I have install Office 2010 and Remoteapp Program on One of windows 2012 server. I can open the word from rdweb without problem. However, I have these questions.

• Whenever I open thhps://win2012/rdweb and click Word to open it, it keep asking for username and password. Since I am in a domain computer, can we integrate centennials with AD like Outlook without entering password?
• How can I create rdp file and distribute it to users?

Bob Lin, MVP, MCSE & CNE Networking, Internet, Routing, VPN Troubleshooting on

http://www.ChicagoTech.net

http://www.howtonetworking.com

I need to publish an application using 2008 R2 RDS for vendor specific reasons.  I also want the feature of 2012 in RDWeb where I can use other Internet Explorers.

Q:  Can I have all the roles on 2012 and publish an application installed on 2008 R2 RDS?

I want to use RDWEB to connect to personal and pooled desktops inside domain and seems that SSO not working in this case. Is it possible to connect to RDWEB site in domain environment without credentials prompt?

We have a product that allocates a large number of items in a tree list control. Upon exiting the dialog, we deallocate the memory - which takes up to about 8 seconds on the terminal server via Remote Desktop.

If I use RemoteApp - the SAME application takes up to almost 90 seconds!!

This has left us surprised and confused. (along with a customer that is peeved at us about this)

Is there any resource governor on RemoteApp's? Its almost like it is being throttled, but I'm not sure. I really need help in figuring this out as it makes no sense to us. We advocate RemoteApp to our customers over Remote Desktop since we tell them that it is exactly the same in terms of speed but looks as if the application is integrated on a users desktop.

Thanks for any response to this and guidance on checking whatever is necessary.

Sincerely,

=-Chris

I mostly followed this guide (http://blogs.msdn.com/b/rds/archive/2012/11/13/easier-user-data-management-with-user-profile-disks-in-windows-server-2012.aspx). The file server is samba based.

I've verified below two cases:

1. I could map the share to a local drive from windows and create/modify files/folders without problem.

2. I could set the disk path to a windows share.

PS C:\Users\Administrator.000> Set-RDSessionCollectionConfiguration -CollectionName "Test Session Collection" -EnableUserProfileDisk -MaxUserProfileDiskSizeGB 20 -DiskPath \\remote-file-server\data2

Could not create the template VHD. 
Error Message: The RPC server is unavailable. (Exception from HRESULT: 0x800706BA).    + CategoryInfo          : InvalidResult: (:) [], WorkflowTerminatedException    + FullyQualifiedErrorId : JobStateFailed    + PSComputerName        : localhost

I have converted a physical windows 7 desktop to a VHD file for Hyper-V using disk2vhd and all seems to work just fine except that when we RDP in to the VM we cannot extend the desktop across all monitors that we have in use. The main computer we use to remote desktop in to this VM has 2 monitors and we cannot use them both. Any VM that I create from scratch can use both monitors is just the ones that have been converted. I have went into device manager and uninstalled anything hardware related that I can see in there but nothing seems to work.

Anyone have a fix or idea?

Hello.

Server 2008 R2 SP1, all updates

RDweb, RD Gateway Roles installed

Server has two network adapters: LAN (local IP) and WAN (DMZ IP)

Installing TMG 2010 with all updates (ver 7.0.9193.500) as Back Firewall

TMG has rule in Firewall Policy "Allow from Internal\Localhost\Perimeter to Internal\Localhost\Perimeter any"

I configure RD Web Access to provide users access to RemoteApp and Desktop Connection: go to RDweb site, Configuration tab, enter RD Session Host server name (FQDN).

After pressing "OK" i see error message:

"RD Web Access was not able to access server3.domain.local. Verify that the RD Session Host server name was entered correctly, that the server is running and connected to the network, and then try again."

In System log i see event 10009

Log Name:      System

Source:        Microsoft-Windows-DistributedCOM
Date:          12/6/2012 9:44:26 AM
Event ID:      10009
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      WWW.domain.local
Description:
DCOM was unable to communicate with the computer server3.domain.local using any of the configured protocols.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />
    <EventID Qualifiers="49152">10009</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-12-06T05:44:26.000000000Z" />
    <EventRecordID>8921</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>System</Channel>
    <Computer>WWW.domain.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">server3.domain.local</Data>
    <Binary>3C5265636F726423313A20436F6D70757465723D286E756C6C293B5069643D3732343B31322F362F3230313220353A34343A32363A3531333B5374617475733D313732323B47656E636F6D703D323B4465746C6F633D313731303B466C6167733D303B506172616D733D313B7B506172616D23303A307D3E3C5265636F726423323A20436F6D70757465723D286E756C6C293B5069643D3732343B31322F362F3230313220353A34343A32363A3531333B5374617475733D313732323B47656E636F6D703D31383B4465746C6F633D313434323B466C6167733D303B506172616D733D313B7B506172616D23303A736572766572332E636C69656E74732E736D6F66662E72757D3E3C5265636F726423333A20436F6D70757465723D286E756C6C293B5069643D3732343B31322F362F3230313220353A34343A32363A3531333B5374617475733D313732323B47656E636F6D703D31383B4465746C6F633D3332333B466C6167733D303B506172616D733D303B3E3C5265636F726423343A20436F6D70757465723D286E756C6C293B5069643D3732343B31322F362F3230313220353A34343A32363A3531333B5374617475733D313233373B47656E636F6D703D31383B4465746C6F633D3331333B466C6167733D303B506172616D733D303B3E3C5265636F726423353A20436F6D70757465723D286E756C6C293B5069643D3732343B31322F362F3230313220353A34343A32363A3531333B5374617475733D31303036303B47656E636F6D703D31383B4465746C6F633D3331313B466C6167733D303B506172616D733D333B7B506172616D23303A3133357D7B506172616D23313A307D7B506172616D23323A3078376131343030306130303030303030307D3E3C5265636F726423363A20436F6D70757465723D286E756C6C293B5069643D3732343B31322F362F3230313220353A34343A32363A3531333B5374617475733D31303036303B47656E636F6D703D31383B4465746C6F633D3331383B466C6167733D303B506172616D733D303B3E</Binary>
  </EventData>
</Event>

At the RD Session Host server i see two events in Security log:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          06.12.2012 9:53:26
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      Server3.domain.local
Description:
An account failed to log on.

Subject:
    Security ID:        NULL SID
    Account Name:        -
    Account Domain:        -
    Logon ID:        0x0

Logon Type:            3

Account For Which Logon Failed:
    Security ID:        NULL SID
    Account Name:        WWW$
    Account Domain:        DOMAIN

Failure Information:
    Failure Reason:        An Error occured during Logon.
    Status:            0xc00002ee
    Sub Status:        0x0

Process Information:
    Caller Process ID:    0x0
    Caller Process Name:    -

Network Information:
    Workstation Name:    -
    Source Network Address:    -
    Source Port:        -

Detailed Authentication Information:
    Logon Process:        Kerberos
    Authentication Package:    Kerberos
    Transited Services:    -
    Package Name (NTLM only):    -
    Key Length:        0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
    - Transited services indicate which intermediate services have participated in this logon request.
    - Package name indicates which sub-protocol was used among the NTLM protocols.
    - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4625</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2012-12-06T05:53:26.074824300Z" />
    <EventRecordID>54591</EventRecordID>
    <Correlation />
    <Execution ProcessID="540" ThreadID="1104" />
    <Channel>Security</Channel>
    <Computer>Server3.domain.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-0-0</Data>
    <Data Name="SubjectUserName">-</Data>
    <Data Name="SubjectDomainName">-</Data>
    <Data Name="SubjectLogonId">0x0</Data>
    <Data Name="TargetUserSid">S-1-0-0</Data>
    <Data Name="TargetUserName">WWW$</Data>
    <Data Name="TargetDomainName">DOMAIN</Data>
    <Data Name="Status">0xc00002ee</Data>
    <Data Name="FailureReason">%%2304</Data>
    <Data Name="SubStatus">0x0</Data>
    <Data Name="LogonType">3</Data>
    <Data Name="LogonProcessName">Kerberos</Data>
    <Data Name="AuthenticationPackageName">Kerberos</Data>
    <Data Name="WorkstationName">-</Data>
    <Data Name="TransmittedServices">-</Data>
    <Data Name="LmPackageName">-</Data>
    <Data Name="KeyLength">0</Data>
    <Data Name="ProcessId">0x0</Data>
    <Data Name="ProcessName">-</Data>
    <Data Name="IpAddress">-</Data>
    <Data Name="IpPort">-</Data>
  </EventData>
</Event>

AND

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          06.12.2012 9:53:26
Event ID:      4634
Task Category: Logoff
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      Server3.domain.local
Description:
An account was logged off.

Subject:
    Security ID:        DOMAIN\WWW$
    Account Name:        WWW$
    Account Domain:        DOMAIN
    Logon ID:        0x325a4cf

Logon Type:            3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4634</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12545</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2012-12-06T05:53:26.074824300Z" />
    <EventRecordID>54592</EventRecordID>
    <Correlation />
    <Execution ProcessID="540" ThreadID="1104" />
    <Channel>Security</Channel>
    <Computer>Server3.domain.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetUserSid">S-1-5-21-3882217896-3255031834-2471755480-1945</Data>
    <Data Name="TargetUserName">WWW$</Data>
    <Data Name="TargetDomainName">DOMAIN</Data>
    <Data Name="TargetLogonId">0x325a4cf</Data>
    <Data Name="LogonType">3</Data>
  </EventData>
</Event>

Help, please!

I understand Remote Desktop Services has undergo some drastric changes.

How do you configure a farm name in RDS 2012? Or is the concept around farm name changed in another concept?

Although I have imported a certificate on the RDCH withe the farm name I want to use. When I click on a RemoteApp on the RD Web Access portal, it does not connect to the right farm name.

Boudewijn Plomp, BPMi Infrastructure & Security

I need a help about configuration Windows 2012 Foundation Server as a RDS for 8 users.

I bought 8 per user licenses, install server as a AD controller, install RD license manager and put the licenses there. But I don't know how to continue. In http://technet.microsoft.com/en-us/library/jj679892.aspx is described that I don't use RD Connection Brooker and without it I don't have any tool to configure RD because Server Manager requires it. Only thing I can do is install RD Session Host and then I am able to connect more than 2 users in the same time, but I am warned about 120 days time limit because terminal server license mode is not properly configured. Without Session Host I am limited to 2 users. If I tried to install Connection Brooker as a new role, installation failed.

Can anybody help me, please??

I have a Windows Server 2008R2 server installed with RDS Gateway.  I use this gateway to access all of our internal servers.  I have a certificate installed from a public CA (*.externaldomain.com).  When I attempt to connect with my RDP client to server01.domain.local, I receive a certificate error.  The certificate it is presenting is my local computer cert from my internal CA. 

Since my workstation doesn't trust my local CA, it can't verify the cert.

Since I'm authenticating to my gateway server, I was assuming (hoping) that I didn't need a public cert on each of my servers.

DB

I have setup a Windows 2012 server running as a member server on my Domain. Everything seems to be working fine. But I have a couple problems that are probably related to the certificate. Although this is not a huge problem and the end users can still login and open the apps, I would like to get rid of the popups so that the users can have a better experience using the new server and apps.

When I login from a computer on the LAN that is in the domain, I get the first popup that you see below. When I login to the server from a computer somewhere on the Internet that is not on the domain, I get both the first and the second popups that you see below.

The actual server name is 123.123.com and the name I use for it on the internet is abc.abc.com I have puchased a certificate that is for the name abc.abc.com only. Unfortunately we do not own the domain name that we use internally, so I could not buy a certificate for that name.

In the first diagram the Publisher name is our external name, The Remote Computer name is our internal name and the Gateway Server is our external name.

In the second diagram The Requested Remote Computer is our internal server name and the Name in the Certificate from the Remote Computer is out external server name.

Any help with this would be greatly appreciated.

I started this thread (http://social.technet.microsoft.com/Forums/en-US/winserverTS/thread/8209ecda-a9ae-48db-b564-379d9ad47d02) a while ago while I was in the planning/daydreaming stage of the project. Now that I have the foundation complete and have completed some initial scenario testing, I would like to share some information and hopefully get some feedback.

My #1 requirement is complete site independence. There were suggestions in the previous post that I connect both Conn Brokers to the same SQL Server so that I can make sure that each site has access to the same session info in the DB. That is not an option as this does not fulfill the #1 requirement of site independence.

Here is my current setup:

I have 2 separate AD sites in the same domain connected by a 200mbps circuit. I am planning for not only local high availability, but also DR. Hurricane Sandy opened some eyes around here. Let's say there are 50 users in each location, and each site is going to serve as the DR site for the other. My users do not roam from site to site. If they do, I do not have a problem with them running their VDI session over the WAN. The client I am planning to use is ThinKiosk. The UI allows me to present multiple RDWA portals for the users. Since my users do not roam from site to site, they will be instructed which RDWA site to access. If they mistakenly go to the wrong RDWA site, they will not see any collections. However, after a DR event, the user will be instructed to access the other RDWA site in order to get their desktop (See below on how I pre-created a unmanaged collection in the DR site to support this). The architecture will look like this:

Site A:

2 - RD Conn brokers in a HA setup backed by a SQL Cluster (VMs) / 2 license servers (VMs co-located with RDCB) / 2 RD Web access servers (load balanced via netscaler) (VMs co-located with RDCB) / 2 RDVH Servers (Hyper-V Cluster with CSV) (Physical) connected to a 3PAR SAN

Site B:

2 - RD Conn brokers in a HA setup backed by a SQL Cluster (VMs) / 2 license servers (VMs co-located with RDCB) / 2 RD Web access servers (load balanced via netscaler) (VMs co-located with RDCB) / 2 RDVH Servers (Hyper-V Cluster with CSV) (Physical) connected to a 3PAR SAN

I will be replicating the LUNs that the VMs are on using 3PAR Remote Copy. All the other components of the infrastructure (RDCB/RDLS/RDWA) do not need to be replicated for DR as the real horsepower required for my implementation is on the RDVH and these are physical machines. I have also come to the realization that a "VDI deployment" in fact requires that all the roles participate with each other. For example, if the RDVH servers are down, the RDCB shows no collections even though they have been configured.

I initially created my collections as managed personal collections with manual user assignment. This seemed like the right way to go at the time when not taking DR into consideration because of the ease of setup (Deploy 50 machines from a gold image/assign the users/done). Local site HA works flawlessly in both sites when taking this approach.

The next step involved DR testing and this is where it gets interesting. The following are the steps I took to bring up the VMs from Site A to Site B:

1. I shutdown all 4 machines in Site A to simulate a failure.

2. Broke the replication on the SAN.

3. Mounted the lun in Site B on the 2 RDVH servers.

4. Added the storage to the cluster and made it a CSV.

5. Changed the path of the mounted volume to what it was in Site A. In Site A, the CSV was mounted as C:\ClusterStorage\MAS-Volume1. When bringing it into the cluster in Site B, it was mounted as C:\ClusterStorage\Volume2. Using Windows Explorer, I changed it to C:\ClusterStorage\MAS-Volume1

6. Imported the VMs from the CSV to one of the RDVH servers in Site B keeping the unique id the same as they were in Site A.

7. Added the VMs to the cluster using cluster manager.

8. At this point, it was time to add them to a collection. The only way to do this was to add them to an unmanaged personal collection which I pre-created in Site B for this purpose.

9. The users then logged into the RDWA portal in Site B and they were able to successfully login to their personal desktops.

The next step was to fail back the desktops from Site B to Site A which did not go as planned. I was expecting the VMs to be just as they were when I shutdown the environment but the desktops did not reappear in the original managed personal collection in Site A. The following are the steps I took to return the VMs from Site B to Site A:

1. Removed the desktops from the collection

2. Removed the desktops from failover cluster manager

3. Shut them down from Hyper-V manager. Did not delete them from Hyper-V manager as this would delete the configuration files from the disk that I would be replicating back to Site A.

4. Removed the disk from CSV

5. Removed the disk from the available storage pool

6. Dismounted the lun from the 2 RDVH servers using the SAN interface

7. Reversed the replication so that the changes made to the desktops in Site B would be reflected in Site A.

8. Mounted the lun on the 2 RDVH servers in Site A.

9. Powered up the 4 servers in Site A. At this point, the VMs were powered up and available in both Hyper-V manager and failover cluster manager. I connected to the console to confirm.

10. Opened server manager on the RDCB in Site A and saw that the collection that the desktops were originally in, was empty. Since the collection is a managed personal collection, I cannot add the desktops back into the collection.

Now some questions?

1. Is there a way to add these orphaned desktops back to the collection using powershell or otherwise?

2. Would I have been better off creating a unmanaged personal collection in Site A in the first place so that I would have been able to re-add the desktops? Keep in mind that this increases the level of administration when creating the initial pool of desktops.

3. 

Hi,

We are using Win 2008 R2 Terminal Server with Thin Client

We have deployed the wallpaper through group policy now desktop icon color is not visible to users on Thin Clinets.

See the below picture

Now we are unable to see the name of icon ,is there any way available to change the color or add backgound color to icons ?

See Picture below :-

Now we need to set the blue backgroudnd in desktop icon so that we can easily read the name of Icon

Please suggect how to do this on win 2008 R2.

 We have already tried to disable "Use drop shadows for icon labels on desktop but no luck.

Please helpus to resolve this issue.

Viral Rathod Blog : http://viralr.wordpress.com

Hi,

TS/Citrix Environment:
MS Windows 2008 Server Enterprise
MS Office 2007 

We were trying to configure the "Programmatic Access Security" via group policy.
But the group policy does not switch the setting cause Outlook cannot detect the status of the antivirus.
(the value is changed in the registry, but it is ignored) 

Some articles say, that Outlook must detect the machines antivirus status from the "Action Center".... but 2008 Server does not have one.

Any ideas?

regards

Hi Everyone,

We have six terminal servers that are distributed like this, four servers (WS03*2, WS08*2) for two different department to access their applications, One server(WS03) for all users to access internally  and one sever(WS03) for all users from outside the network.

We are looking to some sort of load balancing to minimize the server count to as less as we can so that we can best utilize resources among servers.

So we are thinking to have session broker in picture and let all servers upgraded to server 2008
so can someone please suggest how we should proceed further, what architecture and planning we should follow also is there a way (through TS Session broker settings or Group Policy) to direct users to specific Terminal Services in a farm based on their OU or group?  For e.g. Group A be directed to TerminalServerA and everyone else to TerminalServerB.  Is this time of scenario possible?

Thanks