Remote Desktop Session Host Configuration

You can use Remote Desktop Session Host Configuration (formerly Terminal Services Configuration) to configure settings for new connections, modify the settings of existing connections, and delete connections. You can configure settings on a per connection basis, or for the server as a whole.

The following topics are covered:

  • Overview of Remote Desktop Session Host Configuration

  • Configuring Remote Desktop Services Connections

  • Configuring RD Session Host Server Settings

  • Managing Remote Desktop Services Connections

In addition, for information about installing, configuring, and managing the Remote Desktop Connection Broker (RD Connection Broker) role service, see Remote Desktop Connection Broker.

Additional references

  • For more information about Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).


Overview of Remote Desktop Session Host Configuration

You can use Remote Desktop Session Host Configuration to configure settings for new connections, modify the settings of existing connections, and delete connections. You can configure settings on a per connection basis, or for the server as a whole.

Important

You can only use Remote Desktop Session Host Configuration in Windows Server 2008 R2 to configure a Remote Desktop Session Host (RD Session Host) server running Windows Server 2008 or Windows Server 2008 R2.

Note

Remote Desktop Session Host (RD Session Host) was formerly known as the Terminal Server role service, and Remote Desktop Session Host (RD Session Host) server was formerly known as Terminal Server.

The following topics provide information about settings that apply to the server as a whole:

  • Restrict Users to a Single Session

  • Configure Temporary Folders for an RD Session Host Server

  • Deny New User Logons to an RD Session Host Server

  • Configure License Settings for an RD Session Host Server

  • Configure Remote Desktop IP Virtualization

  • Configure Printer Support

  • Configure RD Connection Broker Settings for an RD Session Host Server

The following topics provide information about settings that apply to connections:

  • Managing Remote Desktop Services Connections

  • Configure Security Settings for Remote Desktop Services Connections

  • Configure Client Settings for Remote Desktop Services Connections

  • Configure Session Settings for Remote Desktop Services Connections

The following topics are also covered:

  • Running Remote Desktop Session Host Configuration

  • Connect to Another RD Session Host Server by Using Remote Desktop Session Host Configuration

  • Remote Desktop for Administration


Running Remote Desktop Session Host Configuration

You can run Remote Desktop Session Host Configuration from any of the following locations:

  • Start menu

  • Server Manager

  • Microsoft Management Console

Note

Remote Desktop Session Host Configuration is only available in Server Manager if the Remote Desktop Services role is installed on the computer.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To run Remote Desktop Session Host Configuration from the Start menu

  • Click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  • Click Start, click Run, type tsconfig.msc and then press ENTER.
To run Remote Desktop Session Host Configuration from Server Manager

  1. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, expand Roles.

  3. Expand Remote Desktop Services, and then click Remote Desktop Session Host Configuration.
To run Remote Desktop Session Host Configuration from the Microsoft Management Console

  1. Click Start, click Run, type mmc and then press ENTER.

  2. On the File menu, click Add/Remove Snap-in.

  3. Under Available snap-ins, click Remote Desktop Session Host Configuration, and then click Add.

  4. In the Select Computer dialog box, select whether you want to connect to the local computer or to another computer. If you select Another computer, either type in the name of the computer or use Browse to search for the computer.

  5. Click OK.

  6. In the Add or Remove Snap-ins dialog box, click OK.

Additional references

  • Overview of Remote Desktop Session Host Configuration

  • Connect to Another RD Session Host Server by Using Remote Desktop Session Host Configuration


Connect to Another RD Session Host Server by Using Remote Desktop Session Host Configuration

In Windows Server 2008 R2 you can use Remote Desktop Session Host Configuration to configure the settings on the local Remote Desktop Session Host (RD Session Host) server, or to connect to another RD Session Host server and configure the settings for that RD Session Host server remotely.

Important

You can only use Remote Desktop Session Host Configuration in Windows Server 2008 R2 to configure an RD Session Host server running Windows Server 2008 or Windows Server 2008 R2.

To connect to another RD Session Host server by using Remote Desktop Session Host Configuration

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. On the Action menu, click Connect to Remote Desktop Session Host Server.

  3. In the Select Computer dialog box, select Another computer, type the name of the computer in the box or click Browse to search for the computer, and then click OK.

Additional references

  • Overview of Remote Desktop Session Host Configuration

  • Running Remote Desktop Session Host Configuration


Remote Desktop for Administration

You can use Remote Desktop Session Host Configuration on a computer even if the RD Session Host role service is not installed on the computer. If the RD Session Host role service is not installed, This computer is configured for Remote Desktop for Administration will display in the results pane of Remote Desktop Session Host Configuration.

The following are limitations of Remote Desktop for Administration:

  • The default connection (RDP-Tcp) only allows a maximum of two simultaneous remote connections.

  • Licensing settings cannot be configured.

  • RD Connection Broker settings cannot be configured.

  • User logon mode cannot be configured.

To remove these limitations, you must install the RD Session Host role service on the computer. For more information about installing the RD Session Host role service, see Checklist: RD Session Host Installation Prerequisites.

Additional references

  • Overview of Remote Desktop Session Host Configuration

  • Configure the Number of Simultaneous Remote Connections Allowed for a Connection

  • Configure License Settings for an RD Session Host Server

  • Configure RD Connection Broker Settings for an RD Session Host Server

  • Deny New User Logons to an RD Session Host Server


Configuring Remote Desktop Services Connections

This section provides procedures for configuring Remote Desktop Services connections. The following topics are covered:

  • Configure Security Settings for Remote Desktop Services Connections

  • Configure Client Settings for Remote Desktop Services Connections

  • Configure Session Settings for Remote Desktop Services Connections

Additional references

  • Managing Remote Desktop Services Connections


Configure Security Settings for Remote Desktop Services Connections

This section provides procedures for configuring security settings for Remote Desktop Services connections. The following topics are covered:

  • Configure Server Authentication and Encryption Levels

  • Configure Network Level Authentication for Remote Desktop Services Connections

  • Configure Client Logon Information for Remote Desktop Services Connections

  • Configure Permissions for Remote Desktop Services Connections

Additional references

  • Configuring Remote Desktop Services Connections

  • Managing Remote Desktop Services Connections


Configure Server Authentication and Encryption Levels

By default, Remote Desktop Services sessions are configured to negotiate the encryption level from the client to the RD Session Host server. You can enhance the security of Remote Desktop Services sessions by requiring the use of Transport Layer Security (TLS) 1.0. TLS 1.0 verifies the identity of the RD Session Host server and encrypts all communication between the RD Session Host server and the client computer. The RD Session Host server and the client computer must be correctly configured for TLS to provide enhanced security.

Note

For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).

Three security layers are available.

Security layer | Description
SSL (TLS 1.0) | SSL (TLS 1.0) will be used for server authentication and for encrypting all data transferred between the server and the client.
Negotiate | This is the default setting. The most secure layer that is supported by the client will be used. If supported, SSL (TLS 1.0) will be used. If the client does not support SSL (TLS 1.0), the RDP Security Layer will be used.
RDP Security Layer | Communication between the server and the client will use native RDP encryption. If you select RDP Security Layer, you cannot use Network Level Authentication.

A certificate, used to verify the identity of the RD Session Host server and encrypt communication between the RD Session Host and the client, is required to use the TLS 1.0 security layer. You can select a certificate that you have installed on the RD Session Host server, or you can use a self-signed certificate.

Caution

We recommend that you obtain and install a certificate issued by one of the trusted public certification authorities that participate in the Microsoft Root Certificate Program Members program.

By default, Remote Desktop Services connections are encrypted at the highest level of security available. However, some older versions of the Remote Desktop Connection client do not support this high level of encryption. If your network contains such legacy clients, you can set the encryption level of the connection to send and receive data at the highest encryption level supported by the client.

Four encryption levels are available.

Encryption level | Description
FIPS Compliant | This level encrypts and decrypts data sent from the client to the server and from the server to the client by using Federal Information Process Standard (FIPS) 140-1 validated encryption methods. Clients that do not support this level of encryption cannot connect.
High | This level encrypts data sent from the client to the server and from the server to the client by using 128-bit encryption. Use this level when the RD Session Host server is running in an environment containing 128-bit clients only (such as Remote Desktop Connection clients). Clients that do not support this level of encryption will not be able to connect.
Client Compatible | This is the default setting. This level encrypts data sent between the client and the server at the maximum key strength supported by the client. Use this level when the RD Session Host server is running in an environment containing mixed or legacy clients.
Low | This level encrypts data sent from the client to the server by using 56-bit encryption. Data sent from the server to the client is not encrypted.

Use the following procedure to configure the server authentication and encryption settings for a connection on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the server authentication and encryption settings for a connection

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, on the General tab, select the server authentication and encryption settings that are appropriate for your environment, based on your security requirements and the level of security that your client computers can support.

  4. If you select SSL (TLS 1.0), either select a certificate that is installed on the RD Session Host server, or click Default to generate a self-signed certificate. If you are using a self-signed certificate, the name of the certificate will display as Auto generated.

  5. Click OK.

You can also configure server authentication and encryption settings by applying the following Group Policy settings:

  • Set client connection encryption level

  • Require use of specific security layer for remote (RDP) connections

  • Server Authentication Certificate Template

  • Require user authentication for remote connections by using Network Level Authentication

These Group Policy settings are located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that these Group Policy settings will take precedence over the settings configured in Remote Desktop Session Host Configuration, with the exception of the Server Authentication Certificate Template policy setting.

You can configure the RD Session Host server to use FIPS as the encryption level by applying the System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that this Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration and takes precedence over the Set client connection encryption level policy setting.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure Security Settings for Remote Desktop Services Connections

  • Configure Network Level Authentication for Remote Desktop Services Connections


Configure Network Level Authentication for Remote Desktop Services Connections

Network Level Authentication is an authentication method that can be used to enhance RD Session Host server security by requiring that the user be authenticated to the RD Session Host server before a session is created.

Network Level Authentication completes user authentication before you establish a remote desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer from malicious users and malicious software. The advantages of Network Level Authentication are:

  • It requires fewer remote computer resources initially. The remote computer uses a limited number of resources before authenticating the user, rather than starting a full remote desktop connection as in previous versions.

  • It can help provide better security by reducing the risk of denial-of-service attacks.

To use Network Level Authentication, you must meet the following requirements:

  • The client computer must be using at least Remote Desktop Connection 6.0.

  • The client computer must be using an operating system, such as Windows 7, Windows Vista, or Windows XP with Service Pack 3, that supports the Credential Security Support Provider (CredSSP) protocol.

  • The RD Session Host server must be running Windows Server 2008 R2 or Windows Server 2008.

Use the following procedure to configure Network Level Authentication for a connection.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure Network Level Authentication for a connection

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. On the General tab, select the Allow connections only from computers running Remote Desktop with Network Level Authentication check box.

    If the Allow connections only from computers running Remote Desktop with Network Level Authentication check box is selected and is not enabled, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the RD Session Host server.

  4. Click OK.

The Network Level Authentication setting for an RD Session Host server can also be set in the following ways:

  • During the installation of the RD Session Host role service in Server Manager, on the Specify Authentication Method for Remote Desktop Session Host page in the Add Roles Wizard.

  • On the Remote tab in the System Properties dialog box on an RD Session Host server.

    If the Allow connections from computers running any version of Remote Desktop (less secure) is not selected and is not enabled, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the RD Session Host server.

    To configure the Network Level Authentication setting by using the Remote tab in the System Properties dialog box on an RD Session Host server, see Change Remote Connection Settings.

  • By applying the Require user authentication for remote connections by using Network Level Authentication Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration or on the Remote tab.

To determine whether a computer is running a version of Remote Desktop Connection that supports Network Level Authentication, start Remote Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. Look for the phrase Network Level Authentication supported in the About Remote Desktop Connection dialog box.

For more information about Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure Security Settings for Remote Desktop Services Connections


Configure Client Logon Information for Remote Desktop Services Connections

To connect remotely to an RD Session Host server, the user must provide credentials to be authenticated and for the RD Session Host server to determine what actions the user is authorized to perform.

By default, a connection will use the logon information provided by the user, which the user provides when using Remote Desktop Connection to connect remotely to the RD Session Host server.

Instead of using the logon information provided by the client, you can specify the logon information to be used for the connection on the Log on Settings tab in the Properties dialog box for the connection.

You can also specify that a user is always prompted to provide a password when connecting to the RD Session Host server, even if the user has configured Remote Desktop Connection to use saved credentials when connecting to the RD Session Host server.

Use the following procedure to configure the logon settings for a connection.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the logon settings for a connection

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, on the Log on Settings tab, configure the logon settings as appropriate for your environment, and then click OK.

    Note

    If the Always prompt for password check box is selected and dimmed, the Always prompt for password upon connection Group Policy setting has been enabled and has been applied to the RD Session Host server.

You can also specify that a user is prompted for a password when connecting remotely to an RD Session Host server by applying the Always prompt for password upon connection Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

For more information about Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

Additional references

  • Configure Security Settings for Remote Desktop Services Connections


Configure Permissions for Remote Desktop Services Connections

Remote Desktop Services permissions are used to control which users or groups can perform particular tasks on the RD Session Host server, such as logging on to the RD Session Host server or remotely controlling a user session. You can manage permissions on a per connection basis in Remote Desktop Session Host Configuration.

Note

To control who can connect remotely to the RD Session Host server, we recommend that you modify the Remote Desktop Users group. For more information about modifying the Remote Desktop Users group, see Configure the Remote Desktop Users Group.

The connection permissions that are set in Remote Desktop Session Host Configuration also determine the actions that a given user can perform in Remote Desktop Services Manager. For example, a user must have at least the Remote Control special access permission to remotely control a user session by using Remote Desktop Services Manager.

The following is a list of the permissions that you can set in Remote Desktop Session Host Configuration and the capability that each permission provides.

Permission | Capability
Query Information | Query sessions and RD Session Host servers for information
Set Information | Configure properties of the connection
Remote Control | View or actively control another user's session
Logon | Log on to a session on the RD Session Host server
Logoff | Log off a user from a session
Message | Send a message to a user session
Connect | Connect to another user session
Disconnect | Disconnect a user session
Virtual Channels | Use a virtual channel in a session, which provides local device and resource redirection

By default, the Remote Desktop Users group is assigned the following permissions: Query Information, Logon, and Connect.

There are three standard preconfigured sets of permissions:

  • Full Control

  • User Access

  • Guest Access

The following is a list of permissions that are associated with each of the standard preconfigured sets of permissions.

Permission set | Permissions assigned
Full Control | Query Information, Set Information, Remote Control, Logon, Logoff, Message, Connect, Disconnect, Virtual Channels
User Access | Query Information, Logon, Connect
Guest Access | Logon

Use the following procedure to configure permissions for a connection.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure permissions for a connection

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, on the Security tab, configure the permissions as appropriate for your environment, and then click OK.

You can prevent administrators from changing the permissions for a connection by applying the Do not allow local administrators to customize permissions Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

For more information about Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

Additional references

  • Configure Security Settings for Remote Desktop Services Connections


Configure Client Settings for Remote Desktop Services Connections

This section provides procedures for configuring client settings for Remote Desktop Services connections. The following topics are covered:

  • Make Local Devices and Resources Available in a Remote Session

  • Specify a Program to Start Automatically When a User Logs On

  • Configure Maximum Color Depth for a Remote Session

  • Configure Monitor Settings for a Remote Session

Additional references

  • Configuring Remote Desktop Services Connections

  • Managing Remote Desktop Services Connections


Make Local Devices and Resources Available in a Remote Session

Remote Desktop Services provides users the ability to access their local devices and resources in remote sessions. Users can access resources such as local drives, printers, the Clipboard, and supported Plug and Play devices. This is usually referred to as redirection.

In Windows Server 2008 and Windows Server 2008 R2, redirection has been enhanced and expanded. Now you can redirect Windows Portable Devices, specifically media players based on the Media Transfer Protocol (MTP) and digital cameras based on the Picture Transfer Protocol (PTP).

Users can specify which types of devices and resources they would like to redirect to the remote computer on the Local Resources tab of Remote Desktop Connection.

You can specify which local devices and resources will be available to users for remote sessions by using a connection on the RD Session Host server. You can enable or disable the redirection of the following:

  • Drives

  • Printers

  • LPT Port

  • COM Port

  • Clipboard

  • Audio

  • Supported Plug and Play devices

Note

Remote Desktop Services in Windows Server 2008 R2 supports redirection of some additional supported Plug and Play devices. These additional supported Plug and Play devices exclude the various kinds of Plug and Play devices that are already supported in other categories, such as Drives, Printers, or Smart Cards. For example, a USB thumb drive that gets installed as a drive letter on the client computer will be listed as available for redirection under the Drives category, and a USB Plug and Play printer attached to the client computer will be redirected under the Printers category.

If you disable redirection of the Clipboard, for example, users connecting remotely to the RD Session Host server on this connection will not be able to redirect their Clipboard in their remote session, even if they select the Clipboard check box on the Local Resources tab under Options in Remote Desktop Connection. If you enable redirection of a local device or resource on the RD Session Host server, users will still have to specify that they want to redirect that type of local device or resource by making the appropriate selection on the Local Resources tab under Options in Remote Desktop Connection.

Use the following procedure to enable or disable the redirection of local devices and resources for the connection on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable or disable the redirection of local devices and resources

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Client Settings tab.

  4. Under Redirection, do one of the following for a given local device or resource category:

    • Select the check box to disable redirection of that type of local device or resource.

    • Clear the check box to enable redirection of that type of local device or resource.

  5. Click OK.

You can also configure which local devices and resources will be available to users in their remote sessions by applying Group Policy settings.

The following is a list of some of the Remote Desktop Services-specific Group Policy settings that are related to local device and resource redirection.

Group Policy setting name Group Policy setting location

Allow audio and video playback redirection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

Do not allow clipboard redirection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

Do not allow COM port redirection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

Do not allow drive redirection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

Do not allow LPT port redirection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

Do not allow supported Plug and Play device redirection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection

Do not allow client printer redirection

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection

These Group Policy settings can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

Note

These Group Policy settings will take precedence over the settings configured in Remote Desktop Session Host Configuration and over the settings specified by the user in Remote Desktop Connection. If both the Computer Configuration and the User Configuration policy settings are configured, the Computer Configuration policy settings take precedence.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

For more information about Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

Additional references

  • Configure Client Settings for Remote Desktop Services Connections

  • Configure Printer Support


Specify a Program to Start Automatically When a User Logs On

By default, Remote Desktop Services sessions provide access to the full Windows desktop, unless a program has been specified to start when the user logs on to the remote session.

If an initial starting program has been specified, it will be the only program that the user can use in the Remote Desktop Services session. The Start menu and the Windows Desktop are not displayed when the user logs on to the remote session, and when the user exits the program the session is automatically logged off.

Note

Specifying an initial program to run does not apply to a RemoteApp session. For more information about RemoteApp, see the topic "Overview of RemoteApp" in the RemoteApp Manager Help in Windows Server 2008 R2.

Configuring the initial starting program on a per connection basis affects all users that use the connection.

You can configure the initial starting program on a per user basis by using the Remote Desktop Services Extension to the Local Users and Groups snap-in or to the Active Directory Users and Computers snap-in.

Initial starting program settings configured by using Remote Desktop Session Host Configuration will take precedence over initial starting program settings that have been configured for a specific user account or that the user has specified in Remote Desktop Connection.

Use the following procedure to specify a program to start when the user logs on to a remote session.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify a program to start when the user logs on to a remote session

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, on the Environment tab, configure the initial starting program settings as appropriate for your environment.

    If you select Start the following program when the user logs on, do the following:

    1. In the Program path and file name box, enter the fully qualified path and file name of the executable file to be run when the user logs on.

    2. If necessary, in the Start in box, enter the fully qualified path to the starting directory for the program.

      Note

      If you leave the Start in box blank, the program runs with its default working directory. If the specified program path, file name, or working directory is not the name of a valid directory, the RD Session Host server connection fails with an error message.

  4. Click OK. Changes made on the Environment tab are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the RD Session Host server.

You can also configure whether a program or the desktop appears when the user logs on to a remote session by applying the following Group Policy settings:

  • Start a program on connection

  • Always show desktop on connection

These Group Policy settings are located in the following locations:

  • Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment

  • User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment

These Group Policy settings can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

Note

These Group Policy settings will take precedence over the settings configured in Remote Desktop Session Host Configuration. If both the Computer Configuration and the User Configuration policy settings are configured, the Computer Configuration policy settings take precedence. Also, the Always show desktop on connection policy setting will take precedence over the Start a program on connection policy setting.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

For information about starting a program on a per user basis, see the topic "<UserAccount> Properties: Environment Tab " in the Remote Desktop Services User Properties Help in Windows Server 2008 R2.

Additional references

  • Configure Client Settings for Remote Desktop Services Connections

  • Configure Security Settings for Remote Desktop Services Connections


Configure Maximum Color Depth for a Remote Session

You can specify the maximum color resolution (color depth) for a remote session. Limiting the color depth can improve connection performance, particularly over slow links, and reduce server load.

The actual color depth for the connection is determined by the color support available on the client computer. The user can also specify a color depth for the connection on the Display tab under Colors in Remote Desktop Connection, but the specified color depth cannot exceed the value configured on the RD Session Host server.

Use the following procedure to specify the maximum color depth for a remote session.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify the maximum color depth for a remote session

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, on the Client Settings tab, select the Limit Maximum Color Depth check box, and then select the appropriate value for your environment.

    The default value is 32 bpp. A color depth of 24 bpp is only supported on Windows XP Professional and Windows Server 2003.

  4. Click OK. Changes to color depth settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the RD Session Host server.
Note

You can also set the maximum color depth for a remote session by applying the Limit maximum color depth Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure Client Settings for Remote Desktop Services Connections


Configure Monitor Settings for a Remote Session

You can specify the monitor settings, or number of monitors, available for a remote session. Limiting the number of monitors can improve connection performance, particularly over slow links, and reduce server load.

The actual number of monitors available for the connection is determined by the number of monitors available on the client computer. The user can specify to use all monitors for the connection on the Display tab under Display configuration in Remote Desktop Connection, but the specified number of monitors cannot exceed the value configured on the RD Session Host server.

Use the following procedure to specify the number of monitors for a remote session.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify the number of monitors for a remote session

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, click the Client Settings tab.

  4. Under Monitor Settings, in the Limit maximum number of monitors per session box, enter the number of monitors to be available to the client.

    Note

    Desktop composition or Aero Glass will not be enabled at the remote desktop client if the client is using multiple monitors. Desktop composition is only enabled if the remote desktop client is using a single monitor.

  5. Click OK. Changes to monitor settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the RD Session Host server.
Note

You can also specify the number of monitors for a remote session by applying the Limit maximum number of monitors Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure Client Settings for Remote Desktop Services Connections


Configure Session Settings for Remote Desktop Services Connections

This section provides procedures for configuring session settings for Remote Desktop Services connections. The following topics are covered:

  • Configure Timeout and Reconnection Settings for Remote Desktop Services Sessions

  • Configure Remote Control of Remote Desktop Services Sessions

Additional references

  • Configuring Remote Desktop Services Connections

  • Managing Remote Desktop Services Connections


Configure Timeout and Reconnection Settings for Remote Desktop Services Sessions

By default, Remote Desktop Services allows users to disconnect from a remote session without logging off and ending the session. When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected.

You can limit the amount of time that active, disconnected, and idle (without user input) sessions remain on the server. This is useful because sessions that remain running indefinitely on the RD Session Host server continue to consume system resources.

Configuring timeout and reconnection settings on a per connection basis affects all sessions that use the connection.

You can configure timeout and reconnection settings on a per user basis by using the Remote Desktop Services Extension to the Local Users and Groups snap-in or to the Active Directory Users and Computers snap-in.

Timeout and reconnection settings configured by using Remote Desktop Session Host Configuration will take precedence over timeout and reconnection settings that have been configured for a specific user account.

You can configure the following timeout and reconnection settings in Remote Desktop Session Host Configuration.

Setting Details

End a disconnected session

Specify the maximum amount of time that a disconnected user session is kept active on the RD Session Host server. If you specify "Never," the user's disconnected session is maintained for an unlimited time.

When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected.

Active session limit

Specify the maximum amount of time that the user's Remote Desktop Services session can be active before the session is automatically disconnected or ended.

The user receives a warning two minutes before the Remote Desktop Services session is disconnected or ended, which allows the user to save open files and close programs.

Idle session limit

Specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before the session is automatically disconnected or ended.

The user receives a warning two minutes before the session is disconnected or ended, which allows the user to press a key or move the mouse to keep the session active.

When a session limit is reached or connection is broken

Specify whether to disconnect or end the user's Remote Desktop Services session when an active session limit or an idle session limit is reached.

If the user's session is disconnected, the programs that the user is running are kept active even though the user is no longer actively connected.

If the user's session is ended, the user will need to establish a new Remote Desktop Services session with an RD Session Host server.

Use the following procedure to specify the timeout and reconnection settings for a remote session.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify timeout and reconnection settings for a remote session

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, on the Sessions tab, select the following options as necessary:

    • Select the Override user settings check box, and then set timeout settings for End a disconnected session, Active session limit, and Idle session limit.

    • Select the Override user settings check box, and then select one of the following reconnection settings: Disconnect from session or End session.

  4. Click OK. Changes to timeout and reconnection settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the RD Session Host server.

You can also configure timeout and reconnection settings by applying the following Group Policy settings:

  • Set time limit for disconnected sessions

  • Set time limit for active but idle Remote Desktop Services sessions

  • Set time limit for active Remote Desktop Services sessions

  • Terminate session when time limits are reached

These Group Policy settings are located in the following locations:

  • Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

  • User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits

These Group Policy settings can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

Note

These Group Policy settings will take precedence over the settings configured in Remote Desktop Session Host Configuration. If both the Computer Configuration and the User Configuration policy settings are configured, the Computer Configuration policy settings take precedence.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

For information about configuring timeout and reconnection settings on a per user basis, see the topic "<UserAccount> Properties: Sessions Tab" in the Remote Desktop Services User Properties Help in Windows Server 2008 R2.

Additional references

  • Configure Session Settings for Remote Desktop Services Connections


Configure Remote Control of Remote Desktop Services Sessions

You can monitor the actions of a client logged on to an RD Session Host server by using remote control from another session. Remote control allows you to either observe or actively control a client session. If you choose to actively control a client session, you will be able to input keyboard and mouse actions to the session. You can warn a client that you want to remotely control their session by choosing to display a message on the client that asks permission to view or take part in the session.

Configuring remote control on a per connection basis affects all sessions that use the connection. By default, remote control is not allowed.

You can configure remote control on a per user basis by using the Remote Desktop Services Extension to the Local Users and Groups snap-in or to the Active Directory Users and Computers snap-in.

Remote control settings configured by using Remote Desktop Session Host Configuration will take precedence over the remote control settings that have been configured for a specific user account.

Use the following procedure to specify the remote control settings for a remote session.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify the remote control settings for a remote session

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, on the Remote Control tab, select one of the following options:

    • To use the remote control settings specified for the user account, select Use remote control with default user settings. The default setting for a user account is that remote control users have full control of the session if the user gives permission.

    • To disable remote control sessions, select Do not allow remote control.

    • To specify remote control settings for the connection, select Use remote control with the following settings. To require user permission before the remote control session is enabled, select the Require user’s permission check box and then select one of the following options:

      • To only allow the remote control session to view the remote session, click View the session.

      • To allow the remote control session to interact with the remote session, click Interact with the session.

  4. Click OK. Changes to remote control settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the RD Session Host server.

You can also configure remote control settings by applying the Set rules for remote control of Remote Desktop Session Host server user sessions Group Policy setting. This Group Policy setting is located in the following locations:

  • Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections

  • User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections

This Group Policy setting can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC).

Note

The Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration. If both the Computer Configuration and the User Configuration policy settings are configured, the Computer Configuration policy setting takes precedence.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

For information about how to remotely control a user session, see the topic "Remotely Control a User Session" in the Remote Desktop Services Manager Help in Windows Server 2008 R2.

For information about configuring remote control settings on a per user basis, see the topic "<UserAccount> Properties: Remote Control Tab" in the Remote Desktop Services User Properties Help in Windows Server 2008 R2.

Additional references

  • Configure Session Settings for Remote Desktop Services Connections


Configuring RD Session Host Server Settings

This section provides procedures for configuring RD Session Host server settings. The following topics are covered:

  • Restrict Users to a Single Session

  • Configure Temporary Folders for an RD Session Host Server

  • Deny New User Logons to an RD Session Host Server

  • Configure License Settings for an RD Session Host Server

  • Configure Remote Desktop IP Virtualization

  • Configure Printer Support

  • Configure RD Connection Broker Settings for an RD Session Host Server


Restrict Users to a Single Session

To improve the performance of the RD Session Host server, you can restrict users to a single session (either active or disconnected). By restricting users to a single session on the RD Session Host server, you can minimize the number of remote sessions that are created. This can help conserve system resources on the RD Session Host server, thereby allowing more users to connect to the RD Session Host server.

If an RD Session Host server is configured to restrict users to a single session and the user leaves the session in a disconnected state, the user will automatically reconnect to that session the next time the user connects to the RD Session Host server.

By default, an RD Session Host server is configured to restrict users to a single session.

Use the following procedure to configure the Restrict each user to a single session setting on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the Restrict each user to a single session setting on the RD Session Host server

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. In the Edit settings area, under General, double-click Restrict each user to a single session.

  3. On the General tab of the Properties dialog box, select or clear the Restrict each user to a single session check box according to what is most appropriate for your environment, and then click OK.

You can also restrict users to a single session on the RD Session Host server by enabling the Restrict Remote Desktop Services users to a single remote session Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

If a user specifies a different program to start when the user connects to the RD Session Host server, a new session will be created on the RD Session Host server for the user, even if the RD Session Host server is configured to restrict users to a single session. A user can specify a program to start on connection on the Programs tab under Options in Remote Desktop Connection. However, you can prevent a user from starting a program on connection; for more information about preventing a user from starting a program on connection, see Specify a Program to Start Automatically When a User Logs On.

Additional references

  • Configuring RD Session Host Server Settings


Configure Temporary Folders for an RD Session Host Server

By default, Remote Desktop Services creates a separate temporary folder on the RD Session Host server for each active session that a user maintains on the RD Session Host server. The temporary folder is created on the RD Session Host server in a Temp folder under the user’s profile folder and is named with the "sessionid." This temporary folder is used to store individual temporary files.

To reclaim disk space, the temporary folder is deleted when the user logs off from a session.

Use the following procedure to configure temporary folders on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure temporary folders on the RD Session Host server

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. In the Edit settings area, under General, double-click either Delete temporary folders on exit or Use temporary folders per session.

  3. On the General tab of the Properties dialog box, select or clear the Delete temporary folders on exit check box and the Use temporary folders per session check box based on what is appropriate for your environment, and then click OK.

    If you clear the Use temporary folders per session check box, a user's temporary files for all sessions on the RD Session Host server are stored in a common Temp folder under the user’s profile folder on the RD Session Host server.

You can also configure temporary folders on the RD Session Host server by using the Do not delete temp folder upon exit and the Do not use temporary folders per session Group Policy settings. These Group Policy settings are located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Temporary folders and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configuring RD Session Host Server Settings


Deny New User Logons to an RD Session Host Server

You can configure the user logon mode on the RD Session Host server to prevent new user sessions from being created on the RD Session Host server. This capability was released with Windows Server 2008.

You might want to prevent new user sessions from being created on the RD Session Host server when you are planning to take the RD Session Host server offline for maintenance or to install new applications.

You can specify one of the following settings for the user logon mode:

  • Allow all connections. By default, this setting is selected and is the recommended setting. This allows users to connect remotely to the RD Session Host server to establish a remote session.

  • Allow reconnections, but prevent new logons. If you select this setting, a user who already has a remote session running on the RD Session Host server can reconnect to that session. However, a new user—that is, a user that does not currently have a remote session running on the RD Session Host server—will not be able to connect to the RD Session Host server. If the RD Session Host server is restarted, no users will be able to connect to the RD Session Host server.

  • Allow reconnections, but prevent new logons until the server is restarted. If you select this setting, a user who already has a remote session running on the RD Session Host server can reconnect to that session. However, a new user—that is, a user that does not currently have a remote session running on the RD Session Host server—will not be able to connect to the RD Session Host server. If the RD Session Host server is restarted, the user logon mode will be set to Allow all connections and users will be able to connect to the RD Session Host server.

Use the following procedure to configure the user logon mode on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the user logon mode on the RD Session Host server

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. In the Edit settings area, under General, double-click User logon mode.

  3. On the General tab of the Properties dialog box, select the user logon mode setting that is most appropriate for your environment, and then click OK.

You can also use the change logon command at a command prompt to configure the user logon mode on the RD Session Host server. For more information about command-line tools for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138135).

If you want to prevent all users—even users with remote sessions running on the RD Session Host server—from being able to connect remotely to the RD Session Host server over a given connection, you can disable the connection. For more information about disabling a connection, see Disable a Remote Desktop Services Connection.

Additional references

  • Configuring RD Session Host Server Settings


Configure License Settings for an RD Session Host Server

Each user or computing device that connects to a Remote Desktop Session Host (RD Session Host) server must have a valid Remote Desktop Services client access license (RDS CAL) issued by a Remote Desktop license server.

To ensure that an RD Session Host server can contact a Remote Desktop license server to request RDS CALs for clients, you need to do the following on the RD Session Host server:

  • Specify the Remote Desktop Licensing Mode for an RD Session Host Server

  • Specify a License Server for an RD Session Host Server to Use

To be alerted to possible licensing configuration issues, use Licensing Diagnosis in Remote Desktop Session Host Configuration. For more information about Licensing Diagnosis, see Identify Possible Licensing Problems for the RD Session Host Server.

Additional references

  • Configuring RD Session Host Server Settings


Specify the Remote Desktop Licensing Mode for an RD Session Host Server

The Remote Desktop licensing mode determines the type of Remote Desktop Services client access licenses (RDS CALs) that a Remote Desktop Session Host (RD Session Host) server will request from a Remote Desktop license server on behalf of a client connecting to the RD Session Host server.

Important

The Remote Desktop licensing mode configured on an RD Session Host server must match the type of RDS CALs available on the license server.

There are two types of RDS CALs:

  • RDS Per Device CAL: Permits one device (used by any user) to connect to an RD Session Host server.

  • RDS Per User CAL: Gives one user the right to access RD Session Host servers from an unlimited number of client computers or devices.

Use the following procedure to specify the Remote Desktop licensing mode for the RD Session Host server by using Remote Desktop Session Host Configuration.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify the Remote Desktop licensing mode

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the Edit settings area, under Licensing, double-click Remote Desktop licensing mode.

  4. On the Licensing tab of the Properties dialog box, click either Per Device or Per User, depending on which is most appropriate for your environment.

    If the Remote Desktop licensing mode choices are dimmed and you cannot make a selection, the Set the Remote Desktop licensing mode Group Policy setting has been enabled and has been applied to the RD Session Host server.

  5. After you have specified a Remote Desktop licensing mode, you must specify a license server for the RD Session Host server to use. For more information, see Specify a License Server for an RD Session Host Server to Use.

  6. Click OK to save your changes to the licensing settings.

The Remote Desktop licensing mode for the RD Session Host server can also be set in the following ways:

  • During the installation of the RD Session Host role service in Server Manager, on the Specify Licensing Mode page in the Add Roles Wizard.

    On the Specify Licensing Mode page, you can select Configure later if you are unsure during the installation whether to select Per Device or Per User. If you select Configure later, each time that you log on to the RD Session Host server, a message will appear in the lower-right corner of the desktop reminding you that you need to configure the licensing mode for the RD Session Host server.

  • By applying the Set the Remote Desktop licensing mode Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

    For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

  • By using the Remote Desktop Services module for Windows PowerShell. For more information about using Windows PowerShell with Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=139898).

To be alerted to possible licensing configuration issues, use Licensing Diagnosis in Remote Desktop Session Host Configuration. For more information about Licensing Diagnosis, see Identify Possible Licensing Problems for the RD Session Host Server.

For more information about RD Licensing, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140434).

Additional references

  • Configure License Settings for an RD Session Host Server


Specify a License Server for an RD Session Host Server to Use

A Remote Desktop Session Host (RD Session Host) server must be able to contact a Remote Desktop license server to request Remote Desktop Services client access licenses (RDS CALs) for users or computing devices that are connecting to the RD Session Host server.

In Windows Server 2008 R2, you must specify a license server for the RD Session Host server to use. Automatic license server discovery is no longer supported for an RD Session Host server that is running Windows Server 2008 R2.

An RD Session Host server running Windows Server 2008 R2 can contact a license server running either Windows Server 2008 R2 or Windows Server 2008 to request RDS CALs.

Note

Before you can specify a license server for the RD Session Host server to use, you must specify a Remote Desktop licensing mode. For more information, see Specify the Remote Desktop Licensing Mode for an RD Session Host Server.

Use the following procedure to specify a license server for the RD Session Host server to use.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify a license server for the RD Session Host server to use

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the Edit settings area, under Licensing, double-click Remote Desktop license servers.

  4. On the Licensing tab of the Properties dialog box, click Add.

  5. In the Add License Server dialog box, select a license server from the list of known license servers, and then click Add. If the license server that you want to add is not listed, in the License server name or IP address box, type the name or IP address of the license server that you want to add, and then click Add.

    You can add more than one license server for the RD Session Host server to use. The RD Session Host server will contact the license servers in the order in which they appear in the Specified license servers box.

  6. Click OK to close the Add License Server dialog box, and then click OK to save your changes to the licensing settings.

You can also specify a license server for the RD Session Host server to use by applying the Use the specified Remote Desktop license servers Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the license servers configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

You can also use the Remote Desktop Services module for Windows PowerShell to configure RD Licensing-related settings. For more information about using Windows PowerShell with Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=139898).

To be alerted to possible licensing configuration issues, use Licensing Diagnosis in Remote Desktop Session Host Configuration. For more information about Licensing Diagnosis, see Identify Possible Licensing Problems for the RD Session Host Server.

For more information about RD Licensing, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140434).

Additional references

  • Configure License Settings for an RD Session Host Server


Identify Possible Licensing Problems for the RD Session Host Server

Remote Desktop Session Host Configuration includes the Licensing Diagnosis tool. Licensing Diagnosis provides information to help identify possible licensing problems for the Remote Desktop Session Host (RD Session Host) server.

Each user or computing device that connects to an RD Session Host server must have a valid Remote Desktop Services client access license (RDS CAL) issued by a Remote Desktop license server.

An RD Session Host server must be able to contact a Remote Desktop license server in order to request RDS CALs for users or computing devices that are connecting to the RD Session Host server.

The primary purpose of Licensing Diagnosis is to determine which license servers the RD Session Host server is configured to use and whether those license servers have RDS CALs available to issue to users or computing devices that are connecting to the RD Session Host server. In addition, Licensing Diagnosis will try to identify any possible licensing problems and provide suggested resolutions to those problems.

Use the following procedure to run the Licensing Diagnosis tool.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To run the Licensing Diagnosis tool

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. In the left pane, click Licensing Diagnosis. Licensing Diagnosis will automatically run and try to contact the license servers that the RD Session Host server is configured to use and identify licensing configuration problems, and then display the results.

There are four main sections to Licensing Diagnosis:

  • Remote Desktop Session Host Configuration Details, which displays configuration information about the RD Session Host server, including the licensing mode that has been specified for the RD Session Host server.

  • Licensing Diagnosis Information, which displays any licensing problems that were identified along with suggested resolutions to the problems.

  • Remote Desktop Services License Server Information, which displays the license servers that the RD Session Host server is configured to use.

  • License Server Configuration Details, which displays configuration information about a license server, including the type and version of RDS CALs installed and available on that license server.

To view the configuration details of a selected license server, the account that you are logged on as needs administrator privileges on the license server. If your account does not have administrator privileges on the license server, you can use Provide Credentials in the Licensing Diagnosis tool to provide credentials that have administrative privileges on the license server.

Important

To view the configuration details of a Windows 2000 or a Windows Server 2003 license server, you must provide the credentials of the built-in local Administrator account on the license server. The credentials of any other account, even if that account has administrator privileges on the license server, will not allow you to view the configuration details.

For more information about RD Licensing, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140434).

Additional references

  • Configure License Settings for an RD Session Host Server

  • Specify the Remote Desktop Licensing Mode for an RD Session Host Server

  • Specify a License Server for an RD Session Host Server to Use


Configure Remote Desktop IP Virtualization

Remote Desktop IP Virtualization allows IP addresses to be assigned to remote desktop connections on a per session or per program basis. This can be useful if a program communicates with a server that only allows one connection per IP address. Prior to Windows Server 2008 R2, every session on an RD Session Host server was assigned the same IP address. With Windows Server 2008 R2, you can use Remote Desktop IP Virtualization to assign IP addresses on a per session or per program basis. If you assign IP addresses for multiple programs, they will share a per session IP address. If you have more than one network adapter on the server, you must also choose one network adapter for Remote Desktop IP Virtualization.

Remote Desktop IP Virtualization is configured by using the Remote Desktop Session Host Configuration tool. On the RD IP Virtualization tab of Remote Desktop Session Host Configuration, you can do the following:

  • Enable or disable Remote Desktop IP Virtualization.

  • Select the network adapter to be used for Remote Desktop IP Virtualization.

  • Configure whether the Remote Desktop IP Virtualization mode is per session or per program.

  • If Remote Desktop IP Virtualization is configured per program, you can add a list of programs that Remote Desktop IP Virtualization can use.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure Remote Desktop IP Virtualization settings

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. In the Edit settings area, under RD IP Virtualization, double-click IP Virtualization.

  3. In the Properties dialog box, click the RD IP Virtualization tab.

  4. To enable or disable Remote Desktop IP Virtualization, do one of the following:

    • Select the Enable IP virtualization check box to enable Remote Desktop IP Virtualization.

    • Clear the Enable IP virtualization check box to disable Remote Desktop IP Virtualization.

  5. To select the network adapter to be used for Remote Desktop IP Virtualization, in the Select the network adapter to be used for IP virtualization list, select the appropriate network adapter.

  6. To select the Remote Desktop IP Virtualization mode, under IP virtualization mode:

    • Click Per session to configure Remote Desktop IP Virtualization to run in per session mode.

    • Click Per program to configure Remote Desktop IP Virtualization to run in per program mode.

  7. To assign which programs use Remote Desktop IP Virtualization, under Assign virtual IP addresses to these programs, click Add Program.

Additional references

  • Configuring RD Session Host Server Settings


Configure Printer Support

Remote Desktop Services provides printer redirection, which routes printing jobs from a server to a printer that is attached to a client computer or to a shared printer that is available to the client computer. On an RD Session Host server, you can use the Remote Desktop Easy Print printer driver to simplify printer configuration. The Remote Desktop Easy Print driver is useful if an RD Session Host server does not have a printer driver installed that matches the printer driver on a client computer.

By default, the RD Session Host server first tries to use the Remote Desktop Easy Print driver. If the client computer does not support this driver, the server looks for a matching printer driver on the server. You can either install a matching printer driver on the RD Session Host server, or you can create a custom printer mapping file.

Note

The RD Session Host server fallback printer driver is not supported in Windows Server 2008 or Windows Server 2008 R2.

Client requirements

To use Remote Desktop Easy Print, the client computer must have the following components installed:

  • Remote Desktop Connection (RDC) 6.1

    Note

    The RDC 6.1 client supports Remote Desktop Protocol 6.1.

  • At least Microsoft .NET Framework 3.0 Service Pack 1

    Note

    The version of Microsoft .NET Framework that is included with Windows Server 2008 and Windows Vista with Service Pack 1 supports Remote Desktop Easy Print. The Microsoft .NET Framework is not required for remote clients running Windows 7 or Windows Server 2008 R2.

Configure printer driver behavior

To change the default printer driver behavior, you can use Group Policy to modify the Use Remote Desktop Services Easy Print printer driver first policy setting. This policy setting is located in the following node of the Group Policy Management Console (GPMC):

Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection

Note

If you are using the Local Group Policy Editor, "Policies" is not part of the node path.

By using this policy setting, you can configure the RD Session Host server to do either of the following:

  • Use the Remote Desktop Easy Print driver first. If that fails, look for a matching printer driver. (This is the behavior if you enable or do not configure the policy setting.)

  • Look for a matching printer driver first. If that fails, use the Remote Desktop Easy Print driver. (This is the behavior if you disable the policy setting.)

Other printer redirection policy settings that are available in this node of the Local Group Policy Editor include:

  • Do not allow client printer redirection

  • Do not set default client printer to be default printer in a session

  • Redirect only the default client printer

For more information about these policy settings, view the policy setting descriptions in the GPMC or the Local Group Policy Editor.

Additional references

  • Configuring RD Session Host Server Settings

  • For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).


Configure RD Connection Broker Settings for an RD Session Host Server

For information about configuring Remote Desktop Connection Broker (RD Connection Broker) settings for a Remote Desktop Session Host (RD Session Host) server, see Configure an RD Session Host Server to Join a Farm in RD Connection Broker.


Managing Remote Desktop Services Connections

This section provides procedures for managing Remote Desktop Services connections. The following topics are covered:

  • Create a Remote Desktop Services Connection

  • Configure the Number of Simultaneous Remote Connections Allowed for a Connection

  • Enable a Remote Desktop Services Connection

  • Disable a Remote Desktop Services Connection

  • Rename a Remote Desktop Services Connection

  • Delete a Remote Desktop Services Connection


Create a Remote Desktop Services Connection

By default, a connection is automatically created and enabled on a computer running Windows Server 2008 and Windows Server 2008 R2, even if the Remote Desktop Session Host (RD Session Host) role service is not installed on the computer. This connection is named RDP-Tcp and only allows a maximum of two simultaneous remote connections to the computer.

When you install the RD Session Host role service on the computer, the RDP-Tcp connection is changed to allow an unlimited number of simultaneous remote connections. For more information about configuring the number of simultaneous remote connections that a connection will allow, see Configure the Number of Simultaneous Remote Connections Allowed for a Connection.

Only one Remote Desktop Protocol (RDP) connection can be configured for each network adapter installed on the RD Session Host server. Typically, the default RDP-Tcp connection is the only connection needed to support remote administration of the server or to support the RD Session Host role service. If you want to configure additional connections that use RDP, you must install an additional network adapter for each RDP connection that you want to create.

Use the following procedure to create a new connection.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To create a new connection

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. On the Action menu, click Create New Connection.

  3. On the Welcome page of the Remote Desktop Services Connection Wizard, click Next.

  4. On the Connection Protocol page, type the name for the connection. You cannot have two connections with the same name on the computer.

  5. If there is more than one Connection Type available on the computer, select the appropriate one for your environment.

    You cannot have more than one of the same Connection Type assigned to a given network adapter.

  6. Click Next.

  7. On the Network Adapter page, do the following:

    • Select the network adapter that the connection will use. If you want the connection to use all network adapters available on the computer, select All network adapters configured with this protocol.

    • Select the number of simultaneous remote connections that the connection will support.

  8. Click Next, and then on the Summary page, click Finish. The new connection will appear under Connections on the main page of Remote Desktop Session Host Configuration.

Additional references

  • Managing Remote Desktop Services Connections


Configure the Number of Simultaneous Remote Connections Allowed for a Connection

You can configure the number of simultaneous remote connections that are allowed for a connection. Restricting the number of simultaneous remote connections can improve performance of the computer because fewer sessions are demanding system resources.

If the RD Session Host role service is not installed on the computer, a connection can only allow a maximum of two simultaneous remote connections to the computer.

Use the following procedure to configure the number of simultaneous remote connections allowed for a connection.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure the number of simultaneous remote connections allowed for a connection

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the name of the connection, and then click Properties.

  3. In the Properties dialog box for the connection, on the Network Adapter tab, click Maximum connections, enter the number of simultaneous remote connections that you want to allow for the connection, and then click OK.

    If the Maximum connections option is selected and dimmed, the Limit number of connections Group Policy setting has been enabled and has been applied to the RD Session Host server.

You can also set the maximum number of simultaneous connections allowed for an RD Session Host server by applying the Limit number of connections Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Managing Remote Desktop Services Connections


Enable a Remote Desktop Services Connection

You must enable a connection on the RD Session Host server so that users can log on to the RD Session Host server by using that connection.

Use the following procedure to enable a connection on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To enable a connection on the RD Session Host server

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, click the name of the connection (for example, RDP-Tcp) that you want to enable.

  3. On the Action menu, click Enable Connection. A green up arrow on the icon associated with the connection name indicates that the connection is enabled.

Additional references

  • Managing Remote Desktop Services Connections

  • Disable a Remote Desktop Services Connection


Disable a Remote Desktop Services Connection

You can disable a connection on the RD Session Host server so that no users can log on to the RD Session Host server by using that connection. You might want to disable all connections to the RD Session Host server when you are planning to take the RD Session Host server offline for maintenance or to install new applications.

Important

When you disable a connection on the RD Session Host server, all users using that connection to access the RD Session Host server will be immediately disconnected from the RD Session Host server. Before you disable the connection, you should send a message to users connected to the RD Session Host server to warn them that they will be disconnected from the RD Session Host server.

For more information about sending a message to a user connected to an RD Session Host server, see the topic "Send a Message to a User" in the Remote Desktop Services Manager Help in Windows Server 2008 R2.

Use the following procedure to disable a connection on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To disable a connection on the RD Session Host server

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, click the name of the connection (for example, RDP-Tcp) that you want to disable.

  3. On the Action menu, click Disable Connection. The connection is immediately disabled and all users using that connection will be immediately disconnected from the RD Session Host server. A red down arrow on the icon associated with the connection name indicates that the connection is disabled.

You can also deny new logons to the RD Session Host server. For more information, see Deny New User Logons to an RD Session Host Server.

Additional references

  • Managing Remote Desktop Services Connections

  • Enable a Remote Desktop Services Connection


Rename a Remote Desktop Services Connection

You can rename a connection on the RD Session Host server. You might want to rename a connection to make the name more descriptive.

The connection name appears when you view session information in Remote Desktop Services Manager. For more information about viewing session information in Remote Desktop Services Manager, see the topic "View Sessions Running on an RD Session Host Server" in the Remote Desktop Services Manager Help in Windows Server 2008 R2.

You cannot have two connections with the same name on an RD Session Host server.

Use the following procedure to rename a connection on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To rename a connection on the RD Session Host server

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, click the name of the connection (for example, RDP-Tcp) that you want to rename.

  3. On the Action menu, click Rename Connection.

  4. In the Rename Connection dialog box, type the new name for the connection, and then click OK.

Additional references

  • Managing Remote Desktop Services Connections


Delete a Remote Desktop Services Connection

You can delete a connection on the RD Session Host server.

Important

When you delete a connection on the RD Session Host server, all users using that connection to access the RD Session Host server will be immediately disconnected from the RD Session Host server. Before you delete the connection, you should send a message to users connected to the RD Session Host server to warn them that they will be disconnected from the RD Session Host server.

For more information about sending a message to a user connected to an RD Session Host server, see the topic "Send a Message to a User" in the Remote Desktop Services Manager Help in Windows Server 2008 R2.

Use the following procedure to delete a connection on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To delete a connection on the RD Session Host server

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, click the name of the connection (for example, RDP-Tcp) that you want to delete.

  3. On the Action menu, click Delete, and then click Yes. The connection is immediately disabled, and all users using that connection will be immediately disconnected from the RD Session Host server.

    Users will not be able to reconnect to their sessions until you create a new connection that uses the same connection protocol and network adapter as the connection that was deleted. For more information about creating a new connection, see Create a Remote Desktop Services Connection.

You can temporarily prevent users from connecting to the RD Session Host server by doing either of the following:

  • Disabling a connection on the RD Session Host server. For more information, see Disable a Remote Desktop Services Connection.

  • Denying new logons to the RD Session Host server. For more information, see Deny New User Logons to an RD Session Host Server.

Additional references

  • Managing Remote Desktop Services Connections


Remote Desktop Connection Broker

Remote Desktop Connection Broker (RD Connection Broker), formerly Terminal Services Session Broker (TS Session Broker), is a role service that provides the following functionality:

  • Allows users to reconnect to their existing sessions in a load-balanced RD Session Host server farm. This prevents a user with a disconnected session from being connected to a different RD Session Host server in the farm and starting a new session.

  • Enables you to evenly distribute the session load among RD Session Host servers in a load-balanced RD Session Host server farm.

  • Provides users access to virtual desktops hosted on RD Virtualization Host servers and to RemoteApp programs hosted on RD Session Host servers through RemoteApp and Desktop Connection.

For an introduction to RD Connection Broker, see Overview of Remote Desktop Connection Broker (RD Connection Broker).

For more information about RD Connection Broker, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140432).

The following topics are covered:

  • Overview of Remote Desktop Connection Broker (RD Connection Broker)

  • Checklist: Create a Load-Balanced RD Session Host Server Farm by Using RD Connection Broker

  • Install the RD Connection Broker Role Service

  • Add Each RD Session Host Server in the Farm to the Session Broker Computers Local Group

  • Configure an RD Session Host Server to Join a Farm in RD Connection Broker

  • Configure DNS for RD Connection Broker Load Balancing

  • About IP Address and Token Redirection

  • About Dedicated Farm Redirection and Virtual Machine Redirection


Overview of Remote Desktop Connection Broker (RD Connection Broker)

Remote Desktop Connection Broker (RD Connection Broker), formerly Terminal Services Session Broker (TS Session Broker), is a role service that provides the following functionality:

  • Allows users to reconnect to their existing sessions in a load-balanced RD Session Host server farm. This prevents a user with a disconnected session from being connected to a different RD Session Host server in the farm and starting a new session.

  • Enables you to evenly distribute the session load among RD Session Host servers in a load-balanced RD Session Host server farm.

  • Provides users access to virtual desktops hosted on RD Virtualization Host servers and to RemoteApp programs hosted on RD Session Host servers through RemoteApp and Desktop Connection.

RD Connection Broker keeps track of user sessions in a load-balanced RD Session Host server farm. The RD Connection Broker database stores session information, including the name of the RD Session Host server where each session resides, the session state for each session, the session ID for each session, and the user name associated with each session. RD Connection Broker uses this information to redirect a user who has an existing session to the RD Session Host server where the user’s session resides.

If a user disconnects from a session (whether intentionally or because of a network failure), the applications that the user is running will continue to run. When the user reconnects, RD Connection Broker is queried to determine whether the user has an existing session, and if so, on which RD Session Host server in the farm. If there is an existing session, RD Connection Broker redirects the client to the RD Session Host server where the session exists.

With RD Connection Broker Load Balancing, when a user without an existing session connects to an RD Session Host server in the load-balanced RD Session Host server farm, the user will be redirected to the RD Session Host server with the fewest sessions. If a user with an existing session reconnects, the user is redirected to the RD Session Host server where the user’s existing session resides. To distribute the session load between more powerful and less powerful servers in the farm, you can assign a relative server weight value to a server.

RD Connection Broker is also used to provide users with access to RemoteApp and Desktop Connection. RemoteApp and Desktop Connection provides a customized view of RemoteApp programs and virtual desktops to users. RD Connection Broker supports load balancing and reconnection to existing sessions on virtual desktops accessed by using RemoteApp and Desktop Connection. To configure the RD Connection Broker server to support RemoteApp and Desktop Connection, use the Remote Desktop Connection Manager tool. For more information, see the Remote Desktop Connection Manager Help in Windows Server 2008 R2.

RD Connection Broker components

There are two RD Connection Broker components to consider in a load-balanced RD Session Host server farm.

  • RD Connection Broker server. This is the server that runs the Remote Desktop Connection Broker service and tracks user sessions for one or more load-balanced RD Session Host server farms. RD Connection Broker uses a farm name to determine which servers are in the same RD Session Host server farm.

  • RD Session Host servers that use RD Connection Broker. These are RD Session Host servers that are members of a farm in RD Connection Broker. To participate in RD Connection Broker, a server must meet the following criteria:

    • The server must have the RD Session Host role service installed.

    • The server must be a member of an Active Directory domain.

    • The server must be a member of the Session Broker Computers local group on the RD Connection Broker server.

    • The server must be a member of a load-balanced RD Session Host server farm.

      If you are using the RD Connection Broker Load Balancing feature, you can configure load-balancing settings together with other RD Connection Broker settings. For more information, see Checklist: Create a Load-Balanced RD Session Host Server Farm by Using RD Connection Broker.

      Important

      To be a member of a farm that uses RD Connection Broker in Windows Server 2008 R2, an RD Session Host server must be running either Windows Server 2008 R2 or Windows Server 2008.

For more information about RD Connection Broker, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140432).

Additional references

  • Checklist: Create a Load-Balanced RD Session Host Server Farm by Using RD Connection Broker

  • Install the RD Connection Broker Role Service

  • Add Each RD Session Host Server in the Farm to the Session Broker Computers Local Group

  • Configure an RD Session Host Server to Join a Farm in RD Connection Broker

  • Configure DNS for RD Connection Broker Load Balancing


Checklist: Create a Load-Balanced RD Session Host Server Farm by Using RD Connection Broker

With a load-balanced RD Session Host server farm, you can scale the performance of a single RD Session Host server by distributing Remote Desktop Services sessions across multiple servers. You can configure a load-balanced farm by using the RD Connection Broker Load Balancing feature, Network Load Balancing (NLB), or a third-party solution. RD Connection Broker also enables a user to reconnect to their existing session in a load-balanced RD Session Host server farm.

This checklist shows the steps that are required to create and configure a load-balanced RD Session Host server farm by using RD Connection Broker Load Balancing.

Important

To be a member of a farm that uses RD Connection Broker in Windows Server 2008 R2, an RD Session Host server must be running either Windows Server 2008 R2 or Windows Server 2008.

Task | Reference
Install the RD Connection Broker role service on the server that you want to use to track user sessions for a farm. | Install the RD Connection Broker Role Service
Add the RD Session Host servers in the farm to the Session Broker Computers local group on the RD Connection Broker server. | Add Each RD Session Host Server in the Farm to the Session Broker Computers Local Group
Configure the RD Session Host servers in the farm to join a farm in RD Connection Broker, and to participate in RD Connection Broker Load Balancing. | Configure an RD Session Host Server to Join a Farm in RD Connection Broker
Configure DNS round robin entries for RD Session Host servers in the farm. | Configure DNS for RD Connection Broker Load Balancing

For more information about RD Connection Broker, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140432).

Additional references

  • Overview of Remote Desktop Connection Broker (RD Connection Broker)


Install the RD Connection Broker Role Service

You must install the RD Connection Broker role service on the server that you want to use to track user session information for a load-balanced RD Session Host server farm. The server where you install the RD Connection Broker role service does not have to be an RD Session Host server or have Remote Desktop enabled.

You can use a single RD Connection Broker server to track user sessions across multiple farms, as there is minimal performance overhead.

When you install the RD Connection Broker role service, the following changes occur on the local computer:

  • The Remote Desktop Connection Broker service is installed. By default, the service is set to Started and to Automatic.

  • The Session Broker Computers local group is created.

  • The Remote Desktop Connection Manager tool is installed.

Installation prerequisites

The server where you install RD Connection Broker must be a member of a domain.

Note

If you install the RD Connection Broker role service on a domain controller, the Session Broker Computers group will be a domain local group and available on all domain controllers.

Installation procedure

Membership in the local Administrators group, or equivalent, on the RD Connection Broker server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To install the RD Connection Broker role service

  1. On the server on which you want to install the RD Connection Broker role service, open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. If the Remote Desktop Services role is not already installed:

    1. Under Roles Summary, click Add Roles.

    2. On the Before You Begin page of the Add Roles Wizard, click Next.

    3. On the Select Server Roles page, select the Remote Desktop Services check box, and then click Next.

    4. On the Remote Desktop Services page, click Next.

    5. On the Select Role Services page, select the Remote Desktop Connection Broker check box, and then click Next.

    If the Remote Desktop Services role is already installed:

    1. Under Roles Summary, click Remote Desktop Services.

    2. Under Role Services, click Add Role Services.

    3. On the Select Role Services page, select the Remote Desktop Connection Broker check box, and then click Next.

  3. On the Confirm Installation Selections page, confirm that Remote Desktop Connection Broker is listed, and then click Install.

  4. On the Installation Progress page, installation progress will be noted.

  5. On the Installation Results page, confirm that installation for the RD Connection Broker role service succeeded, and then click Close.

Additional references

  • Checklist: Create a Load-Balanced RD Session Host Server Farm by Using RD Connection Broker


Add Each RD Session Host Server in the Farm to the Session Broker Computers Local Group

For a Remote Desktop Session Host (RD Session Host) server to use RD Connection Broker, you must add the computer account for the RD Session Host server to the Session Broker Computers local group on the RD Connection Broker server.

Membership in the local Administrators group, or equivalent, on the RD Connection Broker server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

You must perform this procedure on the server where you installed the RD Connection Broker role service.

To add an RD Session Host server to the Session Broker Computers local group

  1. On the RD Connection Broker server, click Start, point to Administrative Tools, and then click Computer Management.

  2. In the left pane, expand Local Users and Groups, and then click Groups.

  3. In the middle pane, right-click the Session Broker Computers group, and then click Properties.

  4. On the General tab, click Add.

  5. In the Select Users, Computers, or Groups dialog box, click Object Types.

  6. Select the Computers check box, and then click OK.

  7. Locate and then add the computer account for each RD Session Host server that you want to add.

  8. When you are finished, click OK.

Additional references

  • Checklist: Create a Load-Balanced RD Session Host Server Farm by Using RD Connection Broker


Configure an RD Session Host Server to Join a Farm in RD Connection Broker

You can configure a Remote Desktop Session Host (RD Session Host) server to join a farm in RD Connection Broker, and to participate in RD Connection Broker Load Balancing, by using the Remote Desktop Session Host Configuration tool.

Note

Before you configure the RD Session Host server to join a farm, the computer account for the RD Session Host server must be a member of the Session Broker Computers group on the RD Connection Broker server. For more information, see Add Each RD Session Host Server in the Farm to the Session Broker Computers Local Group.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure RD Connection Broker settings

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. In the Edit settings area, under RD Connection Broker, double-click Member of farm in RD Connection Broker.

  3. On the RD Connection Broker tab of the Properties dialog box, click Change Settings.

  4. In the RD Connection Broker Settings dialog box, click Farm member.

  5. In the RD Connection Broker server name box, type the name of the RD Connection Broker server.

    Note

    The RD Connection Broker server is the server where you installed the RD Connection Broker role service.

  6. In the Farm name box, type the name of the farm that you want to join in RD Connection Broker.

    Important
    • RD Connection Broker uses a farm name to determine which servers are in the same RD Session Host server farm. You must use the same farm name for all servers that are in the same load-balanced RD Session Host server farm. If you type a new farm name, a new farm is created in RD Connection Broker and the server is joined to the farm. If you type an existing farm name, the server joins the existing farm in RD Connection Broker.
    • Although the farm name in RD Connection Broker does not have to be registered in Active Directory Domain Services, we recommend that you use the same name that you will use in DNS for the RD Session Host server farm. The RD Session Host server farm name in DNS represents the virtual name that clients will use to connect to the RD Session Host server farm. For more information, see Configure DNS for RD Connection Broker Load Balancing.

  7. Click OK to close the RD Connection Broker Settings dialog box.

  8. To participate in RD Connection Broker Load Balancing, select the Participate in Connection Broker Load-Balancing check box.

  9. Optionally, in the Relative weight of this server in the farm box, modify the server weight. By default, the value is 100. The server weight is relative. Therefore, if you assign one server a value of 50, and one a value of 100, the server with a weight of 50 will receive half the number of sessions.

  10. Verify that you want to use IP address redirection. By default, the Use IP address redirection setting is enabled. If you want to use token redirection mode, select Use token redirection. For more information, see About IP Address and Token Redirection.

  11. In the Select IP addresses to be used for reconnection box, select the check box next to each IP address that you want to use.

    Note

    Only the first selected IPv4 address will be used by clients that are running Remote Desktop Connection 5.2 and earlier.

  12. When you are finished, click OK.

You can use Group Policy to configure some RD Connection Broker settings. The relevant Group Policy settings are:

  • Join RD Connection Broker

  • Configure RD Connection Broker farm name

  • Configure RD Connection Broker server name

  • Use RD Connection Broker load balancing

  • Use IP Address Redirection

These Group Policy settings are located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

You can also use the Remote Desktop Services module for Windows PowerShell to view and configure some RD Connection Broker settings. For more information about using Windows PowerShell with Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=139898).

Additional references

  • Checklist: Create a Load-Balanced RD Session Host Server Farm by Using RD Connection Broker


Configure DNS for RD Connection Broker Load Balancing

To load balance sessions in an RD Session Host server farm, you can use the RD Connection Broker Load Balancing feature together with Domain Name System (DNS) round robin. To configure DNS, you must create a DNS host resource record for each RD Session Host server in the farm that maps the RD Session Host server’s IP address to the RD Session Host server farm name in DNS.

The following procedure provides the steps to configure DNS on a Windows Server 2008 R2-based domain controller.

You must be a member of the Domain Admins, Enterprise Admins, or the DnsAdmins group to complete this procedure.

To add DNS entries for each RD Session Host server in the farm

  1. Open the DNS snap-in. To open the DNS snap-in, log on to a computer where the DNS snap-in has been installed, click Start, point to Administrative Tools, and then click DNS.

  2. Expand the server name, expand Forward Lookup Zones, and then expand the domain name.

  3. Right-click the appropriate zone, and then click New Host (A or AAAA).

  4. In the Name (uses parent domain name if blank) box, type the RD Session Host server farm name.

    The farm name is the virtual name that clients will use to connect to the RD Session Host server farm. Do not use the name of an existing server. For management purposes, we recommend that you use the same farm name that you specified when you configured the RD Session Host servers to join a farm in RD Connection Broker.

  5. In the IP address box, type the IP address of an RD Session Host server in the farm.

  6. Click Add Host.

  7. Repeat steps three through six for each RD Session Host server in the farm.

    Important

    You must specify the same farm name in the Name (uses parent domain name if blank) box for each DNS entry.

    For example, if you have three RD Session Host servers in a farm named FARM1, with IP addresses of 192.168.1.20, 192.168.1.21, and 192.168.1.22, the entries would look similar to the following:

    Farm1     Host(A)     192.168.1.20
Farm1     Host(A)     192.168.1.21
Farm1     Host(A)     192.168.1.22

  8. When you are finished, click Done.
Note

By default, DNS round robin is enabled when using DNS on a Windows Server 2008 R2-based domain controller. The Enable round robin setting is available on the Advanced tab when you view the properties of the server in DNS.

Additional references

  • Checklist: Create a Load-Balanced RD Session Host Server Farm by Using RD Connection Broker


About IP Address and Token Redirection

RD Connection Broker redirection modes

RD Connection Broker can use either IP address redirection or routing token redirection to redirect a client to the Remote Desktop Session Host (RD Session Host) server where their session exists. When you configure RD Connection Broker settings in the Remote Desktop Session Host Configuration tool, you can choose the client redirection mode.

IP address redirection

By default, an RD Session Host server uses IP address redirection, where a client queries RD Connection Broker and is redirected to their existing session by using the IP address of the server where their session exists. To use this redirection method, client computers must be able to connect directly by IP address to RD Session Host servers in the farm. If clients can connect directly to the RD Session Host servers, we recommend that you accept the default behavior. For example, you must use IP address redirection if you use any of the following as your load-balancing solution:

  • RD Connection Broker Load Balancing, using DNS round robin

  • Network Load Balancing (NLB)

  • A hardware load balancer that does not support RD Connection Broker routing tokens

RD Connection Broker routing token redirection

You can configure an RD Session Host server to use RD Connection Broker routing token redirection instead of IP address redirection. However, only use this mode when your network load-balancing solution supports the use of RD Connection Broker routing tokens.

If you configure an RD Session Host server to use RD Connection Broker routing tokens as the redirection method, the IP address of the RD Session Host server is not sent to the client. Instead, the IP address is embedded in a token. When a client reconnects to the load balancer, the routing token is used to redirect the client to their existing session on the correct RD Session Host server in the farm.

If you switch to token redirection mode, you can select only one IP address for reconnection. The address that you select must meet both of the following criteria:

  • It must be the IP address of the network adapter that is connected to the load balancer.

  • It must be the address that is configured on the load balancer as the IP address for the RD Session Host server.

Note

Only select an IPv6 address if your load-balancing solution supports the use of IPv6.

Additional references

  • Configure an RD Session Host Server to Join a Farm in RD Connection Broker


About Dedicated Farm Redirection and Virtual Machine Redirection

You can configure a Remote Desktop Session Host (RD Session Host) server to work with RD Connection Broker to provide two types of redirection:

  • Dedicated farm redirection

  • Virtual machine redirection

Dedicated farm redirection

When you register the IP address of each RD Session Host server in the farm to a single RD Session Host server farm name in DNS, incoming Remote Desktop Services clients try to connect to the first IP address for the farm name that is returned by DNS. The RD Session Host server that receives this initial connection request acts as the redirector.

To increase session redirection performance in a large RD Session Host server farm, you can configure an RD Session Host server to provide dedicated redirection for the farm. This RD Session Host server processes incoming requests, but does not accept user sessions. To configure dedicated farm redirection, you must do the following:

  1. Configure all RD Session Host servers in the farm to use the same farm in RD Connection Broker. For more information, see Configure an RD Session Host Server to Join a Farm in RD Connection Broker.

  2. Configure another RD Session Host server to provide dedicated redirection for the farm. This RD Session Host server must be configured with the same farm name and RD Connection Broker server as the other RD Session Host servers. The only difference is that for this RD Session Host server, select Dedicated farm redirection (instead of Farm member) in the RD Connection Broker Settings dialog box in Remote Desktop Session Host Configuration.

    Important

    When you configure an RD Session Host server for dedicated farm redirection, the user logon mode of the RD Session Host server is changed to Allow reconnections, but prevent new logons. To connect remotely to administer an RD Session Host server that is configured to provide dedicated farm redirection, use mstsc /admin.

  3. Create a DNS round robin entry for the RD Session Host server that is providing dedicated redirection for the farm. When you do so, you must map the IP address of this RD Session Host server to the farm name in DNS. For information about how to add a DNS entry for a farm name, see Configure DNS for RD Connection Broker Load Balancing.

You can have more than one RD Session Host server configured to provide dedicated redirection for the farm. To configure another RD Session Host server to provide dedicated redirection for the farm, repeat Steps 2 and 3.

Virtual machine redirection

To provide users access to personal virtual desktops or virtual machines in a virtual desktop pool through RemoteApp and Desktop Connection, you must configure an RD Session Host server to provide virtual machine redirection.

To configure an RD Session Host server to provide virtual machine redirection, select Virtual machine redirection in the RD Connection Broker Settings dialog box in Remote Desktop Session Host Configuration.

When you configure an RD Session Host server to provide virtual machine redirection, the following changes are made to the RD Session Host server:

  • The user logon mode is changed to Allow reconnections, but prevent new logons.

  • All programs are removed from the RemoteApp Programs list in RemoteApp Manager.

  • The Authenticated Users group is added to the Remote Desktop Users group.

Note

To connect remotely to administer an RD Session Host server that is configured to provide virtual machine redirection, use mstsc /admin.

For more information about providing users access to personal virtual desktops or virtual machines in a virtual desktop pool through RemoteApp and Desktop Connection, see the Remote Desktop Connection Manager Help in Windows Server 2008 R2.

Additional references

Checklist: Create a Load-Balanced RD Session Host Server Farm by Using RD Connection Broker


Remote Desktop Session Host (RD Session Host)

A Remote Desktop Session Host (RD Session Host) server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server by using Remote Desktop Connection or by using RemoteApp.

The following topics are covered:

  • Overview of Remote Desktop Session Host (RD Session Host)

  • Checklist: RD Session Host Installation Prerequisites

  • Checklist: Configure an RD Session Host Server

  • Configuring an RD Session Host Server

  • Managing an RD Session Host Server

For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).


Overview of Remote Desktop Session Host (RD Session Host)

The Remote Desktop Services server role in Windows Server 2008 R2 consists of several role services, one of which is Remote Desktop Session Host (RD Session Host).

An RD Session Host server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server from within a corporate network or from the Internet by using Remote Desktop Connection or by using RemoteApp.

For more information about RemoteApp, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140439).

When a user accesses a program on an RD Session Host server, the program execution occurs on the server. Each user sees only their individual session. The session is managed transparently by the server operating system and is independent of any other client session.

If you deploy a program on an RD Session Host server instead of on each device, there are many benefits. These include the following:

  • You can quickly deploy Windows-based programs to computing devices across an enterprise. This is especially useful when you have programs that are frequently updated, infrequently used, or difficult to manage.

  • Users can access programs that are running on an RD Session Host server from devices such as home computers, kiosks, hardware that might not meet the requirements of the operating system or application, and operating systems other than Windows.

  • Branch office workers who need access to centralized data stores can receive better program performance by accessing a program remotely on an RD Session Host server. Data-intensive programs sometimes do not have client/server protocols that are optimized for low-speed connections. Programs of this kind frequently perform better over a Remote Desktop Services connection than over a typical wide area network.

For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).


Checklist: RD Session Host Installation Prerequisites

An RD Session Host server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server by using Remote Desktop Connection or by using RemoteApp.

This checklist provides tasks that an administrator should perform before installing and configuring an RD Session Host server.

Note

Installing the RD Session Host role service on an Active Directory® domain controller is not recommended. For more information, see Installing RD Session Host on a Domain Controller.

Task Reference

Determine if you need an RD Session Host server.

To allow remote connections for administrative purposes only, you do not have to install an RD Session Host server.

For more information about remote connections for administrative purposes, see Using Remote Desktop.

Review licensing requirements for an RD Session Host server.

Each user or computing device that connects to an RD Session Host server must have a valid Remote Desktop Services client access license (RDS CAL).

An RD Session Host server running Windows Server 2008 R2 must be configured to use at least a license server running Windows Server 2008, and the license server must have valid RDS CALs installed.

For more information about licensing requirements for Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

Decide which programs you want to host on the RD Session Host server.

You should install the RD Session Host role service on the computer before you install any programs that you want to make available to users. If you install the RD Session Host role service on a computer that already has programs installed, some of the existing programs may not work correctly in a multiple user environment. Uninstalling and then reinstalling the affected programs may resolve these issues.

For more information, see Install Programs on an RD Session Host Server.

Review information about:

  • Hardware requirements

  • Capacity and scaling

See the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=138055).

Determine if you need to deploy a load-balanced RD Session Host server farm.

For more information about RD Connection Broker, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140432).

Determine the Remote Desktop licensing mode that the RD Session Host server will use.

The Remote Desktop licensing mode configured on an RD Session Host server must match the type of RDS CALs available on the Remote Desktop license server.

For more information, see Specify the Remote Desktop Licensing Mode.

Determine the Remote Desktop license server from which the RD Session Host server will request RDS CALs.

An RD Session Host server must be configured to specify a Remote Desktop license server from which to request RDS CALs for users or computing devices that are connecting to the RD Session Host server.

For more information, see Specify a License Server for the RD Session Host Server to Use.

Determine which users will be able to remotely connect to the RD Session Host server.

The Remote Desktop Users group on an RD Session Host server is used to give users and groups permission to log on remotely to an RD Session Host server.

For more information, see Configure the Remote Desktop Users Group.

Determine if you need to deploy an RD Gateway server.

For more information about RD Gateway, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140433).

Determine if the RD Session Host server will require Network Level Authentication.

You can enhance RD Session Host server security by providing user authentication earlier in the connection process when a client connects to an RD Session Host server. This early user authentication method is referred to as Network Level Authentication.

For more information, see Configure the Network Level Authentication Setting for an RD Session Host Server.

Review information about Windows Firewall.

The installation of the Remote Desktop Services role changes the configuration of Windows Firewall.

For more information, see Remote Desktop Services and Windows Firewall.


Using Remote Desktop

To allow remote connections for administrative purposes only, you do not have to install the RD Session Host role service. Instead, you enable Remote Desktop on the computer that you want to remotely administer.

Note

Remote Desktop supports only two concurrent remote connections to the computer. You do not need Remote Desktop Services client access licenses (RDS CALs) for these connections.

You can use the following procedure to enable Remote Desktop on a Windows Server 2008 R2 computer.

Membership in the local Administrators group, or equivalent, on the computer that you plan to configure, is the minimum required to complete this procedure.

To enable Remote Desktop

  1. Start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click either of the following, depending on your environment:

    • Allow connections from computers running any version of Remote Desktop (less secure)

    • Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)

    For more information about the two options, click the Help me choose link on the Remote tab.

  4. Click Select Users to add the users and groups that need to connect to the computer by using Remote Desktop. The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

Additional references

  • Configuring an RD Session Host Server

  • Configure the Network Level Authentication Setting for an RD Session Host Server

  • Configure the Remote Desktop Users Group

  • Overview of Remote Desktop Session Host (RD Session Host)

  • Checklist: RD Session Host Installation Prerequisites


Installing RD Session Host on a Domain Controller

Installing the RD Session Host role service on an Active Directory domain controller is not recommended. Allowing users to run programs on a domain controller could create security risks and performance issues.

If the RD Session Host role service is installed on a domain controller, the security settings of the domain controller will need to be adjusted to allow users to have remote access to the server. This remote access is controlled by the Allow logon through Remote Desktop Services user rights assignment, which can be configured by using the Group Policy Management Console (GPMC).

On a domain controller, by default, only the Administrators group is granted the Allow logon through Remote Desktop Services user right. To allow remote access to the RD Session Host server for users who are not members of the Administrators group, you should grant the Remote Desktop Users group the Allow logon through Remote Desktop Services user right.

For more information about using GPMC to configure user rights assignments, see the Group Policy Management Console Help in Windows Server 2008 R2.

For more information about RD Licensing, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140434).

Additional references

  • Checklist: RD Session Host Installation Prerequisites


Remote Desktop Services and Windows Firewall

The Windows Firewall is on by default in Windows Server 2008 and Windows Server 2008 R2. Windows Firewall helps control which programs or ports can be used to communicate between the Windows Server 2008 or Windows Server 2008 R2 server and other computers on the network or the Internet. To allow a program or port to communicate through Windows Firewall, an exception needs to be enabled.

If you enable Remote Desktop, Windows Firewall automatically enables the Remote Desktop exception.

When the RD Session Host role service is installed, Windows Firewall automatically enables the following exceptions:

  • Remote Desktop

  • Remote Desktop Services

If you install other Remote Desktop Services role services, Windows Firewall will automatically enable other exceptions. For example, when you install the RD Licensing role service, Windows Firewall enables the Remote Desktop Licensing Server exception.

When you uninstall (remove) a role service from the computer, Windows Firewall automatically removes the exception for that role service.

Important

When the RD Session Host role service is uninstalled (removed), only the Remote Desktop Services exception is removed. The Remote Desktop exception is not removed.

Use the following procedure to view Windows Firewall exceptions.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To view Windows Firewall exceptions

  1. Click Start, and then click Control Panel.

  2. Click System and Security, and then click Windows Firewall.

  3. Click Allow a program or feature through Windows Firewall.

  4. If the check box associated with the program or port listed is selected, the Windows Firewall exception for that program or port is enabled.

    Some programs only appear in the list when the role service is installed. For example, the Remote Desktop Licensing Server exception only appears in the list when the RD Licensing role service is installed on the computer.

To view more detailed information about Windows Firewall settings, use the Windows Firewall with Advanced Security snap-in.

Use the following procedure to use Windows Firewall with Advanced Security.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To use the Windows Firewall with Advanced Security snap-in

  1. Click Start, point to Administrative Tools, and then click Windows Firewall with Advanced Security.

  2. To view detailed information about Windows Firewall settings, click either of the following nodes in the left pane:

    • Inbound rules

    • Outbound rules

For more information about configuring Windows Firewall, see the Windows Firewall with Advanced Security Help in Windows Server 2008 R2.

For more information about Remote Desktop Services-specific Windows Firewall exceptions, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?Linkid=138056).

Additional references

  • Using Remote Desktop

  • Install the RD Session Host Role Service

  • Checklist: RD Session Host Installation Prerequisites


Checklist: Configure an RD Session Host Server

An RD Session Host server is the server that hosts Windows-based programs or the full Windows desktop for Remote Desktop Services clients. Users can connect to an RD Session Host server to run programs, to save files, and to use network resources on that server. Users can access an RD Session Host server by using Remote Desktop Connection or by using RemoteApp.

This checklist provides tasks that an administrator needs to complete to install and configure an RD Session Host server.

Please note the following:

  • Installing the RD Session Host role service requires the computer to be restarted.

  • Installing the RD Session Host role service on an Active Directory domain controller is not recommended. For more information, see Installing RD Session Host on a Domain Controller.

  • You should install the RD Session Host role service on the computer before you install any programs that you want to make available to users. For more information, see Install Programs on an RD Session Host Server.

Task | Reference
Review prerequisites for installing the RD Session Host role service. | Checklist: RD Session Host Installation Prerequisites
Install the RD Session Host role service. | Install the RD Session Host Role Service
Configure the license settings on the RD Session Host server. | Configure License Settings for an RD Session Host Server
Configure the Network Level Authentication setting for the RD Session Host server. | Configure the Network Level Authentication Setting for an RD Session Host Server
Install programs on the RD Session Host server. | Install Programs on an RD Session Host Server
Configure which users can remotely connect to the RD Session Host server. | Configure the Remote Desktop Users Group

Additional references

  • Overview of Remote Desktop Session Host (RD Session Host)


Configuring an RD Session Host Server

This section provides procedures for configuring an RD Session Host server. The following topics are covered:

  • Install the RD Session Host Role Service

  • Configure License Settings for an RD Session Host Server

  • Configure the Network Level Authentication Setting for an RD Session Host Server

  • Install Programs on an RD Session Host Server

  • Configure the Remote Desktop Users Group

  • Configure the Client Experience on an RD Session Host Server

Additional references

  • Overview of Remote Desktop Session Host (RD Session Host)

  • Checklist: RD Session Host Installation Prerequisites

  • Checklist: Configure an RD Session Host Server


Install the RD Session Host Role Service

In Windows Server 2008 R2, you can use Server Manager to install the RD Session Host role service. For more information about other ways to install the RD Session Host role service, including by using the command-line tool servermanagercmd.exe, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?linkid=138055).

Use the following procedure to install the RD Session Host role service by using Server Manager if Remote Desktop Services is not already installed on the server. If Remote Desktop Services is already installed on the server, see Install the Remote Desktop Session Host role service (when Remote Desktop Services is already installed).

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

Important

The installation of the RD Session Host role service requires the computer to be restarted.

To install the Remote Desktop Session Host role service

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, right-click Roles, and then click Add Roles.

  3. In the Add Roles Wizard, on the Before You Begin page, click Next.

  4. On the Select Server Roles page, under Roles, select the Remote Desktop Services check box.

    Note

    If Remote Desktop Services is already installed on the server, the Remote Desktop Services check box will be selected and dimmed, and followed by “(Installed).”

  5. Click Next.

  6. On the Remote Desktop Services page, click Next.

  7. On the Select Role Services page, select the Remote Desktop Session Host check box, and then click Next.

    Note

    If you are installing the RD Session Host role service on a domain controller, you will receive a warning message because installing the RD Session Host role service on a domain controller is not recommended. For more information, see Installing RD Session Host on a Domain Controller.

  8. On the Uninstall and Reinstall Applications for Compatibility page, click Next.

  9. On the Specify Authentication Method for Remote Desktop Session Host page, select the appropriate authentication method for the RD Session Host server, and then click Next. For more information about authentication methods, see Configure the Network Level Authentication Setting for an RD Session Host Server.

  10. On the Specify Licensing Mode page, select the appropriate licensing mode for the RD Session Host server, and then click Next. For more information about licensing modes, see Specify the Remote Desktop Licensing Mode.

  11. On the Select User Groups Allowed Access To This Remote Desktop Session Host Server page, add the users or user groups that you want to be able to remotely connect to this RD Session Host server, and then click Next. For more information, see Configure the Remote Desktop Users Group.

  12. On the Configure Client Experience page, select the functionality that you want to be available to remote clients that are connected by using this RD Session Host server, and then click Next. For more information, see Configure the Client Experience on an RD Session Host Server.

  13. On the Confirm Installation Selections page, verify that the RD Session Host role service will be installed, and then click Install.

  14. On the Installation Progress page, installation progress will be noted.

  15. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then in the Add Role Services window, click Yes to restart the server.

  16. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  17. After the server restarts and you log on to the computer, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that the installation of RD Session Host succeeded.

    You can also confirm that RD Session Host is installed by following these steps:

    1. Start Server Manager.

    2. Under Roles Summary, click Remote Desktop Services.

    3. Under System Services, confirm that the status for Remote Desktop Services is Running.

    4. Under Role Services, confirm that the status for Remote Desktop Session Host is Installed.

Install the Remote Desktop Session Host role service (when Remote Desktop Services is already installed)

Use the following procedure to install the RD Session Host role service when Remote Desktop Services is already installed on the server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

Important

The installation of the RD Session Host role service requires the computer to be restarted.

To install the Remote Desktop Session Host role service when Remote Desktop Services is already installed

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, expand Roles.

  3. Right-click Remote Desktop Services, and then click Add Role Services.

  4. On the Select Role Services page, select the Remote Desktop Session Host check box, and then click Next.

    Note

    If you are installing the RD Session Host role service on a domain controller, you will receive a warning message because installing the RD Session Host role service on a domain controller is not recommended. For more information, see Installing RD Session Host on a Domain Controller.

  5. On the Uninstall and Reinstall Applications for Compatibility page, click Next.

  6. On the Specify Authentication Method for Remote Desktop Session Host page, select the appropriate authentication method for the RD Session Host server, and then click Next. For more information about authentication methods, see Configure the Network Level Authentication Setting for an RD Session Host Server.

  7. On the Specify Licensing Mode page, select the appropriate licensing mode for the RD Session Host server, and then click Next. For more information about licensing modes, see Specify the Remote Desktop Licensing Mode.

  8. On the Select User Groups Allowed Access To This Remote Desktop Session Host page, add the users or user groups that you want to be able to remotely connect to this RD Session Host server, and then click Next. For more information, see Configure the Remote Desktop Users Group.

  9. On the Configure Client Experience page, select the functionality that you want to be available to remote clients that are connected by using this RD Session Host server, and then click Next. For more information, see Configure the Client Experience on an RD Session Host Server.

  10. On the Confirm Installation Selections page, verify that the RD Session Host role service will be installed, and then click Install.

  11. On the Installation Progress page, installation progress will be noted.

  12. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then in the Add Role Services window, click Yes to restart the server.

  13. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  14. After the server restarts and you log on to the computer, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that the installation of RD Session Host succeeded.

    You can also confirm that RD Session Host is installed by following these steps:

    1. Start Server Manager.

    2. Under Roles Summary, click Remote Desktop Services.

    3. Under System Services, confirm that the status for Remote Desktop Services is Running.

    4. Under Role Services, confirm that the status for Remote Desktop Session Host is Installed.

Additional references

  • Configuring an RD Session Host Server

  • Overview of Remote Desktop Session Host (RD Session Host)

  • Checklist: RD Session Host Installation Prerequisites

  • Checklist: Configure an RD Session Host Server


Configure License Settings for an RD Session Host Server

Each user or computing device that connects to a Remote Desktop Session Host (RD Session Host) server must have a valid Remote Desktop Services client access license (RDS CAL) issued by a Remote Desktop license server.

To ensure that an RD Session Host server can contact a Remote Desktop license server to request RDS CALs for clients, you need to do the following on the RD Session Host server:

  • Specify the Remote Desktop Licensing Mode

  • Specify a License Server for the RD Session Host Server to Use

To be alerted to possible licensing configuration issues, use Licensing Diagnosis in Remote Desktop Session Host Configuration. For information about Licensing Diagnosis, see the topic "Identify Possible Licensing Problems for the RD Session Host Server" in the Remote Desktop Session Host Configuration Help in Windows Server 2008 R2.

Additional references

  • Configuring an RD Session Host Server

  • Checklist: RD Session Host Installation Prerequisites


Specify the Remote Desktop Licensing Mode

The Remote Desktop licensing mode determines the type of Remote Desktop Services client access licenses (RDS CALs) that a Remote Desktop Session Host (RD Session Host) server will request from a license server on behalf of a client connecting to the RD Session Host server.

Important

The Remote Desktop licensing mode configured on an RD Session Host server must match the type of RDS CALs available on the license server.

There are two types of RDS CALs:

  • RDS Per Device CAL: Permits one device (used by any user) to connect to an RD Session Host server.

  • RDS Per User CAL: Gives one user the right to access RD Session Host servers from an unlimited number of client computers or devices.

The Remote Desktop licensing mode for the RD Session Host server can be set in the following ways:

  • During the installation of the RD Session Host role service in Server Manager, on the Specify Licensing Mode page in the Add Roles Wizard.

    On the Specify Licensing Mode page, you can select Configure later if you are unsure during the installation whether to select Per Device or Per User. If you select Configure later, each time you log on to the RD Session Host server, a message will appear in the lower-right corner of the desktop reminding you that you need to configure the licensing mode for the RD Session Host server.

  • By configuring the Remote Desktop licensing mode for the RD Session Host server by using the Remote Desktop Session Host Configuration tool.

    If the Remote Desktop licensing mode choices are dimmed and you cannot make a selection, the Set the Remote Desktop licensing mode Group Policy setting has been enabled and has been applied to the RD Session Host server.

  • By applying the Set the Remote Desktop licensing mode Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about RD Licensing, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140434).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure License Settings for an RD Session Host Server


Specify a License Server for the RD Session Host Server to Use

A Remote Desktop Session Host (RD Session Host) server must be able to contact a Remote Desktop license server to request Remote Desktop Services client access licenses (RDS CALs) for users or computing devices that are connecting to the RD Session Host server.

In Windows Server 2008 R2, you must specify a license server for the RD Session Host server to use. Automatic license server discovery is no longer supported for an RD Session Host server that is running Windows Server 2008 R2.

Use the following procedure to specify a license server for the RD Session Host server to use.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To specify a license server for the RD Session Host server to use

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. Under Licensing in the Edit settings section, double-click Remote Desktop license servers.

  4. Click Add.

  5. In the Add License Server dialog box, select a license server from the list of known license servers, and then click Add. If the license server that you want to add is not listed, in the License server name or IP address box, type the name or IP address of the license server that you want to add, and then click Add.

    You can add more than one license server for the RD Session Host server to use. The RD Session Host server will contact the license servers in the order in which they appear in the Specified license servers box.

  6. Click OK to close the Add License Server dialog box, and then click OK to save your changes to the licensing settings.

You can also specify a license server for the RD Session Host server to use by applying the Use the specified Remote Desktop license servers Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Licensing and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the license servers configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure License Settings for an RD Session Host Server


Configure the Network Level Authentication Setting for an RD Session Host Server

Network Level Authentication can be used to enhance RD Session Host server security by requiring that the user be authenticated to an RD Session Host server before a session is created.

Network Level Authentication is an authentication method that completes user authentication before you establish a remote desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer from malicious users and malicious software. The advantages of Network Level Authentication are:

  • It requires fewer remote computer resources initially. The remote computer uses a limited number of resources before authenticating the user, rather than starting a full remote desktop connection as in previous versions.

  • It can help provide better security by reducing the risk of denial-of-service attacks.

To use Network Level Authentication, you must meet the following requirements:

  • The client computer must be using at least Remote Desktop Connection 6.0.

  • The client computer must be using an operating system, such as Windows® 7 or Windows Vista®, that supports the Credential Security Support Provider (CredSSP) protocol.

  • The RD Session Host server must be using Windows Server 2008 R2 or Windows Server 2008.

You can configure an RD Session Host server to only support connections from clients running Network Level Authentication. The Network Level Authentication setting for an RD Session Host server can be set in the following ways:

  • During the installation of the RD Session Host role service in Server Manager, on the Specify Authentication Method for Remote Desktop Session Host page in the Add Roles Wizard.

  • On the Remote tab in the System Properties dialog box on an RD Session Host server.

    If the Allow connections from computers running any version of Remote Desktop (less secure) is not selected and not enabled, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the RD Session Host server.

    To configure the Network Level Authentication setting by using the Remote tab in the System Properties dialog box on an RD Session Host server, see Change Remote Connection Settings.

  • On the General tab of the Properties dialog box for a connection in the Remote Desktop Session Host Configuration tool by selecting the Allow connections only from computers running Remote Desktop with Network Level Authentication check box.

    If the Allow connections only from computers running Remote Desktop with Network Level Authentication check box is selected and is dimmed, the Require user authentication for remote connections by using Network Level Authentication Group Policy setting has been enabled and has been applied to the RD Session Host server.

  • By applying the Require user authentication for remote connections by using Network Level Authentication Group Policy setting.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security and can be configured by using either the Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration or on the Remote tab.

To determine whether a computer is running a version of Remote Desktop Connection that supports Network Level Authentication, start Remote Desktop Connection, click the icon in the upper-left corner of the Remote Desktop Connection dialog box, and then click About. In the About Remote Desktop Connection dialog box, look for the phrase Network Level Authentication supported.

For more information about Network Level Authentication and Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkID=138055).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configuring an RD Session Host Server

  • Install the RD Session Host Role Service


Install Programs on an RD Session Host Server

You should install the RD Session Host role service on the computer before you install any programs that you want to make available to users. If you install the RD Session Host role service on a computer that already has programs installed, some of the existing programs may not work correctly in a multiuser environment. Uninstalling and then reinstalling the affected programs may resolve these issues.

To ensure that an application is installed correctly to work in a multiuser environment, you must put the RD Session Host server into a special installation mode before you install the application on the RD Session Host server. This special installation mode ensures that the correct registry entries and .ini files that are needed to support running the application in a multiuser environment are created during the installation process.

You can put an RD Session Host server into this special installation mode by using either of the following:

  • Install Application on Remote Desktop Session Host tool under Programs in Control Panel. This tool will run a wizard to help install the application.

  • Change user /install command at a command prompt. You will have to start the installation of the application manually.

After the application is installed, you must put the RD Session Host server into execution mode before remote users begin using the application. The Install Application on Remote Desktop Session Host tool will automatically put the RD Session Host server into execution mode when it is finished running. To put the RD Session Host server into execution mode from a command prompt, use the change user /execute command.

Additional considerations

  • Some programs may require minor setup modifications to run correctly on an RD Session Host server.

  • If you have programs that are related to each other or have dependencies on each other, you should install the programs on the same RD Session Host server. For example, you should install Microsoft Office as a suite on the same RD Session Host server instead of installing individual Office programs on separate RD Session Host servers.

  • You should consider installing individual programs on separate RD Session Host servers in the following circumstances:

    • The program has compatibility issues that may affect other programs.

    • A single program and the number of associated users may fill server capacity.

  • For more information about command-line tools for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138135).

  • For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).

Additional references

  • Configuring an RD Session Host Server


Configure the Remote Desktop Users Group

The Remote Desktop Users group on an RD Session Host server is used to give users and groups permission to remotely connect to an RD Session Host server.

You can add users and groups to the Remote Desktop Users group in the following ways:

  • Local Users and Groups snap-in

  • Active Directory Users and Computers snap-in, if the RD Session Host server is installed on a domain controller

  • On the Remote tab in the System Properties dialog box on an RD Session Host server

You can use the following procedure to add users and groups to the Remote Desktop Users group by using the Remote tab in the System Properties dialog box on an RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

To add users and groups to the Remote Desktop Users group by using the Remote tab

  1. Start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click Select Users. Add the users or groups that need to connect to the RD Session Host server by using Remote Desktop. The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

    If you select Don't allow connections to this computer on the Remote tab, no users will be able to connect remotely to this computer, even if they are members of the Remote Desktop Users group.

Additional references

  • Configuring an RD Session Host Server


Configure the Client Experience on an RD Session Host Server

You can configure a Remote Desktop Session Host (RD Session Host) server so that users connecting to a remote desktop session can use functionality similar to that provided by Windows 7.

Important

Providing this functionality requires additional system and bandwidth resources and may affect the scalability of the RD Session Host server.

During the installation of the RD Session Host role service in Server Manager, you can automatically configure the following functionality on the Configure Client Experience page in the Add Roles Wizard:

  • Audio and video playback

  • Audio recording redirection

  • Desktop composition

If you configure the RD Session Host server to provide audio and video playback or desktop composition, the Desktop Experience feature will be installed on the RD Session Host server. For more information about Desktop Experience, see Desktop Experience Feature.

To manually configure this functionality, see the following topics:

  • Configure Audio and Video Playback on an RD Session Host Server

  • Configure Audio Recording Redirection on an RD Session Host Server

  • Configure Desktop Composition on an RD Session Host Server


Desktop Experience Feature

The Desktop Experience feature allows you to install a variety of components and features that are provided in the Windows 7 operating system onto a computer that is running the Windows Server 2008 R2 operating system. After you install Desktop Experience, the Windows 7 components and features, such as Windows Media Player, will appear under All Programs on the Start menu.

Note

Installing Desktop Experience does not automatically turn on any of its features or components. After installing Desktop Experience, you must manually enable or configure the features or components.

For information about installing Desktop Experience, see Install Desktop Experience on an RD Session Host Server.

What’s in the Desktop Experience feature

Desktop Experience includes the following Windows 7 components and features:

  • Windows Calendar

  • Windows Mail

  • Windows Media Player

  • Desktop themes

  • Video for Windows (AVI support)

  • Windows Photo Gallery

  • Windows SideShow

  • Windows Defender

  • Disk Cleanup

  • Sync Center

  • Sound Recorder

  • Character Map

  • Snipping Tool

Additional references

  • Configure the Client Experience on an RD Session Host Server


Install Desktop Experience on an RD Session Host Server

When a user uses Remote Desktop Connection to connect to a Remote Desktop Session Host (RD Session Host) server, the desktop that exists on the RD Session Host server is reproduced, by default, in the remote session. To make the remote session look and feel more like the user's local Windows 7 desktop experience, install the Desktop Experience feature on an RD Session Host server that is running Windows Server 2008 R2.

Desktop Experience installs components and features of Windows 7, such as Windows Media Player, Windows Defender, and Windows Calendar. For more information about Desktop Experience, see Desktop Experience Feature.

Install Desktop Experience

Use the following procedure to install Desktop Experience on the server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The installation of Desktop Experience requires the computer to be restarted.

To install Desktop Experience

  1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, click Features, and then in the Features Summary section, click Add Features.

  3. On the Select Features page, select the Desktop Experience check box.

  4. Review the information about the required features that need to be installed with the Desktop Experience feature, and then click Add Required Features.

  5. Click Next.

  6. On the Confirm Installation Selections page, verify that the Desktop Experience feature will be installed, and then click Install.

  7. On the Installation Progress page, installation progress will be noted.

  8. On the Installation Results page, you are prompted to restart the server to finish the installation process. Click Close, and then click Yes to restart the server.

  9. After the server restarts and you log on to the computer with the same user account, the remaining steps of the installation will finish. When the Installation Results page appears, confirm that the installation of Desktop Experience succeeded, and then click Close.

    You can also confirm that Desktop Experience is installed by following these steps:

    1. Start Server Manager.

    2. In the left pane, click Features, and then in the Features Summary section, confirm that Desktop Experience is listed as installed.

After you install Desktop Experience, the Windows 7 components and features, such as Windows Media Player, will appear under All Programs on the Start menu.

Uninstall (Remove) Desktop Experience

Use the following procedure to uninstall (remove) Desktop Experience from the server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Important

The removal of Desktop Experience from the server requires the computer to be restarted.

To uninstall (remove) Desktop Experience

  1. Open Server Manager. Click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, click Features, and then in the Features Summary section, click Remove Features.

  3. On the Select Features page, clear the Desktop Experience check box, and then click Next.

  4. On the Confirm Removal Selections page, verify that the Desktop Experience feature will be removed, and then click Remove.

  5. On the Removal Progress page, removal progress will be noted.

  6. On the Removal Results page, you are prompted to restart the server to finish the removal process. Click Close, and then click Yes to restart the server.

  7. After the server restarts and you log on to the computer with the same user account, the remaining steps of the removal process will finish. When the Removal Results page appears, confirm that the removal of Desktop Experience succeeded, and then click Close.

    You can also confirm that Desktop Experience is removed by following these steps:

    1. Start Server Manager.

    2. In the left pane, click Features, and then in the Features Summary section, confirm that Desktop Experience is no longer listed as installed.

Additional references

  • Configure the Client Experience on an RD Session Host Server


Configure Audio and Video Playback on an RD Session Host Server

Audio and video playback allows users to redirect the remote computer’s audio in a remote session, and provides an improved experience for video playback in remote sessions. By default, audio and video playback is not allowed when connecting to a computer running Windows Server 2008 R2.

Note

Users can specify where to play the remote computer’s audio output by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). Video playback can be configured by using the videoplayback setting in a Remote Desktop Protocol (.rdp) file. By default, video playback is enabled.

Manually configuring audio and video playback

To manually configure audio and video playback on a Remote Desktop Session Host (RD Session Host) server, you need to do the following:

  • Install the Desktop Experience feature.

  • Start the Windows Audio service.

  • Enable the Allow audio and video playback redirection Group Policy setting.

  • Set the maximum color depth to 32 bits per pixel.

Install the Desktop Experience feature

For information about installing Desktop Experience, see Install Desktop Experience on an RD Session Host Server.

Start the Windows Audio service

Use the following procedure to start the Windows Audio service on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To start the Windows Audio service

  1. On the RD Session Host server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the Services pane, right-click Windows Audio, and then click Properties.

  4. On the General tab, in the Startup type box, select Automatic, and then click Apply.

  5. Under Service status, click Start.

  6. Click OK to close the Windows Audio Properties dialog box.

  7. Confirm that the Status column for the Windows Audio service displays Started.

Enable the Allow audio and video playback redirection Group Policy setting

To allow audio and video playback when connecting to a computer running Windows Server 2008 R2, you must enable the Allow audio and video playback redirection Group Policy setting. The Allow audio and video playback redirection Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Set the maximum color depth to 32 bits per pixel

Use the following procedure to set the maximum color depth to 32 bits per pixel on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To set the maximum color depth to 32 bits per pixel

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. Under Connections, right-click the name of the connection that you want to configure (for example, RDP-Tcp), and then click Properties.

  4. On the Client Settings tab, in the Limit Maximum Color Depth box, select 32 bits per pixel.

  5. Click OK. Changes to color depth settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the RD Session Host server.

You can also set the maximum color depth by applying the Limit maximum color depth Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure the Client Experience on an RD Session Host Server


Configure Audio Recording Redirection on an RD Session Host Server

Audio recording redirection allows users to record audio to the remote computer in a remote session. By default, audio recording redirection is not allowed when connecting to a computer running Windows Server 2008 R2.

Note

Users can specify whether to record audio to the remote computer by configuring the remote audio settings on the Local Resources tab in Remote Desktop Connection (RDC). Users can record audio by using an audio input device on the local computer, such as a built-in microphone.

Manually configuring audio recording redirection

To manually configure audio recording redirection on a Remote Desktop Session Host (RD Session Host) server, you need to do the following:

  • Start the Windows Audio service.

  • Enable the Allow audio recording redirection Group Policy setting.

Start the Windows Audio service

Use the following procedure to start the Windows Audio service on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To start the Windows Audio service

  1. On the RD Session Host server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the Services pane, right-click Windows Audio, and then click Properties.

  4. On the General tab, in the Startup type box, select Automatic, and then click Apply.

  5. Under Service status, click Start.

  6. Click OK to close the Windows Audio Properties dialog box.

  7. Confirm that the Status column for the Windows Audio service displays Started.

Enable the Allow audio recording redirection Group Policy setting

To allow audio recording redirection when connecting to a computer running Windows Server 2008 R2, you must enable the Allow audio recording redirection Group Policy setting. The Allow audio recording redirection Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure the Client Experience on an RD Session Host Server


Configure Desktop Composition on an RD Session Host Server

Desktop composition provides the user interface elements of Windows Aero, such as translucent windows, for remote desktop sessions. By default, desktop composition is not allowed when connecting to a computer running Windows Server 2008 R2.

Important

Because Windows Aero requires additional system and bandwidth resources, allowing desktop composition for remote desktop sessions can reduce connection performance, particularly over slow links, and increase the load on the Remote Desktop Session Host (RD Session Host) server.

Desktop composition is not available for RemoteApp sessions. In addition, the client computer must have the necessary hardware to support Windows Aero features.

Manually configuring desktop composition

To manually configure desktop composition on an RD Session Host server, you need to do the following:

  • Install the Desktop Experience feature.

  • Start the Themes service.

  • Enable the Allow desktop composition for remote desktop sessions Group Policy setting.

  • Set the maximum color depth to 32 bits per pixel.

Install the Desktop Experience feature

For information about installing Desktop Experience, see Install Desktop Experience on an RD Session Host Server.

Start the Themes service

Use the following procedure to start the Themes service on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To start the Themes service

  1. On the RD Session Host server, open the Services snap-in. To open the Services snap-in, click Start, point to Administrative Tools, and then click Services.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. In the Services pane, right-click Themes, and then click Properties.

  4. On the General tab, in the Startup type box, select Automatic, and then click Apply.

  5. Under Service status, click Start.

  6. Click OK to close the Themes Properties dialog box.

  7. Confirm that the Status column for the Themes service displays Started.

Enable the Allow desktop composition for remote desktop sessions Group Policy setting

To allow desktop composition when connecting to a computer running Windows Server 2008 R2, you must enable the Allow desktop composition for remote desktop sessions Group Policy setting. The Allow desktop composition for remote desktop sessions Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Set the maximum color depth to 32 bits per pixel

Use the following procedure to set the maximum color depth to 32 bits per pixel on the RD Session Host server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To set the maximum color depth to 32 bits per pixel

  1. On the RD Session Host server, open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  3. Under Connections, right-click the name of the connection that you want to configure (for example, RDP-Tcp), and then click Properties.

  4. On the Client Settings tab, in the Limit Maximum Color Depth box, select 32 bits per pixel.

  5. Click OK. Changes to color depth settings are not applied to sessions that are connected when the change is made. The changes will take effect the next time the user establishes a new connection to the RD Session Host server.

You can also set the maximum color depth by applying the Limit maximum color depth Group Policy setting. This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC). Note that the Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration.

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure the Client Experience on an RD Session Host Server


Group Policy Settings and Configuring the Client Experience

During the installation of the RD Session Host role service in Server Manager, you can automatically configure the following functionality on the Configure Client Experience page in the Add Roles Wizard:

  • Audio and video playback

  • Audio recording redirection

  • Desktop composition

Server Manager automatically checks that there are no Group Policy settings currently being applied to the computer that would prevent the requested functionality from being correctly configured. If there is a Group Policy setting being applied to the computer that would prevent the requested functionality from being correctly configured, that selection will be dimmed and you will not be able to select the associated check box on the Configure Client Experience page.

The following is a list of Group Policy settings that Server Manager checks:

  • Allow audio and video playback redirection

    If the Allow audio and video playback redirection Group Policy setting is disabled, you cannot select the Audio and video playback check box on the Configure Client Experience page.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection.

  • Allow audio recording redirection

    If the Allow audio recording redirection Group Policy setting is disabled, you cannot select the Audio recording redirection check box on the Configure Client Experience page.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection.

  • Allow desktop composition for remote desktop sessions

    If the Allow desktop composition for remote desktop sessions Group Policy setting is disabled, you cannot select the Desktop composition check box on the Configure Client Experience page.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment.

  • Limit maximum color depth

    If the Limit maximum color depth Group Policy setting is enabled and the maximum color depth selected is less than 32 bits per pixel, you cannot select the Desktop composition check box on the Configure Client Experience page.

    This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment.

These Group Policy settings can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Configure the Client Experience on an RD Session Host Server


Managing an RD Session Host Server

This section provides procedures for managing an RD Session Host server. The following topics are covered:

  • Change Remote Connection Settings

  • Enable RDC Client Single Sign-On for Remote Desktop Services

  • Manage User Profiles for Remote Desktop Services

  • Configure Font Smoothing for Remote Sessions

  • Monitor an RD Session Host Server with Windows System Resource Manager

  • Uninstall the RD Session Host Role Service


Change Remote Connection Settings

You can use the following procedure to change the remote connection settings on an RD Session Host server.

On the RD Session Host server, on the Remote tab in the System Properties dialog box, you can change the following remote connection settings:

  • Network Level Authentication requirement for Remote Desktop connections

  • Membership of the Remote Desktop Users group

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

To change remote connections settings

  1. Start the System tool. To start the System tool, click Start, click Run, type control system and then click OK.

  2. Under Tasks, click Remote settings.

  3. In the System Properties dialog box, on the Remote tab, click either of the following, depending on your environment:

    • Allow connections from computers running any version of Remote Desktop (less secure)

    • Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure)

    For more information about the two options, click the Help me choose link on the Remote tab.

    On the Remote tab, if you select Don't allow connections to this computer, no users will be able to connect remotely to this computer, even if they are members of the Remote Desktop Users group.

  4. Click Select Users to add the users and groups that need to connect to the computer by using Remote Desktop. The users and groups that you add are added to the Remote Desktop Users group.

    Note

    Members of the local Administrators group can connect even if they are not listed.

Additional references

  • Managing an RD Session Host Server

  • Configure the Network Level Authentication Setting for an RD Session Host Server

  • Configure the Remote Desktop Users Group


Enable RDC Client Single Sign-On for Remote Desktop Services

Single sign-on is an authentication method that allows users with a domain account to log on once to a client computer by using a password, and then gain access to remote servers without being asked for their credentials again.

Note

This topic only covers single sign-on authentication from the Remote Desktop Connection client to an RD Session Host server. In Windows Server 2008 R2, you can enable single sign-on between Remote Desktop Web Access (RD Web Access) and RD Session Host as well. For more information about single sign-on with RD Web Access, see http://go.microsoft.com/fwlink/?LinkId=137334.

To implement single sign-on functionality in Remote Desktop Services, ensure that you meet the following requirements:

  • You can only use single sign-on for remote connections from a computer running Windows 7, Windows Vista, or Windows XP with Service Pack 3 to an RD Session Host server running Windows Server 2008 R2 or Windows Server 2008. You can also use single sign-on for remote connections from one server running Windows Server 2008 R2 or Windows Server 2008 to another server running Windows Server 2008 R2 or Windows Server 2008.

  • Ensure that the user accounts that are used for logging on have appropriate rights to log on to both the RD Session Host server and the client computer.

  • Your client computer and RD Session Host server must be joined to a domain.

To configure the recommended settings for your RD Session Host server, complete the following steps:

  • Configure authentication on the RD Session Host server.

  • Configure the client computer to allow default credentials to be used for logging on to the specified RD Session Host servers.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To configure authentication on the RD Session Host server

  1. Open Remote Desktop Session Host Configuration. To open Remote Desktop Session Host Configuration, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Session Host Configuration.

  2. Under Connections, right-click the appropriate connection (for example, RDP-Tcp), and then click Properties.

  3. In the Properties dialog box, on the General tab, verify that the Security Layer value is set to either Negotiate or SSL (TLS 1.0).

  4. On the Log on Settings tab, ensure that the Always prompt for password check box is not selected, and then click OK.

After you configure authentication on the RD Session Host server, you must allow default credential usage on the RD Session Host server by using Group Policy. The Group Policy settings can be found in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

For more information about security and Remote Desktop Services, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkID=138055).

Additional references

  • Managing an RD Session Host Server


Manage User Profiles for Remote Desktop Services

A user profile describes the configuration for a specific user, including the user’s environment and preference settings. Unless you carefully plan and manage user profiles in an RD Session Host server environment, user profiles can become large in size and can cause problems, such as slow logon times, when a user connects to an RD Session Host server. User profile management is also important when users connect to several different RD Session Host servers or connect to RD Session Host servers in remote locations.

You can specify a Remote Desktop Services-specific profile path and home folder for a user connecting to an RD Session Host server. This profile and home folder will only be used for Remote Desktop Services sessions. You should assign a separate profile for Remote Desktop Services sessions because many of the common options that are stored in profiles, such as screen savers and animated menu affects, are not desirable when using Remote Desktop Services.

You can manually configure these settings on the Remote Desktop Services Profile tab on the Properties sheet of a user account in the Local Users and Groups snap-in or the Active Directory Users and Computers snap-in.

You can also use the following Group Policy settings to configure these settings:

  • Set RD User Home Directory

  • Set path for RD Roaming User Profile

  • Use mandatory profiles on the RD Session Host server

The Group Policy settings can be found in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Profiles and can be configured by using either Local Group Policy Editor or the Group Policy Management Console (GPMC).

Note

The Group Policy setting will take precedence over the setting configured in Remote Desktop Session Host Configuration or on the Remote tab.

For more information about RD Session Host, see the Remote Desktop Services page on the Windows Server 2008 R2 TechCenter (http://go.microsoft.com/fwlink/?LinkId=140438).

For more information about Group Policy settings for Remote Desktop Services, see the Remote Desktop Services Technical Reference (http://go.microsoft.com/fwlink/?LinkId=138134).

Additional references

  • Managing an RD Session Host Server


Configure Font Smoothing for Remote Sessions

Windows Server 2008 R2 supports ClearType®, which is a technology for displaying computer fonts so that they appear clear and smooth, especially when you are using an LCD monitor.

An RD Session Host server running Windows Server 2008 R2 can provide ClearType functionality in a remote session when a client computer connects to the RD Session Host server by using Remote Desktop Connection (RDC).

Note

ClearType functionality is referred to as font smoothing in Remote Desktop Connection.

Font smoothing is available if the client computer is running any of the following:

  • Windows 7

  • Windows Vista

  • Windows Server 2003 with Service Pack 1 (SP1) and at least RDC 6.0

  • Windows XP with SP2 and at least RDC 6.0

Important

Using font smoothing in a remote session will increase the amount of bandwidth used between the client computer and the RD Session Host server.

To make font smoothing available in a remote session

  1. On the client computer, open Remote Desktop Connection. To open Remote Desktop Connection, click Start, point to All Programs, click Accessories, and then click Remote Desktop Connection.

  2. In the Remote Desktop Connection dialog box, click Options.

  3. On the Experience tab, select the Font smoothing check box.

  4. Configure any remaining connection settings, and then click Connect.

Additional references

  • Managing an RD Session Host Server


Monitor an RD Session Host Server with Windows System Resource Manager

Windows System Resource Manager (WSRM) on Windows Server 2008 R2 allows you to control how CPU and memory resources are allocated to applications, services, and processes on the computer. Managing resources in this way improves system performance and reduces the chance that applications, services, or processes will take CPU or memory resources away from one another and slow down the performance of the computer. Managing resources also creates a more consistent and predictable experience for users of applications and services running on the computer.

You can use Windows System Resource Manager to manage users or multiple applications on a computer on which Remote Desktop Services is installed.

Before installing and configuring WSRM, install the RD Session Host role service on your computer. To install RD Session Host, see Install the RD Session Host Role Service. To install WSRM, go to Features in Server Manager.

For more information about installing, configuring, and using Windows System Resource Manager, see the Windows System Resource Manager Help in Windows Server 2008 R2.

There are two features of WSRM that will be of particular interest to RD Session Host server administrators:

  • Resource allocation policies

  • Resource Monitor

Resource allocation policies

Windows System Resource Manager uses resource allocation policies to determine how computer resources, such as CPU and memory, are allocated to processes running on the computer. The three resource allocation policies that are specifically designed for computers running Remote Desktop Services are:

  • Equal_Per_User

  • Equal_Per_Session

  • Weighted_Remote_Sessions

If you implement the Equal_Per_Session resource allocation policy, each user session (and its associated processes) gets an equal share of the CPU resources on the computer.

Resource Monitor

You should collect data about the performance of your RD Session Host server before and after implementing a resource allocation policy (or making any other WSRM-related configuration changes). You can use Resource Monitor in the Windows System Resource Manager snap-in to collect and view data about the usage of hardware resources and the activity of system services on the computer.

Additional references

  • Managing an RD Session Host Server


Uninstall the RD Session Host Role Service

Use the following procedure to uninstall (remove) the RD Session Host role service from the server.

Membership in the local Administrators group, or equivalent, on the RD Session Host server that you plan to configure, is the minimum required to complete this procedure.

Important

The removal of the RD Session Host role service from the server requires the computer to be restarted.

To uninstall (remove) the Remote Desktop Session Host role service

  1. Open Server Manager. To open Server Manager, click Start, point to Administrative Tools, and then click Server Manager.

  2. In the left pane, expand Roles.

  3. Right-click Remote Desktop Services, and then click Remove Role Services.

  4. On the Select Role Services page, clear the Remote Desktop Session Host check box, and then click Next.

  5. On the Confirm Removal Selections page, click Remove.

  6. On the Removal Progress page, removal progress will be noted.

  7. On the Removal Results page, you are prompted to restart the server to finish the removal process. Click Close, and then in the Remove Role Services window, click Yes to restart the server.

  8. If you are prompted that other programs are still running, do either of the following:

    • To close the programs manually and restart the server later, click Cancel.

    • To automatically close the programs and restart the server, click Restart now.

  9. After the server restarts and you log on to the computer, the remaining steps of the removal process will finish. When the Removal Results page appears, confirm that the removal of RD Session Host succeeded.

    You can also confirm that RD Session Host is removed by following these steps:

    1. Start Server Manager.

    2. Under Roles Summary, verify that Remote Desktop Services does not appear as a role that is installed.

Additional references

  • Managing an RD Session Host Server