RDP Options

[Jason1975]

Afternoon everyone.

 

I have a quick question that I would appreciate feedback on please.

 

With all our budget cuts there is less money for staff laptops, but many staff still want to work from home.

 

I have seen various web based RDP software solutions but wondered if there was a preferred solution that schools use.

 

Essentially I would like staff to be able to access SIMS and their files on various non school devices from home via an RDP connection of sorts, ideally from a 'web portal' we can link from our school website.

 

Many thanks in advance for any advice.

[Steve21]

RemoteApps built into Windows server etc. If you already have the hardware can just add the license into your EES/OVS and it works

 

Steve

[Jason1975]

Thanks Steve

 

Windows Remote App does seem like it will work well for us

 

2 things I have been unable to find - I assume one would need an external IP mapped to the internal server IP running remote apps correct?

 

Secondly, can one set up drive mappings?

 

Thanks

[Steve21]

Well it depends on how you set it up.

 

I'm assuming you already have an external IP address for the school etc, so don't need a seperate one for this as such. We just use hostname redirection on our firewall so like remote.myschool.co.uk etc redirects internally to our server.

 

And yes full drive mappings/programs anything "normal" RDP internally can do remoteapps can

 

Steve

[sted]

you will need an external ip that has port 443 available, to do it properly a real world certificate and a domain name you can use a name from (so rds.school.org for example) as far as stuff on the rds like mapped drives anything that runs on server 20xx will run as an rdp app/ in an rdp session as its being run by the server the device you connect with is basically a keyboard/mouse/screen its all done internally

[Jason1975]

Sounds good.

 

Any advice in terms of servers? Should we have a dedicated server to handle this or would an existing server do?

 

We have 3 pretty high end boxes running 2012. 1 Sims server, 1 file server and the DC.

 

We have another lower end 2012 box running some domain services and some 2008 servers running n computing terminals.

 

I am leaning towards a server just for remote apps.

[sted]

i run it as a vm. Its usually not that heavy on processor power but eats ram. It does depend though how many people use it and what for 4 people using word isnt going to stress pretty much anything 20 people running photoshop is

[bwestlake]

IT: How to Set Up Your Own Terminal Server Using Remote Desktop Services On Server 2008 R2

 

 

We have 5 vms running, one as a gateway, other 4 as session hosts, they each have 2 cores and 8gb ram, all our staff and students can connect to them our of hours, and we use them also on our "thin clients" comfortably have 80+ users on at once..

Edited October 19, 2016 by bwestlake

[Jason1975]

IT: How to Set Up Your Own Terminal Server Using Remote Desktop Services On Server 2008 R2

 

Thanks Ben

 

This is a very helpful link. I will give this a try.

[bwestlake]

we also have ours as a custom front page which gives staff and students information about how to use it

https://remote.beaufort.coop

[bwestlake]

https://robertsmit.wordpress.com/2015/06/23/step-by-step-server-2016-remote-desktop-services-quickstart-deployment-rds-vdi-rdp-remoteapp/

 

^ Server 2016

[Jason1975]

Thanks again Ben

 

I think I will update our one 2008 Servers that is not doing much to 2012 and give this a try. You have a nice setup on that page. great idea to have options for the various devices and the layout is very user friendly.

[Jason1975]

Quick Update

 

So, the install has gone pretty well with very few issues.

 

The problem I am having is the SSL certificate. Any advice would be appreciated.

 

We created our own SSL certificate and it has been stored on the server C drive. Permissions have been set.

 

However when we try access remote.ourdomain.com/rdweb we get the error saying there is a problem with the websites certificate.

 

I can continue to the Remote App home page but the link says certificate error.

 

-----------

 

I have had success running basic MS apps like word and paint, but PARS and SIMS have been more problematic not loading.

 

I just want to try eliminate the ssl certificate as what is causing the Sims issues (although I doubt it is causing SIMS not to load)

 

Many thanks in advance for any help.

[Steve21]

When you say your own one do you mean a local cert created from your IIS? If so it'll always error externally as it isn't trusted for your domain.

 

Also did you remember to set the external URL of your remote server as a public one and not local? e.g. remote.school.co.uk not Remote.local for the gateway etc?

 

Steve

[Jason1975]

Hi Steve

 

Yes, I found it was the local cert. The url is correct.

 

I have downloaded a free cert from STARTCOM and trying to install it.

 

Will update when I have more info

 

*

Edited October 20, 2016 by Jason1975

[dblight]

You can save an RDP file and use rdpsign.exe to associate a very to it as others have said for it not to error about the domain it will need to be a cert for the external domain. We sign ours with a wildcard cert.

 

https://technet.microsoft.com/en-gb/library/cc753982.aspx

Edited October 20, 2016 by dblight

[Jason1975]

So, a couple of updates

 

I have this working but really struggling with the SSL bit any advice is appreciated.

 

The remote Apps server is installed on a 2012 box. When remote apps was installed I used remote.ourdomain.com fr the setup.

 

I have purchased an SSL certificate using remote.ourdomain.com. The SSL for the remote Apps seems to work fine internally (the irony is not lost on me!) but I have problems when accessed externally, where the page is showing as not secure.

 

Initially I accessed the remote apps, by using the externally IP that is mapped to the Internal server. This worked externally but with the security warnings on the page.

 

I then tried to set up the URL subdomain with our Web hosting company - remote.ourdomain.com. I then redirected this subdomain to the external IP which redirects to the Internal IP. This also works but with the same security warnings.

 

 

I guess my question would be where the SSL certificate needs to be installed as installing it on the local server does not resolve the error.

 

This is made worse by the fact that my predecessor used 1and1 to register the schools website address and their customer services are pretty dismal. They say we can't use our current SSL cert that was purchased from a different company on their system.

 

Thanks for any help!

[Steve21]

Whats the actual error you're getting on the warning?

 

Steve

[Jason1975]

Hi Steve

 

It says the connection is not private and the address/lock in the address bar is red.

 

You can click on advanced, then proceed to site, but I would prefer it working correctly.

 

Thanks

[Steve21]

Can you do a screenshot, that warning sounds like nothing related to remoteApps. You sure it isn't a Chrome warning etc?

 

If so what's it actually saying isn't matching? Should give you an error but remember as it's RemoteApps it might not work in Chrome anyway.

 

Under your Gateway did you remember to enable the SSL cert for the RDP servers? - To go the RD Gateway manager, Properties, SSL Certs and screenshot that page please.

 

 

Steve

[Jason1975]

Hi Steve

 

So I did a few tests from home and after the certificate install yesterday the remote Apps no longer work.

 

Here are some screen shots.

 

This is the first error that comes up when you try to access the page. The same happens on chrome.

 

 

This is me ignoring the warning and navigating to the page. Note the certificate error in the taskbar

 

 

Error 3 is what comes up after yesterday's cert install that now prevents Remote Apps working correctly.

 

 

The final screen shot shows the cert trusted and installed on the remote App internal server

 

 

The error I feel is certificate related so I may uninstall the cert we purchased yesterday and use the certificate we created we had previously used just to test it again.

 

Thanks for looking at this, it is appreciated.

[Steve21]

Not sure if you just changed something, but your domain is redirecting to an IP address which won't work. As the cert isn't valid for the IP address. Thus the error as it's a mismatch between the address "remote." and what's actually being returned "31...."

 

Steve

[sted]

to get it to work externally you need to port forward port 443 from whatever your external ip is to your internal but the server needs to be "visible" as name.domain.com or the certificate wont match the address and it will not work (or i could just install googles certificate on mydodgysite.com

[Jason1975]

Hi Steve

 

Yes this is what is happening. I have never set this up before so this is how I thought it would work:

 

When I set up remote Apps server, I used remote.ourdomain.com as the FQDN during setup as recommended in an article I read#

 

Before we bought the cert yesterday the system worked like this: external ip redirecting to internal ip of server running remote App. This worked but came up with certificate errors.

 

The cert was purchased as remote.ourdomain.com and installed.

 

This still did not work correctly, so I setup a subdomain with 1and1 (remote.ourdomain.com) which redirects to the external IP then to the internal IP.

 

This is where I think the issue is coming up.

 

I spoke to 1 and 1 asking how I could use the certificate we purchased in their back office but they said they do not support 3rd party certificates. 1and1 has been a real thorne in my side over the last year and I will definately migrate away when I get the time to make all the changes.

 

I think I will strip this back and remove the 1and1 settings I setup to try make this work, and go from there.

 

So if my redirection is incorrect, what would the best practice be to get the traffic from 'the web' to our internal remote App server?

 

Thanks

Edited November 1, 2016 by Jason1975

[Steve21]

You should have an option about setting up a A record etc for it so it points at the IP but doesn't rename

 

This will then show to them as that domain but link to your external IP

 

Steve