Hiding individual items in RD Web Access 2012R2

This is in addition to the “Customize RD Web Access 2012 R2” series. You can start this series here in case you want to read up or see what else I customized in this series.

This post is inspired by comments in the series, in which readers asked if it was possible to hide RemoteApp programs in the main page, whilst still retaining them in the WebFeed so they show up in RemoteApp and Desktop connections (RADC).
I did a little digging in the code and found a way to accomplish this.

I’ve used setups from different guides you can find on this blog. I’ve created a Remote Desktop Services environment in which I have created two collections. One which holds a full desktop, and one which will look familiar, which holds several RemoteApps.

Logging into the RD Web Access shows this:
RDS Customize Web Access - Hiding items 01
Just basic stuff here, nothing customized.
It shows the published RemoteApps (Calculator, Paint and Wordpad), and the published desktop (Desktop).

Connecting the WebFeed to RADC shows this:
RDS Customize Web Access - Hiding items 03
The WebFeed shows the same RemoteApps and the same published desktop.

If I modify the published RemoteApp “Paint” to not show up in RD Web Access, by going to the RemoteApps collection and editing the properties for “Paint”:
RDS Customize Web Access - Hiding items 04
It will indeed not show up in the RD Web Acces interface, but it will also disappear from the RADC program:
RDS Customize Web Access - Hiding items 05
Granted, it will not disappear immediately, but on the next update interval or when you reconnect, it will be gone.

So, in order to hide certain applications from the RD Web Access interface and still be able to access them from the WebFeed, we’ll need to edit some code again.

The files that make up RD Web Access are in C:\Windows\Web\RDWeb\Pages so make a copy of that folder structure just to make sure we have a backup should we break something.

The code that handles what resources to display in the RD Web Access interface is in the Site.xsl file so open that in an editor.
Find line 721, you’ll find the XSL Template for handling RDP Resources:
RDS Customize Web Access - Hiding items 02
This template actually inserts a <div></div> structure for each item.
The idea is to modify this template to only create this structure if it is for an item we wish to show.

Find line 747:
RDS Customize Web Access - Hiding items 06
Insert the following code BEFORE this line:


The result must look like this:
RDS Customize Web Access - Hiding items 07
Then, go back to line 721 and insert the following code BEFORE line 722:

                <xsl:variable name="currentTitle" select="@Title"/>
                <xsl:variable name="hideApps" select="''"/>
                <xsl:when test="not(contains($hideApps,$currentTitle))">

The result must look like this:
RDS Customize Web Access - Hiding items 08

This modification takes a variable “hideApps” and checks if the title for the item to display is somewhere in this variable. If it’s not, it will show the item. If the title for the current item is one of the items to hide, it skips the creation of the <div></div> structure and so hiding the item entirely.
To test this add “Paint” to the “hideApps” variable on line 723:
RDS Customize Web Access - Hiding items 09

Save the file and reload the RD Web Access page:
RDS Customize Web Access - Hiding items 10
“Paint” is hidden.

Disconnect the RADC and reconnect the WebFeed again and you’ll see you’ll still be able to access “Paint” from there.

If you want to hide multiple items you’ll need to make sure they are separated with a character you don’t use in the display names for your RemoteApps or Desktops.
The name of the item you want to hide must be the exact name as it would show when it is visible, and yes, that means these are case sensitive.
So in this case, if I wanted to hide both “Paint” and “WordPad”, I’d make line 723 look like this:
RDS Customize Web Access - Hiding items 11

And that’s it. Improvements to this method? If you’d want to do this really fancy you could dive into IIS Application Settings and look into ways of using those in the xsl file and make editing the apps to hide a little more user friendly.

Till next time,



20+ years experience in Microsoft powered environments. Enjoy automating stuff using scripts, powershell, and even batch files. In my free time (hah! as if there is any) I hunt achievements and gamerscore on anything Xbox Live enabled (Windows Mobile, Windows 8, Windows 10, Xbox 360 and Xbox One). When I'm not doing that I enjoy traveling or riding my Yamaha R1 on the edge ;)

Tagged with: , , , ,
Posted in Customize, Remote Desktop
41 comments on “Hiding individual items in RD Web Access 2012R2
  1. David says:

    Great job Arjan!
    Thanks to have created the guidelines for my problem :)
    I will try it and let u know.
    Thanks ^^

  2. David says:

    Work like a charm!
    You’re the best Arjan ;)
    Thanks for the help!

  3. Boris says:

    Hi Arjan,
    My customer has shared PC (different shifts), can we have current user login name (similar like SharePoint has) on web application page?
    Thanks a lot,

  4. Luis Almeida says:

    Hi. Can you please help me.
    I have configured RDWeb on my WS2012 with Remote Apps published and visible in RD Web Access. But when i access rdweb site and log in, the icons never appear.
    What shall i do?

    • Arjan Mensch says:

      Is this a reinstall, or have you removed the session host and simply added anew one?
      Have you configured security groups on the RemoteApps?
      Did you do any customizing to the Web Acces interface?

  5. Luis Almeida says:

    I Simply added RemoteApp Programs resources to the Collection previously created. I have under assignment all users and groups to access to the collection. I did not costumize web access interface.

  6. Luis Almeida says:

    Any news related qithe my issue?

    • Arjan Mensch says:

      Nope, not on my side.
      In the deployment properties are all 4 certificate configurations ok?

      • Luis Almeida says:

        All 4 configurations show OK. When i try to access from RemoteApps using the “RemoteApp and Desktop Connections”, it asks authentication and then gives the information “that has ocurred an error. Please contact administrator”. The url that i use is htpps://machine.domain/rdweb/Feed/webfeed.aspx.
        Via browser it continues not to list remote apps.

      • Arjan Mensch says:

        https://machine.domain/rdweb/feed/webfeed.aspx is not supposed to show apps in the browser. Apps are only visible in Web Access accessed through a browser.
        Have you tried creating a new collection?
        Can you confirm that the correct machines, FQDNs, or IPs are part of the group you assigned access to in NAP?

      • Luis Almeida says:

        The first problem is that the apps do not appear on remote access via browser.
        second problem is that when I access through the control panel by https://machine.domain/rdweb/feed/webfeed.aspx link after login gives error.
        third problem is that I can not create a new collection since I only have one server with TS CAL that is already used to access the terminal via TS. Was that I added the role of remote apps. To create a new collection needed to have another server, I have not.
        Lastly, did not understand the assignment in the NAP.

  7. David says:

    And if the RemoteApp has SPACES inside its name?

    • David says:

      My bad, it seems that the problem wasnt that in the name where spaces, but that there was an &.
      Changed the name from & to and, and it worked flawlessly :)

  8. Ray says:

    Hi Arjan.

    I hope you can help, my boss is asking what I think is possible, but appears to not be documented anywhere.

    I want to be able to connect to a remote session desktop, then be able to access remotely published applications from within that session, but I don’t want to open a browser from within the session and have to login again.

    I have 2 collections at the moment, one which is hosting a remote desktop and another collection hosting remote apps, I can see both the remote session and apps once logged in to RDWEB.

    If it would be easier for you to mail me, please let me know, I’m scratching my head at this and getting splinters.

    • Ray says:

      Oh and I have tried the above hiding option and showing in Control Panel Feed, but the only one I get appearing in the start menu is the remote desktop, which by the way, I don’t actually want appearing, just the published apps.

      Have I missed something out, I have checked the tags in the script and they all match up exactly as to your guide.

      I have cut the display names down to one word Apps and still they do not appear in the control panel feed.

      • Arjan Mensch says:

        That’s strange. The code works. I’m using it as is for several customers, and I have recreated my lab since publishing this..

    • Arjan Mensch says:

      I haven’t tested that yet. If the “Remote App and Desktop connections” application is not available in the published desktop, I’d say it’s a no go.
      What you could try is using Firefox or Chrome on the Web Access page, download the RDP file for one of your apps, copy it to the Desktop Host and start it from there, see what happens..
      My guess: your broker gets confused..

  9. BW says:

    I followed your excellent guide to setting up my first single server RDS setup with 2012 R2. It all works great RDWeb and RemoteApps but I have one problem. When I try to add my RemoteApp and Desktop Connections in Control Panel on my Win10 machine that is in a workgroup (but uses my domains DNS) I keep getting this error:

    An error occurred
    Windows cannot find the remote computer that contains the connection

    If I run the same thing on a domain joined PC it works first time!

    Is there anything I can try to use RemoteApps from a workgroup machine? I know the DNS is working correctly as I can resolve the RDS server name (just like the domain machines can)

    Help please ;-)

  10. BW says:


    I’ve tried both. I think I have found the source of the problem. If I disable the firewall in Windows 10 then the RemoteApps connection gets established first time and works 100%. I tried setting an unrestricted firewall rule between my machine and the RDS server but it didn’t help. Any ideas?

    Thanks for the reply!

  11. BW says:

    I also have this other strange error when trying to access my RemoteApp resources from my Android phone. This is what shows in the IIS ARR logs:

    2015-12-16 11:31:20 RPC_IN_DATA /rpc/rpcproxy.dll localhost:3388 443 – MSRPC – 404 0 2 89
    2015-12-16 11:31:20 RPC_OUT_DATA /rpc/rpcproxy.dll localhost:3388 443 – MSRPC – 404 0 64 87

    Does anything “special” need to be done to get this working through an IIS ARR server from an Android Microsoft Remote Desktop Client? I can access all my RemoteApps no problem from a browser. Its only from the Android client that I get these errors. Very odd!

  12. BW says:

    Thanks for the great help! Yes, I did temporarily bypass the ARR server and then the Android client worked perfectly. Unfortunately I can’t leave it like that as I only have a single public IP so I need to get the ARR working again with Android.

    I ran the tracing but it doesn’t tell me much more except that there is a 404 for:

    /rpc/rpcproxy.dll localhost:3388 443
    /rpc/rpcproxy.dll localhost:3388 443

    Is there anything further that can be done to troubleshoot this? Its such an odd problem!

  13. Aristides Gallani Junior says:

    I’m new in remote apps configration. I have a Windows 2012 R2 server with remote app. I have in this server 3 remote apps published in remote app console, suppose App1, App2 and App3. Each App belongs to a particular city, for example: CityApp1, CityApp2 and CityApp3.

    When I call in the browser window https://…/rdweb, and make my login (page 1) I’m directed to page 2 where all 3 remote apps icons for App1, App2 and App3 are showed.

    I would like to, if Is possible, to change the rdweb app in IIS (or this trick is the publish level) to allow me to call in the browser windows this way https://…rdweb/CityApp1 would show only the App1 icon in the rdweb page. If I use https://…rdweb/CityApp2 the the App2 (blelong to CityApp2) is showed, the same for the App3. So, All the 3 App3 are published but the url in the rdweb url adds the name of the city to allow me to show and start only the App in the related city.

    Is there a way to do this?

    Thanks in advance,

    • Arjan Mensch says:

      Hi Aristides,
      Yes it is possible, and basically you could do it if you combine several guides I posted. I’d create a custom page for each app and modify that page accordingly.
      How to hide apps is shown in one of my guides. You could use that technique to just show a single app. Maybe even based on the custom page name!

      • Aristides Gallani Junior says:

        Hi Arjan,
        Thanks for the quick reply. I will get a look at this guides and try to make a test using the techniques on them.
        Best regards

  14. jones1337 says:

    Just what I was looking for. Instead of hiding certain apps, do you know of any ways to hide ALL apps from a certain RDS Collection in an easy way because that is my scenario.

    • Arjan Mensch says:

      Hi Jones,
      Can you explain your scenario a bit more? Why would you want to hide ALL apps? What’s the point of publishing apps if you want to hide them all?

      • jones1337 says:

        I’ll try to make a long story short :). I’ve explained the problem here: https://social.technet.microsoft.com/Forums/windowsserver/en-US/4e734f5c-6ea8-4ade-a2e9-b9abf8784abc/rd-gw-pluggable-authentication-cause-internet-explorer-popup?forum=winserverTS. This means that ALL users get a IE popup when trying to start any RemoteApp application and we want to avoid this. So one workaround would be to have two collections, one collection called “RDS1” which don’t have “gatewaycredentialssource:i:5” set and this is the RemoteApps all internal users have. Then I have another collection called “RDSExternal” which have all the same apps but “gatewaycredentialssource:i:5” set.

        Then external on the Internet we have dedicated RD GW/WA servers but when the user login there, they will see all RemoteApps and I want hide all RemoteApps in “RDS1” Collection and only show the ones in “RDS2” Collection. I could use your process above but then every time I make a change on RemoteApps published, I have to edit the Site.xsl file every time. Would be better if I just could filter out all RemoteApps from a certain Collection or RemoteApp folder.

        Makes any sense?

      • Arjan Mensch says:

        Hi Jones,
        The exact same logic that I show in this article for hiding apps applies to hiding folders.
        In the code I now refer to the template for displaying a appfeed resource (which is in fact the app or desktop rdp file), and you need to apply it to the folder template.The template for the folder starts in line 749 I think:
        If you apply the same logic you can disable showing the folder based on the folder name.

  15. jones1337 says:

    Or maybe a wildcard is supported? So that it will show all RemoteApps ending with “*External”?

    • Arjan Mensch says:

      If you switch the compare around, that will work.
      when test="not(contains($hideApps,$currentTitle))"
      would become
      when test="not(contains($currentTitle,$hideApps))"

      You would need to set
      variable name="hideApps" select="'External'"

      That would hide all apps with “External” somewhere in the title.

  16. jones1337 says:

    Hi! Thanks a lot for the quick answers. This meant that I solved this today. Great support! :)

  17. Chris says:

    Really great articles! I have a query, is it possible to remove the “RemoteApp and Desktops” tab from the site? You can hide the “Connect to a remote PC” tab simply enough from IIS, but I haven’t found a way to do this for the RemoteApp tab.


    • Arjan Mensch says:

      Hi Chris,

      Yes that is possible. But you’ll have to do this yourself.

      In your case, rename Default.aspx in \RDWeb\Pages\en-US to something else and rename the Desktops.aspx file in that same folder to Default.aspx.
      Then, if necessary still, check my articles about hiding a tab, which was accurate before they fixed the IIS bug.
      Untested, so good luck :)

      • Chris says:

        Almost perfect and very simple… not sure I’m bothered too much about hiding the other tab. So in order just to make the “Connect to a remote PC” tab the landing page, it’s a perfectly fine solution in my case!

        Many thanks! :)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

Blog Authors

Enter your email address to follow this blog and receive notifications of new posts by email.

Join 400 other followers

Blog Stats
  • 2,725,117 hits
  • An error has occurred; the feed is probably down. Try again later.
%d bloggers like this: