In some earlier posts I discussed the new High Availability (HA) feature of the RD Connection Broker (RDCB) in Windows Server 2012 (formally known as Windows Server 8).
- RDS in WIN8 Feature highlight no. 1 Better High Availability of the RD Connection Broker
- How to configure High Availability for RD Connection Broker on Windows 8
- RD Connection Broker HA – SQL Permissions
In the blog post regarding the configuration of HA (no. 2 in de above list) I ended the blog with the comment that we would now be able to connect to the environment by using MSTSC and entering the DNS farm name as the destination host to connect to. Having read that you’re probably wondering how this works. Because we’re launching an RDP connection using MSTSC with the destination set to the DNS farm name that points to the brokers. Would that not result in launching an RDP session to the RDCB server and not to the RDSH server(s) behind it? Yes it would!
If, after completing the step in blog post no. 2, I would launch MSTSC and enter the DNS farm name as the destination host (as shown below):
That would result in the error below. Why? Because we’re actually launching an RDP session to one of the RDCB servers, and of course that’s denied for our end user.
What we need to do is configure some properties in an .RDP file so that it has knowledge of the fact that we’re trying to connect through a HA Connection Broker.
These are the properties that need to be added:
full address:s:FARM.LAB.LOCAL
workspace id:s:FARM.LAB.LOCAL
use redirection server name:i:1
loadbalanceinfo:s:tsv://MS Terminal Services Plugin.1.Wortell_sLab_Ses
alternate full address:s:FARM.LAB.LOCAL
If we try that as our end user, the connection bar would still show the RDCB DNS farm name, but we’re now logged in on the RDSH server.
This also get’s automatically configured for your RemoteApps. RemoteApps integrated on the client are stored inside RDP files in the following location:
C:\Users\<username>\AppData\Roaming\Microsoft\Workspaces\<Workspace-ID>\Resource
Editing such a .RDP file in notepad would (amongst some other properties that I left out here) results in:
full address:s:FARM.LAB.LOCAL
alternate shell:s:||calc
remoteapplicationprogram:s:||calc
gatewayhostname:s:rdgw.lab.local
remoteapplicationname:s:Calculator
remoteapplicationcmdline:s:
workspace id:s:FARM.LAB.LOCAL
use redirection server name:i:1
loadbalanceinfo:s:tsv://MS Terminal Services Plugin.1.Wortell_sLab_Ses
alternate full address:s:FARM.LAB.LOCAL
RD WebAccess also automatically points to the RD Connection Broker farm
So that’s how to configure your .RDP files if you want to connect through a HA RD Connection Broker!
Good luck testing this. If you have any questions, let me know!
I have configured RDS in WS2012. I am configuring a session to run MS Office and MS Access. When I use RD Web to access this two things happen that I am trying to stop. One is that I get a message that the publisher of the RemoteAPP program can not be identified,I get prompted for credentials and then a download starts of the RDP file. The RDP File name is something like cpub-MSACCESS-Dataops_S1-CmsRDSH.rdp. The collections name is DataOps_S1.
ReplyDeleteIn my reading, I have come across the statement that just publishing the apps does not give access but I am unsure where do I need to go to give access to MS Word, Excel, etc.?
Hi Teresa,
ReplyDeleteMake sure you have SSL certificates configured properly, preferably by a CA that is publically trusted. With Windows Server 2012 you can centrally configure SSL certificates by using the RDMS in Server Manager. There should then be a Single Sign On (no additional prompt) when launching a Remote App and users should be able to select that they trust the publisher and don't want to be warned again upon their next logon. About your other question, yes publishing the apps just makes sure that they show up in RD Web Access (or by using the Web Feed URL) that does not imply that they are also allowed to run the application. Technologies like i.e. AppLocker (http://technet.microsoft.com/en-us/library/dd723678(v=ws.10).aspx) can be used to explicitly deny or allow access to certain applications. If you have any other questions feel free to drop me an email at info@themicrosoftplatform.net
Freek, I just left a comment in one of you earlier posts and finally read down to here that "this is my exact problem"! However, I get this error when users are connecting using a RemoteApp link within RDWEB. There is no RDP file for me to edit within RemoteApp, shouldn't this be automatic?
ReplyDeleteHi Damian,
ReplyDeleteYes, Remote Apps and desktops that are published (and thus available in the RD Web Access as well as through the Control Panel (web feed URL) will contain these parameters automatically so that they will make an initial connection to the RD Connection Broker and will then be redirected to a RD Session Host within the Session Collection.
Based on your comment I'm assuming that this is not working for you? Feel free to drop me an e-mail with some more details, I'd be happy to help you out.
Kind regards,
Freek Berson
Email sent, thank you!
ReplyDeleteHi Freek,
ReplyDeleteI've started playing with RDS 2012 in a test environment (session based, no vdi) and I couldn't find a clear answer regarding to rdp connection. If there is a session host farm is it better to rdp'd to farm (farm "a" DNS record) or rdp'd to connection broker?
In my test env, I've created: 1x Connection Broker, 1x Web Access, 3 Session Hosts (2x collection)
Thanks,
Cem
Hi Cem,
ReplyDeleteWith RDS in Windows Server 2012 the RD Connection Broker always handles the initial connection. (similar to the RD Dedicated Redirector in Windows Server 2008 R2). That's why all published Remote Apps and Desktop in RD Web Access as well inside the RADC are configured to let users connect to the RD Connection Broker as the destination server. If you have multiple RD Connection Broker servers running in HA mode you can load balance those initial connections.
Does that answer your question?
Hi Freek,
ReplyDeleteThanks for the article.
We have a test setup that combines the Connection Broker and Gateway roles on each server.
Does this setup still require to configure Remote Desktop Clients this way to use Connection Broker HA functionality correctly?
Thanks,
Melvin
Hi Melvin,
ReplyDeleteYes, using the RD Gateway does not change this. RD Connection Broker (farm) will always be the initial connection for end users. If you use RD Gateway the destination name of the RD Connection Broker DNS (farm) name will be resolved on the RD Gateway Server. Note that when using 1 RD connection Broker the initial connection will always be the FQDN of that RD Connection Broker. When you put the RD Connection Broker in HA mode (prepare for HA is enough, adding an additional RD Connection broker server is not necessary) you are able to customize the DNS name of the initial connection.
45
ReplyDeleteWhat about thin clients trying to rdp to rdsh going through broker?
ReplyDeleteHi Bridgette,
ReplyDeleteThin clients that need to connect to a RDSH farm using the broker would also need to specify that parameter. I know that in the mean time some thin client suppliers already have thin client firmware available compatible with RDP8 and the RD Connection Broker in 2012.
Great post Freek.
ReplyDeleteHow is this behaviour changed with W2012 R2? I hear that RDP connections have been deprecated?
What do you mean exactly by RDP connections?
ReplyDeletewhat if we created RDS host farm with a NLB virtual DNS address and client use that NLB to connect to the host servers instead of Broker farm DNSRR address with the customized MSTSC client setting?
ReplyDeleteHi,
ReplyDeleteIs it possible to disable the popup dialog that ask you if you want to connect?
Yes. Set GPO Specify SHA1 thumbprints of certificates representing trusted .rdp publishers (Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Connection Client)
Deletehttp://blog.it-kb.ru/2014/08/24/windows-server-2012-r2-remote-desktop-connection-broker-rdp-client-certificate-warning-make-sure-that-you-trust-the-publisher-before-you-connect/
How do we add a connection to the broker server in Windows 8 native remote desktop client (metro) app? I can add a connection to say my office PC, perhaps I can modify this connection file but where does Win 8 store the .rdp file? It's not located in C:\Users\\AppData\Roaming\Microsoft\Workspaces\\Resource.
ReplyDeleteMany thanks!
Hi Freek, any thoughts on this: https://social.technet.microsoft.com/Forums/en-US/e46599e4-4d62-4e41-995b-ce1af3a17d9e/how-to-create-a-custom-rdp-file-for-connecting-to-a-2012-r2-rdsh-farm?forum=winserverTS
ReplyDeleteKind regards,
Matthijs
Hi Matthijs,
ReplyDeleteYes its possible to create a .RDP for this scenario. You just need to make sure you add the correct value for loadbalanceinfo. Feel free to send me an email if you need further assistance.
This comment has been removed by the author.
DeleteHi,
DeleteI use 1xBroker (RDB), 2 Session Hosts (RDSH1,RDSH2), without Gateway. Collection name is "RDSCollection". All are 2012 R2 servers. When I try to connect from internet, I always "get" RDSH1. Redirection to RDSH2 is not working - blank screen for a few seconds, then disconnect). How should I set internal and external DNS settings to work properly. I do not want to use RD Gateway. Thanks for advance. AJ
Hey Freek,
ReplyDeleteSo, I found the solution.
It was in the comments in another article about the same config:
http://microsoftplatform.blogspot.nl/2012/04/how-to-configure-high-availability-for.html
The solution was to use the following registry key to get the values needed for the custom RDP:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\CentralPublishedResources\PublishedFarms\Wortell_Session\RemoteDesktops
Bedankt en de groeten! ;-)
Dear Freek,
ReplyDeleteIt is really help the article.
however I got confuse on below
"What we need to do is configure some properties in an .RDP file so that it has knowledge of the fact that we’re trying to connect through a HA Connection Broker."
just need info which & where .RDP file must be edited.
please help.
Thanks
Danushka
Danuska, please send me an email to info@themicrosoftplatform.net
DeleteI have some issues with a farm that, for the most part, works well. On occasion, one or two users will log in with temp user, which I think has to do with SMB 2.0, but, reviewing events, I see ID 802 repeatedly, yet the users seem to be able to log in regardless. From your page, it would appear that the farm name is incorrect, but, opening in notepad reveals the farm name is correct. When pinging the farm name as written or the FQDN, the response is correct. Some of the information you have listed above do not exist in my rdp file. If required for correct functionality, I'm unsure where to place them in the file. Any help would be appreciated.
ReplyDeleteI have the following scenario:
ReplyDeleteRequirements:
- Only session based RDP connections and must be load balanced across multiple RDSH (scalable)
- Only need to be accessible on the inside of the network
- No wish for RemoteApp or RDWeb
- No HA requirements
- End user must use a single netbios name to connect to the farm
- Reconnection must work
I'm thinking of:
1 Connection Broker
4 Remote Desktop Services Host servers
Create DNS Round Robin using the 4 RDSH IP/hostnames on an A-record named my farm name (defined in local policies area) ?
Question:
Will I archive the requirements?
I’m insecure on how the end-users will actually connect to the farm (CB/RDSH directly etc)
Thank you very much in advance.
Hi Martin,
Delete>>1 Connection Broker
That will cover your requirements. Do make sure that an RD Web Access server is always part of a RDS deployment (since Server 2012). I would advise to have that installed in the Connection Broker server and just not use it, that's totally fine.
>>Create DNS Round Robin using the 4 RDSH IP
No need to do that, the RD Connection Broker will perform the load balancing for you. If you provide your users with the correct .RDP file, their initial connection will go to the broker server and the broker will redirect to the session host with the least load. This process is fully transparant to the end user.
If you have more questions, feel free to contact me via email!
Kind regards,
Freek Berson
i have just implement farm yesterday. I have create one additional session server with only os and av. Add it to session server group in farm. And put it to drain mode(no new user login). connect mstsc with this new drain server and it work as redirector.
ReplyDeleteRedirector server request Is being transferred to other server by broker server as it in maintenance mode.
DeleteThis comment has been removed by the author.
DeleteHi Freek, this is an awesome post and I was glad to find it. I set up a highly available RD Connection Broker farm and ran into that issue and this article helped me out. The biggest issue remaining is that I now have to figure out how to configure Thin Clients which don't have a place to put the settings in like a Windows RDP File. You can only put the hostname username and password. Do you know of a way to force redirection to session hosts on the brokers for such clients?
ReplyDelete