click Add Servers).
RDS Deployment - Single Server - 1

Now that all servers needed in this deployment scenario are present, click Manage, and click Add Roles & Features.

Before you begin
RDS Deployment - Single Server - 2

Click Next.

Select Installation Type
RDS Deployment - Single Server - 3
Select Remote Desktop Services installation. Click Next.

Select Deployment Type
RDS Deployment - Single Server - 4
Although Quick Start might be a valid option for a single server deployment, leave the default selected. This will explain the steps necessary to install Remote Desktop Services in greater detail.
Click Next.

Select Deployment Scenario
RDS Deployment - Single Server - 5
Select Session-based desktop deployment. The other option will be a different post in this series.
Click Next.

Review Role Services
RDS Deployment - Single Server - 6
Review the services that will be installed.
Click Next.

Specify RD Connection Broker server
RDS Deployment - Single Server - 7
Click the member server and click the Add button.
Click Next.

Specify RD Web Access server
RDS Deployment - Single Server - 8
Check Install the RD Web Access role on the RD Connection Broker server.
Click Next.

Specify RD Session Host server
RDS Deployment - Single Server - 9
Click the member server and click the Add button.
Click Next.

Confirm selections
RDS Deployment - Single Server - 10

Check Restart the destination server automatically if required.
Click Deploy.

View progress
RDS Deployment - Single Server - 11
Wait until all role services are deployed and the member server has restarted.
Click Close.

In Server Manager click Remote Desktop Services and scroll down to the overview.
RDS Deployment - Single Server - 12

As you can see the deployment is missing a RD Gateway server and a RD Licensing server.

Installing the missing Remote Desktop Services Roles
RDS Deployment - Single Server - 13
Click the Add RD Licensing server button.

Select a server
RDS Deployment - Single Server - 14
Click the domain controller and click the Add button.
Click Next.

Confirm selections
RDS Deployment - Single Server - 15
Click Add.

View progress
RDS Deployment - Single Server - 16
Wait until the role service is deployed. No restart is needed.
Click Close.

RDS Deployment - Single Server - 17
Click the Add RD Gateway server button.

Select a server
RDS Deployment - Single Server - 18
Click the member server and click the Add button.
Click Next.

Name the self-signed SSL certificate
RDS Deployment - Single Server - 19
The wizard creates a self-signed certificate. We will deal with certificates in this deployment in a little bit. Enter the external Fully Qualified Domain Name which you will also use for the Web Access URL. In my case, for lack of a better name, I used “gateway.it-worxx.nl”. I didn’t want to use “remote.it-worxx.nl” or “desktop.it-worxx.nl” or anything else.
Click Next.

Confirm selections
RDS Deployment - Single Server - 20
Click Add.

View progress
RDS Deployment - Single Server - 21
Wait until the role service is deployed. No restart is needed.
Notice that “gateway.it-worxx.nl” was configured for the deployment.
Also notice that even more certificate configuring is need, but we’ll get to that later. Pay no attention to it for now.
Click Close.

Let’s have a quick look at the certificate configuration.

Reviewing the Remote Desktop Services certificate requirements
RDS Deployment - Single Server - 22
In Server Manager, Remote Desktop Services, Overview, click Tasks and click Edit Deployment Properties.

Configure the deployment
RDS Deployment - Single Server - 23

Review the RD Gateway settings and notice what settings are available.
Click RD Licensing.

Configure the deployment
RDS Deployment - Single Server - 24
Notice that a RD License server is available, but no license type is selected yet.
I selected Per User, but since this is just a guide setup, it really doesn’t matter.
Click RD Web Access.

Configure the deployment
RDS Deployment - Single Server - 60

By default the RD Web Access IIS application is installed in /RdWeb. If you want to know how to change this, check another post: https://msfreaks.wordpress.com/2013/12/07/redirect-to-the-remote-web-access-pages-rdweb/

Click Certificates.

Configure the deployment
RDS Deployment - Single Server - 25

Notice that the certificate level currently has a status of Not Configured.
As you can see, certificates are used for different goals within the deployment.
The RD Gateway certificate is used for Client to gateway communication and needs to be trusted by the clients. Either install the self-signed certificate on all clients, or use a certificate for which the complete certificate chain is already trusted by all clients. As it said in the wizard, the external FQDN should be on the certificate.
The RD Web Access certificate is used by IIS to provide a server identity to the browser clients (and to the Feed clients, but that’s a subject for a future post).
The RD Connection Broker actually has two goals for which it needs certificates. To enable single sign on (server to server authentication), and for publishing (signing RDP files). If you look in the deployment you’ll see that the Connection Broker is now configured to use “itwrds01.itw.test”, so we have to change it to use an external FQDN as well.
If we use the same FQDN for all goals described above, we need only 1 certificate, and only 1 external IP address.
We’ll come back to this wizard later to assign the certificate. First order of business is to change the internal FQDN for the Connection Broker to an external FQDN.
Click OK (no reason why we shouldn’t commit the change we made on the licensing tab, remember?)

Preparing for completing the Remote Desktop Services configuration
Open DNS Manager on the domain controller and browse to Forward Lookup Zones.
RDS Deployment - Single Server - 33

Right click Forward Lookup Zones and click New Zone… Go through this wizard accepting the defaults until you have to enter a Zone Name.

RDS Deployment - Single Server - 61
Enter the external FQDN which will also be used by the Connection Broker.
Finish the rest of the wizard accepting the defaults.

Browse to the newly created zone.
RDS Deployment - Single Server - 34
Right click the newly created zone and click New Host (A or AAAA)…

New Host
RDS Deployment - Single Server - 35

Leave the Name field blank, but enter the member server’s (holding the RD Connection Broker role) IPv4 address.
Click Add Host.

Create a new Global Security Group called “RDS Connection Brokers” and add the computer account for the member server to it as a group member.
We need this group to be able to convert the RD Connection Broker to a highly available RD Connection Broker. You’ll see why we need to do this in a few steps.
Reboot the member server to let it know it’s a member of the RDS Connection Brokers security group.

Install SQL Express on the Domain Controller (or use an existing SQL Server if you already have one). Here’s a list of needed features:
RDS Deployment - Single Server - 26

Now you see why I pre-configured the servers with the .NET Framework 3.5 feature before starting anything.
RDS Deployment - Single Server - 27
Use the Default Instance (so click Default, and do not leave the wizard’s selection on Named instance: SQLEXPRESS).

When the installation is done open SQL Configuration manager and browse to Client Protocols under SQL Native Client 11.0 Configuration.
RDS Deployment - Single Server - 62

Check if TCP/IP is enabled under Client Protocols. SQL Express install enables this by default, but check it just to be sure, especially if you use an existing SQL Server.

Browse to Protocols for MSSQLSERVER under SQL Server Network Configuration.
RDS Deployment - Single Server - 38

Enable TCP/IP. If this is a new SQL installation, this will be disabled by default.
Restart the SQL Server service if you changed this setting.

On the SQL Server, make sure port 1433 is not being blocked by Windows Firewall.
RDS Deployment - Single Server - 37

I added the SQL Server executable to the exception list to allow all inbound traffic.

Open SQL Server Management Studio and browse to Logins under Security.
RDS Deployment - Single Server - 29
Right click Logins and click New Login…

Login – New
RDS Deployment - Single Server - 30

Click Search…

Select User, Service Account, or Group
RDS Deployment - Single Server - 63
Click Object Types… and select Group.
Type the RDS Connection Brokers security group name and click Check Names.
Click OK.

Login – New
RDS Deployment - Single Server - 64

Click Server Roles and select dbcreator.
Click OK.

We have just effectively granted the RDS Connection Broker server the right to create databases.
We need this because the RDS Connection Broker service will try to migrate from WID (Windows Internal Database to a (high available) SQL Server instance when we convert the Broker to a high available broker.

Install the SQL Native Client on the member server (Client Components only).

Everything we need is now in place to convert the RD Connection Broker, so let’s do just that.

Convert the RD Connection Broker
In Server Manager click Remote Desktop Services and scroll down to the overview.
RDS Deployment - Single Server - 31

Right click RD Connection Broker and click Configure High Availability.

Before you begin
RDS Deployment - Single Server - 32

So we’re actually building a single node cluster here ;)
Look at the pre-requisites.
If you have more than one RD Connection Broker they need to be configured using DNS Round Robin. More on that in a later post.
Click Next.

Configure RD Connection Broker for High Availability
RDS Deployment - Single Server - 39
Database connection string:

DRIVER=SQL Server Native Client 11.0;SERVER=ITWDC01;Trusted_Connection=Yes;APP=Remote Desktop Services Connection Broker;DATABASE=ITWRDCB
Folder to store database files:
C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\DATA
I used the instance default folder.
DNS round robin name:
The DNS Zone name we configured in DNS earlier.
Click Next.

Confirmation
RDS Deployment - Single Server - 39
If you get an error before this page:
Check if TCP/IP is enabled in client protocols and for your instance
– Check if you can reach port 1433 on the SQL Server from the member server
Click Configure. 

Progress
RDS Deployment - Single Server - 40

If you get an error on this page:
Check SQL permissions for the security group
– Check if the database path you entered is correct
Click Close.

RDS Deployment - Single Server - 41
The RD Connection Broker is now in High Availability Mode and we are finally ready to complete the configuration.

Completing the Remote Desktop Services configuration
RDS Deployment - Single Server - 22
In Server Manager, Remote Desktop Services, Overview, click Tasks and click Edit Deployment Properties, then click Certificates.

Configure the deployment
RDS Deployment - Single Server - 42

Click RD Connection Broker – Enable Single Sign On and click Select Existing certificate.
RDS Deployment - Single Server - 43

Browse to the .pfx file, enter its password, and check Allow the certificate..
Click OK.

RDS Deployment - Single Server - 44
So click Apply. This takes a little while, be patient.

Configure the deployment
RDS Deployment - Single Server - 45

Click RD Connection Broker – Publishing and click Select Existing certificate.
Browse to the .pfx file, enter its password, and check Allow the certificate..
Click OK.

Click Apply. This again takes a little while, be a little more patient.

Configure the deployment
RDS Deployment - Single Server - 46

Click RD Web Access and click Select Existing certificate.
RDS Deployment - Single Server - 47
Note: Did you notice the warning when you select RD Web Access? Browse to the .pfx file, enter its password, and check Allow the certificate..
Click OK.

Click Apply again. This takes another little while longer, be a slightly more patient.

Configure the deployment
RDS Deployment - Single Server - 48
Last one. Click RD Gateway and click Select Existing certificate.
Browse to the .pfx file, enter its password, and check Allow the certificate..
Click OK.

Click OK to finish the certificate configuration.

Configured all servers, configured certificates..

One thing left to do: Tell our RDS environment exactly what to publish.

In fact you can use this setup to either provide full desktop sessions on the Session Host, or you can choose to publish only applications on the Session Host.

Let’s publish full desktop sessions.

Publish a full Remote Desktop environmentRDS Deployment - Single Server - 49
In Server Manager, Remote Desktop Services, Session Collections, click Tasks and click Create Session Collection.

Before you begin
RDS Deployment - Single Server - 50

Review the requirements. This won’t be an issue in this setup, but you could restrict access to this collection by selecting a select group of people.
Click Next.

Name the collection
RDS Deployment - Single Server - 51

Enter a descriptive name. This name will be displayed under its icon in the Web Access interface.
Click Next.

Specify RD Session Host servers
RDS Deployment - Single Server - 52

Click the member server and click the Add button.
Click Next.

Specify user groups
RDS Deployment - Single Server - 53

You can limit access here. Add one or more groups to restrict access to these groups only. In this setup Domain Users will do fine.
Click Next.

Specify user profile disks
RDS Deployment - Single Server - 54
User profile disks are not in focus in this guide. Since I have no file shares configured in this setup, uncheck Enable user profile disks for now.
Does and Don’ts will be covered in a future post.
Click Next.

Confirm selections
RDS Deployment - Single Server - 55
Review the information and click Create.

View Progress
RDS Deployment - Single Server - 56

Wait until the collection is created and the server is added to the collection.
Click Close.

Time to test the setup!

Testing the Remote Desktop Services
On a machine that has access to your test setup (you may have to add the external FQDN to your hosts file if you didn’t publish it to the internet) open https://gateway.it-worxx.nl/rdweb.
RDS Deployment - Single Server - 57
Hey! At least the RD Web Access application works :)
Enter a valid username and password (ITW\username or username@itw.test).
Create a user for this, or simply use the domain admin account.
Click Sign in.

RDS Deployment - Single Server - 58
After logging in you’re presented with the full desktop session collection we created.

RDS Deployment - Single Server - 59
After clicking the Full Desktop icon you get the warning that devices are going to be redirected.
And when you click Connect, you actually connect :) 

Enjoy.

In the next part of this series I will show how to extend this setup to use multiple session hosts, combine these with remote applications, and setting up dedicated servers for Web Access, Gateway and Connection Broker. 

Arjan

Upate: Part 2 in the series was just published. Find it here: https://msfreaks.wordpress.com/2013/12/23/windows-2012-r2-remote-desktop-services-part-2/

20+ years experience in Microsoft powered environments. Enjoy automating stuff using scripts, powershell, and even batch files. In my free time (hah! as if there is any) I hunt achievements and gamerscore on anything Xbox Live enabled (Windows Mobile, Windows 8, Windows 10, Xbox 360 and Xbox One). When I'm not doing that I enjoy traveling or riding my Yamaha R1 on the edge ;)

Tagged with: , ,
Posted in Remote Desktop, Step-by-Step guide, Windows 2012 R2
496 comments on “Step by Step Windows 2012 R2 Remote Desktop Services – Part 1
  1. Afzal Hussain says:

    Hi I’ve just been through your guide which is super helpful. I’m just waiting for my SSL to arrive before I can properly test it. However, while I’m waiting, I setup a collection, and I get the following message when completing the process.

    The property UserAuthenticationRequired is configured is configured by using the group policy settings. Use the the group policy management console to configure this property.

    I’ve done a bit of searching on this, and it seems to indicate that you need to ensure the NLA settings are set on your RDP server, which I’ve done. I’confirmed this through gpresults. However I still can’t get rid of the error.

    I’ve posted screenshots on here,

    https://community.spiceworks.com/topic/1918991-network-level-authentication-setting-up-remote-desktop?source=navbar-community-notifications

    and would be most grateful if you can help.

  2. Kevin Bloomfield says:

    SQL Express will not run on a DC so these instructions need changing

  3. Andy says:

    Thanks for your detailed guide. A few questions:
    1) While your guide goes thru the process of creating a self-signed certificate, the steps to export the certificate so that it can be used if the Deployment Properties seems to be missing. Also how did it get to a .pfx format?
    2) You go thru the process to make the Connection Broker High-availability instead of using the WID. What are the benefits? Is this necessary for a small number of RDP clients (3)?

    • Arjan Mensch says:

      Hi Andy,
      In the guide I use certificates from StartSsl, those are definately not selfsigned.
      The broker needs to hav a certificate that is trusted by all clients, internally and externally. If you make it HA you determine the FQDN.

  4. Hi,

    In a Domain where there’s allready functionning RDS deployment, i want to deploy a new RDS with new Servers-Version and demote the Old-one.
    my question: can i deploy a new RDS in the Domain while the other is working ? will the Deployment process affect the functionning one ? and what should be the BPA for such a Planing ?
    I will be greatfull for any help.

    • Arjan Mensch says:

      Hi Vilick,
      If you build the new farm and roles on new machines there’s no problem.
      I’m running 5 different deployments alongside each other at times.
      Best practices would be to build it the way you want it with probably the same DNS FQDNs and certificates, then have it tested by end-users (using modified host files to allow them to reach the new farm instead of the current one), then switch DNS to the new farm and role IPs and decommission the old farm and roles.

  5. Robin Schoofs says:

    Hey thanks man this works for me, Good Job !!!

  6. Arjan hello, thanks for the instructions I just wanted to ask a few things before I get started,
    I never had good luck installing SQL In a domain controller, but I did build 2 servers one Is domain controller running windows 2012 R2 Essentials and the other is setup as SQL server running windows 2012 R2 Datacenter, another is I don’t have a static IP address or a registered Domain resolved in the DNS on DC server, do I need that configured first? Thanks Im Pat

  7. Arjan , in addition I want to use the Server with Domain Controller installed as the main server and I want to be able to remote into the server running SQL , I m pretty sure reading your instructions it looks possible , Thanks once again.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Blog Authors
Donate Button

Enter your email address to follow this blog and receive notifications of new posts by email.

Join 322 other followers

Blog Stats
  • 1,913,769 hits
%d bloggers like this: