Remiel

Our Company The LTE Group was developed in 2016 and is the first integrated education and skills group of its kind, we are part of the public sector and are dedicated to learning, training, and employment. LTE Group consists of almost 3,500 colleagues and operates 6 businesses which are Novus (delivering learning and skills on behalf of the Ministry of Justice), The Manchester College (Further Education delivery), UCEN Manchester (Higher Education delivery), Total People (Work Based Learning), MOL (blended distance learning) and LTE Group Operations. Our mission statement is “To improve lives and economic success through learning and skills” We work in over 120 locations across the UK, providing the highest level of teaching to ensure the best outcomes for our students. Overview of the role We have a great opportunity to join the IT Services Team as a Third Line Technician on a permanent, full time (37 hours) basis. As a Third Line Technician you will provide in-depth technical support to a diverse range of customers and business units across varied technologies and systems. Able to work independently in a customer facing role, the third-line technician will be capable of making technical decisions independently to affect a positive outcome for the individual or business unit. Working to and understanding ITIL and ISO 27001 processes is essential as is participating in Change Advisory Boards and mentoring other technicians. Training and mentoring staff in the use of IT systems is an on-going requirement.The LTE group structure encompasses the strengths of each of our individual organisations allowing them the freedom to focus on their own learners, colleagues, stakeholders and communities, whilst providing the support and added value of a Group. Each of our 5,000 colleagues benefits from the opportunity to develop and progress their career within and across our wider Group network. In order to do this, you will need experience of: Proven desktop support experience Experience in a networking, design and implementation Knowledge of ISO Standards (ISO27001) Strong diagnostic and problem-solving skills in: hardware, software and networking incidents and a proactive approach linked to the appropriate skill and knowledge to effect timely repairs Provable experience and support skills in Windows /2008R2/2012/2012R2/2016 server, Windows 10 and Mac OS X. Remote software distribution system (Windows Deployment Server or equivalent). Active Directory, Group Policy, VMware and general administration skills. Assigning rights and determining inherited rights to accounts. Supporting a large number of customers within a customer service orientated environment. The LTE Group is an equal opportunities employer welcoming application from all sections of the community. If you feel you could make a difference in this rewarding and growing sector, please visit our website to apply! All applicants must demonstrate in their application their ability to meet the Key Responsibilities, Key Result Areas and Qualifications/Skills/Experience detailed within the job description for shortlisting purposes. Salaries are based on skills, qualifications and experience. Colleague Benefits As part of the LTE Group family, you will benefit from an excellent package including: An excellent annual leave entitlement in-house ‘Evolve’ training programme offers you the chance to upskill and further your career through a wide range of recognised qualifications. Flexible/Hybrid working. Career development opportunities Local Government Pension Scheme Discounts on your health care through Simply Health Free, confidential support service provided by an external organisation, PAM Assist Cycle to work scheme saving you 25% on your purchase. Access to lots of offers with well-known retailers. The closing date for this job advert is 06/09/2024 - Click to Apply

Congrats Dave!

Simplest setup would be RDWeb and Gateway on one server (with app proxy connector), Broker and Licensing on a 2nd then use the 3rd as your session host.

So that's positive, it's logging correctly for connections made internally. Can you post a screenshot of your on-premise application App Proxy settings page from the Azure Portal? Blank out the addresses etc.

Exactly, so publish terminal services client as a remoteapp. Try it yourself, works fine.

Yes you can still connect to individual desktops via the HTML5 experience in the browser, you can achieve it via an RDP file for terminal services since the HTML5 page doesn't have a 'connect to my PC' tab anymore. I do it as a remoteapp mstsc.exe shortcut.

If you can try logging into RDS using the internal URL and running an app / remote session via the /rdweb/webclient/ page and then via an /rdweb/ RDS file then check the SessionBroker and SessionBroker Client logs on the Connection Broker Host it may help narrow down the stage at which the external connection is failing. Just need to prove it's working and logging correctly when used internally. The application proxy is installed in the right place, if you manage to login and see the app collection on the /rdweb/webclient/ page then you've already hit the RD Web Access service so it's at least partially working.

Look for the TerminalServices logs under Applications and Services Logs > Microsoft

I'd start here with code 1006 although it's pretty generic. Are you using separate hosts for licensing, connection broker and session host? Would be worth looking at the logs there too.

That's grand, try testing the app proxy using the pre-generated external *.msappproxy.net URL so it won't rely on your SSL cert. It may be worth deleting and recreating the enterprise application app when you do this so you know it's defaulted all settings. Just add your user groups, change authentication to Azure Active Directory then turn off URL translation for headers and body (this is under the Application Proxy section of the enterprise application within Azure portal). See if that works or if the error message changes for the /rdweb/webclient/ page and the /rdweb/ .RDP file?

That should be fine, a DNS redirect to the msappproxy.net link (or your custom domain one as you said) on your internal DNS would force everyone through Azure SSO so they receive the same experience internally and externally. Also may be worth testing the app proxy application using the default *.msappproxy.net address to see if there's any difference. Might be a silly question by how many subdomains deep is the external URL? I had an issue where one of our internal services that needed the SSL cert was one subdomain too deep and needed it's own cert purchasing (SSL cert was for *.schoolname.county.sch.uk while the internal service was *.domain.schoolname.county.sch.uk - hence wildcard having an issue). Just to clarify, by internally do you mean you're using the /RDWeb/ URL of your internal server? If you're getting the firewall error shown above when accessed within your network you can (for now) rule out Azure App Proxy being the cause. Have you missed any steps such as adding user/groups to your remote app collection and also the session host's remote desktop list? Yeah apologies should have clarified that the guide has some useful bits but isn't a complete experience. When I was setting up my system in March I honestly couldn't find one complete, perfect guide on the process. Each one I found either missed a step or simply didn't work. This wasn't helped by the fact that the HTML5 client and App Proxy SSO are still relatively 'new' features that previous weren't compatible meaning numerous guides don't cater to both being used in the same environment. It definitely does work though, so you'll get there in the end! Edit: If you'd like to chat about it over the phone PM me, happy to help as it was such a nightmare setup!

Are the apps failing when you login internally from your own network or just when you login via the appproxy.net link? I've had it working via Azure App Proxy since March, works very well in Chrome, Edge, Safari etc. How have you setup your internal hosts? Are you running RDWeb and Gateway on the same server? I'd recommend having a look at this guide, it's a bit better than the official one - https://parveensingh.com/publish-rds-environment-with-azure-ad-application-proxy/ Just one caveat to the guide above - his section on publishing RDWeb and RPC as two separate on-premise applications in app proxy is wrong and caused me huge issues. It was essentially stopping the gateway and RDWeb from communicating with each other when accessed outside of our network. The solution (which I've posted to his guide but he's not taken into account) is to ensure RDWeb and the Gateway are both on the same host (the guide even suggests this), then publish one on-premise application with no trailing /rdweb/ or /rpc/ on either the internal or external URLs. You can then just manually add /rdweb/ (or /rdweb/webclient/ for the updated interface that works in newer browsers) to the URL when you distribute it to your users and it should work correctly with Azure SSO. The only issue with this is if users try to click the published application from within office365 as the URL will be missing the /rdweb/webclient/ and throw an IIS error page. We get around this by hiding the published application from the gallery then simply distributing the URL directly to staff via guide email etc.

Unbelievable process this - finally got authorisation to order 126 devices 2 weeks ago, our first try at ordering was cancelled by techsource with no notice given - only found out by checking the order status on the portal when nothing arrived 4 days later. Took nearly a week for them to reassign the devices to us ("you've already reached your 126 device order limit") only to then find out that "no Chromebooks were available for order at the moment but we're working on getting stock soon". Now we get news that not only can we not place an order over half term but that our allocation of 126 has been reduced to 25. Just don't know what to say without getting into a political rant...

I managed to get lucky and bag a card from Scan just after 2pm on the launch day, picked it up from the shop that afternoon. There were some pretty irate folks in the queue who evidently assumed they could just walk in and buy one there and then, felt for the staff having to explain the situation repeatedly. They really are phenomenal cards though, especially if you're on 1440p. Everything I've thrown at it so far has been 100+fps smooth with everything maxed out, finally in a position to finish RDR2 without it being a slide show.

Sadly 4Matrix is no longer available to us, otherwise i'd look into it. If anyone has any other ideas do post them!EduGeek.net - The I.T. Professionals' life line