RDS in 2016

[Tefters]

Microsoft RDS and SCCM 2012 R2 is all I can say. 3rd party products other than Citrix are slowly becoming obsolete.

[gshaw]

Bit disappointed there still isn't any integration with ADFS

@FN-GM you can possibly get around that by publishing via Azure AD Application Proxy, which will use your Office 365 login in Azure AD using Kerberos delegation provides SSO to the internal resource. Comes with Azure AD Basic (free on EES)

 

As an aside I'm looking at setting up RD session based for a cheap remote access solution, not running Hyper-V and don't want to run the Session Host on our VM infrastructure but do have some decent spec physical servers spare. Was thinking this...

 

• Physical - Session Host (64GB RAM, possibly more if I can find some)
  
• VM - RD Gateway \ RD Web Access
  
• VM - RD Connection Broker \ RD Licensing
  
• Azure AD Application Proxy publishing RD Web Access externally
  

 

Or I guess I could put Hyper-V onto that physical and run everything as VMs within it, seems a bit inefficient that way though?

Edited January 3, 2017 by gshaw

[Tefters]

@FN-GM you can possibly get around that by publishing via Azure AD Application Proxy, which will use your Office 365 login in Azure AD.

 

As an aside I'm looking at setting up RD session based for a cheap remote access solution, not running Hyper-V and don't want to run the Session Host on our VM infrastructure but do have some decent spec physical servers spare. Was thinking this...

 

• Physical - Session Host (64GB RAM, possibly more if I can find some)
  
• VM - RD Gateway \ RD Web Access
  
• VM - RD Connection Broker \ RD Licensing
  
• Azure AD Application Proxy publishing RD Web Access externally
  

 

Exactly my setup except I have 3 physical servers which I run hyper-v on and then run the Session Hosts as VM's off the host.

[gshaw]

Exactly my setup except I have 3 physical servers which I run hyper-v on and then run the Session Hosts as VM's off the host.

 

Any performance hit by running the Session Hosts as VMs or much of a muchness if running them without graphics cards \ RemoteFX?

[Tefters]

Any performance hit by running the Session Hosts as VMs or much of a muchness if running them without graphics cards \ RemoteFX?

 

None at all, I do it purely because I can increase the number of session hosts by simply bashing up a new VM and upgrading memory, rebuilds are quicker, always have a VHD of a session host offline ready for a hot swap if needed.

 

The thing I find with Remote Desktop is with that many users all logging on to the 1 server and a good 20+ all at once something goes wrong on one every 6 weeks or so, whether it's UPD temp folder, a windows patch fubar something, or simply an application spas out from having several instances open by several users at once.

 

In short - Running VM's is generally quicker for troubleshooting/repair/rebuilds then having to do the full metal.

The full metal install is simply Hyper-V, domain join and that's it... so nothing ever goes wrong on that side

 

My RDS image is in SCCM so I can turn around a VM rebuild in 3 hours but I also use Veeam Endpoint Backup on the host which is hooked up the my Veeam repository which points to my NAS so I can also backup the host and everything on it as well.

Edited January 3, 2017 by Tefters

[gshaw]

None at all, I do it purely because I can increase the number of session hosts by simply bashing up a new VM and upgrading memory, rebuilds are quicker, always have a VHD of a session host offline ready for a hot swap if needed.

 

The thing I find with Remote Desktop is with that many users all logging on to the 1 server and a good 20+ all at once something goes wrong on one every 6 weeks or so, whether it's UPD temp folder, a windows patch fubar something, or simply an application spas out from having several instances open by several users at once.

 

In short - Running VM's is generally quicker for troubleshooting/repair/rebuilds then having to do the full metal.

The full metal install is simply Hyper-V, domain join and that's it... so nothing ever goes wrong on that side

 

My RDS image is in SCCM so I can turn around a VM rebuild in 3 hours but I also use Veeam Endpoint Backup on the host which is hooked up the my Veeam repository which points to my NAS so I can also backup the host and everything on it as well.

 

Turns out the spare server I have is an R610 and doesn't support Server 2016 so looks like I'll have to VM-host it anyway. Good news it appears I can run Server 2016 \ Win10 guest on a 2012 R2 host so can do it that way instead

 

I wonder if I can find another server then have two physicals running Hyper-V then spead all the RDS components between them, perhaps one session host VM per physical tin.

Edited January 10, 2017 by gshaw

[Tefters]

I host 2 VM's in my main production environment on the SAN, 1 hosts RD Web and the other is the Connection Broker, I then just run the Session Hosts only on the other servers off SAN and have an SCCM image to build/rebuild them if needed

[Tefters]

Why won't server 2016 work on the server by the way?

[JackT]

It should work, i've got an R610 sitting on my server room with server 2016 installed on it. Im also using it as a HV host to run some windows 7 and ubuntu vms on it.

[gshaw]

Why won't server 2016 work on the server by the way?

 

@Tefters was just going by the compatibility matrix that shows it's not Qualified for 2016 - that may only mean it doesn't work with OpenManage but was erring on the side of caution

 

http://en.community.dell.com/techcenter/extras/m/white_papers/20438149/download.aspx

 

Also Certified list here...

 

http://en.community.dell.com/techcenter/b/techcenter/archive/2016/11/10/dell-poweredge-servers-certified-for-windows-server-2016

Edited January 12, 2017 by gshaw

[Tefters]

Pffff.... What the manufacturers say and what can be done are 2 different things

[gshaw]

Pffff.... What the manufacturers say and what can be done are 2 different things

 

Indeed, although on servers I tend to stick to be a bit more by-the-book so it stays as a supported config. No real difference between 2012 R2 and 2016 for the basic host role so not too worried about using the older version there

 

Btw quick straw poll... on a Hyper-V host running Core... AV or no AV?

[Tefters]

if it was me, I wouldn't...

[gshaw]

So just gone to install this today and trying to go for a nice tight, secure install with Server Core...

 

...deployment failed after barely trying on the last step, after some research it seems you can't run RD Web Access or RD Gateway on Core?!

 

So we can have a nice low-attack-surface server for web-facing services... apart from when trying to deploy the web-facing parts of RDS... the mind boggles

[Tefters]

Should of just asked

RdWeb and Gateway = GUI only

Rd License Server = GUI by docs, can be done on core but very fiddly! Advise GUI (I chuck on a DC)

RDCB = Core or GUI

 

I personally just shove it all on GUI out of laziness and frustration as MS want to go core but the number of roles supported is so minor... Especially when going into ADFS, Skype for Business etc...

 

Unless your the MoD (Ministry of Defence) or a massive datacenter server core is a big disappointment.

Edited January 31, 2017 by Tefters

[gshaw]

Should of just asked

RdWeb and Gateway = GUI only

Rd License Server = GUI by docs, can be done on core but very fiddly! Advise GUI (I chuck on a DC)

RDCB = Core or GUI

 

I personally just shove it all on GUI out of laziness and frustration as MS want to go core but the number of roles supported is so minor... Especially when going into ADFS, Skype for Business etc...

 

Unless your the MoD (Ministry of Defence) or a massive datacenter server core is a big disappointment.

 

Haha that'll teach me for thinking Microsoft would've followed their own recommendations! Did actually manage to get the RD Web Access to install on Core via Powershell but it won't enable due to an IIS management component (seriously MS?)

 

Was hoping to go the same way as my CentOS VMs where it's nice and clean, not quite there yet MS... maybe in Server 2020 if they haven't forced us all into Azure by then

@Tefters @FN-GM out of interest how have you licensed your RDS setup? Was hoping the User CALs would be based on concurrent users but seemingly not and it's based on "unique humans". Per device seems a bit more flexible but still likely to need more CALs than people connecting.

Edited February 1, 2017 by gshaw

[FN-GM]

 

So we can have a nice low-attack-surface server for web-facing services... apart from when trying to deploy the web-facing parts of RDS... the mind boggles

 

I publish mine through a web application proxy to try an help with the risk of attack.

[gshaw]

Yeah mine will go out through Azure AD Application Proxy for the same reason

[Tefters]

At the moment we are running device cal's at 1150 however this is major overkill and as of July when I refresh I will be going to a user CAL model.

 

Coincidentally.... Having just logged on my DC to check my RD licensing numbers I noticed I couldn't connect to the console and drilled down to find the issue being the RDS licensing service being disabled and stopped.

Re-Enabled and started and all OK now but hmmm.... How have my clients been licensed...?

 

I noticed this with another service on my RDCB server the day after I did patching over Christmas as no-one could use the RDS from home due to a "logon server not available" error which took me like 4 hours to narrow it down to a disabled service on the RDCB server, both the RDCB server and the licensing server coincidentally are Server 2016!

 

In short - Keep an eye out after running in patches on Server 2016 as I believe some updates are disabling services for whatever reason by the looks.

Now going to trawl through all my other 2016 servers and check each service individually...

 

EDIT - Don't forget that if you are doing Server 2016 RDSH VM's to turn off client device redirection as it is horribly broken at the moment and blue screens servers, I have just checked my Microsoft thread and still no patch in sight... *sigh*

Edited February 1, 2017 by Tefters

[Homer]

Should of just asked

RdWeb and Gateway = GUI only

Rd License Server = GUI by docs, can be done on core but very fiddly! Advise GUI (I chuck on a DC)

RDCB = Core or GUI

 

I personally just shove it all on GUI out of laziness and frustration as MS want to go core but the number of roles supported is so minor... Especially when going into ADFS, Skype for Business etc...

 

Unless your the MoD (Ministry of Defence) or a massive datacenter server core is a big disappointment.

 

I couldn't get RDCB to work on Core either. The only thing that ever did, from memory, was the gateway service. Right PITA

[gshaw]

RDCB does work on Core, that's the only one that's left (Licensing on there too and seems OK so far)

[Homer]

Weird, I had all kinds of weird stuff going on trying to run that on core. When I switched it to GUI, no problems! For me the only thing that is not running on core, is the gateway.

[richbrowncardiff]

I'm having a really strange issue. Setup rds all working for domain admins and 1 standard user in group "staff - sims" who isn't an admin. login vid rdweb and all perfect for the user "Test" login as another staff - sims member and i get "you are not authorized to login" have checked group memberships and they are all identical, Anyway i comare the working "test" user with all others in the same group ? Any idea why my mysterious user works and no one else does ?

[Tefters]

NPS policy?

[CAWJames]

I'll second NPS, it is the highest policy for entry and overlooked frequently