Remote desktop gateway / RDS access from domain PCs

[foobs]

Hi All

 

Hoping for some wisdom here or anyone with previous experience of this issue please!

 

Basically, we run a remote server using RD gateway and up until recently it was fine, all of a sudden it's not accessible from any domain joined PC but still works perfectly fine from any non domain joined PC

 

We've tried everything we can think of but it's driving me nuts.. Any ideas?

 

The only thing we've changed recently is the website provider, and it's SSL certificate but can't see how that would be related.. The server is on a subdomain but has a separate certificate

 

Many thanks in advance

[Steve21]

Is there a specific error you get?

 

First thing would be does the subdomain route internally on your dns? As if it’s not leaving site you’ll need the A record setting

 

Steve

[foobs]

This is the error, no logs or anything we can find - really not helpful:

 

 

We do have it routed and the A record is all there on DNS, it's the internal address which I believe is correct (always used to be)

 

Thanks

[Oaktech]

Can you dispense with the gateway for internal machines? We had a similar issue when we went from using RDP on a non standard port directly to using RDP gateway. That turned out to be incorrectly configured DNS.

[foobs]

Yeah we can and that works fine - the strange part is that when they take their laptops home it still doesn't work - even on their home networks....

[Oaktech]

Yeah we can and that works fine - the strange part is that when they take their laptops home it still doesn't work - even on their home networks....

 

How are they taking the domain machines home? Local user? VPN?

 

Can you train one of them to try a DNS flush on their home network?

 

Is there any authentication policies on the gateway that might preclude a connection?

[Julian]

Are you using a proxy server? If so please check your proxy bypass rules, to make sure that traffic to the RDS gateway in not being sent to your proxy server.

[foobs]

Just local user, I'll give that a go tomorrow as I'll be there, will try on a hotspot

 

We've got an authentication policy for the RDS users group (as it should be) but nothing else, I was debating adding a group that allowed all domain PCs or something but can't see that making a difference either

[foobs]

We are using a proxy, adding it as a bypass didn't seem to help (or just turning proxy off on client and server - still worked externally!)

[foobs]

Somewhat of a discovery; it works using the new style "Remote Desktop" app with the orange icon instead of the old one with the blue icon... I added a rule to allow the old one through firewalls and no difference, really lost now..

[foobs]

Think we've sorted - there was a HTTP redirect setup on the /rpc site in IIS for some reason - got rid of that and instantly started working... Thanks all for your input - good to know I guess!