Session collection settings

Session collections determine the properties of RD Session Host servers. You can configure the following RD Session Host settings on a per session collection basis:

• User Groups. These settings determine which user groups are associated with a specific session collection. If a user is a member of the user group, they can connect to session host servers that are members of the collection. They can also access RemoteApp applications published to the collection.

• Session. Shown in Figure 16-4, these settings determine the amount of time after which a session that is disconnected is automatically ended. The default value is Never. You can be configure the value to be as short as one minute. You can also configure active session limits, how long before an idle session is disconnected, and then determine what happens when a disconnection occurs: should the session be automatically terminated or should reconnection be allowed. You can also use the settings contained in this area to configure whether to use temporary folders and whether those folders are deleted when the session ends.

  

• Security. These settings allow you to configure whether Remote Desktop Connections require RDP Security or TLS security. Encryption options include Low, Client Compatible, High, and FIPS Compliant. You should generally select High unless you are required to use FIPS Compliant. The drawback of doing so is that some older third-party remote desktop clients may not support this level of encryption.

• Load Balancing. This section allows you to configure the load balancing settings for a session collection, including the relative weight the server is assigned when multiple session host servers are available to the session collection and the limit to the number of sessions each session host server can host.

• Client Settings. The Client Settings section allows you to configure which redirection options to enable. You can configure redirection for the following:

  • Audio and video playback

  • Audio recording

  • Smart cards

  • Plug-and-play devices

  • Drives

  • Clipboard

  • Printers, including using the default client printing device and the Remote Desktop easy print driver

  • Monitor redirection

• User Profile Disks. User profile disks allow users to store settings and folders in a central location. This is useful to allow users to persist data and settings across different session host settings on multiple servers. You can choose the following user profile disk settings:

  • User profile disk location

  • Maximum size

  • Store all user settings and data on the profile disk, with specified folders excluded

  • Store only certain folders on the user profile disk

You can also use Session Collection settings to configure which remote app programs will be available to the Session Collection. You can also add and remove session host servers from the session collection. These servers should already have the RD Session Host role installed prior to performing this task.

Personal session desktops

Personal session desktops are a feature of Windows Server 2019 that allow you to create a special type of Session Collection where each user has access to their own personal session host where they enjoy administrative rights. Personal session desktops can be useful for developers who might need administrative rights without giving them those rights over a Remote Desktop Session Host server.

RemoteApp

Rather than open a full session, including a desktop, Start menu, and a taskbar, RemoteApp allows a user to run one or more applications directly. The application runs in such a way that it appears as if it is executing on the local computer. When a client invokes multiple applications from the same host server, the server transmits the applications to the client using the same session.

RemoteApp includes the following benefits:

• Any application that can be run on the RD Session Host server can be run as a RemoteApp application.

• You can associate RemoteApp applications with local file extensions. This means that the RemoteApp application starts when the user attempts to open an associated document.

• Users are often unaware that an application is running remotely.

• RemoteApp applications can be used with RD Gateway, allowing access to clients on remote networks such as the Internet.

You publish a RemoteApp program to a Session Collection once you’ve installed it on a RD Session Host server through the session collection area of the Server Manager console.

Group Policy configuration

The Computer ConfigurationPoliciesAdministrative TemplatesWindows ComponentsRemote Desktop ServicesRemote Desktop Session Host server node of Group Policy contains several policies that you can use to configure Session Host servers. There are many settings that can only be configured through group policy and PowerShell that are not available in the Remote Desktop Services area of the Server Manager Console. The coverage here is brief, as there are a vast number of policies, and you’ve already learned about the functionality that most of them implement.

• Application Compatibility. Through the Application Compatibility node, you can access the Turn Off Windows Installer RDS Compatibility, Turn On Remote Desktop IP Virtualization, Select The Network Adaptor To Be Used For Remote Desktop IP Virtualization, and Do Not Use Remote Desktop Session Host Server IP Address When Virtual IP Address Is Not Available.

• Connections. Through the Connections node, you can access the following policies: Automatic Reconnection, Allow Users To Connect Remotely Using Remote Desktop Services, Deny Logoff Of An Administrator Logged In To The Console Session, Configure Keep-Alive Connection Interval, Limit Number Of Connections, Suspend User Sign-In To Complete App Registration, Set Rules For Remote Control Of Remote Desktop Services User Sessions, Select RDP Transport Protocols, Select Network Detection On The Server, Restrict Remote Desktop Services Users To A Single Remote Desktop Services Session, Allow Remote Start Of Unlisted Programs, and Turn Off Fair Share CPU Scheduling.

• Device and Resource Redirection. Through the Device and Resource Redirection node, you can configure the following policies: Allow Audio And Video Playback Redirection, Allow Audio Recording Redirection, Limit Audio Playback Quality, Do Not Allow Clipboard Redirection, Do Not Allow COM Port Redirection, Do Not Allow Drive Redirection, Do Not Allow LPT Port Redirection, Do Not Allow Supported Plug And Play Device Redirection, Do Not Allow Smart Card Device Redirection, and Allow Time Zone Redirection.

• Licensing. You can access the Licensing node to configure the following policies: Use The Specified Remote Desktop License Servers, Hide Notifications About RD Licensing Problems That Affect The RD Session Host Server, and Set The Remote Desktop Services Licensing Mode.

• Printer Redirection. Through the Printer Redirection node, you can configure the following policies: Do Not Set Default Client Printer To Be Default Printer In A Session, Do Not Allow Client Printer Redirection, Use Remote Desktop Easy Print Printer Driver First, Specify RD Session Host Server Fallback Printer Driver Behavior, and Redirect Only The Default Client Printer.

• Profiles. You can find the following policies in the Profiles node: Limit The Size Of The Entire Roaming User Profile Cache, Set Remote Desktop Services User Home Directory, Use Mandatory Profiles On The RD Session Host Server, and Set Path For Remote Desktop Services Roaming User Profile.

• RD Connection Broker. You can find the following policies in the RD Connection Broker node: Join RD Connection Broker, Configure RD Connection Broker Farm Name, Use IP Address Redirection, Configure RD Connection Broker Server Name, and Use RD Connection Broker Load Balancing.

• Remote Session Environment. You can use the Remote Session Environment node to locate the following policies: Limit Maximum Color Depth, Enforce Removal Of Remote Desktop Wallpaper, Use The Hardware Default Graphics Adapter For All Remote Desktop Services Sessions, Limit Maximum Display Resolution, Limit Number Of Monitors, Remove Disconnect Option From Shut Down Dialog, Remove Windows Security Item From Start Menu, Use Advanced RemoteFX Graphics For RemoteApp, Prioritize H.264/AVC 444 Graphics Mode For Remote Desktop Connections, Configure H.264/AVC Hardware Encoding For Remote Desktop Connections, Configure Compression For RemoteFX Data, Configure Image Quality For RemoteFX Adaptive Graphics, Enable RemoteFX Encoding For RemoteFX Clients Designed For Windows Server 2008 R2 SP1, Configure RemoteFX Adaptive Graphics, Start A Program On Connection, Always Show Desktop On Connection, Allow Desktop Composition For Remote Desktop Sessions, and Do Not Allow Font Smoothing.

• RemoteFX for Windows Server 2008 R2. This node contains the following policies: Configure Remote FX, Optimize Visual Experience When Using RemoteFX and Optimize Visual Experience For Remote Desktop Service Sessions.

• Security. The Security node contains the following policies: Server Authentication Certificate Template, Set Client Connection Encryption Level, Always Prompt For Password Upon Connection, Require Secure RPC Communication, Require Use Of Specific Security Layer for Remote (RDP) Connections, Do Not Allow Local Administrators To Customize Permissions, and Require User Authentication For Remote Connections By Using Network Level Authentication.

• Session Time Limits. You can find the following policies in the Session Time Limits node: Set Time Limit For Disconnected Sessions, Set Time Limit For Active But Idle Remote Desktop Services Sessions, Set Time Limit For Active Remote Desktop Services Sessions, End Session When Time Limits Are Reached, and Set Time Limit For Logoff Of RemoteApp Sessions.

• Temporary Folders. The Temporary Folders node contains the following policies: Do Not Delete Temp Folder Upon Exit and Do Not Use Temporary Folders Per Session.

Virtual machine preparation

To prepare a virtual machine for use as a template in an RD Virtualization Host deployment, you should perform the following tasks:

• Deploy the virtual machine and install all the applications that will be available to users of the RD Virtualization Host VMs. Perform this deployment on one of the Hyper-V servers that will function as an RD Virtualization Host. You can build this virtual machine on another computer and then import it on the RD Virtualization Host. Although not required, you should configure this virtual machine as a Generation 2 VM because this will give you the greatest flexibility in terms of virtual machine configuration.

• Once the applications are installed, sysprep the virtual machine, generalize and set it to boot using the Out Of Box Experience setting. Once sysprepped, the virtual machine will be shut down.

Virtual desktop collections

Virtual desktop collections function in a manner similar to a session collection. You configure who can connect and select the resources they have access to on a per-collection basis. When creating the virtual desktop collection, you need to provide the following information:

• Collection Name. Name of the virtual desktop collection.

• Collection Type. This can be a pooled virtual desktop collection or a personal virtual desktop collection.

• Virtual Desktop Template. The prepared template virtual machine.

• Virtual Desktop Settings. You can specify a Sysprep answer file or provide unattended installation settings. This information is used to join the virtual machine to the domain. This requires that the computer account of the host computer has permission to perform the AD DS domain join.

• Unattended Settings. Provide the time zone, AD DS domain, and organizational unit used in the domain join operation.

• Users and User Groups. Shown in Figure 16-6, these settings allow you to specify which users and groups have access to the collection. They also allow you to configure the number of virtual desktops to be created in the collection, and the name prefix and suffix for the computer accounts of RDS VDI virtual machines.

  

• Virtual Desktop Allocation. Allows you to specify the allocation of VDI virtual machines in the collection to RD Virtualization Host servers. For example, you can have 10 virtual machines on one host server and 20 on another.

• Virtual Desktop Storage. Allows you to configure the type of storage used for the virtual desktops.

• User Profile Disks. Allows you to configure and enable user profile disk settings and the location.

Once the virtual desktop collection is created, you can also configure client settings for the collection. This determines whether functionality such as audio and video playback, audio recording, smart cards, plug and play devices, drives, the clipboard, and printers are redirected from the Remote Desktop client to the RD virtual machine.

Pooled virtual desktops

Pooled virtual desktops are collections of identically configured virtual machines that users connecting a Remote Desktop Virtualization Host through a Remote Desktop Connection Broker are assigned. A user will be connected to the first available pooled virtual desktop on first sign in, and will only be redirected to the same pooled virtual desktop in the event that their connection is disrupted and they haven’t signed out. If they sign out and reconnect, they may be assigned to a new virtual desktop within the pool. Pooled virtual desktops do not retain session information. When a user signs out from a pooled virtual desktop, the virtual machine reverts to its original pre sign-in state.

Personal virtual desktops

You use personal virtual desktops when you want to assign users persistent VDI virtual machines. This means that users can make customizations and store data on the virtual machines that persist across sessions. The virtual machines are associated with the user, and they are automatically connected to that virtual machine when they initiate a session through the Remote Desktop Connection Broker. Personal virtual desktops retain session information across connections and are not reverted to their original pre sign-in state when the session ends.

DDA and RemoteFX

Discrete Device Assignment (DDA) and RemoteFX allow virtual machines in a VDI deployment to leverage the graphical processing power of compatible graphics cards. In turn, this allows workloads that need to leverage substantive graphical processing power, such as those used in Computer Aided Design (CAD). RemoteFX has been deprecated in Windows Server 2019 in favor of Discrete Device Assignment (DDA). Chapter 6, “Hyper-V,” includes more information on DDA. In Windows Server 2016 deployments, graphics cards used for DDA must be installed on the Remote Desktop Virtualization Host, and special graphics adapter drivers will need to be configured for each virtual machine that takes advantage of DDA or RemoteFX.

Installing RDS CALs

You can install several types of licenses on an RD license server. The different license types are as follows:

• RDS Per User CAL. An RDS Per User CAL gives a specific user account the ability to access any RD Session Host server in an organization from any computer or device. This type of CAL is a good idea when you have the same person accessing Remote Desktop from different devices.

• RDS Per Device CAL. The RDS Per Device CAL licenses a specific device, such as a normal computer or thin client, with the ability to connect to an RD Session Host server. RDS Per Device CALs are reset automatically by the RD license server after a random period between 52 and 89 days. This means that if a computer or thin client is decommissioned, the license assigned to it is reclaimed automatically and can be used again. If you are decommissioning a large number of computers, you can revoke 20% of the RDS Per Device CALs.

• RDS External Connector. Use this license type to allow people who are external to your organization to access a single Remote Desktop server. A separate RDS External Connector license must be purchased for each Remote Desktop server accessible to external users.

• Service Providers License Agreement. This is a special type of license agreement for service providers. It is useful when providing Remote Desktop Services to multiple organizations.

You can mix and match RDS Per User CALs and RDS Per Device CALS as necessary. When using Remote Desktop Virtualization Hosts, you also need to purchase a Virtual Enterprise Centralized Desktop licensing agreement for the VDI operating system. You can use the Manage RDS CALs Wizard in the RD Licensing Manager console to:

• Migrate RDS Cals to different RD Licensing Servers

• Rebuild the RD Licensing Server database

Activating a License Server

You must activate an RD license server before it is able to issue CALs. The activation process is reasonably similar to the one that you need to go through when you perform product activation for a Windows operating system or for an application such as Microsoft Office. The method you use depends on whether the RD license server has a connection to the Internet. If the server does have a connection to the Internet, you can perform automatic activation. If the server does not have a direct connection to the Internet, you can perform an activation using a telephone, or you can navigate to a website on a computer or mobile device that does have a connection to the Internet and perform activation by filling out a form and entering the activation code on the RD license server.