Server 2008 R2 Hyper-V and VDI

[nick3young]

Hi All,

 

I've recently been experimenting with configuring a virtual desktop infrastructure (VDI) for remote access using Server 2008 R2's RDS services and Hyper-V. I have ran into a couple of problems as I'm nearing the end of the process though. If anyone has set this up before, I'd be most grateful if anyone could shed any light on these.....

 

1. Once the VDI pool has been created, you can no longer RDP onto the actual host server using standard 'remote desktop'. This is because the RD host is configured to redirect to the virtual machine pool. Is it not possible to be able to connect to the virtual machine pool AND the physical host using RDP?? We would like to be able to offer 'RemoteApps' published directly on the host and, with this configuration, it doesn't seem possible without the use of an additional server.

 

2. We have 'RD Web Access' configured and the VDI pool has been published to that. I can connect to our RDWeb page from home and 'see' the pool as an available icon. However, when I click the icon, it attemts to use the internal name of the virtual machine (e.g. vdi-01.domain.internal). Our host is configured with a public IP and domain name (hence why I can connect ok to the RDWeb page).... but surely it is not standard practice for external access to have a public IP for EVERY virtual machine in the pool is it?

 

Thanks

Nick

[Achandler]

You need to use the /admin switch when logging in to the server. This will log you in properly.

 

That pool on the RDWeb access should be all VDI computers.

[nick3young]

Ha... I didn't think the solution to the 1st one would be so simple. Thanks for that it helps massively. It doesn't solve the problem for 'remoteapp' access though for our standard network users. Do I just have to accept that if I'm using a VDI pool I cannot use RemoteApps?

 

For the 2nd one... I understand that the RDWeb pool accesses all VDI computers within it (I assume sequentually until the run out... e.g. VDI-01, VDI-02 etc?). But each one of those VDI computers has an internal name. When I connect to our RDS server from home I use RDS.domain.sch.uk but each of our VDI computers have internal names (as mentioned above). So obviously these cannot be seen over the internet. I was assuming that once I had connected to the actual RDS server, it wouldn't matter that the names of the VDI computers are internal......

[Achandler]

have you set up a gateway server? if you are connecting over the Internet i would.

 

I believe it is either VDI pool or RemoteApps you server cannot provide both, as RemoteApps is done using a session host.

[nick3young]

I do have a gateway server configured yep... is this where I need to be focusing my efforts to make these VDIs visible over the internet then...?

[Achandler]

I don't actually have my VDI pool available online, but you should use it. Try using a pre-configured RDP file from home, so one that has your gateway preconfigured and check that works. Once you know that works for sure you can start checking the RDWeb one, personally I email staff the RDP file that connects to our session host server.

[nick3young]

Right, I have tried a pre-configured RDP file remotely. I entered the external FQDN of our gateway (e.g. server.school.sch.uk) and the internal FQDN of a pooled virtual machine (e.g. vid-01.domain.internal). Is this correct?

 

It asked for the login credential before going no further (it simply loops back). I'm pretty confident that everything else is setup correctly .e.g. we have a signed SSL installed from GoDaddy matching the external FQDN of the gateway.... I can see the gateway using RDWeb...... I'm a little baffled! Thanks again

[Achandler]

You shouldn't be connecting to an individual VDI but to the server hosting the VDIs, this server you then realise you don't have a /admin switch and redirect you to one of the pooled VMs, it acts as the session broker.

 

If you download your working RDP file from RD WebAccess, then add the gateway to this, then it should work without changing anything else. But to connect to a pool of VDIs, it shouldn't be connecting to individual machines. Although you could make it, but then you would need lots of individual RDP files, which defeats the point of a pool, even a perosnalised pool using the same RDP file.

 

Can you ping the gateway on the external address, although you should be able to use the gateway internally, just turn off bypass the gateway to force it to use it. The gateway may not work if you aren't connecting to the server though (as I queried above)

[nick3young]

The only way I can get any kind of response from our hosting server is with the /a switch. If I try and connect to it without the switch, I get the following error:

 

"....... computer is not yet registered with the session broker....". (I get this both remotely from home with the public name and internally with the local name)

 

This I imagine is because I have redirection enabled on the server for connection to my VDI pool. If I then manually specify my RD gateway server under advanced settings I simply get no error and it times out.

 

I'm not entirely sure what you mean by 'downloading RDP file from WebAccess'.... I can't seem to do this. I do believe I'm entering the settings correctly manually though (there isn't a lot of room for error).

 

The gateway is on the same server as everything else - WebAccess, Hyper-V (etc) so I know it can be pinged fine from home.

 

Thanks so much for all your help with this so far... do you have any more ideas? Thanks

[Achandler]

If you go to https://yourserver.domain.local/rdweb in Firefox, then when you click the RDP connection, it will download the RDP file because it can't launch it like IE can.

 

If that file downloaded doesn't work then your issue is to do with your server/ vdi pool setup. The RDP file will also connect to the pool, and it will say it is connecting to the server, NOT an individual machine.

 

The error to do with a computer not being registered with the session broker implies that the problem is down to how you originally setup your server and pool, when you are connecting to the server it seems there are no pooled VDIs to connect to, and you cannot connect to the VDI directly because the host isn't set up correctly to allow this (especially when using the gateway)

[nick3young]

Ah, this may be a big clue. The RDS server generates the following error after each attemp to remote into it:

 

"Unable to resolve the Remote Desktop for user domain\username. No Remote Desktops are assigned to the user in Active Directory. Assign the user a Remote Desktop in Active Directory."

 

You're right... it seems to be looking for a personal desktop as opposed to one from the pool. Hmmm... I wonder why this is.... I will update if I find anything.

[nick3young]

Almost cracked it! It seems my issue is caused by a bit of a glitch with Windows 7's RDP client. A reg key needs adding to the server to fix it.......

 

RDS VDI Problem Connecting to Pooled Virtual Desktops

 

I cannot believe that it effects ALL Windows 7 clients though. And I also don't quite understand why it fixes it (but it does).

 

So now that it works through the RDP client I can move on to trying to get it working through RD Web Access.......

Edited May 8, 2013 by nick3young

[Achandler]

Your RD web Access should be easy, as your server is told to publish the link to RDWebAccess, so it should be automatically configured correct.

 

Try disabling the the published RDP file, then re-enabling it.

[nick3young]

I'm afraid it isn't proving quite as easy as you think achandler..... Here's my situation:

 

- I can connect to my VDI pool fine using the standard RDP client via the RD Gateway (internally and externally)

- I cannot connect to the pool using the icon published in the 'Remote App' tab of 'RD WebAccess'. I simply get the error: "remote desktop cant find the computer ......".

- If I use the 'Remote Desktop' tab of 'RD WebAccess' I can connect to ANY of our physical internal workstations via the RD Gateway (I had to make a small change in IIS to the default TSGateway setting to get this working)

- I have added in the public name of our 'RD Gateway' into the 'RemoteApp Manager' (I believe this only effects RemoteApps)

 

There isn't really a lot I can do from there. I believe the bottom line is that, when I click on the VDI pool in 'RD WebAccess', it isn't using the RD Gateway. It is simply trying to find a computer from the pool using their internal names over the internet and obviously failing. If I try to use a RemoteApp, I can clearly see from the popup box that the site is using the RD Gateway (it doesn't do this for the published VDI pool).

 

I know you don't use RD WebAccess but do you have any ideas....?

 

Cheers

Nick

[TheScarfedOne]

Ive just got my own gateway set up and working for my rds farm...so not quite the same setup as yours. Rather than personal desktops - I have a shared farm, where all users will be distributed across it. My job tomorrow is to get the web access part updated to match...it has the "apps" published (just the office apps and "remote desktop") to prove in concept it works. Now, it works internally, but I need to update the "Remote App" settings on each server in the farm to give it the gateway settings so it will use that. As I understand it, you need to use your public name, and then set the Bypass on internal - so that it doesnt nerf your internal setup. Im hoping this, as the internal farm (it was primarily set up for this) is heavily used by my thin client estate!! I will let you know tomorrow. Im also going to update my blog with all the past 2 days work on it too....

[Achandler]

So basically from what I am reading the published RemoteApp (for RDPing) doesn't contain the gateway, and it needs to.

 

When you click on the Remote Desktop in RemoteApp, what details does it give you, I have just checked on my session based server, and the remote app shows me the following:

 

Publisher: *.mydomain.org.uk

Type: Remote Desktop Connection

Remote Computer: Myserver.domain.local

Gateway server: ts.mydomain.org.uk == my external gateway server name

 

Do you have the gateway in your server details? I don't know for sure but if I was connecting to my VDI Pool and not my Session Host, the only detail I would expect different would be the Remote Computer name.

[TheScarfedOne]

That looks right to me... the setting hides in the Remote App manager. In the panel on the right - Gateway Settings.

[Achandler]

I know mine is right it works! I am wondering what nick gets

[nick3young]

Yep....in Remote App Manager, I have entered the FQDN of my gateway server into the right hand panel. The overview box confirms that this setting has been successfully applied. My VDI pool is not visible in the RemoteApp program list at the bottom though.... the way my pool has been published is through RD Connection Manager (I right clicked the pool and ticked the box for "show in RemoteApp and Desktop Connection"). I don't know if this is relevant?

 

Achandler..... where do I click on the remote desktop to pull up those settings? I don't have the option in RemoteApp since it isn't visible and I cannot do anything in my browser. Is there an alternative way of publishing it?

 

Thanks again

 

EDIT: I have published a standard RemoteApp (the standard way) and this does appear to be picking up the gateway (a box appears when you try and run it which contains the gatway address). The VDI pool misses this line of information when you clikc it though.

Edited May 14, 2013 by nick3young

[Achandler]

Interesting, so when you publish the standard app, it picks up the gateway but the remote app doesn't. That box your talking about is what I see.

 

Which server is the standard app trying to connect to?

[nick3young]

The standard app has the following:

 

Publisher: *.mydomain.sch.uk

Type: RemoteApp Program

Remote Computer: server.mydomain.sch.uk

Gateway server: server.mydomain.sch.uk (these 2 addresses are the same, gateway and remote computer)

 

The remote desktop (VDI pool) has the following:

 

Publisher: *.mydomain.sch.uk

Type: Remote Desktop Connection

Remote Computer: server.domain.internal

 

... there isn't a gateway line.....

[nick3young]

Cracked it...... I recreated the VDI pool (30 second job). Not a very satisfying conclusion but at least it works! I guess it must be because I entered the RD gateway settings after I created the pool. Thanks for the help to both you.

 

My next tasks (!)....... get single sign on working (for some reason it asks me to enter username/password when I click on the pool after logging into RD Web Access). Also, it comes up with a certificate warning for the VDI machine..... I guess this is because the internal name doesn't match the public name on my SSL certificate. Is there any way around that?

[Achandler]

The certificate warning is something I never sorted out because I didn't think it was that big of an issue, we taught our staff to accept the certificate.

 

As for the single sign on, that should be a few tick boxes to get to work.

 

The fix would explain it, the pool and the RDP file being created before the gateway meaning they didn't know about it and hence when recreated it does appear, my gateway was there from the start but for me the gateway was created early.

 

I'm glad you have it solved except a couple of minor niggles that can be ironed out.

[nick3young]

I ws hoping to update this thread with the solutions to my final couple of niggles.... but reports on the internet are so 'wishy-washy' when it comes to SSO and SSL with remote access. I've had to admit defeat!

 

I thought it would be tidier to start a new thread on this since my initial problems have now been resolved in this thread. My new thread on SSO and SSL is here:

 

http://www.edugeek.net/forums/thin-client-virtual-machines/113606-rd-web-access-ssl-cert-sso-desktops-personal-vdi.html

 

Thanks

[itrimble]

Nick, were you ever able to configure your RD Web for external web acces? I am stuck at that part. I don't know what to do next. How did you redirect your site for external access?