RDP Web Access
Introduction
This is a brief article about configuring RD Web Access for your home lab
Pros and Cons
If you don't have MSDN this can cost a few hundred for a Windows License then around £25 for a 5 User TSCAL
Costs
Free if you have access to an MSDN license or happy with the 90/180 trials to learn
What will you need
- About an hour maybe two depending on the speed of your environment
- At least 2 VMs and a DC as a minimum
- The same amount of spare IPs to VMs
- Access to your router/firewall
- Ideally a trust certificate
- 1 public IP or a NAT from a load balancer
Use Cases
The use cases for this type of technology are for accessing your environment over standard SSL ports. This helps with locked down company environments as it doesn't rely on port 3389 for RDP
Solutions
Firstly I shall start by saying I have configured this as bare bones to limit the amount of resources I use on my environment and also what works for me. If you are studying for your MCSA I would suggest you build this out and include a RD Web Access server, RD Virtualization Host and a RD Connection Broker. I used my Gateway as a session broker as most my traffic would be coming from here.
Firstly start by getting your two new VMs up and running and ready to join to your domain (sys prepped, WSUS etc)
From here use any naming convention you want but I used
- Corprdsgw01.domain.com - This will be your RD Gateway
- Corprdssh011.domain.com - This will be where your session gets dropped onto
You will also need another machine for licensing, I usually opt for this on my secondary DC
Please note I will put notes in for alternative config if only using two machines. I couldn't do this as I already had an environment on this domain
I am also to happy to explain I do the configuration this way as it allows you to install .NET 3.5 if you are still using the old fat clients for your hyper-visors
Configuring the RD Gateway server
Start by logging into the Corprdsgw01 machine, within server manager select add roles
Press next and select Role-Based or Feature-based installation
Ensure you server is selected as you may already have these in a group
Within this window select 'Remote Desktop Services'
This following window allows you to install .NET 3.5 for older applications and web browsers
Select next on this window
Within this window select Remote Desktop Gateway Also select Remote Desktop Broker and Web Access if you only plan to have two machines
The system will now guide you through the NPS server roles. Keep these at the default for now but can help you lock down access going forward
Again follow the standard settings for IIS
Finally confirm the installation, once complete reboot the VM
Configuring the RD Session Host
Follow all the above sections for your RDS host but on this screen select Remote Desktop Session Host
Configuring the RD Session Host
Follow all the above sections for your License server but on this screen select Remote Desktop Licensing
Configuring the services to talk
Firstly I would suggest you ensure all the VMs have been rebooted. When logging in ensure you use a domain admin account for the next steps
Firstly start by clicking manage in the server manager and select Create Server Group
Within this window add your RDS boxes and license server
Click on your server group and then select Add Roles and Features
This time ensure you have selected Remote Desktop Services Installation
Select standard deployment
On this following screen select Session-Based desktop deployment and select next on the screen after
In the next screen select your session broker. If in the 2 VM scenario this should be your gateway server
In the next step as above if in a two VM scenario select your gateway server. If you didnt do it previously select install RD Web Access Role Image is for illustrative purposes
Finally select the confirmation screen and allow the restarts
Once this completes on the server you configured your group select the following option
If you have done things correctly you should now see the following screen, Press the RD Gateway + icon
In here select your RDS gateway server
You may get this error if you havent rebooted
In the FQDN type in your full domain name and if you have a split zone this will be the same internally. If you want to get access outside of course you will need to use your external domain name
Confirm the next two screen
Do the same for the License server
If you have done everything right you will now get the screen below
From the left bar select Collections
Once the menu is open select tasks and then create session collection
Select next to the following screen and appropriately name your RDS collection
Select your session host you create earlier
Apply a relevant group of people who you want to have access
If you have a file server you can create a profile disk
Select create to finish your collection
If require select your RDS group, tasks and then Publish RemoteApp
Assume you have already install the apps you want to access tick these to publish them
Confirm your selections
Testing your config
To try out your system go to the following url https://yourgw.yourdomain.com/RDWeb. For now you will need to accept the certificate issue
Try and log in of which you should see your apps
Select an app and you should now see the following screen, select connect. This is down to the fact you have not got a trusted certificate
Fingers crossed your app should appear
Securing your environment
This section will be updated when the certificates section has been populated.
Exposing this to the world....
I will update this shortly with a common UK router configuration as you will need to NAT some ports from the outside world.
Known Issues and Solutions
This is specifically to detail any issues with the technology being discussed, and how to resolve them. See the Intel NUC page for an example.
- You may want to deliver several services or pages on port 443
- Head over to my page about load balancing to learn more if you only have 1 public IP
- Requires several servers or understanding a DMZ
- Don't go for best practice but it may compromise security