Load balancing Remote Desktop Services Web Access & Gateway with KEMP Load Master for Azure

I recently build a lab in Windows Azure running Remote Desktop Services (a session-based deployment) to test-drive the KEMP Load Master for Azure which Kemp Technologies recently announced.

I wrote a detailed blog post which was published on the Kemp Technologies blog.

“…Guest post by Freek Berson, Microsoft MVP on RDS

Recently, Kemp Technologies has released their KEMP LoadMaster for Azure which they offer for free! I wrote a quick blog post recently on why this is interesting. In this blog post I want to describe a specific scenario based in a lab I have built in Azure using the KEMP Load Master for Azure and compare that solution to the load balancing options Windows Azure offers in the box…”

Read the blog post here: Load balancing Remote Desktop Services Web Access & Gateway with KEMP Load Master for Azure

KB: Best practices for setting up Remote Desktop Licensing across Active Directory Domains/Forests or Workgroup (2473823)

Microsoft has published a new KB article (KB2473823 ) covering Best Practices for Remote Desktop Licensing.

 

“…Question:
Can the RD Licensing (Terminal Server Licensing) server issue a Client Access License (CAL) to users or devices connecting to RD Session Host (Terminal Server) servers under any of the following conditions?

• RD Session Host servers are in an Active Directory Domain and RD Licensing server is in a workgroup environment
• RD Session Host servers are in a workgroup and the RD Licensing server in an Active Directory Domain
• RD Session Host servers and RD Licensing server are in different forests. No trusts exist (One-way or Two-way trust) between these forests
• RD Session Host servers and RD Licensing servers are in the same workgroup

Answer:
For both Per Device and Per User CALs issuance to work, the RD Session Host and RD Licensing server in any one of the following three configurations:

• Both in the same workgroup
• Both in the same domain
• Both in the trusted (Two-way trust) Active Directory Domains or Forest..”

For more information on these scenario’s see the KB article:
http://support.microsoft.com/kb/2473823/en-us?sd=rss&spid=14134

Kemp announces FREE software load balancer for Windows Azure!

Kemp Technologies (kemptechnologies.com) have announced the availability of a free software load balancer specifically for Azure!

Why is this important?

The Azure load balancing options that Windows Azure offers today are very basic. Basically its just round robin. Which means no layer 7 functionality is available, and therefor there is no option for affinity, content switching, compression etc.

I have previously performed some testing with the load balancing options available in Azure today, and ran into serious issues where Session Affinity was required by the web application.

The Kemp Load Master for Azure solution could solve those issues with a license free software load balancer that even includes e-mail support!

Here is a link where Kemp announced this: http://kemptechnologies.com/blog/introducing-loadmaster-for-windows-azure-load-balancing-the-microsoft-cloud/

My request for the Free LoadMaster for Azure is on it’s way!

A quick comparison sheet taken from their description:

KB: "Not enough storage is available to process this command" error when a new user tries to log on through RDP in Windows Server 2008 R2

A new KB article (2877056) was released yesterday regarding an error message when connecting via RDP to a non domain-joined RD Session Host Server with a user account that is configured to change the password at next logon. Which results in a “Not enough storage is available to process this command.”.

“…You have a Windows Server 2008 R2-based computer that is not a member of a domain. An administrator of the server creates a new user who is also an administrator, sets a password for the new user, and selects the option to require a password change at the next logon. When the new user connects to the server through Remote Desktop Protocol (RDP) for the first logon, he or she is prompted to enter a new password. When the user types the new password and tries to continue, he or she receives the following error message: Not enough storage is available to process this command.

The password is not changed, and the user receives the same error message when he or she tries to log on again.

This issue occurs because the RPC runtime receives an error.
Specifically, the scenario that occurs is as follows:
The password change request process is put into an anonymous access token by Local Security Authority (LSA). This occurs because the password is not valid and the user is therefore not authenticated…”

Source en download: http://support.microsoft.com/kb/2877056/

New feature in RDP 8.1 : RestrictedAdmin

A new feature has been added to RDP 8.1, currently available in Windows 8.1 preview and Windows Server 2012 R2. The feature is called Restricted Admin (mstsc /RestrictedAdmin).

The description taken from the mstsc client:

“…/restrictedAdmin -- Connects you to the remote PC or server in Restricted Administration mode. In this mode, credentials won’t be sent to the remote PC or server, which can protect you if you connect to a PC that has been compromised. However, connections made from the remote PC might not be authenticated by other PCs and servers, which might impact app functionality and compatibility. Implies /admin…”

The parameter can be added on the commandprompt using it as follows:

mstsc.exe /RestrictedAdmin

or in the GUI, as shown below:

When using the above method the following error message occurs:

After clicking Ok, you can still continue so I’m assuming this is a bug in the preview release.

Using this RestrictedAdmin option the credentials you connect with are not passed to your session and therefor it prevents you from connecting to other resources despite for example your membership of the domain admins group.

I did a quick test and connected with my Windows Surface Pro running Windows 8.1 to a Windows Server 2012 R2 with my domain admin credentials and the /RestrictedAdmin switch enabled.

Upon browsing to the administrative share \\dc01-demo\c$ on the domain controller I was presented with an access denied:

It’s an interesting feature, I could think of some “delegation of control” scenario’;s where this might be useful.

There a a very detailed blog here by Kurt Falde that brought this to my attention. If you’re interested, it’s a good read!

What do you think about the feature? Is it useful for your environment or your customers environment? I’d be happy to hear about that!

KB: Updates to improve Remote Desktop Protocol network-level authentication

A new KB article was released that contains a NLA update for the RDP Protocol.
The corresponding security advisory page seems to be not available yet.

“…An update is available that provides additional defense-in-depth measures for Remote Desktop Protocol Network Level Authentication. Microsoft has released a Microsoft security advisory about this issue for IT professionals. The security advisory contains additional security-related information. To view the security advisory, go to the following Microsoft website http://technet.microsoft.com/security/advisory/2861855…”

Source: https://support.microsoft.com/kb/2861855

Windows Server 2012 R2 and Windows 8.1 will launch October 18, 2013

Microsoft has announced that they will launch both Windows Server 2012 R2 and Windows 8.1 on October 18, 2013!

Official annoucement by Brad Anderson:

http://blogs.technet.com/b/in_the_cloud/archive/2013/08/14/mark-your-calendars-for-oct-18-the-r2-wave-is-coming.aspx

Mark Your Calendars for Oct. 18: The R2 Wave is Coming!
“…As some of you may have already noticed, earlier this morning Microsoft announced that Windows 8.1 will be available to consumers and businesses worldwide on October 18, 2013. 

But before you start your 8.1 party (with a DJ in a data center, for example), there’s even more good news: 

I'm excited to announce that, on the same day, eligible customers will be able to download Windows Server 2012 R2 and System Center 2012 R2, as well as the latest update to Windows Intune!  We’ll make evaluation versions available through the TechNet Evaluation Center, and these products will be available for new purchases when they hit the price list on November 1st..”