{"id":2508,"date":"2014-07-30T08:25:05","date_gmt":"2014-07-30T13:25:05","guid":{"rendered":"http:\/\/www.poweradmin.com\/blog\/?p=2508"},"modified":"2015-10-21T13:16:05","modified_gmt":"2015-10-21T18:16:05","slug":"deploying-terminal-services-within-your-organization","status":"publish","type":"post","link":"https:\/\/www.poweradmin.com\/blog\/deploying-terminal-services-within-your-organization\/","title":{"rendered":"Deploying Terminal Services"},"content":{"rendered":"

In this article we will discuss Terminal Services<\/i> or Remote Desktop Services<\/i> available with newer versions of Windows Server. I will describe the main components that make up this technology and we will then install and configure this feature. A Terminal Server is a machine which offers RDP clients a way to connect and access services and applications on one powerful machine. A centralized machine on which clients would connect offers a lot of advantages. <\/span><\/p>\n

One important aspect is that you would provide clients low specs hardware devices to be able to connect to the Terminal Server, so overall costs of your network devices are highly reduced. Applications are centralized, updated and managed on the Terminal Server which means that not only do you decrease the workload of your Administrators, but increase network security and reliability. Data is stored in a centralized fashion and can be backed up directly from the Terminal Server, thus enabling you to better control data manipulation.<\/span><\/p>\n

One important aspect that needs consideration is the single point of failure that can occur within such design. This problem can be fixed by deploying multiple Terminal Servers that are load balanced to provide users multiple sources to connect. Microsoft has addressed this issue by creating the Terminal Server Session Broker<\/i> Service which is responsible for load balancing RDP connections between multiple Terminal Servers. The TSSB service will host a local database with all active sessions and will allocate new connections using the Round Robin<\/i> technology from the local DNS Server<\/i> or by using the Network Load Balancing technology<\/i>.<\/span><\/p>\n

For applications that require high hardware resources, it would be much easier to deploy a Terminal Server for your whole network infrastructure rather than upgrading\/installing individual machines for each user. Hardware usage can be monitored using Windows System Resource Manager<\/i>, a feature that can be installed with Windows Server 2008<\/a>:<\/span><\/p>\n

\"Windows<\/a><\/p>\n

When planning to deploy a TS Server you will need to take into consideration several factors. The machine hosting the Remote Desktop Service<\/i> must have enough RAM and CPU capacity to sustain all users that are going to connect to it. You would also need to consider the bandwidth latency for remote users because low performance may decrease user\u2019s productivity.<\/span><\/p>\n

Besides the Terminal Services Role you will also need to deploy a TSL (Terminal Services Licensing)<\/i> Server within your organization. This is a service responsible for generating and assigning Terminal Services client access licenses (TS CALs) to your RDP clients. Licenses must first be acquired and activated from Microsoft using the activation Wizard available with TSL. When the TS Server is activated, a certificate is generated to validate the server\u2019s identity and ownership. This digital certificate will be used in future transactions when more TS CALs will be activated. The Terminal Service Licensing server can issue two types of client access licenses:<\/span><\/p>\n

\u00b7 TS Per Device Cal<\/i> \u2013 the Cal is assigned to devices and computers. The license will allow network devices to connect to the Terminal Server<\/span><\/p>\n

\u00b7 TS Per User Cal<\/i> \u2013 gives a Cal license to a specific user and those credentials can be used to authenticate to the Terminal Server from any machine within your network<\/span><\/p>\n

TS feature allows deploying a Terminal Service Web Access<\/i> Service to allow clients to connect to the TS using a web page rather than accessing it using the local Remote Desktop Services<\/a> client. One requirement of using this feature is that the Server must run Remote Desktop Services<\/i> and IIS (Internet Information Services) <\/i>web server. We will add this feature to our Server when installing Remote Desktop Services.<\/span><\/p>\n

For this demonstration I will be using two Windows Server 2008 R2 machines; one is the Domain Controller<\/i> for my AD<\/i> infrastructure<\/i> and the second one will be used to host Remote Desktop Services<\/i>. Login to the designated Server, open the Server Manager Console<\/i>, navigate to the Roles<\/i> section and press the Add Roles<\/i> button. From the available list select Remote Desktop Services<\/i> and process to the next section:<\/span><\/p>\n

\"Select<\/a><\/p>\n

From the Role Services<\/i> section select Remote Desktop Session Host<\/i>, Remote Desktop Licensing<\/i>, Remote Desktop Web Access<\/i> and click Next<\/i>:<\/span><\/p>\n

\"Select<\/p>\n

From the Authentication Method<\/i> page select Require Network Level Authentication <\/i>and select Per User licensing<\/i> mode:<\/span><\/p>\n

\"Specify<\/a><\/p>\n

You can leave the rest of the settings as default because we can configure those later. Now proceed with the Installation<\/i> and wait until the server is restarted. Log in to your DC and create a new user account using Users and Computers Console. <\/i>Add the user to the Remote Desktop Users<\/i> group. We will use this user to connect to our Remote Desktop Services Server:<\/i><\/span><\/p>\n

\"RDP<\/a><\/p>\n

Open Group Policy Management Console<\/i>, create a new Group Policy<\/i>, link it to your domain and enter editing mode. Navigate to Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment<\/i> and open Allow Log on through Terminal Services policy<\/i>:<\/span><\/p>\n

\"Group<\/a><\/p>\n

Enable this policy by checking Define these policy settings<\/i> and add the Remote Desktop Users<\/i> group. Wait until the policy has been applied or execute gpupdate \/force<\/i> on your TS Server.<\/span><\/p>\n

\"Allow<\/a><\/p>\n

Now let\u2019s try to establish a RDP connection<\/a> to our Remote Desktop Services <\/i>Server. If the connection is not successful, you\u2019ll need to enable RDP on the target machine. Navigate to Control Panel\\System and Security\\System<\/i> and click on Remote settings<\/i> button. Allow Remote Desktop only from computers running Remote Desktop with Network Level Authentication<\/i>:<\/span><\/p>\n

\"Allow<\/a><\/p>\n

Once we\u2019ve tested that the RDP connection is successful, let\u2019s make further configurations to our Terminal Server.<\/span><\/p>\n

From the Administrative Tools<\/i> menu open Remote Desktop Session Host Server Configuration Console<\/i>, right click RDP-Tcp<\/i> and select Properties<\/i>:<\/span><\/p>\n

\"RD<\/a><\/p>\n

There are several things that we can configure in this section, so I will point out only the most important features. From the General<\/i> tab we can configure the Security Layer<\/i> method (we\u2019ll select SSL TLS1.0) and the encryption level<\/i> (set it to high<\/i> so that all traffic is encrypted using the highest encryption key possible):<\/span><\/p>\n

\"RDP-TCP<\/a><\/p>\n

On the Security <\/i>tab we can add Security Groups or Users<\/i> that will be able to interact with the Terminal Server.<\/span><\/p>\n

In the Network<\/i> Adapter<\/i> section we can configure the maximum number of connections allowed per network interface. For this example I\u2019ll configure my TS server to support maximum 10 concurrent connections:<\/span><\/p>\n

\"RDP-TCP<\/a><\/p>\n

In the Remote Control<\/i> settings we can allow System Administrators to interact with user\u2019s sessions. In case they have problems accessing applications or you\u2019ll need to troubleshoot session related stuff, you can configure the TS server to allow you to view<\/i> or interact<\/i> with the user\u2019s session<\/i>:<\/span><\/p>\n

\"RDP-TCP<\/a><\/p>\n

Terminal Services Licensing Server <\/i>can be activated with Microsoft by using the RD Licensing Manager Console <\/i>available in Administrative Tools<\/i>. Once you\u2019ve opened up the console, navigate to your TS Server, right click<\/i> and select Activate Server<\/i>:<\/span><\/p>\n

\"RD<\/a><\/p>\n

You\u2019ll need to follow the activation Wizard and select one of the three activation methods. Note that I haven\u2019t bought TS CALs from Microsoft, so I will not cover that in today\u2019s article.<\/span><\/p>\n

One more thing we need to check out is the Terminal Service Web Access<\/i> feature that we\u2019ve configured during the installation process of our TS Server. Open a browser and navigate to https:\/\/localhost\/RDWeb. The webpage will allow users to connect to your Terminal Server directly without using their local RDP client. Note that you can add a DNS record to point to your TS server so that the webpage is available throughout your organization.<\/span><\/p>\n

\"RD<\/a><\/p>\n

I hope you\u2019ve understood the main principles behind this technology, which I\u2019ve found very useful, so maybe this article will clarify any problems that you may have regarding Terminal Services technology. We haven\u2019t covered Terminal Services Gateway<\/i> feature which allows external clients to connect to your Terminal Server using an encrypted channel provided by a VPN connection. Most deployments of TS Servers are made in the intranet so, you will not need to configure a TSG Server. <\/span><\/p>\n

Don\u2019t forget to rate this article and comment in the discussion section below. Enjoy your day and don\u2019t forget to check out our website for the latest articles!<\/span><\/p>\n

\u00a0<\/p>\n

\"Tweet<\/a><\/p>\n

\"Share<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

In this article we will discuss Terminal Services or Remote Desktop Services available with newer versions of Windows Server. I will describe the main components that make up this technology and we will then install and configure this feature. A Terminal Server is a machine which offers RDP clients a way to connect and access […]<\/p>\n","protected":false},"author":4,"featured_media":2511,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,5,13,9,8],"tags":[],"class_list":["post-2508","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general-it","category-how-to","category-pc-security","category-technical","category-windows"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts\/2508","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/comments?post=2508"}],"version-history":[{"count":5,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts\/2508\/revisions"}],"predecessor-version":[{"id":4238,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts\/2508\/revisions\/4238"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/media\/2511"}],"wp:attachment":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/media?parent=2508"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/categories?post=2508"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/tags?post=2508"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}