Why is group policy to attach/ map the current local drive to the terminal server environemnt not allowing everyone to have shared network drive attached to it via the MSTSC? That's my first question. That is something that is most liley fixable. personally it is the coorect thing to do not allow this access. Do you really want people to be able to transfer between their home PC and The TS? That would cause a HUGE security hole.
I would look into RDS, the cost isn't too bad. Personally, we use a Citrix Web interface with SSl to access or RDS (well Citrix) servers. i'm Sure you can set up SSL access to your RDS server, and allow users to log in and work just like they would in the office.
From Experts Exchange
Apologies for the delay getting back to you. Had issues with our RemoteApp implementation to contend with the past couple of days! I've since learned not to have NAP healthchecking enabled on your RD Gateway RD CAP store settings if you don't have health policies configured in NPS, and to make sure a valid proxy (all our Internet browsing is out on a proxy) is set via netsh winhttp set proxy. Otherwise remote connections through RD Gateway to RemoteApps take nearly a minute and a half to fire up.
>> You say that even without a certificate (which I will get anyways), it is protected via SSL?
It will be protected by its default self-signed certificate, but you don't want to use that in the long run, because it causes no end of warning boxes to users trying to launch your apps.
Instead, I'd suggest you buy a SAN/UCC certificate from somewhere like GoDaddy which includes all the following names:
- Internal names (servername.domain.local) of all your RD Session Host servers
- External address of your RD Gateway (i.e. rdp.domain.com)
- External address for accessing RD Web Access if different to RD Gateway
- If you're using a connection broker or have your servers in a RD Server Farm (from your original question you are not, but just throwing this in here for completeness), then you will need to take that into consideration and include names of the farm instead.
Using a valid certificate means the connections should proceed with minimal scary messages to end users, and it also means RemoteApps are signed with the certificate as originating from you, so you are less restricted by RD Web's strict SSO requirements. I've had issues with running systems in production without third-party SSL certificates in the past, like users who become trained to ignore the "this certificate is invalid" warnings whenever they see them (at any website). Not good practice, so I'm glad you're getting a commercial one!
Since you're installing a single box, like me, I suspect you will just be using two names - the internal name and the external name.
>> I suppose I could even go as far as limiting access by THEIR public IP address on the firewall, no?
Yes. If your firewall is up to it, you can restrict inbound connections on port 443 to the RD Gateway to their public IP. No problems there.
I would also suggest you configure stringent RD Resource Authorisation Policies. Put the Session Host server in its own group, and then on the resource policy for the group of remote users, set the "Network Resource" so they can only access the security group for Session Host servers.
This way they can only get to the Terminal Server, and can't try to pick holes in your network to remote desktop into other workstations or servers they don't need access to.
>> Is there a way to make it so that once they log into RDS, that's it for domain credentials....No more prompts until asked to log onto the webpage?
You're talking about RemoteApp SSO (single-sign on) there. It is possible - I now have this working on our deployment - but you need the commercial certificate installed to do it. The commercial certificate is there to "sign" your RemoteApp packages as originating from you, which adds that degree of trust and allows the RDWeb credentials to be passed on automatically.
Once you've got your certificate installed, you want to configure it in the following places:
- RD Gateway server properties
- RemoteApp manager - Digital Signature settings
When the certificate is set for RD Gateway, RD Web Access should work with it too.
Here's a blog post from Microsoft which is very useful in explaining SSO in more detail: http://blogs.msdn.com/b/rds/archive/2009/08/11/introducing-web-single-sign-on-for-remoteapp-and-desktop-connections.aspx.
>> If they click on a link (.pdf, .doc, etc...) inside this webpage, is there a way to have it open up in the application on the RDS server
That should be the behaviour it exhibits. It shouldn't launch using the version on the user's local machine because all that is being transmitted back to the user is the graphic of the screen at the session host server - minus the Windows Shell / Desktop / Start Menu. I just ran a report from the database package we're running via RemoteApp and it uses the version of Word on the server to display it at my workstation (2010 on my box, 2007 on the server, so I can see the difference). I'm not so sure you should even be seeing that behaviour.
-Matt