RemoteApp Manager

Remote Desktop Services enables organizations to provide access to standard Windows programs from virtually any location, to any Windows device, from the Internet or an intranet. RemoteApp enables you to make programs that are accessed remotely through Remote Desktop Services appear as if they are running on the end user’s local computer. These programs are referred to as RemoteApp programs.

Use RemoteApp Manager to make programs installed on a Remote Desktop Session Host (RD Session Host) server available to users as RemoteApp programs. RemoteApp Manager is automatically installed on a computer on which the RD Session Host role service has been installed.

The following topics are covered:

  • Overview of RemoteApp

  • Checklist: Configure RemoteApp

  • Configuring the RD Session Host Server to Host RemoteApp Programs

  • Configuring RemoteApp Programs

  • Checklist: Make RemoteApp Programs Available from the Internet

  • Remote Desktop Web Access (RD Web Access)

For more information about RemoteApp, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140439).


Overview of RemoteApp

What is RemoteApp?

RemoteApp enables you to make programs that are accessed remotely through Remote Desktop Services appear as if they are running on the end user's local computer. These programs are referred to as RemoteApp programs. Instead of being presented to the user in the desktop of the Remote Desktop Session Host (RD Session Host) server, the RemoteApp program is integrated with the client's desktop. The RemoteApp program runs in its own resizable window, can be dragged between multiple monitors, and has its own entry in the taskbar. If a user is running more than one RemoteApp program on the same RD Session Host server, the RemoteApp program will share the same Remote Desktop Services session.

Users can access RemoteApp programs several ways. They can:

  1. Access a link to the program through RemoteApp and Desktop Connection by using Remote Desktop Web Access (RD Web Access).

  2. Double-click a Remote Desktop Protocol (.rdp) file that has been created and distributed by their administrator.

  3. Double-click a program icon on their desktop or Start menu that has been created and distributed by their administrator with a Windows Installer (.msi) package.

  4. Double-click a file where the file name extension is associated with a RemoteApp program. This can be configured by their administrator with a Windows Installer package.

Users can access RemoteApp and Desktop Connection through the Start menu on a computer that is running Windows® 7 or through the RD Web Access Web site. For more information about making RemoteApp programs available through RemoteApp and Desktop Connection, see the Remote Desktop Connection Manager Help in Windows Server 2008 R2. For more information about RemoteApp and Desktop Connection, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=143108).

The .rdp files and Windows Installer packages contain the settings that are needed to run RemoteApp programs. After opening a RemoteApp program on their local computer, the user can interact with the program that is running on the RD Session Host server as if it were running locally.

Why use RemoteApp?

RemoteApp can reduce complexity and reduce administrative overhead in many situations, including the following:

  • Branch offices, where there may be limited local IT support and limited network bandwidth.

  • Situations where users need to access programs remotely.

  • Deployment of line-of-business (LOB) programs, especially custom LOB programs.

  • Environments, such as "hot desk" or "hoteling" workspaces, where users do not have assigned computers.

  • Deployment of multiple versions of a program, particularly if installing multiple versions locally would cause conflicts.

For more information about RemoteApp, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140439).

Additional references

  • Checklist: Configure RemoteApp

  • Configuring the RD Session Host Server to Host RemoteApp Programs

  • Configuring RemoteApp Programs

  • Checklist: Make RemoteApp Programs Available from the Internet

  • Remote Desktop Web Access (RD Web Access)


Checklist: Configure RemoteApp

You can make programs on a Remote Desktop Session Host (RD Session Host) server available to users through RemoteApp. You can deploy RemoteApp programs to users through .rdp files, Windows Installer packages, or by using RD Web Access to make the programs available through RemoteApp and Desktop Connection.

Note

This checklist applies to an environment where you are using a single RD Session Host server to host RemoteApp programs.

Task | Reference
Before you can make RemoteApp programs available to users, you must complete installation prerequisites. | Configuring the RD Session Host Server to Host RemoteApp Programs
Add programs to the RemoteApp Programs list. | Add Programs to the RemoteApp Programs List
Assign domain users and domain groups to a RemoteApp program. | Assign Domain Users and Domain Groups to a RemoteApp Program
Configure global deployment settings. | Configure Deployment Settings
Decide how to distribute RemoteApp programs to users. | Distribute RemoteApp Programs to Users
If you are going to distribute RemoteApp programs through RemoteApp and Desktop Connection, configure RD Web Access. | Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access
If you are going to distribute RemoteApp programs through .rdp files, create .rdp files. | Create an .rdp File
If you are going to distribute RemoteApp programs through Windows Installer packages, create Windows Installer packages. | Create a Windows Installer Package
Manage the RemoteApp Programs list. (Optional) | Manage the RemoteApp Programs List

Additional references

  • Overview of RemoteApp


Configuring the RD Session Host Server to Host RemoteApp Programs

There are installation prerequisites that you must complete before you can configure RemoteApp programs for use. The following topics discuss how to configure the server to host RemoteApp programs:

  • Install the RD Session Host Role Service

  • Install Programs

  • Verify Remote Connection Settings


Install the RD Session Host Role Service

RemoteApp Manager is installed as part of the Remote Desktop Session Host (RD Session Host) role service.

Use the following procedure to install the RD Session Host role service.

Important

The installation of the RD Session Host role service requires the computer to be restarted.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To install the RD Session Host role service

  1. On the computer on which you want to install the RD Session Host role service, open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. If the Remote Desktop Services role is not already installed:

    1. Under Roles Summary, click Add Roles.

    2. On the Before You Begin page of the Add Roles Wizard, click Next.

    3. On the Select Server Roles page, select the Remote Desktop Services check box, and then click Next.

    4. On the Remote Desktop Services page, click Next.

    5. On the Select Role Services page, select the Remote Desktop Session Host check box, and then click Next.

    If the Remote Desktop Services role is already installed:

    1. Under Roles Summary, click Remote Desktop Services.

    2. Under Role Services, click Add Role Services.

    3. On the Select Role Services page, select the Remote Desktop Session Host check box, and then click Next.

  3. On the Uninstall and Reinstall Applications for Compatibility page, click Next.

  4. On the Specify Authentication Method for Remote Desktop Session Host page, select the desired authentication method, and then click Next.

  5. On the Specify Licensing Mode page, select the licensing mode that applies to your Remote Desktop Services environment, and then click Next.

  6. On the Select User Groups Allowed Access To This Remote Desktop Session Host page, add any users or groups that you want to add to the Remote Desktop Users group, and then click Next.

  7. On the Configure Client Experience page, select the client experience that you want to provide, and then click Next.

  8. On the Confirm Installation Selections page, verify that the RD Session Host role service will be installed, and then click Install.

  9. On the Installation Progress page, installation progress will be noted.

  10. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then click Yes to restart the server.

  11. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  12. After the server restarts and you log on to the computer with the same user account, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that installation of the RD Session Host role service succeeded.

Additional references

  • Configuring the RD Session Host Server to Host RemoteApp Programs


Install Programs

Install programs on the remote server after you have installed the Remote Desktop Session Host (RD Session Host) role service. You can install a program on the RD Session Host server just like you would install the program on a local desktop. Ensure, however, that you install the program for all users and that all components of the program are installed locally on the RD Session Host server.

If you have programs that are related to each other or have dependencies on each other, we recommend that you install the programs on the same RD Session Host server. For example, we recommend that you install Microsoft Office as a suite instead of installing individual Office programs on separate RD Session Host servers.

You should consider putting individual programs on separate RD Session Host servers in the following circumstances:

  • The program has compatibility issues that may affect other programs.

  • A single program and the number of associated users may fill server capacity.

Additional references

  • Configuring the RD Session Host Server to Host RemoteApp Programs


Verify Remote Connection Settings

By default, remote connections are enabled after you install the Remote Desktop Session Host (RD Session Host) role service. You can use the following procedure to add users and groups that need to connect to the RD Session Host server, and to verify or to change remote connection settings.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To verify remote connection settings

  1. On the RD Session Host server, start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click either of the following, depending on your environment:

    • Allow connections from computers running any version of Remote Desktop (less secure)

    • Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)

    For more information about the two options, on the Remote tab, click the Help me choose link.

  4. To add the users and groups that need to connect to the RD Session Host server by using Remote Desktop, click Select Users, and then click Add.

    The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

Additional references

  • Configuring the RD Session Host Server to Host RemoteApp Programs


Configuring RemoteApp Programs

This section provides procedures to configure RemoteApp programs on the Remote Desktop Session Host (RD Session Host) server. The following topics are covered:

  • Add Programs to the RemoteApp Programs List

  • Assign Domain Users and Domain Groups to a RemoteApp Program

  • Configure Deployment Settings

  • Create an .rdp File

  • Create a Windows Installer Package

  • Distribute RemoteApp Programs to Users

  • Manage the RemoteApp Programs List

You can also use the Remote Desktop Services module for Windows PowerShell to configure some RemoteApp program settings. For more information about using Windows PowerShell with Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=139898).

Additional references

  • Configuring the RD Session Host Server to Host RemoteApp Programs


Add Programs to the RemoteApp Programs List

To make a program available remotely to users through RemoteApp Manager, you must add the program to the RemoteApp Programs list.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To add a program to the RemoteApp Programs list

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the Actions pane, click Add RemoteApp Programs.

  3. On the Welcome to the RemoteApp Wizard page, click Next.

  4. On the Choose programs to add to the RemoteApp Programs list page, select the check box next to each program that you want to add to the list of RemoteApp programs. You can select multiple programs.

    Note

    The programs that are shown on the Choose programs to add to the RemoteApp Programs list page are the programs that are found on the All Users Start menu on the RD Session Host server. If the program that you want to add to the RemoteApp Programs list is not in the list, click Browse, and then specify the location of the program's .exe file.

  5. To configure the properties for a RemoteApp program, right-click the program name, and then click Properties. You can configure the following:

    • The program name that will appear to users. To change the name, type a new name in the RemoteApp program name box.

    • The path of the program executable file. To change the path, type the new path in the Location box, or click Browse to locate the .exe file.

      Note

      You can use system environment variables in the path name. For example, you can substitute %windir% for the explicit path of the Windows folder (such as C:\Windows). You cannot use per user environment variables.

    • The alias for the RemoteApp program. The alias is a unique identifier for the program that defaults to the program's file name (without the extension). We recommend that you do not change this name.

    • Whether the program is available through RD Web Access. By default, the RemoteApp program is available through RD Web Access setting is enabled. To change the setting, select or clear the check box.

    • Whether command-line arguments are allowed, not allowed, or whether to always use the same command-line arguments.

    • The program icon that will be used. To change the icon, click Change Icon.

    • The domain users and domain groups that can see the icon for the program when the program is made available through RD Web Access. To specify the domain users and domain groups, click the User Assignment tab. For more information, see Assign Domain Users and Domain Groups to a RemoteApp Program.

  6. When you are finished configuring program properties, click OK, and then click Next.

  7. On the Review Settings page, review the settings, and then click Finish.

    The programs that you selected should appear in the RemoteApp Programs list.

Additional references

  • Configuring RemoteApp Programs


Assign Domain Users and Domain Groups to a RemoteApp Program

You can specify which domain users and domain groups can see the icon for a RemoteApp program when the RemoteApp program is made available through RD Web Access. By default, all authenticated domain users will be able to see the icon for a RemoteApp program on the Web site provided by RD Web Access.

Important
  • To assign users to a RemoteApp program, the Remote Desktop Session Host (RD Session Host) server on which the RemoteApp program is configured must be a member of an Active Directory domain.
  • To run the RemoteApp program, a user must be a member of the Remote Desktop Users group on the RD Session Host server.

Use the following procedure to specify which domain users and domain groups will be able to see the icon for a RemoteApp program.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To assign domain users and domain groups to a RemoteApp program

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the RemoteApp Programs list, click the program to which you want to assign domain users and domain groups.

  3. In the Actions pane for the program, click Properties, and then click the User Assignment tab.

  4. Click Specified domain users and domain groups, and then click Add.

  5. Use the Select Users or Groups dialog box to select the domain users and domain groups to assign to the RemoteApp program.

  6. Click OK to close the Select Users or Groups dialog box.

  7. Click OK to close the RemoteApp Properties dialog box.

Additional references

  • Add Programs to the RemoteApp Programs List

  • Configuring RemoteApp Programs


Configure Deployment Settings

You can configure deployment settings that apply to all RemoteApp programs in the RemoteApp Programs list. These settings will apply to any RemoteApp program that you make available through RD Web Access. Additionally, these settings will be used as the default settings if you create .rdp files or Windows Installer packages from any of the listed RemoteApp programs.

Note

Any changes to deployment settings that you make when you use RemoteApp Manager to create .rdp files or Windows Installer packages will override the global deployment settings.

These global deployment settings include:

  • RD Session Host server settings. For more information, see Configure RD Session Host Server Settings.

  • RD Gateway settings. For more information, see Configure Remote Desktop Gateway Settings.

  • Common Remote Desktop Protocol (RDP) settings. For more information, see Configure Common RDP Settings.

  • Custom RDP settings. For more information, see Configure Custom RDP Settings.

  • Digital signature settings. For more information, see About Digitally Signing RemoteApp Programs.

Additional references

  • Configuring RemoteApp Programs


Configure RD Session Host Server Settings

To define how users will connect to the RD Session Host server (or RD Session Host server farm) to access RemoteApp programs, you can configure RD Session Host server deployment settings.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure RD Session Host server settings

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the Actions pane of RemoteApp Manager, click Remote Desktop Session Host Settings. (Or, in the Overview pane, next to Remote Desktop Session Host Settings, click Change.)

  3. On the Remote Desktop Session Host tab, under Connection settings, accept or modify the server name and the Remote Desktop Protocol (RDP) port number.

  4. To provide a link to a full desktop session to the RD Session Host server through RD Web Access, under Remote desktop access, select the Show a remote desktop connection to this RD Session Host server in RD Web Access check box.

    Note

    If you want the user to be able to use all available client monitors when connecting to a full desktop session to the RD Session Host server, on the Common RDP Settings tab, under User experience, select the Use all client monitors when connecting to a remote desktop check box.

  5. Under Access to unlisted programs, choose either of the following:

    • Do not allow users to start unlisted programs on initial connection (Recommended)

      To help protect against malicious users, or a user unintentionally starting a program from an .rdp file on initial connection, we recommend that you select this setting.

      Important

      This setting does not prevent users from starting unlisted programs remotely after they connect to the RD Session Host server by using the RemoteApp program. For example, if Microsoft Word is in the RemoteApp Programs list and a Web browser is not, if a user starts a remote Word session, and then clicks a hyperlink in a Word document, the user can start a Web browser.

    • Allow users to start both listed and unlisted programs on initial connection

      Caution

      If you choose this option, users can start any program remotely from an .rdp file on initial connection, not just those programs in the RemoteApp Programs list. To help protect against malicious users, or a user unintentionally starting a program from an .rdp file, we recommend that you do not select this setting.

  6. When you are finished, click OK.

Additional references

  • Configure Deployment Settings


Configure Remote Desktop Gateway Settings

To define whether users will connect to the Remote Desktop Session Host (RD Session Host) server across a firewall through Remote Desktop Gateway (RD Gateway), you can configure RD Gateway deployment settings.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure RD Gateway settings

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the Actions pane of RemoteApp Manager, click RD Gateway Settings. (Or, in the Overview pane, next to RD Gateway Settings, click Change.)

  3. On the RD Gateway tab, configure the desired RD Gateway behavior. You can configure whether to automatically detect RD Gateway server settings, to use RD Gateway server settings that you specify, or to not use an RD Gateway server.

    If you select Automatically detect RD Gateway server settings, the client tries to use Group Policy settings to determine the behavior of client connections to RD Gateway.

    If you select Use these RD Gateway server settings, do the following:

    1. Configure the RD Gateway server name and the logon method.

      Important

      The server name must match what is specified in the Secure Sockets Layer (SSL) certificate for the RD Gateway server.

    2. If you want the connection to try to use the same user credentials to access both the RD Gateway server and the RD Session Host server, select the Use the same user credentials for RD Gateway and RD Session Host server check box. However, users may still receive two prompts for credentials if conflicting credentials exist from any source such as Group Policy settings, and those credentials do not work. They may also receive two prompts for credentials if default credentials are used for the connection and those credentials do not work.

    3. If you want the client computer to automatically detect when RD Gateway is required, select the Bypass RD Gateway server for local addresses check box. (Selecting this option optimizes client performance.)

      To always use an RD Gateway server for client connections, clear the Bypass RD Gateway server for local addresses check box.

  4. When you are finished, click OK.

For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure Deployment Settings


Configure Common RDP Settings

You can specify common Remote Desktop Protocol (RDP) settings for RemoteApp connections, such as device and resource redirection, and some user display settings. These settings will apply when a user connects to a RemoteApp program through RD Web Access, or when you create an .rdp file or a Windows Installer package from an existing RemoteApp program.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure common RDP settings

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the Overview pane of RemoteApp Manager, next to RDP Settings, click Change.

  3. Under Devices and resources, configure which devices and resources on the client computer you want to make available in the remote session.

  4. Under User experience, choose whether to enable font smoothing and the desired color depth.

    You can also choose whether all available client monitors will be used when connecting to a remote desktop. This setting only applies when the user is connecting to a full desktop session to the RD Session Host server through RD Web Access. Connections to RemoteApp programs will always attempt to use all client monitors that are available.

    Note

    To provide a link to a full desktop session to the RD Session Host server through RD Web Access, on the Remote Desktop Session Host tab, under Remote desktop access, select the Show a remote desktop connection to this RD Session Host server in RD Web Access check box.

  5. When you are finished, click Apply.

    Note

    To configure additional RDP settings, such as audio redirection, click the Custom RDP Settings tab. For more information, see Configure Custom RDP Settings.

  6. To close the RemoteApp Deployment Settings dialog box, click OK.
Note

If you do not sign .rdp files with a digital signature, or if you sign .rdp files with a digital signature that clients do not recognize (such as a certificate from a private certification authority), some redirection settings that you specify in RemoteApp Manager may be overridden by the client. For example, if you enable all redirection settings on the Common RDP Settings tab, and a user connects to an .rdp file that is not signed, disk drives, and supported Plug and Play devices will not be redirected automatically. These devices and resources will only be redirected if the user enables these redirection settings in the RemoteApp warning dialog box that appears when they try to connect. This default behavior helps to reduce potential security vulnerabilities. (Note that the same behavior occurs if you enable serial port redirection on the Custom RDP Settings tab.)

For more information about RDP settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=139899).

Additional references

  • Configure Deployment Settings

  • About Digitally Signing RemoteApp Programs


Configure Custom RDP Settings

You can specify custom Remote Desktop Protocol (RDP) settings for RemoteApp connections, such as audio redirection. These settings will apply when a user connects to a RemoteApp program through RD Web Access, or when you create an .rdp file or a Windows Installer package from an existing RemoteApp program.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify custom RDP settings

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the Overview pane of RemoteApp Manager, next to RDP Settings, click Change.

  3. On the Custom RDP Settings tab, type or copy the custom RDP settings that you want to use into the Custom RDP settings box.

    Note

    The RDP setting for authentication level is added into the Custom RDP settings box by default in Windows Server 2008 R2.

    To copy settings from an existing .rdp file, open the file in a text editor such as Notepad, and then copy the desired settings.

    Important

    You cannot override settings that are available in the global deployment settings in RemoteApp Manager. This includes settings such as RD Gateway server settings and common RDP settings. If you do so, you will be prompted to remove those settings when you click Apply.

    To create an .rdp file to copy the settings from, follow these steps:

    1. Open the Remote Desktop Connection client, and then click Options.

    2. Configure the settings that you want, such as audio redirection.

    3. When you are finished, on the General tab, click Save As, and then save the .rdp file.

    4. Open the .rdp file in Notepad, and then copy the desired settings into the Custom RDP settings box on the Custom RDP Settings tab.

  4. When you have finished adding the settings that you want, click Apply.

  5. If the Error with Custom RDP Settings dialog box appears, do the following:

    1. Click Remove to automatically remove the settings that are either not valid or cannot be overridden, or click OK to remove the settings manually.

    2. After the settings are removed, click Apply again.

  6. To close the RemoteApp Deployment Settings dialog box, click OK.

For more information about RDP settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=139899).

Additional references

  • Configure Deployment Settings

  • Configure Common RDP Settings


About Digitally Signing RemoteApp Programs

You can use a digital signature to sign .rdp files that are used for RemoteApp connections to the Remote Desktop Session Host (RD Session Host) server. This includes the .rdp files that are used for connections through RD Web Access to RemoteApp programs and to the desktop of an RD Session Host server.

Important

To connect to a RemoteApp program by using a digitally signed .rdp file, the client must be running at least Remote Desktop Client (RDC) 6.1. (The RDC 6.1 client supports Remote Desktop Protocol 6.1.)

If you use a digital certificate, the cryptographic signature on the connection file provides verifiable information about your identity as its publisher. This enables clients to recognize your organization as the source of the RemoteApp program or the remote desktop connection, and allows them to make more informed trust decisions about whether to start the connection. This helps protect against the use of .rdp files that were altered by a malicious user.

You can sign .rdp files that are used for RemoteApp connections by using a Server Authentication certificate [Secure Sockets Layer (SSL) certificate], a Code Signing certificate, or a specially defined Remote Desktop Protocol (RDP) Signing certificate. You can obtain SSL and Code Signing certificates from public certification authorities (CAs), or from an enterprise CA in your public key infrastructure hierarchy. Before you can use an RDP Signing certificate, you must configure a CA in your enterprise to issue RDP Signing certificates.

If you are already using an SSL certificate for RD Session Host server or RD Gateway connections, you can use the same certificate to sign .rdp files. However, if users will connect to RemoteApp programs from public or home computers, you must use either of the following:

  • A certificate from a public CA that participates in the Microsoft Root Certificate Program Members program (http://go.microsoft.com/fwlink/?LinkID=59547).

  • If you are using an enterprise CA, your enterprise CA-issued certificate must be co-signed by a public CA that participates in the Microsoft Root Certification Program Members program.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the digital certificate to use

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the Actions pane of RemoteApp Manager, click Digital Signature Settings. (Or, in the Overview pane, next to Digital Signature Settings, click Change.)

  3. Select the Sign with a digital certificate check box.

  4. In the Digital certificate details box, click Change.

  5. In the Select Certificate dialog box, select the certificate that you want to use, and then click OK.

    Note

    The Select Certificate dialog box is populated by certificates that are located in the local computer's certificates store or in your personal certificate store. The certificate that you want to use must be located in one of these stores.

Using Group Policy settings to control client behavior when opening a digitally signed .rdp file

You can use Group Policy to configure clients to always recognize RemoteApp programs from a particular publisher as trusted. You can also configure whether clients will block RemoteApp programs and remote desktop connections from external or unknown sources. By using these policy settings, you can reduce the number and complexity of security decisions that users face. This reduces the chances of inadvertent user actions that may lead to security vulnerabilities.

The relevant Group Policy settings are:

  • Specify SHA1 thumbprints of certificates representing trusted .rdp publishers

  • Allow .rdp files from valid publishers and user’s default .rdp settings

  • Allow .rdp files from unknown publishers

These Group Policy settings are located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Connection Client and User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Connection Client.

These Group Policy settings can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure Deployment Settings


Create an .rdp File

You can use the RemoteApp Wizard to create a Remote Desktop Protocol (.rdp) file from any program in the RemoteApp Programs list. For more information about how to distribute .rdp files to users, see Distribute RemoteApp Programs to Users.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create an .rdp file

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the RemoteApp Programs list, click the program that you want to create an .rdp file for. To select multiple programs, press and hold the CTRL key when you click each program name.

  3. In the Actions pane for the program or selected programs, click Create .rdp File.

    Note

    If you selected multiple programs, the settings described in the rest of this procedure apply to all of the selected programs. A separate .rdp file is created for each program.

  4. On the Welcome to the Remote App Wizard page, click Next.

  5. On the Specify Package Settings page, do the following:

    1. In the Enter the location to save the packages box, accept the default location or click Browse to specify a new location to save the .rdp file.

    2. In the Remote Desktop Session Host settings area, click Change to modify the server name or the Remote Desktop Protocol (RDP) port number. When you are finished, click OK.

    3. In the RD Gateway settings area, click Change to modify or to configure whether clients will use an RD Gateway server to connect to the target RD Session Host server across a firewall. (For more information about these settings, see Configure Remote Desktop Gateway Settings.) When you are finished, click OK.

    4. To digitally sign the .rdp file, in the Certificate settings area, click Change to select or to change the certificate to use. (For more information, see About Digitally Signing RemoteApp Programs.) Select the certificate that you want to use, and then click OK.

  6. When you are finished, click Next.

  7. On the Review Settings page, click Finish.

    When the wizard is finished, the folder where the .rdp file was saved opens in a new window. You can confirm that the .rdp file was created.

Additional references

  • Configuring RemoteApp Programs


Create a Windows Installer Package

You can use the RemoteApp Wizard to create a Microsoft Windows Installer (.msi) package from any program in the RemoteApp Programs list. For more information about how to distribute Windows Installer packages to users, see Distribute RemoteApp Programs to Users.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a Windows Installer package

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the RemoteApp Programs list, click the program that you want to create a Windows Installer package for. To select multiple programs, press and hold the CTRL key when you click each program name.

  3. In the Actions pane for the program or selected programs, click Create Windows Installer Package.

    Note

    If you selected multiple programs, the settings described in the rest of this procedure apply to all of the selected programs. A separate Windows Installer package is created for each program.

  4. On the Welcome to the RemoteApp Wizard page, click Next.

  5. On the Specify Package Settings page, do the following:

    1. In the Enter the location to save the packages box, accept the default location or click Browse to specify a new location to save the Windows Installer package.

    2. In the Remote Desktop Session Host settings area, click Change to modify the server name or the Remote Desktop Protocol (RDP) port number. When you are finished, click OK.

    3. In the RD Gateway settings area, click Change to modify or to configure whether clients will use an RD Gateway server to connect to the target RD Session Host server across a firewall. (For more information about these settings, see Configure Remote Desktop Gateway Settings.) When you are finished, click OK.

    4. To digitally sign the file, in the Certificate settings area, click Change to select or to change the certificate. (For more information, see About Digitally Signing RemoteApp Programs.) Select the certificate that you want to use, and then click OK.

  6. When you are finished, click Next.

  7. On the Configure Distribution Package page, do the following:

    1. In the Shortcut icons area, specify where the shortcut icon for the program will appear on client computers.

    2. In the Take over client extensions area, configure whether to take over client file name extensions for the program.

      If you associate the file name extensions on the client computer with the RemoteApp program, all file name extensions that are handled by the program on the RD Session Host server will also be associated on the client computer with the RemoteApp program. Note that users are not prompted whether the RD Session Host server should take over file extensions for the program.

      To view what file name extensions are associated with a program on the RD Session Host server, click Start, click Control Panel, and then double-click Default Programs. Click Associate a file type or protocol with a program to view the file name extensions and their default associated program.

      Caution

      Do not install Windows Installer packages that were created with this setting enabled on the RD Session Host server itself. If you do, clients that use the Windows Installer package may not be able to start the associated RemoteApp program.

  8. After you have configured the properties of the distribution package, click Next.

  9. On the Review Settings page, click Finish.

    When the wizard is finished, the folder where the Windows Installer package was saved opens in a new window. You can confirm that the Windows Installer (.msi) package was created.

Additional references

  • Configuring RemoteApp Programs


Distribute RemoteApp Programs to Users

You can distribute RemoteApp programs to users several ways. Depending on the method that you choose, users can:

  • Access a link to the program through RemoteApp and Desktop Connection by using RD Web Access.

    RD Web Access is a Remote Desktop Services role service that lets you make RemoteApp programs available to users through RemoteApp and Desktop Connection. For more information, see Remote Desktop Web Access (RD Web Access).

  • Double-click an .rdp file that has been created and distributed by their administrator.

    You can create a Remote Desktop Protocol (.rdp) file to distribute RemoteApp programs to users. For more information, see Create an .rdp File. You can distribute an .rdp file to client computers by using your existing software distribution process, such as Microsoft System Center Configuration Manager, or through a file share.

  • Double-click a program icon on their desktop or Start menu that has been created and distributed by their administrator with a Windows Installer package.

    You can create a Windows Installer (.msi) package to distribute RemoteApp programs to users. For more information, see Create a Windows Installer Package. To distribute a Windows Installer package to client computers, you can use your existing software distribution process, such as Microsoft System Center Configuration Manager or Active Directory Group Policy. You can also make the Windows Installer package available through a file share.

  • Double-click a file where the file name extension is associated with a RemoteApp program.

    If you distribute RemoteApp programs through Windows Installer packages, you can configure whether the RD Session Host server will take over client file name extensions for the RemoteApp program. For more information, see Create a Windows Installer Package.

Important

To access RemoteApp programs, the client computer must be running at least Remote Desktop Connection (RDC) 6.0.

Additional references

  • Configuring RemoteApp Programs


Manage the RemoteApp Programs List

In RemoteApp Manager, you can make changes to existing RemoteApp programs, or you can remove programs from the RemoteApp Programs list. Additionally, you can import or export the list of RemoteApp programs and the global deployment settings to or from another RD Session Host server.

  • Change or Delete a RemoteApp Program

  • Export or Import Configuration

Additional references

  • Configuring RemoteApp Programs


Change or Delete a RemoteApp Program

After you have added programs to the RemoteApp Programs list, you can change the deployment settings for all RemoteApp programs, change the properties of a single RemoteApp program, or delete the RemoteApp program from the list.

  • To change deployment settings for all RemoteApp programs, in the Actions pane of RemoteApp Manager, click Remote Desktop Session Host Settings, RD Gateway Settings, or Digital Signature Settings. (Or, you can click one of the Change options in the Overview pane. You can also change RDP settings from the Overview pane.)

    Important

    If you make any changes, the changes will not affect .rdp files or Windows Installer packages that you already created by using RemoteApp Manager.

  • To change the properties of a single RemoteApp program, click the program in the RemoteApp Programs list, and then in the Actions pane for the program, click Properties.

    Note

    You cannot change the properties of an .rdp file or Windows Installer package by using RemoteApp Manager. Instead, you must click Create .rdp File or Create Windows Installer Package in the Actions pane to create a new .rdp file or Windows Installer package that has the desired properties.

  • To change whether the RemoteApp program will be available from RD Web Access, click the program name in the RemoteApp Programs list, and then click either Show in RD Web Access or Hide in RD Web Access in the Actions pane.

  • To delete a program in the RemoteApp Programs list, click the RemoteApp program, and then in the Actions pane for the program, click Remove. Click Yes to confirm the deletion.

    Note

    When you delete a program in the RemoteApp Programs list, any .rdp files or Windows Installer packages that you created from the RemoteApp program are not deleted.

Additional references

  • Manage the RemoteApp Programs List

  • Configuring RemoteApp Programs


Export or Import Configuration

You can copy the list of RemoteApp programs and deployment settings from one Remote Desktop Session Host (RD Session Host) server to another RD Session Host server. You might want to do this if you want to configure multiple RD Session Host servers identically to host RemoteApp programs, for example, in an RD Session Host server farm.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To export the RemoteApp Programs list and deployment settings

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the Actions pane, click Export RemoteApp Settings.

  3. Select either of the following options:

    • Export the RemoteApp Programs list and settings to another RD Session Host server

      If you select this option, enter the name of the RD Session Host server that you want to export the settings to in the RD Session Host server name box. For the export operation to succeed, the source RD Session Host server must have Windows Management Instrumentation (WMI) access to the target RD Session Host server.

      Important

      When you click OK, the RemoteApp Programs list and deployment settings will be automatically overwritten on the target RD Session Host server.

    • Export the RemoteApp Programs list and settings to a file

      If you select this option, click OK. In the Save As dialog box, specify a location to save the .tspub file, and then click Save.
To import the RemoteApp Programs list and deployment settings

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the Actions pane, click Import RemoteApp Settings.

  3. Select either of the following options:

    • Import the RemoteApp Programs list and settings from another RD Session Host server

      If you select this option, enter the name of the RD Session Host server that you want to import the settings from in the RD Session Host server name box, and then click OK. For the import operation to succeed, the source RD Session Host server must have WMI access to the target RD Session Host server.

    • Import the RemoteApp Programs list and settings from a file

      If you select this option, click OK. In the Open dialog box, locate and then click the .tspub file that you want to import, and then click Open.

If you import a configuration, and the target RD Session Host server does not have a program in the RemoteApp Programs list installed or the program is installed in a different folder, the program will appear in the RemoteApp Programs list. However, the name will be displayed with strikethrough text.

Note

Only the RemoteApp Programs list and deployment settings are exported or imported. Any .rdp files or Windows Installer packages that were created from the programs will not be exported or imported. You must create new .rdp files or Windows Installer packages on each RD Session Host server, unless the server is a member of an RD Session Host server farm. If you specified a farm name when you created the .rdp files or Windows Installer packages, and the server where you want to copy the files to is a member of the same RD Session Host server farm, you can manually copy the files.

Additional references

  • Manage the RemoteApp Programs List

  • Configuring RemoteApp Programs


Checklist: Make RemoteApp Programs Available from the Internet

By using RemoteApp together with RD Gateway, you can enable users to connect from the Internet to individual programs on a Remote Desktop Session Host (RD Session Host) server without having to first establish a virtual private network (VPN) connection. Depending on the deployment method that you choose, remote users can connect to a program by opening an .rdp file, by clicking a shortcut to a Windows Installer package on their desktop or Start menu, or by accessing a RemoteApp program through RemoteApp and Desktop Connection by using RD Web Access.

This checklist shows the steps that are required to make RemoteApp programs available from the Internet through RD Gateway. Alternatively, if you do not want to deploy RD Gateway, you can make RemoteApp programs available through a VPN solution.

Important

Before you complete this checklist, you must meet the following prerequisites:

  • You must have already deployed RemoteApp programs on the RD Session Host server. For more information, see Checklist: Configure RemoteApp.

  • If you want to make RemoteApp programs available from the Internet through RD Web Access, you must have successfully deployed RD Web Access in an intranet environment. For more information, see Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access.

Task Reference

Review information about RD Gateway.

For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Deploy and configure RD Gateway. When you configure RD Gateway, ensure that you do the following:

  • Create a Remote Desktop connection authorization policy (RD CAP) to define the list of user groups that can connect to the RD Session Host servers that host the RemoteApp programs.

  • Create a Remote Desktop resource authorization policy (RD RAP) that provides access to the RD Session Host servers that host the RemoteApp programs.

    When you create the RD RAP, add the user groups that you defined in the RD CAP. Also, create a new RD Gateway-managed computer group that contains both the NetBIOS names and the fully qualified domain names (FQDNs) of the RD Session Host servers or the RD Session Host server farm that hosts the RemoteApp programs.

For more information, see the Remote Desktop Gateway Manager Help in Windows Server 2008 R2.

Configure RD Gateway settings in RemoteApp Manager (either in the global deployment settings or when you create an .rdp file or Windows Installer package).

Configure Remote Desktop Gateway Settings

If you want to use existing .rdp files or Windows Installer packages to access RemoteApp programs over the Internet, ensure that the files were created with the correct RD Gateway settings. If they were not, you must create new files with the correct settings, and then distribute them to users.
  • Create an .rdp File

  • Create a Windows Installer Package

  • Distribute RemoteApp Programs to Users

If you want to allow Internet access to RemoteApp programs through RD Web Access, configure firewall and authentication settings.

Configure the Remote Desktop Web Access Server to Allow Access from the Internet

Additional references

  • Configuring RemoteApp Programs


Remote Desktop Web Access (RD Web Access)

Remote Desktop Web Access (RD Web Access), formerly Terminal Services Web Access (TS Web Access), enables users to access RemoteApp and Desktop Connection through the Start menu on a computer that is running Windows 7 or through a Web browser. RemoteApp and Desktop Connection provides a customized view of RemoteApp programs and virtual desktops to users.

Additionally, RD Web Access includes Remote Desktop Web Connection, which enables users to connect remotely to the desktop of any computer where they have Remote Desktop access.

The following topics are covered:

  • Overview of Remote Desktop Web Access (RD Web Access)

  • Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access

  • Enable RemoteApp Programs for Remote Desktop Web Access

  • Install the Remote Desktop Web Access Role Service

  • Populate the TS Web Access Computers Security Group

  • Configure the RD Web Access Server for RemoteApp and Desktop Connection

  • Connect to Remote Desktop Web Access

  • Configure the Remote Desktop Web Access Server to Allow Access from the Internet

  • Configure Remote Desktop Web Connection Behavior

For more information about RD Web Access, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140437).


Overview of Remote Desktop Web Access (RD Web Access)

Remote Desktop Web Access (RD Web Access), formerly Terminal Services Web Access (TS Web Access), enables users to access RemoteApp and Desktop Connection through the Start menu on a computer that is running Windows 7 or through a Web browser. RemoteApp and Desktop Connection provides a customized view of RemoteApp programs and virtual desktops to users.

Additionally, RD Web Access includes Remote Desktop Web Connection, which enables users to connect remotely from a Web browser to the desktop of any computer where they have Remote Desktop access.

When a user starts a RemoteApp program, a Remote Desktop Services session is started on the Remote Desktop Session Host (RD Session Host) server that hosts the RemoteApp program. If a user connects to a virtual desktop, a remote desktop connection is made to a virtual machine that is running on a Remote Desktop Virtualization Host (RD Virtualization Host) server.

To provide users access to RemoteApp and Desktop Connection, you must configure RD Web Access to specify the source that provides the RemoteApp programs and virtual desktops that are displayed to users. You can configure RD Web Access to use either of the following:

  • Remote Desktop Connection Broker (RD Connection Broker) server

  • RemoteApp source

An RD Connection Broker server provides users access to virtual desktops hosted on RD Virtualization Host servers and to RemoteApp programs hosted on RD Session Host servers. To configure the RD Connection Broker server, use the Remote Desktop Connection Manager tool. For more information, see the Remote Desktop Connection Manager Help in Windows Server 2008 R2. For more information about RemoteApp and Desktop Connection, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=143108).

A RemoteApp source is an individual RD Session Host server or a farm of identically configured RD Session Host servers on which RemoteApp programs have been configured. You can specify multiple RemoteApp sources. To configure RemoteApp programs on an RD Session Host server, use RemoteApp Manager. For more information, see RemoteApp Manager.

Deploying RD Web Access

You must install the RD Web Access role service on the server that you want users to connect to over the Web to access RemoteApp programs. When you install RD Web Access, Microsoft Internet Information Services (IIS) is also installed as a required component.

After you install RD Web Access, you must specify whether to use an RD Connection Broker server or a RemoteApp source as the source that provides the RemoteApp programs and virtual desktops that are displayed to users through RemoteApp and Desktop Connection. For more information, see Configure the RD Web Access Server for RemoteApp and Desktop Connection.

If you want users to access the Web page from the Internet, you can use RD Gateway to help secure remote connections. For more information, see Checklist: Make RemoteApp Programs Available from the Internet.

For more information about RD Web Access, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140437).

Additional references

  • Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access

  • Enable RemoteApp Programs for Remote Desktop Web Access

  • Install the Remote Desktop Web Access Role Service

  • Populate the TS Web Access Computers Security Group

  • Connect to Remote Desktop Web Access

  • Configure the Remote Desktop Web Access Server to Allow Access from the Internet

  • Configure Remote Desktop Web Connection Behavior


Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access

This checklist shows the steps that are required to configure RD Web Access to make RemoteApp programs available through RemoteApp and Desktop Connection.

Note

RD Web Access can also be configured to provide users access to virtual desktops through RemoteApp and Desktop Connection. For more information, see the Remote Desktop Connection Manager Help in Windows Server 2008 R2.

Task | Reference
Configure RemoteApp programs on one or more Remote Desktop Session Host (RD Session Host) servers in your environment. | Configuring RemoteApp Programs
Enable RemoteApp programs for RD Web Access. | Enable RemoteApp Programs for Remote Desktop Web Access
Install the RD Web Access role service on the server that you want users to connect to over the Web to access RemoteApp programs. | Install the Remote Desktop Web Access Role Service
Add the computer account of the RD Web Access server to the TS Web Access Computers group on the RD Session Host server. | Populate the TS Web Access Computers Security Group
Specify the source that provides the RemoteApp programs that will be available through RemoteApp and Desktop Connection. | Configure the RD Web Access Server for RemoteApp and Desktop Connection

After you complete this checklist, users can access the RD Web Access Web site from an intranet. To make the RD Web Access Web site available from the Internet, see Checklist: Make RemoteApp Programs Available from the Internet.

Important

The RD Web Access Web site is automatically configured to use Secure Sockets Layer (SSL) with a self-signed certificate. By default, the self-signed certificate is not a trusted certificate, and self-signed certificates are recommended only for testing and evaluation purposes. For more information about configuring the RD Web Access Web site to use a trusted certificate, such as a certificate issued by a trusted public certification authority (CA), see Remote Desktop Web Access Security.

Additional references

  • Overview of Remote Desktop Web Access (RD Web Access)


Enable RemoteApp Programs for Remote Desktop Web Access

By default, a RemoteApp program is enabled for RD Web Access when you add a program to the RemoteApp Programs list on a Remote Desktop Session Host (RD Session Host) server.

Use the following procedure on the RD Session Host server where the RemoteApp programs are configured to determine if a RemoteApp program is enabled for RD Web Access.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To determine if a RemoteApp program is enabled for RD Web Access

  1. On the RD Session Host server, open RemoteApp Manager. To open RemoteApp Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click RemoteApp Manager.

  2. In the RemoteApp Programs list, verify that a Yes value appears in the RD Web Access column next to the program that you want to make available through RD Web Access.

  3. To change whether a RemoteApp program is available through RD Web Access, do either of the following:

    • To enable a RemoteApp program for RD Web Access, click the program name, and then click Show in RD Web Access in the Actions pane.

    • To disable a RemoteApp program for RD Web Access, click the program name, and then click Hide in RD Web Access in the Actions pane.

RemoteApp programs that are enabled for RD Web Access will automatically be available through RemoteApp and Desktop Connection if RD Web Access is configured to use the RD Session Host server as a source for RemoteApp and Desktop Connection. For more information, see Configure the RD Web Access Server for RemoteApp and Desktop Connection.

Additional references

  • Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access


Install the Remote Desktop Web Access Role Service

Install the RD Web Access role service on the server that you want users to connect to over the Web to access RemoteApp programs. When you install the RD Web Access role service, Microsoft Internet Information Services (IIS) is also installed.

The server where you install RD Web Access acts as the Web server. The server does not have to be a Remote Desktop Session Host (RD Session Host) server.

Use the following procedure to install the RD Web Access role service.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To install the RD Web Access role service

  1. On the computer on which you want to install the RD Web Access role service, open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. If the Remote Desktop Services role is not already installed:

    1. Under Roles Summary, click Add Roles.

    2. On the Before You Begin page, click Next.

    3. On the Select Server Roles page, select the Remote Desktop Services check box, and then click Next.

    4. Review the Remote Desktop Services page, and then click Next.

    5. On the Select Role Services page, select the Remote Desktop Web Access check box.

    If the Remote Desktop Services role is already installed:

    1. Under Roles Summary, click Remote Desktop Services.

    2. Under Role Services, click Add Role Services.

    3. On the Select Role Services page, select the Remote Desktop Web Access check box.

  3. Review the information about the required role services, and then click Add Required Role Services.

  4. Click Next.

  5. Review the Web Server (IIS) page, and then click Next.

  6. On the Select Role Services page, where you are prompted to select the role services that you want to install for IIS, click Next.

  7. On the Confirm Installation Selections page, click Install.

  8. On the Installation Progress page, installation progress will be noted.

  9. On the Installation Results page, confirm that the installation succeeded, and then click Close.

Additional references

  • Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access


Populate the TS Web Access Computers Security Group

If the RD Web Access server and the Remote Desktop Session Host (RD Session Host) server that hosts the RemoteApp programs are separate servers, you must add the computer account of the RD Web Access server to the TS Web Access Computers security group on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To add the computer account of the RD Web Access server to the security group

  1. On the RD Session Host server, click Start, point to Administrative Tools, and then click Computer Management.

  2. In the left pane, expand Local Users and Groups, and then click Groups.

  3. In the right pane, double-click TS Web Access Computers.

  4. In the TS Web Access Computers Properties dialog box, click Add.

  5. In the Select Users, Computers, or Groups dialog box, click Object Types.

  6. In the Object Types dialog box, select the Computers check box, and then click OK.

  7. In the Enter the object names to select box, specify the computer account of the RD Web Access server, and then click OK.

  8. Click OK to close the TS Web Access Computers Properties dialog box.

Additional references

  • Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access


Configure the RD Web Access Server for RemoteApp and Desktop Connection

To provide users access to RemoteApp and Desktop Connection, you must configure RD Web Access to specify the source that provides the RemoteApp programs and virtual desktops that are displayed to users. You can configure RD Web Access to use either of the following:

  • Remote Desktop Connection Broker (RD Connection Broker) server

  • RemoteApp source

An RD Connection Broker server provides users access to virtual desktops hosted on RD Virtualization Host servers and to RemoteApp programs hosted on Remote Desktop Session Host (RD Session Host) servers. To configure the RD Connection Broker server, use the Remote Desktop Connection Manager tool. For more information, see the Remote Desktop Connection Manager Help in Windows Server 2008 R2. For more information about RemoteApp and Desktop Connection, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=143108).

A RemoteApp source is an individual RD Session Host server or a farm of identically configured RD Session Host servers on which RemoteApp programs have been configured. You can specify multiple RemoteApp sources. To configure RemoteApp programs on an RD Session Host server, use RemoteApp Manager. For more information, see RemoteApp Manager.

You must log on by using either the local Administrator account on the RD Web Access server or an account that is a member of the TS Web Access Administrators group on the RD Web Access server to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify the source for RemoteApp and Desktop Connection

  1. Connect to the RD Web Access Web site. To do this, use either of the following methods:

    • On the RD Web Access server, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Web Access Configuration.

    • Use Internet Explorer to connect to the RD Web Access Web site. By default, the Web site is located at the following address, where server_name is the fully qualified domain name (FQDN) of the RD Web Access server:

      https://server_name/rdweb

  2. Log on to the site by using either the local Administrator account on the RD Web Access server or an account that is a member of the TS Web Access Administrators group on the RD Web Access server.

  3. On the title bar, click Configuration.

    Note

    If you access the RD Web Access Web site by using the Remote Desktop Web Access Configuration option, the page automatically opens to the Configuration page.

  4. Select either An RD Connection Broker server or One or more RemoteApp sources.

    If you select An RD Connection Broker server, in the Source name box, enter the NetBIOS name or FQDN of the RD Connection Broker.

    If you select One or more RemoteApp sources, in the Source name box, enter the NetBIOS name or FQDN of the RemoteApp source. If you are using an RD Session Host server farm as the RemoteApp source, specify the DNS name of the farm. If you are specifying multiple RemoteApp sources, separate each name with a semicolon.

  5. Click OK to save the changes.

If you selected One or more RemoteApp sources, you also need to specify a connection name and a connection ID. The connection name will be used to identify RemoteApp and Desktop Connection provided by the RD Web Access server to the user. To specify the connection name and connection ID, on the RD Web Access server, open the %windir%\Web\RDWeb\App_Data\RDWebAccess.config file in a text editor, such as Notepad.

If you selected An RD Connection Broker server, you need to specify the connection name and connection ID by using the Remote Desktop Connection Manager tool on the RD Connection Broker server. For more information, see the Remote Desktop Connection Manager Help in Windows Server 2008 R2.

Additional references

  • Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access


Connect to Remote Desktop Web Access

By default, you can access the RD Web Access Web site at the following location, where server_name is the fully qualified domain name (FQDN) of the Web server where you installed RD Web Access:

https://server_name/rdweb

If you connect to the RD Web Access Web site from a public computer, such as a kiosk computer in a public establishment, or from a computer that you share with other users, click This is a public or shared computer. You must provide both your user name and password each time you sign in to the RD Web Access Web site.

If you are using a work computer assigned to you, that you do not share with others, click This is a private computer. Your user name is remembered, so you only have to provide your password each time you sign in to the RD Web Access Web site.

Note

To protect against unauthorized access, RD Web Access sessions automatically time out after a period of inactivity. If the RD Web Access session times out, you need to sign in again. There are different timeout values, depending on whether you select This is a public or shared computer or you select This is a private computer when you sign in to the RD Web Access Web site. The administrator can configure the default timeout values by using the Internet Information Services (IIS) Manager tool.

To access the configuration settings for the RD Web Access Web site, you must log on to the RD Web Access Web site by using either the local Administrator account on the RD Web Access server or an account that is a member of the TS Web Access Administrators group on the RD Web Access server. To access the Web site, use either of the following methods:

  • Type the URL of the RD Web Access Web site into a Web browser.

  • On the RD Web Access server, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Web Access Configuration.

Note

All authenticated users can access RemoteApp and Desktop Connection provided by an RD Web Access server. To change this, use Internet Information Services (IIS) Manager to edit the permissions on the RDWeb virtual directory.

For more information about RD Web Access security, see Remote Desktop Web Access Security.

Client computer requirements

To use RD Web Access, client computers must be running at least Internet Explorer 6.0 and a version of Remote Desktop Connection (RDC) that supports at least Remote Desktop Protocol (RDP) 6.1.

To determine the RDP version that RDC supports, start Remote Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. The RDP version that RDC supports is listed in the About Remote Desktop Connection dialog box.

RDC 6.1 supports Remote Desktop Protocol 6.1. RDC 6.1 is included with the following operating systems:

  • Windows Server 2008

  • Windows Vista with Service Pack 1 (SP1)

  • Windows XP with Service Pack 3 (SP3)

The version of RDC in Windows 7 and Windows Server 2008 R2 supports RDP 7.0. The version of RDC that you are using determines which features of RD Web Access are available to you.

Additionally, the Remote Desktop Services ActiveX Client control must be enabled. The ActiveX control is included with RDC 6.1 and the version of RDC in Windows 7 and Windows Server 2008 R2.

For more information about client computer requirements for using RD Web Access, see http://go.microsoft.com/fwlink/?LinkId=142240.

Additional references

  • Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access


Configure the Remote Desktop Web Access Server to Allow Access from the Internet

To allow users to access the RD Web Access server from the Internet, you can also deploy RD Gateway. A recommended configuration is to place both the RD Gateway server and the RD Web Access server in the perimeter network, with the Remote Desktop Session Host (RD Session Host) servers that host RemoteApp programs behind the internal firewall.

For more information about how to deploy RD Gateway and about how to make RemoteApp programs available from the Internet, see Checklist: Make RemoteApp Programs Available from the Internet.

After you have deployed RemoteApp programs, RD Gateway, and RD Web Access, you must configure your firewall to allow Windows Management Instrumentation (WMI) traffic from the RD Web Access server to the RD Session Host server.

Additionally, verify that the RD Web Access Web site is configured to use Forms Authentication.

Note

By default, Forms Authentication is enabled for the RD Web Access Web site.

To verify that Forms Authentication is enabled

  1. On the RD Web Access server, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.

  2. In the left pane of Internet Information Services (IIS) Manager, expand the server name, expand Sites, expand Default Web Site, expand RDWeb, and then click Pages.

  3. In the middle pane, under IIS, double-click Authentication.

  4. Ensure that Forms Authentication is set to Enabled. If it is not, right-click Forms Authentication, and then click Enable.

To configure the RD Web Access Web site to use Windows Authentication instead of Forms Authentication or to not use SSL, see Remote Desktop Web Access Security.

Additional references

  • Checklist: Make RemoteApp Programs Available Through Remote Desktop Web Access


Configure Remote Desktop Web Connection Behavior

Remote Desktop Web Connection enables a user to connect to the desktop of a remote computer from the RD Web Access Web site. To connect to a remote computer, the following conditions must be true:

  • The remote computer must be configured to accept Remote Desktop connections.

  • The user must be a member of the Remote Desktop Users group on the remote computer.

A user can access Remote Desktop Web Connection by clicking the Remote Desktop tab on the RD Web Access page. As an administrator, you can configure whether the Remote Desktop tab is available to users. Additionally, you can configure settings such as the RD Gateway server to use, and the default device and resource redirection options.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure Remote Desktop Web Connection behavior

  1. On the RD Web Access server, start Internet Information Services (IIS) Manager. To do this, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.

  2. In the left pane, expand the server name, expand Sites, expand Default Web Site, expand RDWeb, and then click Pages.

  3. In the middle pane, under ASP.NET, double-click Application Settings.

  4. To change Remote Desktop Web Connection settings, modify the values in the Application Settings pane.

    • To configure a default RD Gateway server, double-click DefaultTSGateway, enter the fully qualified domain name (FQDN) of the server in the Value box (for example, server1.contoso.com), and then click OK.

    • To specify the RD Gateway authentication method, double-click GatewayCredentialsSource, type the number that corresponds to the desired authentication method in the Value box, and then click OK. The possible values include:

      0 = Ask for password (NTLM)

      1 = Smart card

      4 = Allow user to select later

    • To configure whether the Remote Desktop tab appears on the RD Web Access Web page, double-click ShowDesktops. In the Value box, type true to show the Remote Desktop tab, or type false to hide the Remote Desktop tab. When you are finished, click OK.

    • To configure default device and resource redirection settings, double-click the setting that you want to modify (xClipboard, xDriveRedirection, xPnPRedirection, xPortRedirection, or xPrinterRedirection). In the Value box, type true to enable the redirection setting by default, or type false to disable the redirection setting by default, and then click OK.

  5. When you are finished, close IIS Manager.

    Your changes should take effect immediately on the RD Web Access Web site. If the Web page is open, refresh the page to view the changes.
Note

You can also configure these settings by modifying the %windir%\Web\RDWeb\Pages\Web.config file directly by using a text editor such as Notepad.

Additional references

  • Connect to Remote Desktop Web Access