New KB: You cannot reestablish a Remote Desktop Services session to a Windows Server 2008 R2-based server. (2661332)

Microsoft has released a new KB article and fix today regarding RDS on Windows Server 2008 R2. For details see below or browse to the included URL for the original source and download link.
Article ID: 2661332 - Last Review: March 14, 2012 - Revision: 1.0
You cannot reestablish a Remote Desktop Services session to a Windows Server 2008 R2-based server.
 


"...Consider the following scenario:

• You establish a Remote Desktop Services session to a Windows Server 2008-based server from a client computer.
• You disconnect the Remote Desktop Services session.
• You try to reestablish the Remote Desktop Services session.

In this scenario, you cannot reestablish the Remote Desktop Services session. Additionally, you receive the following error message:

The task you are trying to do can't be completed because Remote Desktop Services is currently busy. Please try again in a few minutes. Other users should still be able to log on.

 

This issue occurs because of a deadlock situation that occurs between the Csrss.exe process and some applications (for example, Microsoft Excel or Microsoft Visio)..."

 

Source: http://support.microsoft.com/kb/2661332/en-us?sd=rss&spid=14134

Microsoft Security Bulletin MS12-020 - Critical - Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)

Microsoft has released a critical security bulletin today on Remote Desktop

Microsoft Security Bulletin MS12-020 - Critical
Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)
Published: Tuesday, March 13, 2012

For the complete bulletin please see: http://technet.microsoft.com/en-us/security/bulletin/ms12-020

"...Executive Summary

This security update resolves two privately reported vulnerabilities in the Remote Desktop Protocol. The more severe of these vulnerabilities could allow remote code execution if an attacker sends a sequence of specially crafted RDP packets to an affected system. By default, the Remote Desktop Protocol (RDP) is not enabled on any Windows operating system. Systems that do not have RDP enabled are not at risk.
This security update is rated Critical for all supported releases of Microsoft Windows. For more information, see the subsection, Affected and Non-Affected Software, in this section.
The security update addresses the vulnerabilities by modifying the way that the Remote Desktop Protocol processes packets in memory and the way that the RDP service processes packets. For more information about the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.
Recommendation. The majority of customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.
For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.
See also the section, Detection and Deployment Tools and Guidance, later in this bulletin.
Known Issues. Microsoft Knowledge Base Article 2671387 documents the currently known issues that customers may experience when installing this security update. The article also documents recommended solutions for these issues..."

RDS in WIN8 Feature highlight no. 4 Installing RDSH prior to a scenario based deployment, no requirement anymore

RDS in WIN8 Feature highlight no. 4  Installing RDSH prior to a scenario based deployment, no requirement anymore

This is more of a bug fix then a feature highlight of course, but if you have read one of my previous blog posts back in October 2011, I wrote that having the RD Session Host role installed was a prerequisite for being able to successfully walk through the new the Scenario Based deployment. Described here: http://microsoftplatform.blogspot.com/2011/10/take-rds-management-to-higher-level.html

Since the Beta release of Windows Server 8, this is no longer necessary. Therefore, the deployment of the scenario is now even faster than before.

I tested the quick scenario based deployment on a single server on the Beta Edition of Windows Server 8, within a few mouse clicks and an automatic reboot afterwards all the roles (RD Session Host, RD WebAccess and RD Connection Broker) are installed and the first Session Collection (QuickSessionCollection) is created. The scenario deployment runs very smooth.

RDS in WIN8 Feature highlight no. 3 Change password option in RD WebAccess

RDS in WIN8 Feature highlight no. 3  Change password option in RD WebAccess

This is a long waited feature for RD WebAccess! You will now be able to let your users perform a change of their domain password. The password change option is not enabled by default. Using the application settings section in IIS Manager, you are able to change the parameter “PasswordChangeEnabled” from false to true.

After that you will be able to browse to the following URL:
https://<Server Or DNS>/RDWeb/Pages/en-US/password.aspx

Note that if you did not set the PasswordChangeEnabled to true browsing to the above URL would result in a redirect to login.aspx.

If PasswordChangeEnabled is set to true the following screen will appear in which a user is able to change his password.

By default, the file is located here: C:\Windows\Web\RDWeb\Pages\en-US\password.aspx

I would assume that a link to this page would be showing up on the main page called e.g.“change password” to lead the user to this page, but there is not, at least not yet in the Beta version of Windows Server 8. Maybe it will be added to the final version. And if not, you could of course change the login.aspx yourself as needed

RDS in WIN8 Feature highlight no. 2 RD Dedicated Redirector now part of RD Connection Broker

RDS in WIN8 Feature highlight no. 2  RD Dedicated Redirector now part of RD Connection Broker

If you read the previous feature highlight on RD Connection Broker (http://microsoftplatform.blogspot.com/2012/03/rds-in-win8-feature-highlight-no.html) you know that the RD Connection Broker in Windows Server 8 will play a more central role. This feature highlight will amplify that statement even more. Within Windows Server 8 (beta) the RD Connection Broker is by default now also the your RD Dedicated Redirector.

Let’s quickly recall what the function of the RD Dedicated Redirector is. The RD Dedicated redirector was introduced in Windows Server 2008. It’s a server role, which can be part of an RDS deployment. The RD Dedicated Redirector is in fact a RD Session Host server that runs in Drain Mode en therefore does not host any active sessions. Its purpose is to serve as the initial connection. Users will connect their RDP session to this dedicated redirector. The dedicated redirector, as it is running in drain mode, will contact the RD Connection Broker, which in turn will return the final RD Session Host to connect to (either based on RD Connection Broker load balancing or redirecting to disconnected sessions).

The fact that the RD Dedicated Redirector is now integrated with the RD Connection Broker is great because this means that when you install and configure your RD Connection Broker you immediately have your RD Dedicated Redirector, and thus your Initial connection point up and running. Therefore, the RD Connection Broker will be running in RD Session Host drain mode. This also means that when you make your RD Connection Broker High Available, which, as we’ve seen in the previous feature highlight has become much easier in Windows Server 8 Beta, you also make your Initial Connection (Dedicated redirector) High Available. In my opinion, a great move! You can expect a blog post here soon in which I will discuss the actual setup in detail.

RDS in WIN8 Feature highlight no. 1 Better High Availability of the RD Connection Broker

RDS in WIN8 Feature highlight no. 1 Better High Availability of the RD Connection Broker

The RD Connection Broker plays a central role in the Remote Desktop Environment. That’s not a new thing of course, however, with the release of Windows Server 8 Beta the RD Connection Broker is now even playing a more important role than before. As with any important role in any environment, High Availability is crucial! It’s good to see that the way to make the Broker High Available has improved a lot in Windows Server 8.

After performing your first scenario based deployment and open up the server manager you have an option to make the RD Connection Broker High Available called “Configure RD Connection Broker for HA”.

Doing so launches a wizard to configure the HA. The result is an active-active HA configuration for the RD Connection Broker! By default the RD Connection Broker role uses a Windows Internal Database to store session information. As you can imagine, setting up HA properly for your RD Connection Broker role requires a central SQL Server instance (which is preferably also HA itself of course). That’s why the wizard will ask for a Database Connection String, folder and DNS record name.

I’ll do a separate blogpost in the near future containing a step-by-step guide on how to configure HA for the RD Connection Broker.

RDS in Windows Server 8 (Beta) Feature Highlights

Windows Server 8 Beta is available since last week. I've already set up Windows Server 8 Beta in my lab to test some of the new features for Remote Desktop Services. Coming up on this blog is a series of at least 7 "Feature Highlight" blog posts in which I will discuss some of the great new features for RDS in Windows Server 8.

I'll update this blog post along the way as new feature highlight blog posts by adding links of the newly added blog posts. You can expect frequent updates, stay tuned!

Feature highlight no. 1 "Better High Availability of the RD Connection Broker"
http://microsoftplatform.blogspot.com/2012/03/rds-in-win8-feature-highlight-no.html

Feature highlight no. 2 "RD Dedicated Redirector now part of RD Connection Broker" http://microsoftplatform.blogspot.com/2012/03/rds-in-win8-feature-highlight-no-2-rd.html

Feature highlight no. 3 "Change password option in RD WebAccess"
http://microsoftplatform.blogspot.com/2012/03/rds-in-win8-feature-highlight-no_12.html

Feature highlight no. 4 "Installing RDSH prior to a scenario based deployment, no requirement anymore"
http://microsoftplatform.blogspot.com/2012/03/rds-in-win8-feature-highlight-no-4.html

Feature highlight no. 5 "E-mail subscription for Remote Apps"
http://microsoftplatform.blogspot.com/2012/03/rds-in-win8-feature-highlight-no-5-e.html

Feature highlight no. 6 "Demo environment within just a few minutes"
http://microsoftplatform.blogspot.com/2012/03/rds-in-win8-feature-highlight-no-6-demo.html

Feature highlight no. 7 "SSL configuration made easy"
http://microsoftplatform.blogspot.com/2012/03/rds-in-win8-feature-highlight-no-7-ssl.html