Remote Desktop Services

The Remote Desktop Services server role in Windows Server® 2008 R2 provides technologies that enable users to access Windows-based programs that are installed on a Remote Desktop Session Host (RD Session Host) server, or to access the full Windows desktop. By using Remote Desktop Services, users can access an RD Session Host server from within a corporate network or from the Internet.


Remote Desktop Services Overview

What is Remote Desktop Services?

Remote Desktop Services, formerly Terminal Services, is a server role in Windows Server® 2008 R2 that provides technologies that enable users to access Windows-based programs that are installed on a Remote Desktop Session Host (RD Session Host) server, or to access the full Windows desktop. With Remote Desktop Services, users can access an RD Session Host server from within a corporate network or from the Internet.

Remote Desktop Services lets you efficiently deploy and maintain software in an enterprise environment. You can easily deploy programs from a central location. Because you install the programs on the RD Session Host server and not on the client computer, programs are easier to upgrade and to maintain.

When a user accesses a program on an RD Session Host server, the program runs on the server. Each user sees only their individual session. The session is managed transparently by the server operating system and is independent of any other client session. Additionally, you can configure Remote Desktop Services to use Hyper-V™ to either assign virtual machines to users or have Remote Desktop Services dynamically assign an available virtual machine to a user upon connection.

For more information about Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

Why use Remote Desktop Services?

If you deploy a program on an RD Session Host server instead of on each device, there are many benefits. These include the following:

  • Application deployment: You can quickly deploy Windows-based programs to computing devices across an enterprise. Remote Desktop Services is especially useful when you have programs that are frequently updated, infrequently used, or difficult to manage.

  • Application consolidation: Programs are installed and run from an RD Session Host server, eliminating the need for updating programs on client computers. This also reduces the amount of network bandwidth that is required to access programs.

  • Remote access: Users can access programs that are running on an RD Session Host server from devices such as home computers, kiosks, low-powered hardware, and operating systems other than Windows.

  • Branch office access: Remote Desktop Services provides better program performance for branch office workers who need access to centralized data stores. Data-intensive programs sometimes do not have client/server protocols that are optimized for low-speed connections. Programs of this kind frequently perform better over a Remote Desktop Services connection than over a typical wide area network.

Remote Desktop Services role services

Remote Desktop Services is a server role that consists of several role services. In Windows Server 2008 R2, Remote Desktop Services consists of the following role services:

  • RD Session Host: Remote Desktop Session Host (RD Session Host), formerly Terminal Server, enables a server to host Windows-based programs or the full Windows desktop. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server.

  • RD Web Access: Remote Desktop Web Access (RD Web Access), formerly TS Web Access, enables users to access RemoteApp and Desktop Connection through the Start menu on a computer that is running Windows 7 or through a Web browser. RemoteApp and Desktop Connection provides a customized view of RemoteApp programs and virtual desktops to users.

  • RD Licensing: Remote Desktop Licensing (RD Licensing), formerly TS Licensing, manages the Remote Desktop Services client access licenses (RDS CALs) that are required for each device or user to connect to an RD Session Host server. You use RD Licensing to install, issue, and track the availability of RDS CALs on a Remote Desktop license server.

  • RD Gateway: Remote Desktop Gateway (RD Gateway), formerly TS Gateway, enables authorized remote users to connect to resources on an internal corporate network, from any Internet-connected device.

  • RD Connection Broker: Remote Desktop Connection Broker (RD Connection Broker), formerly TS Session Broker, supports session load balancing and session reconnection in a load-balanced RD Session Host server farm. RD Connection Broker is also used to provide users access to RemoteApp programs and virtual desktops through RemoteApp and Desktop Connection.

  • RD Virtualization Host: Remote Desktop Virtualization Host (RD Virtualization Host) integrates with Hyper-V to host virtual machines and provide them to users as virtual desktops. You can assign a unique virtual desktop to each user in your organization, or provide them shared access to a pool of virtual desktops.

What is RD Session Host?

An RD Session Host server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server by using the Remote Desktop Connection client or by using RemoteApp programs.

For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).

What is RD Web Access?

RD Web Access enables users to access RemoteApp and Desktop Connection through the Start menu on a computer that is running Windows 7 or through a Web browser. RemoteApp and Desktop Connection provides a customized view of RemoteApp programs and virtual desktops to users.

When a user starts a RemoteApp program, a Remote Desktop Services session is started on the RD Session Host server that hosts the RemoteApp program. If a user connects to a virtual desktop, a remote desktop connection is made to a virtual machine that is running on an RD Virtualization Host server.

To configure which RemoteApp programs and virtual desktops will be available through RemoteApp and Desktop Connection, you must install the RD Connection Broker role service on a computer that is running Windows Server 2008 R2, and then use the Remote Desktop Connection Manager tool.

You can also use RD Web Access if you only want to make RemoteApp programs on an RD Session Host server available to users through a Web browser.

For more information about RD Web Access, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140437).

What is RD Licensing?

RD Licensing manages the RDS CALs that are required for each user or device to connect to an RD Session Host server. You use RD Licensing to install, issue, and track the availability of RDS CALs on a Remote Desktop license server.

To use Remote Desktop Services, you must have at least one license server. For small deployments, you can install both the RD Session Host role service and the RD Licensing role service on the same computer. For larger deployments, it is recommended that the RD Licensing role service be installed on a separate computer from the RD Session Host role service.

You must configure RD Licensing correctly for your RD Session Host server to continue to accept connections from clients.

For more information about RD Licensing, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140434).

What is RD Gateway?

RD Gateway enables authorized remote users to connect to resources on an internal corporate network, from any Internet-connected device. The network resources can be RD Session Host servers running RemoteApp programs [hosting line-of-business (LOB) applications], virtual desktops, or computers with Remote Desktop enabled. RD Gateway encapsulates RDP over HTTPS to help form a secure, encrypted connection between users on the Internet and the internal network resources on which their productivity applications run.

Why use RD Gateway?

RD Gateway provides these benefits:

  • RD Gateway enables remote users to connect to internal network resources over the Internet by using an encrypted connection, without needing to configure virtual private network (VPN) connections.

  • RD Gateway provides a comprehensive security configuration model that enables you to control access to specific internal network resources.

  • RD Gateway enables remote users to connect to internal network resources that are hosted behind firewalls in private networks and across network address translators (NATs).

  • Remote Desktop Gateway Manager (RD Gateway Manager) enables you to configure authorization policies to define conditions that must be met for remote users to connect to internal network resources.

  • RD Gateway Manager provides tools to help you monitor RD Gateway connection status, health, and events.

  • You can configure RD Gateway servers and Remote Desktop Services clients to use Network Access Protection (NAP) to enhance security.

  • You can use an RD Gateway server with Microsoft Internet Security and Acceleration (ISA) Server to further enhance security.

For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

What is RD Connection Broker?

RD Connection Broker keeps track of user sessions in a load-balanced RD Session Host server farm. The RD Connection Broker database stores session state information that includes session IDs, their associated user names, and the name of the server where each session resides. When a user with an existing session connects to an RD Session Host server in the load-balanced farm, RD Connection Broker redirects the user to the RD Session Host server where their session exists. This prevents the user from being connected to a different server in the farm and starting a new session.

If the RD Connection Broker Load Balancing feature is enabled, RD Connection Broker also tracks the number of user sessions on each RD Session Host server in the farm, and redirects users who do not have an existing session to the server with the fewest sessions. This functionality enables you to evenly distribute the session load between servers in a load-balanced RD Session Host server farm.

RD Connection Broker is also used to provide users with access to RemoteApp and Desktop Connection. RemoteApp and Desktop Connection provides a customized view of RemoteApp programs and virtual desktops to users. RD Connection Broker supports load balancing and reconnection to existing sessions on virtual desktops accessed by using RemoteApp and Desktop Connection.

To configure RemoteApp and Desktop Connection, use the Remote Desktop Connection Manager tool on the RD Connection Broker server.

For more information about RD Connection Broker, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140432).

What is RD Virtualization Host?

RD Virtualization Host integrates with Hyper-V to provide virtual machines by using RemoteApp and Desktop Connection. RD Virtualization Host can be configured so that each user in your organization is assigned a unique virtual desktop, or users are redirected to a shared pool where a virtual desktop is dynamically assigned.

RD Virtualization Host requires RD Connection Broker to determine where the user is redirected. If a user is assigned a personal virtual desktop, RD Connection Broker will redirect the user to this virtual machine. If the virtual machine is not turned on, RD Virtualization Host turns the virtual machine on and then connects the user to the personal virtual desktop. If the user is connecting to a shared virtual machine pool, RD Connection Broker will first check to see if the user has a disconnected session in the pool. If the user has a disconnected session, they are reconnected to that virtual desktop. If the user does not have a disconnected session, a virtual desktop in that pool is dynamically assigned to the user.

For more information about RD Virtualization Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140435).


Remote Desktop Session Host (RD Session Host)

A Remote Desktop Session Host (RD Session Host) server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server by using Remote Desktop Connection or by using RemoteApp.

The following topics are covered:

  • Overview of Remote Desktop Session Host (RD Session Host)

  • Checklist: RD Session Host Installation Prerequisites

  • Checklist: Configure an RD Session Host Server

  • Configuring an RD Session Host Server

  • Managing an RD Session Host Server

For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).


Overview of Remote Desktop Session Host (RD Session Host)

The Remote Desktop Services server role in Windows Server 2008 R2 consists of several role services, one of which is Remote Desktop Session Host (RD Session Host).

An RD Session Host server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server from within a corporate network or from the Internet by using Remote Desktop Connection or by using RemoteApp.

For more information about RemoteApp, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140439).

When a user accesses a program on an RD Session Host server, the program execution occurs on the server. Each user sees only their individual session. The session is managed transparently by the server operating system and is independent of any other client session.

If you deploy a program on an RD Session Host server instead of on each device, there are many benefits. These include the following:

  • You can quickly deploy Windows-based programs to computing devices across an enterprise. This is especially useful when you have programs that are frequently updated, infrequently used, or difficult to manage.

  • Users can access programs that are running on an RD Session Host server from devices such as home computers, kiosks, hardware that might not meet the requirements of the operating system or application, and operating systems other than Windows.

  • Branch office workers who need access to centralized data stores can receive better program performance by accessing a program remotely on an RD Session Host server. Data-intensive programs sometimes do not have client/server protocols that are optimized for low-speed connections. Programs of this kind frequently perform better over a Remote Desktop Services connection than over a typical wide area network.

For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).


Checklist: RD Session Host Installation Prerequisites

An RD Session Host server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server by using Remote Desktop Connection or by using RemoteApp.

This checklist provides tasks that an administrator should perform before installing and configuring an RD Session Host server.

Note

Installing the RD Session Host role service on an Active Directory® domain controller is not recommended. For more information, see Installing RD Session Host on a Domain Controller.

Task Reference

Determine if you need an RD Session Host server.

To allow remote connections for administrative purposes only, you do not have to install an RD Session Host server.

For more information about remote connections for administrative purposes, see Using Remote Desktop.

Review licensing requirements for an RD Session Host server.

Each user or computing device that connects to an RD Session Host server must have a valid Remote Desktop Services client access license (RDS CAL).

An RD Session Host server running Windows Server 2008 R2 must be configured to use at least a license server running Windows Server 2008, and the license server must have valid RDS CALs installed.

For more information about licensing requirements for Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

Decide which programs you want to host on the RD Session Host server.

You should install the RD Session Host role service on the computer before you install any programs that you want to make available to users. If you install the RD Session Host role service on a computer that already has programs installed, some of the existing programs may not work correctly in a multiple user environment. Uninstalling and then reinstalling the affected programs may resolve these issues.

For more information, see Install Programs on an RD Session Host Server.

Review information about:

  • Hardware requirements

  • Capacity and scaling

See the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

Determine if you need to deploy a load-balanced RD Session Host server farm.

For more information about RD Connection Broker, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140432).

Determine the Remote Desktop licensing mode that the RD Session Host server will use.

The Remote Desktop licensing mode configured on an RD Session Host server must match the type of RDS CALs available on the Remote Desktop license server.

For more information, see Specify the Remote Desktop Licensing Mode.

Determine the Remote Desktop license server from which the RD Session Host server will request RDS CALs.

An RD Session Host server must be configured to specify a Remote Desktop license server from which to request RDS CALs for users or computing devices that are connecting to the RD Session Host server.

For more information, see Specify a License Server for the RD Session Host Server to Use.

Determine which users will be able to remotely connect to the RD Session Host server.

The Remote Desktop Users group on an RD Session Host server is used to give users and groups permission to log on remotely to an RD Session Host server.

For more information, see Configure the Remote Desktop Users Group.

Determine if you need to deploy an RD Gateway server.

For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Determine if the RD Session Host server will require Network Level Authentication.

You can enhance RD Session Host server security by providing user authentication earlier in the connection process when a client connects to an RD Session Host server. This early user authentication method is referred to as Network Level Authentication.

For more information, see Configure the Network Level Authentication Setting for an RD Session Host Server.

Review information about Windows Firewall.

The installation of the Remote Desktop Services role changes the configuration of Windows Firewall.

For more information, see Remote Desktop Services and Windows Firewall.


Using Remote Desktop

To allow remote connections for administrative purposes only, you do not have to install the RD Session Host role service. Instead, you enable Remote Desktop on the computer that you want to remotely administer.

Note

Remote Desktop supports only two concurrent remote connections to the computer. You do not need Remote Desktop Services client access licenses (RDS CALs) for these connections.

You can use the following procedure to enable Remote Desktop on a Windows Server 2008 R2 computer.

Membership in the local Administrators group, or equivalent, on the computer that you plan to configure, is the minimum required to complete this procedure.

To enable Remote Desktop

  1. Start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click either of the following, depending on your environment:

    • Allow connections from computers running any version of Remote Desktop (less secure)

    • Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)

    For more information about the two options, click the Help me choose link on the Remote tab.

  4. Click Select Users to add the users and groups that need to connect to the computer by using Remote Desktop. The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

Additional references

  • Configuring an RD Session Host Server

  • Configure the Network Level Authentication Setting for an RD Session Host Server

  • Configure the Remote Desktop Users Group

  • Overview of Remote Desktop Session Host (RD Session Host)

  • Checklist: RD Session Host Installation Prerequisites


Installing RD Session Host on a Domain Controller

Installing the RD Session Host role service on an Active Directory domain controller is not recommended. Allowing users to run programs on a domain controller could create security risks and performance issues.

If the RD Session Host role service is installed on a domain controller, the security settings of the domain controller will need to be adjusted to allow users to have remote access to the server. This remote access is controlled by the Allow logon through Remote Desktop Services user rights assignment, which can be configured by using the Group Policy Management Console (GPMC).

On a domain controller, by default, only the Administrators group is granted the Allow logon through Remote Desktop Services user right. To allow remote access to the RD Session Host server for users who are not members of the Administrators group, you should grant the Remote Desktop Users group the Allow logon through Remote Desktop Services user right.

For more information about using GPMC to configure user rights assignments, see the Group Policy Management Console Help in Windows Server 2008 R2.

For more information about RD Licensing, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140434).

Additional references

  • Checklist: RD Session Host Installation Prerequisites


Remote Desktop Services and Windows Firewall

The Windows Firewall is on by default in Windows Server 2008 and Windows Server 2008 R2. Windows Firewall helps control which programs or ports can be used to communicate between the Windows Server 2008 or Windows Server 2008 R2 server and other computers on the network or the Internet. To allow a program or port to communicate through Windows Firewall, an exception needs to be enabled.

If you enable Remote Desktop, Windows Firewall automatically enables the Remote Desktop exception.

When the RD Session Host role service is installed, Windows Firewall automatically enables the following exceptions:

  • Remote Desktop

  • Remote Desktop Services

If you install other Remote Desktop Services role services, Windows Firewall will automatically enable other exceptions. For example, when you install the RD Licensing role service, Windows Firewall enables the Remote Desktop Licensing Server exception.

When you uninstall (remove) a role service from the computer, Windows Firewall automatically removes the exception for that role service.

Important

When the RD Session Host role service is uninstalled (removed), only the Remote Desktop Services exception is removed. The Remote Desktop exception is not removed.

Use the following procedure to view Windows Firewall exceptions.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To view Windows Firewall exceptions

  1. Click Start, and then click Control Panel.

  2. Click System and Security, and then click Windows Firewall.

  3. Click Allow a program or feature through Windows Firewall.

  4. If the check box associated with the program or port listed is selected, the Windows Firewall exception for that program or port is enabled.

    Some programs only appear in the list when the role service is installed. For example, the Remote Desktop Licensing Server exception only appears in the list when the RD Licensing role service is installed on the computer.

To view more detailed information about Windows Firewall settings, use the Windows Firewall with Advanced Security snap-in.

Use the following procedure to use Windows Firewall with Advanced Security.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To use the Windows Firewall with Advanced Security snap-in

  1. Click Start, point to Administrative Tools, and then click Windows Firewall with Advanced Security.

  2. To view detailed information about Windows Firewall settings, click either of the following nodes in the left pane:

    • Inbound rules

    • Outbound rules

For more information about configuring Windows Firewall, see the Windows Firewall with Advanced Security Help in Windows Server 2008 R2.

For more information about Remote Desktop Services-specific Windows Firewall exceptions, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=138056).

Additional references

  • Using Remote Desktop

  • Install the RD Session Host Role Service

  • Checklist: RD Session Host Installation Prerequisites


Checklist: Configure an RD Session Host Server

An RD Session Host server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server by using Remote Desktop Connection or by using RemoteApp.

This checklist provides tasks that an administrator needs to complete to install and configure an RD Session Host server.

Please note the following:

  • Installing the RD Session Host role service requires the computer to be restarted.

  • Installing the RD Session Host role service on an Active Directory domain controller is not recommended. For more information, see Installing RD Session Host on a Domain Controller.

  • You should install the RD Session Host role service on the computer before you install any programs that you want to make available to users. For more information, see Install Programs on an RD Session Host Server.

Task | Reference
Review prerequisites for installing the RD Session Host role service. | Checklist: RD Session Host Installation Prerequisites
Install the RD Session Host role service. | Install the RD Session Host Role Service
Configure the license settings on the RD Session Host server. | Configure License Settings for an RD Session Host Server
Configure the Network Level Authentication setting for the RD Session Host server. | Configure the Network Level Authentication Setting for an RD Session Host Server
Install programs on the RD Session Host server. | Install Programs on an RD Session Host Server
Configure which users can remotely connect to the RD Session Host server. | Configure the Remote Desktop Users Group

Additional references

  • Overview of Remote Desktop Session Host (RD Session Host)


Configuring an RD Session Host Server

This section provides procedures for configuring an RD Session Host server. The following topics are covered:

  • Install the RD Session Host Role Service

  • Configure License Settings for an RD Session Host Server

  • Configure the Network Level Authentication Setting for an RD Session Host Server

  • Install Programs on an RD Session Host Server

  • Configure the Remote Desktop Users Group

  • Configure the Client Experience on an RD Session Host Server

Additional references

  • Overview of Remote Desktop Session Host (RD Session Host)

  • Checklist: RD Session Host Installation Prerequisites

  • Checklist: Configure an RD Session Host Server


Install the RD Session Host Role Service

In Windows Server 2008 R2, you can use Server Manager to install the RD Session Host role service. For more information about other ways to install the RD Session Host role service, including by using the command-line tool servermanagercmd.exe, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?linkid=138055).

Use the following procedure to install the RD Session Host role service by using Server Manager if Remote Desktop Services is not already installed on the server. If Remote Desktop Services is already installed on the server, see Install the Remote Desktop Session Host role service (when Remote Desktop Services is already installed).

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

Important

The installation of the RD Session Host role service requires the computer to be restarted.

To install the Remote Desktop Session Host role service

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, right-click Roles, and then click Add Roles.

  3. In the Add Roles Wizard, on the Before You Begin page, click Next.

  4. On the Select Server Roles page, under Roles, select the Remote Desktop Services check box.

    Note

    If Remote Desktop Services is already installed on the server, the Remote Desktop Services check box will be selected and dimmed, and followed by “(Installed).”

  5. Click Next.

  6. On the Remote Desktop Services page, click Next.

  7. On the Select Role Services page, select the Remote Desktop Session Host check box, and then click Next.

    Note

    If you are installing the RD Session Host role service on a domain controller, you will receive a warning message because installing the RD Session Host role service on a domain controller is not recommended. For more information, see Installing RD Session Host on a Domain Controller.

  8. On the Uninstall and Reinstall Applications for Compatibility page, click Next.

  9. On the Specify Authentication Method for Remote Desktop Session Host page, select the appropriate authentication method for the RD Session Host server, and then click Next. For more information about authentication methods, see Configure the Network Level Authentication Setting for an RD Session Host Server.

  10. On the Specify Licensing Mode page, select the appropriate licensing mode for the RD Session Host server, and then click Next. For more information about licensing modes, see Specify the Remote Desktop Licensing Mode.

  11. On the Select User Groups Allowed Access To This Remote Desktop Session Host Server page, add the users or user groups that you want to be able to remotely connect to this RD Session Host server, and then click Next. For more information, see Configure the Remote Desktop Users Group.

  12. On the Configure Client Experience page, select the functionality that you want to be available to remote clients that are connected by using this RD Session Host server, and then click Next. For more information, see Configure the Client Experience on an RD Session Host Server.

  13. On the Confirm Installation Selections page, verify that the RD Session Host role service will be installed, and then click Install.

  14. On the Installation Progress page, installation progress will be noted.

  15. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then in the Add Role Services window, click Yes to restart the server.

  16. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  17. After the server restarts and you log on to the computer, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that the installation of RD Session Host succeeded.

    You can also confirm that RD Session Host is installed by following these steps:

    1. Start Server Manager.

    2. Under Roles Summary, click Remote Desktop Services.

    3. Under System Services, confirm that the status for Remote Desktop Services is Running.

    4. Under Role Services, confirm that the status for Remote Desktop Session Host is Installed.

Install the Remote Desktop Session Host role service (when Remote Desktop Services is already installed)

Use the following procedure to install the RD Session Host role service when Remote Desktop Services is already installed on the server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

Important

The installation of the RD Session Host role service requires the computer to be restarted.

To install the Remote Desktop Session Host role service when Remote Desktop Services is already installed

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, expand Roles.

  3. Right-click Remote Desktop Services, and then click Add Role Services.

  4. On the Select Role Services page, select the Remote Desktop Session Host check box, and then click Next.

    Note

    If you are installing the RD Session Host role service on a domain controller, you will receive a warning message because installing the RD Session Host role service on a domain controller is not recommended. For more information, see Installing RD Session Host on a Domain Controller.

  5. On the Uninstall and Reinstall Applications for Compatibility page, click Next.

  6. On the Specify Authentication Method for Remote Desktop Session Host page, select the appropriate authentication method for the RD Session Host server, and then click Next. For more information about authentication methods, see Configure the Network Level Authentication Setting for an RD Session Host Server.

  7. On the Specify Licensing Mode page, select the appropriate licensing mode for the RD Session Host server, and then click Next. For more information about licensing modes, see Specify the Remote Desktop Licensing Mode.

  8. On the Select User Groups Allowed Access To This Remote Desktop Session Host page, add the users or user groups that you want to be able to remotely connect to this RD Session Host server, and then click Next. For more information, see Configure the Remote Desktop Users Group.

  9. On the Configure Client Experience page, select the functionality that you want to be available to remote clients that are connected by using this RD Session Host server, and then click Next. For more information, see Configure the Client Experience on an RD Session Host Server.

  10. On the Confirm Installation Selections page, verify that the RD Session Host role service will be installed, and then click Install.

  11. On the Installation Progress page, installation progress will be noted.

  12. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then in the Add Role Services window, click Yes to restart the server.

  13. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  14. After the server restarts and you log on to the computer, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that the installation of RD Session Host succeeded.

    You can also confirm that RD Session Host is installed by following these steps:

    1. Start Server Manager.

    2. Under Roles Summary, click Remote Desktop Services.

    3. Under System Services, confirm that the status for Remote Desktop Services is Running.

    4. Under Role Services, confirm that the status for Remote Desktop Session Host is Installed.

Additional references

  • Configuring an RD Session Host Server

  • Overview of Remote Desktop Session Host (RD Session Host)

  • Checklist: RD Session Host Installation Prerequisites

  • Checklist: Configure an RD Session Host Server


Configure License Settings for an RD Session Host Server

Each user or computing device that connects to a Remote Desktop Session Host (RD Session Host) server must have a valid Remote Desktop Services client access license (RDS CAL) issued by a Remote Desktop license server.

To ensure that an RD Session Host server can contact a Remote Desktop license server to request RDS CALs for clients, you need to do the following on the RD Session Host server:

  • Specify the Remote Desktop Licensing Mode

  • Specify a License Server for the RD Session Host Server to Use

To be alerted to possible licensing configuration issues, use Licensing Diagnosis in Remote Desktop Session Host Configuration. For information about Licensing Diagnosis, see the topic "Identify Possible Licensing Problems for the RD Session Host Server" in the Remote Desktop Session Host Configuration Help in Windows Server 2008 R2.

Additional references

  • Configuring an RD Session Host Server

  • Checklist: RD Session Host Installation Prerequisites


Specify the Remote Desktop Licensing Mode

The Remote Desktop licensing mode determines the type of Remote Desktop Services client access licenses (RDS CALs) that a Remote Desktop Session Host (RD Session Host) server will request from a license server on behalf of a client connecting to the RD Session Host server.

Important

The Remote Desktop licensing mode configured on an RD Session Host server must match the type of RDS CALs available on the license server.

There are two types of RDS CALs:

  • RDS Per Device CAL: Permits one device (used by any user) to connect to an RD Session Host server.

  • RDS Per User CAL: Gives one user the right to access RD Session Host servers from an unlimited number of client computers or devices.

The Remote Desktop licensing mode for the RD Session Host server can be set in the following ways:

  • During the installation of the RD Session Host role service in Server Manager, on the Specify Licensing Mode page in the Add Roles Wizard.

    On the Specify Licensing Mode page, you can select Configure later if you are unsure during the installation whether to select Per Device or Per User. If you select Configure later, each time you log on to the RD Session Host server, a message will appear in the lower-right corner of the desktop reminding you that you need to configure the licensing mode for the RD Session Host server.

  • By configuring the Remote Desktop licensing mode for the RD Session Host server by using the Remote Desktop Session Host Configuration tool.

    If the Remote Desktop licensing mode choices are dimmed and you cannot make a selection, the Set the Remote Desktop licensing mode Group Policy setting has been enabled and has been applied to the RD Session Host server.

  • By applying the Set the Remote Desktop licensing mode Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about RD Licensing, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140434).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure License Settings for an RD Session Host Server


Specify a License Server for the RD Session Host Server to Use

A Remote Desktop Session Host (RD Session Host) server must be able to contact a Remote Desktop license server to request Remote Desktop Services client access licenses (RDS CALs) for users or computing devices that are connecting to the RD Session Host server.

In Windows Server 2008 R2, you must specify a license server for the RD Session Host server to use. Automatic license server discovery is no longer supported for an RD Session Host server that is running Windows Server 2008 R2.

Use the following procedure to specify a license server for the RD Session Host server to use.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify a license server for the RD Session Host server to use

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. Under Licensing in the Edit settings section, double-click Remote Desktop license servers.

  4. Click Add.

  5. In the Add License Server dialog box, select a license server from the list of known license servers, and then click Add. If the license server that you want to add is not listed, in the License server name or IP address box, type the name or IP address of the license server that you want to add, and then click Add.

    You can add more than one license server for the RD Session Host server to use. The RD Session Host server will contact the license servers in the order in which they appear in the Specified license servers box.

  6. Click OK to close the Add License Server dialog box, and then click OK to save your changes to the licensing settings.

You can also specify a license server for the RD Session Host server to use by applying the Use the specified Remote Desktop license servers Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the license servers configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure License Settings for an RD Session Host Server


Configure the Network Level Authentication Setting for an RD Session Host Server

Network Level Authentication can be used to enhance RD Session Host server security by requiring that the user be authenticated to an RD Session Host server before a session is created.

Network Level Authentication is an authentication method that completes user authentication before you establish a remote desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer from malicious users and malicious software. The advantages of Network Level Authentication are:

  • It requires fewer remote computer resources initially. The remote computer uses a limited number of resources before authenticating the user, rather than starting a full remote desktop connection as in previous versions.

  • It can help provide better security by reducing the risk of denial-of-service attacks.

To use Network Level Authentication, you must meet the following requirements:

  • The client computer must be using at least Remote Desktop Connection 6.0.

  • The client computer must be using an operating system, such as Windows® 7 or Windows Vista®, that supports the Credential Security Support Provider (CredSSP) protocol.

  • The RD Session Host server must be using Windows Server 2008 R2 or Windows Server 2008.

You can configure an RD Session Host server to only support connections from clients running Network Level Authentication. The Network Level Authentication setting for an RD Session Host server can be set in the following ways:

  • During the installation of the RD Session Host role service in Server Manager, on the Specify Authentication Method for Remote Desktop Session Host page in the Add Roles Wizard.

  • On the Remote tab in the System Properties dialog box on an RD Session Host server.

    If the Allow connections from computers running any version of Remote Desktop (less secure) is not selected and not enabled, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the RD Session Host server.

    To configure the Network Level Authentication setting by using the Remote tab in the System Properties dialog box on an RD Session Host server, see Change Remote Connection Settings.

  • On the General tab of the Properties dialog box for a connection in the Remote Desktop Session Host Configuration tool by selecting the Allow connections only from computers running Remote Desktop with Network Level Authentication check box.

    If the Allow connections only from computers running Remote Desktop with Network Level Authentication check box is selected and is dimmed, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the RD Session Host server.

  • By applying the Require user authentication for remote connections by using Network Level Authentication Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration or on the Remote tab.

To determine whether a computer is running a version of Remote Desktop Connection that supports Network Level Authentication, start Remote Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. In the About Remote Desktop Connection dialog box, look for the phrase Network Level Authentication supported.

For more information about Network Level Authentication and Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkID=138055).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configuring an RD Session Host Server

  • Install the RD Session Host Role Service


Install Programs on an RD Session Host Server

You should install the RD Session Host role service on the computer before you install any programs that you want to make available to users. If you install the RD Session Host role service on a computer that already has programs installed, some of the existing programs may not work correctly in a multiuser environment. Uninstalling and then reinstalling the affected programs may resolve these issues.

To ensure that an application is installed correctly to work in a multiuser environment, you must put the RD Session Host server into a special installation mode before you install the application on the RD Session Host server. This special installation mode ensures that the correct registry entries and .ini files that are needed to support running the application in a multiuser environment are created during the installation process.

You can put an RD Session Host server into this special installation mode by using either of the following:

  • Install Application on Remote Desktop Session Host tool under Programs in Control Panel. This tool will run a wizard to help install the application.

  • Change user /install command at a command prompt. You will have to start the installation of the application manually.

After the application is installed, you must put the RD Session Host server into execution mode before remote users begin using the application. The Install Application on Remote Desktop Session Host tool will automatically put the RD Session Host server into execution mode when it is finished running. To put the RD Session Host server into execution mode from a command prompt, use the change user /execute command.

Additional considerations

  • Some programs may require minor setup modifications to run correctly on an RD Session Host server.

  • If you have programs that are related to each other or have dependencies on each other, you should install the programs on the same RD Session Host server. For example, you should install Microsoft Office as a suite on the same RD Session Host server instead of installing individual Office programs on separate RD Session Host servers.

  • You should consider installing individual programs on separate RD Session Host servers in the following circumstances:

    • The program has compatibility issues that may affect other programs.

    • A single program and the number of associated users may fill server capacity.

  • For more information about command-line tools for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138135).

  • For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).

Additional references

  • Configuring an RD Session Host Server


Configure the Remote Desktop Users Group

The Remote Desktop Users group on an RD Session Host server is used to give users and groups permission to remotely connect to an RD Session Host server.

You can add users and groups to the Remote Desktop Users group in the following ways:

  • Local Users and Groups snap-in

  • Active Directory Users and Computers snap-in, if the RD Session Host server is installed on a domain controller

  • On the Remote tab in the System Properties dialog box on an RD Session Host server

You can use the following procedure to add users and groups to the Remote Desktop Users group by using the Remote tab in the System Properties dialog box on an RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

To add users and groups to the Remote Desktop Users group by using the Remote tab

  1. Start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click Select Users. Add the users or groups that need to connect to the RD Session Host server by using Remote Desktop. The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

    If you select Don't allow connections to this computer on the Remote tab, no users will be able to connect remotely to this computer, even if they are members of the Remote Desktop Users group.

Additional references

  • Configuring an RD Session Host Server


Configure the Client Experience on an RD Session Host Server

You can configure a Remote Desktop Session Host (RD Session Host) server so that users connecting to a remote desktop session can use functionality similar to that provided by Windows 7.

Important

Providing this functionality requires additional system and bandwidth resources and may affect the scalability of the RD Session Host server.

During the installation of the RD Session Host role service in Server Manager, you can automatically configure the following functionality on the Configure Client Experience page in the Add Roles Wizard:

  • Audio and video playback

  • Audio recording redirection

  • Desktop composition

If you configure the RD Session Host server to provide audio and video playback or desktop composition, the Desktop Experience feature will be installed on the RD Session Host server. For more information about Desktop Experience, see Desktop Experience Feature.

To manually configure this functionality, see the following topics:

  • Configure Audio and Video Playback on an RD Session Host Server

  • Configure Audio Recording Redirection on an RD Session Host Server

  • Configure Desktop Composition on an RD Session Host Server


Desktop Experience Feature

The Desktop Experience feature allows you to install a variety of components and features that are provided in the Windows 7 operating system onto a computer that is running the Windows Server 2008 R2 operating system. After you install Desktop Experience, the Windows 7 components and features, such as Windows Media Player, will appear under All Programs on the Start menu.

Note

Installing Desktop Experience does not automatically turn on any of its features or components. After installing Desktop Experience, you must manually enable or configure the features or components.

For information about installing Desktop Experience, see Install Desktop Experience on an RD Session Host Server.

What’s in the Desktop Experience feature

Desktop Experience includes the following Windows 7 components and features:

  • Windows Calendar

  • Windows Mail

  • Windows Media Player

  • Desktop themes

  • Video for Windows (AVI support)

  • Windows Photo Gallery

  • Windows SideShow

  • Windows Defender

  • Disk Cleanup

  • Sync Center

  • Sound Recorder

  • Character Map

  • Snipping Tool

Additional references

  • Configure the Client Experience on an RD Session Host Server


Install Desktop Experience on an RD Session Host Server

When a user uses Remote Desktop Connection to connect to a Remote Desktop Session Host (RD Session Host) server, the desktop that exists on the RD Session Host server is reproduced, by default, in the remote session. To make the remote session look and feel more like the user's local Windows 7 desktop experience, install the Desktop Experience feature on an RD Session Host server that is running Windows Server 2008 R2.

Desktop Experience installs components and features of Windows 7, such as Windows Media Player, Windows Defender, and Windows Calendar. For more information about Desktop Experience, see Desktop Experience Feature.

Install Desktop Experience

Use the following procedure to install Desktop Experience on the server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The installation of Desktop Experience requires the computer to be restarted.

To install Desktop Experience

  1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, click Features, and then in the Features Summary section, click Add Features.

  3. On the Select Features page, select the Desktop Experience check box.

  4. Review the information about the required features that need to be installed with the Desktop Experience feature, and then click Add Required Features.

  5. Click Next.

  6. On the Confirm Installation Selections page, verify that the Desktop Experience feature will be installed, and then click Install.

  7. On the Installation Progress page, installation progress will be noted.

  8. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then click Yes to restart the server.

  9. After the server restarts and you log on to the computer with the same user account, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that the installation of Desktop Experience succeeded, and then click Close.

    You can also confirm that Desktop Experience is installed by following these steps:

    1. Start Server Manager.

    2. In the left pane, click Features, and then in the Features Summary section, confirm that Desktop Experience is listed as installed.

After you install Desktop Experience, the Windows 7 components and features, such as Windows Media Player, will appear under All Programs on the Start menu.

Uninstall (Remove) Desktop Experience

Use the following procedure to uninstall (remove) Desktop Experience from the server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The removal of Desktop Experience from the server requires the computer to be restarted.

To uninstall (remove) Desktop Experience

  1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, click Features, and then in the Features Summary section, click Remove Features.

  3. On the Select Features page, clear the Desktop Experience check box, and then click Next.

  4. On the Confirm Removal Selections page, verify that the Desktop Experience feature will be removed, and then click Remove.

  5. On the Removal Progress page, removal progress will be noted.

  6. On the Removal Results page, you are prompted to restart the server to finish the removal process. Click Close, and then click Yes to restart the server.

  7. After the server restarts and you log on to the computer with the same user account, the remaining steps of the removal process will finish. When the Removal Results page appears, confirm that the removal of Desktop Experience succeeded, and then click Close.

    You can also confirm that Desktop Experience is removed by following these steps:

    1. Start Server Manager.

    2. In the left pane, click Features, and then in the Features Summary section, confirm that Desktop Experience is no longer listed as installed.

Additional references

  • Configure the Client Experience on an RD Session Host Server


Configure Audio and Video Playback on an RD Session Host Server

Audio and video playback allows users to redirect the remote computer’s audio in a remote session, and provides an improved experience for video playback in remote sessions. By default, audio and video playback is not allowed when connecting to a computer running Windows Server 2008 R2.

Note

Users can specify where to play the remote computer’s audio output by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). Video playback can be configured by using the videoplayback setting in a Remote Desktop Protocol (.rdp) file. By default, video playback is enabled.

Manually configuring audio and video playback

To manually configure audio and video playback on a Remote Desktop Session Host (RD Session Host) server, you need to do the following:

  • Install the Desktop Experience feature.

  • Start the Windows Audio service.

  • Enable the Allow audio and video playback redirection Group Policy setting.

  • Set the maximum color depth to 32 bits per pixel.

Install the Desktop Experience feature

For information about installing Desktop Experience, see Install Desktop Experience on an RD Session Host Server.

Start the Windows Audio service

Use the following procedure to start the Windows Audio service on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To start the Windows Audio service

  1. On the RD Session Host server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the Services pane, right-click Windows Audio, and then click Properties.

  4. On the General tab, in the Startup type box, select Automatic, and then click Apply.

  5. Under Service status, click Start.

  6. Click OK to close the Windows Audio Properties dialog box.

  7. Confirm that the Status column for the Windows Audio service displays Started.

Enable the Allow audio and video playback redirection Group Policy setting

To allow audio and video playback when connecting to a computer running Windows Server 2008 R2, you must enable the Allow audio and video playback redirection Group Policy setting. The Allow audio and video playback redirection Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Set the maximum color depth to 32 bits per pixel

Use the following procedure to set the maximum color depth to 32 bits per pixel on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To set the maximum color depth to 32 bits per pixel

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. Under Connections, right-click the name of the connection that you want to configure (for example, RDP-Tcp), and then click Properties.

  4. On the Client Settings tab, in the Limit Maximum Color Depth box, select 32 bits per pixel.

  5. Click OK. Changes to color depth settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the RD Session Host server.

You can also set the maximum color depth by applying the Limit maximum color depth Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure the Client Experience on an RD Session Host Server


Configure Audio Recording Redirection on an RD Session Host Server

Audio recording redirection allows users to record audio to the remote computer in a remote session. By default, audio recording redirection is not allowed when connecting to a computer running Windows Server 2008 R2.

Note

Users can specify whether to record audio to the remote computer by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). Users can record audio by using an audio input device on the local computer, such as a built-in microphone.

Manually configuring audio recording redirection

To manually configure audio recording redirection on a Remote Desktop Session Host (RD Session Host) server, you need to do the following:

  • Start the Windows Audio service.

  • Enable the Allow audio recording redirection Group Policy setting.

Start the Windows Audio service

Use the following procedure to start the Windows Audio service on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To start the Windows Audio service

  1. On the RD Session Host server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the Services pane, right-click Windows Audio, and then click Properties.

  4. On the General tab, in the Startup type box, select Automatic, and then click Apply.

  5. Under Service status, click Start.

  6. Click OK to close the Windows Audio Properties dialog box.

  7. Confirm that the Status column for the Windows Audio service displays Started.

Enable the Allow audio recording redirection Group Policy setting

To allow audio recording redirection when connecting to a computer running Windows Server 2008 R2, you must enable the Allow audio recording redirection Group Policy setting. The Allow audio recording redirection Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure the Client Experience on an RD Session Host Server


Configure Desktop Composition on an RD Session Host Server

Desktop composition provides the user interface elements of Windows Aero, such as translucent windows, for remote desktop sessions. By default, desktop composition is not allowed when connecting to a computer running Windows Server 2008 R2.

Important

Because Windows Aero requires additional system and bandwidth resources, allowing desktop composition for remote desktop sessions can reduce connection performance, particularly over slow links, and increase the load on the Remote Desktop Session Host (RD Session Host) server.

Desktop composition is not available for RemoteApp sessions. In addition, the client computer must have the necessary hardware to support Windows Aero features.

Manually configuring desktop composition

To manually configure desktop composition on an RD Session Host server, you need to do the following:

  • Install the Desktop Experience feature.

  • Start the Themes service.

  • Enable the Allow desktop composition for remote desktop sessions Group Policy setting.

  • Set the maximum color depth to 32 bits per pixel.

Install the Desktop Experience feature

For information about installing Desktop Experience, see Install Desktop Experience on an RD Session Host Server.

Start the Themes service

Use the following procedure to start the Themes service on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To start the Themes service

  1. On the RD Session Host server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the Services pane, right-click Themes, and then click Properties.

  4. On the General tab, in the Startup type box, select Automatic, and then click Apply.

  5. Under Service status, click Start.

  6. Click OK to close the Themes Properties dialog box.

  7. Confirm that the Status column for the Themes service displays Started.

Enable the Allow desktop composition for remote desktop sessions Group Policy setting

To allow desktop composition when connecting to a computer running Windows Server 2008 R2, you must enable the Allow desktop composition for remote desktop sessions Group Policy setting. The Allow desktop composition for remote desktop sessions Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Set the maximum color depth to 32 bits per pixel

Use the following procedure to set the maximum color depth to 32 bits per pixel on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To set the maximum color depth to 32 bits per pixel

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. Under Connections, right-click the name of the connection that you want to configure (for example, RDP-Tcp), and then click Properties.

  4. On the Client Settings tab, in the Limit Maximum Color Depth box, select 32 bits per pixel.

  5. Click OK. Changes to color depth settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the RD Session Host server.

You can also set the maximum color depth by applying the Limit maximum color depth Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure the Client Experience on an RD Session Host Server


Group Policy Settings and Configuring the Client Experience

During the installation of the RD Session Host role service in Server Manager, you can automatically configure the following functionality on the Configure Client Experience page in the Add Roles Wizard:

  • Audio and video playback

  • Audio recording redirection

  • Desktop composition

Server Manager automatically checks that there are no Group Policy settings currently being applied to the computer that would prevent the requested functionality from being correctly configured. If there is a Group Policy setting being applied to the computer that would prevent the requested functionality from being correctly configured, that selection will be dimmed and you will not be able to select the associated check box on the Configure Client Experience page.

The following is a list of Group Policy settings that Server Manager checks:

  • Allow audio and video playback redirection

    If the Allow audio and video playback redirection Group Policy setting is disabled, you cannot select the Audio and video playback check box on the Configure Client Experience page.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection.

  • Allow audio recording redirection

    If the Allow audio recording redirection Group Policy setting is disabled, you cannot select the Audio recording redirection check box on the Configure Client Experience page.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection.

  • Allow desktop composition for remote desktop sessions

    If the Allow desktop composition for remote desktop sessions Group Policy setting is disabled, you cannot select the Desktop composition check box on the Configure Client Experience page.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment.

  • Limit maximum color depth

    If the Limit maximum color depth Group Policy setting is enabled and the maximum color depth selected is less than 32 bits per pixel, you cannot select the Desktop composition check box on the Configure Client Experience page.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment.

These Group Policy settings can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure the Client Experience on an RD Session Host Server


Managing an RD Session Host Server

This section provides procedures for managing an RD Session Host server. The following topics are covered:

  • Change Remote Connection Settings

  • Enable RDC Client Single Sign-On for Remote Desktop Services

  • Manage User Profiles for Remote Desktop Services

  • Configure Font Smoothing for Remote Sessions

  • Monitor an RD Session Host Server with Windows System Resource Manager

  • Uninstall the RD Session Host Role Service


Change Remote Connection Settings

You can use the following procedure to change the remote connection settings on an RD Session Host server.

On the RD Session Host server, on the Remote tab in the System Properties dialog box, you can change the following remote connection settings:

  • Network Level Authentication requirement for Remote Desktop connections

  • Membership of the Remote Desktop Users group

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

To change remote connections settings

  1. Start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click either of the following, depending on your environment:

    • Allow connections from computers running any version of Remote Desktop (less secure)

    • Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)

    For more information about the two options, click the Help me choose link on the Remote tab.

    On the Remote tab, if you select Don't allow connections to this computer, no users will be able to connect remotely to this computer, even if they are members of the Remote Desktop Users group.

  4. Click Select Users to add the users and groups that need to connect to the computer by using Remote Desktop. The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

Additional references

  • Managing an RD Session Host Server

  • Configure the Network Level Authentication Setting for an RD Session Host Server

  • Configure the Remote Desktop Users Group


Enable RDC Client Single Sign-On for Remote Desktop Services

Single sign-on is an authentication method that allows users with a domain account to log on once to a client computer by using a password, and then gain access to remote servers without being asked for their credentials again.

Note

This topic only covers single sign-on authentication from the Remote Desktop Connection client to an RD Session Host server. In Windows Server 2008 R2, you can enable single sign-on between Remote Desktop Web Access (RD Web Access) and RD Session Host as well. For more information about single sign-on with RD Web Access, see http://go.microsoft.com/fwlink/?LinkId=137334.

To implement single sign-on functionality in Remote Desktop Services, ensure that you meet the following requirements:

  • You can only use single sign-on for remote connections from a computer running Windows 7, Windows Vista, or Windows XP with Service Pack 3 to an RD Session Host server running Windows Server 2008 R2 or Windows Server 2008. You can also use single sign-on for remote connections from one server running Windows Server 2008 R2 or Windows Server 2008 to another server running Windows Server 2008 R2 or Windows Server 2008.

  • Ensure that the user accounts that are used for logging on have appropriate rights to log on to both the RD Session Host server and the client computer.

  • Your client computer and RD Session Host server must be joined to a domain.

To configure the recommended settings for your RD Session Host server, complete the following steps:

  • Configure authentication on the RD Session Host server.

  • Configure the client computer to allow default credentials to be used for logging on to the specified RD Session Host servers.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To configure authentication on the RD Session Host server

  1. Open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the appropriate connection (for example, RDP-Tcp), and then click Properties.

  3. In the Properties dialog box, on the General tab, verify that the Security Layer value is set to either Negotiate or SSL (TLS 1.0).

  4. On the Log on Settings tab, ensure that the Always prompt for password check box is not selected, and then click OK.

After you configure authentication on the RD Session Host server, you must allow default credential usage on the RD Session Host server by using Group Policy. The Group Policy settings can be found in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

For more information about security and Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkID=138055).

Additional references

  • Managing an RD Session Host Server


Manage User Profiles for Remote Desktop Services

A user profile describes the configuration for a specific user, including the user’s environment and preference settings. Unless you carefully plan and manage user profiles in an RD Session Host server environment, user profiles can become large in size and can cause problems, such as slow logon times, when a user connects to an RD Session Host server. User profile management is also important when users connect to several different RD Session Host servers or connect to RD Session Host servers in remote locations.

You can specify a Remote Desktop Services-specific profile path and home folder for a user connecting to an RD Session Host server. This profile and home folder will only be used for Remote Desktop Services sessions. You should assign a separate profile for Remote Desktop Services sessions because many of the common options that are stored in profiles, such as screen savers and animated menu affects, are not desirable when using Remote Desktop Services.

You can manually configure these settings on the Remote Desktop Services Profile tab on the Properties sheet of a user account in the Local Users and Groups snap-in or the Active Directory Users and Computers snap-in.

You can also use the following Group Policy settings to configure these settings:

  • Set RD User Home Directory

  • Set path for RD Roaming User Profile

  • Use mandatory profiles on the RD Session Host server

The Group Policy settings can be found in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

Note

The Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration or on the Remote tab.

For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Managing an RD Session Host Server


Configure Font Smoothing for Remote Sessions

Windows Server 2008 R2 supports ClearType®, which is a technology for displaying computer fonts so that they appear clear and smooth, especially when you are using an LCD monitor.

An RD Session Host server running Windows Server 2008 R2 can provide ClearType functionality in a remote session when a client computer connects to the RD Session Host server by using Remote Desktop Connection (RDC).

Note

ClearType functionality is referred to as font smoothing in Remote Desktop Connection.

Font smoothing is available if the client computer is running any of the following:

  • Windows 7

  • Windows Vista

  • Windows Server 2003 with Service Pack 1 (SP1) and at least RDC 6.0

  • Windows XP with SP2 and at least RDC 6.0

Important

Using font smoothing in a remote session will increase the amount of bandwidth used between the client computer and the RD Session Host server.

To make font smoothing available in a remote session

  1. On the client computer, open Remote Desktop Connection. To open Remote Desktop Connection, click Start, point to All Programs, click Accessories, and then click Remote Desktop Connection.

  2. In the Remote Desktop Connection dialog box, click Options.

  3. On the Experience tab, select the Font smoothing check box.

  4. Configure any remaining connection settings, and then click Connect.

Additional references

  • Managing an RD Session Host Server


Monitor an RD Session Host Server with Windows System Resource Manager

Windows System Resource Manager (WSRM) on Windows Server 2008 R2 allows you to control how CPU and memory resources are allocated to applications, services, and processes on the computer. Managing resources in this way improves system performance and reduces the chance that applications, services, or processes will take CPU or memory resources away from one another and slow down the performance of the computer. Managing resources also creates a more consistent and predictable experience for users of applications and services running on the computer.

You can use Windows System Resource Manager to manage users or multiple applications on a computer on which Remote Desktop Services is installed.

Before installing and configuring WSRM, install the RD Session Host role service on your computer. To install RD Session Host, see Install the RD Session Host Role Service. To install WSRM, go to Features in Server Manager.

For more information about installing, configuring, and using Windows System Resource Manager, see the Windows System Resource Manager Help in Windows Server 2008 R2.

There are two features of WSRM that will be of particular interest to RD Session Host server administrators:

  • Resource allocation policies

  • Resource Monitor

Resource allocation policies

Windows System Resource Manager uses resource allocation policies to determine how computer resources, such as CPU and memory, are allocated to processes running on the computer. The three resource allocation policies that are specifically designed for computers running Remote Desktop Services are:

  • Equal_Per_User

  • Equal_Per_Session

  • Weighted_Remote_Sessions

If you implement the Equal_Per_Session resource allocation policy, each user session (and its associated processes) gets an equal share of the CPU resources on the computer.

Resource Monitor

You should collect data about the performance of your RD Session Host server before and after implementing a resource allocation policy (or making any other WSRM-related configuration changes). You can use Resource Monitor in the Windows System Resource Manager snap-in to collect and view data about the usage of hardware resources and the activity of system services on the computer.

Additional references

  • Managing an RD Session Host Server


Uninstall the RD Session Host Role Service

Use the following procedure to uninstall (remove) the RD Session Host role service from the server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

Important

The removal of the RD Session Host role service from the server requires the computer to be restarted.

To uninstall (remove) the Remote Desktop Session Host role service

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, expand Roles.

  3. Right-click Remote Desktop Services, and then click Remove Role Services.

  4. On the Select Role Services page, clear the Remote Desktop Session Host check box, and then click Next.

  5. On the Confirm Removal Selections page, click Remove.

  6. On the Removal Progress page, removal progress will be noted.

  7. On the Removal Results page, you are prompted to restart the server to finish the removal process. Click Close, and then in the Remove Role Services window, click Yes to restart the server.

  8. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  9. After the server restarts and you log on to the computer, the remaining steps of the removal process will finish. When the Removal Results page appears, confirm that the removal of RD Session Host succeeded.

    You can also confirm that RD Session Host is removed by following these steps:

    1. Start Server Manager.

    2. Under Roles Summary, verify that Remote Desktop Services does not appear as a role that is installed.

Additional references

  • Managing an RD Session Host Server


Remote Desktop Virtualization Host

The procedures in this section are designed to help you set up RD Virtualization Host in your organization.

This section contains the following procedures:

  • Overview of RD Virtualization Host

  • Install the Remote Desktop Virtualization Host Role Service


Overview of RD Virtualization Host

Remote Desktop Virtualization Host (RD Virtualization Host) is a Remote Desktop Services role service included with Windows Server 2008 R2. RD Virtualization Host integrates with Hyper-V to provide virtual machines by using RemoteApp and Desktop Connection. RD Virtualization Host can be configured so that each user in your organization is assigned a unique virtual machine, or users are redirected to a shared virtual machine pool where a virtual machine is dynamically assigned.

RD Virtualization Host uses Remote Desktop Connection Broker (RD Connection Broker) to determine where the user is redirected. If a user is assigned and requests a personal virtual desktop, RD Connection Broker redirects the user to this virtual machine. If the virtual machine is not turned on, RD Virtualization Host turns on the virtual machine and then connects the user. If the user is connecting to a shared virtual machine pool, RD Connection Broker first checks to see if the user has a disconnected session in the pool. If the user has a disconnected session, they are reconnected to that virtual machine. If the user does not have a disconnected session, a virtual machine in that pool is dynamically assigned to the user, if one is available.

For more information about installing and configuring RD Virtualization Host, see the RD Virtualization Host Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=137796).

Additional references

  • Install the Remote Desktop Virtualization Host Role Service


Install the Remote Desktop Virtualization Host Role Service

Remote Desktop Virtualization Host (RD Virtualization Host) is a Remote Desktop Services role service available in Windows Server 2008 R2. RD Virtualization Host is installed by using Server Manager. When the RD Virtualization Host role service is installed, Server Manager checks to see if Hyper-V is installed. If Hyper-V is not installed, Server Manager will install it.

Important

The RD Virtualization Host server must meet the hardware requirement for the Hyper-V server role. For more information about Hyper-V hardware requirements, see http://go.microsoft.com/fwlink/?LinkId=129920.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To install the RD Virtualization Host role service by using Server Manager

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. Expand Roles, and then click Remote Desktop Services.

  3. Under Role Services, click Add Role Services.

  4. Select the Remote Desktop Virtualization Host check box, and then click Next. If Hyper-V is not installed on this computer, Server Manager will install it automatically.

  5. Click Install.

  6. When the installation is finished, click Close.

For more information about installing and configuring the RD Virtualization Host role service, see the RD Virtualization Host Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=137796).

Additional references

  • Overview of RD Virtualization Host