Transcript www.nicolaferrini.it
Implementing and Configuring Microsoft
®
Windows Server
®
2008 Terminal Services
Nicola Ferrini
Who Am I ?
Trainer Technical Writer Systems Engineer Server & Application Virtualization Technology Specialist More on: http://www.nicolaferrini.it/curriculum.shtml
http://www.windowserver.it/ChiSiamo/Staff/tabid/71/Default.aspx
Outline
Configuring Terminal Services Core Functionality Configuring and Managing Terminal Services Licensing Configuring and Troubleshooting Terminal Services Connections Configuring Terminal Services RemoteApp and Easy Print Configuring Terminal Services Web Access and Session Broker Configuring and Troubleshooting Terminal Services Gateway Managing and Monitoring Terminal Services
Configuring Terminal Services Core Functionality • Configuring the TS Server Role Service • Configuring the TS Settings
Main Office Terminal Server
Configuring the TS Server Role Service
TS Features Installing the TS Server Role Service Authentication Modes TS Core Functionality Remote Desktop Connection 6.1
Remote Desktop Connection Display Remote Desktop Experience Device Redirection Introduction to a Standalone Instance and a Farm Standalone Instance vs. Farm
TS Features
TS in Microsoft Windows Server® 2008 provides the following features:
• Support for Remote Desktop Protocol (RDP) over Hypertext Transfer Protocol over Secure Socket Layer (HTTPS) • Support for spanning of display • Improved printing with TS Easy Print • Enhanced security features • Improved management and scalability features • Support for Microsoft® Internet Protocol version 6 (IPv6) • Support for presentation virtualization technology
Installing the TS Server Role Service
1.
Use the Server Manager to install the TS server role service 2.
Install the programs that need to be hosted on the terminal server 3.
Configure the remote connection settings to enable users and groups to connect to TS
1 2 TS Server Role Service 3 Server Manager
Authentication Modes
Password SSL/TLS Certificate Smart card One-Time Password Terminal Server Kerberos
TS Core Functionality
• RDC 6.1
• RDC Display • Plug and Play (PnP) device redirection for media players and digital cameras • Embedded Point of Service (POS) • Single Sign-On (SSO) for domain joined clients
Remote Desktop Connection 6.1
RDC 6.1
RDP 6.1
Remote Desktop Terminal Server
Remote Desktop Connection Display
Supports:
• High resolution desktops • Spanning multiple displays
1680x1050
Device Redirection
On Windows 2008 terminal server, you can configure the redirection of portable devices, such as:
• Media players based on Media Transfer Protocol (MTP) • Digital cameras based on Picture Transfer Protocol (PTP)
PTP POS
Configuring the TS Settings
Configuring ‘Start Program on Connection’ Restricting Remote Connection Sessions Configuring Other TS Settings
Configuring and Managing Terminal Services Licensing Configuring TS Licensing Managing TS Licenses
Main office
Configuring TS Licensing
TS Licensing Role TS Licensing Manager Snap-In TS Client Access Licenses Installing the TS Licensing Role Service Configuring the Terminal Server for Licensing
TS Licensing Role
The TS licensing role:
• Has minimum impact on the performance of the server on which it is installed • Can be centrally administered • Tracks all license issuances • Supports secure communication
TS Licensing Manager Snap-In
You can use the TS Licensing Manager snap-in to:
• Determine the availability of TS CALs • Discover a license server • Install the TS CALs on the TS license server • Generate reports • Confirm the location of the TS licensing database
TS Client Access Licenses
TS Per Device CALs 1 Connects 2 Requests License 4 Delivers License 3 Terminal Server License Server 1 Connects TS Per User CALs 2 Requests License Active Directory Domain Services 4 Stores License Terminal Server 3 License Server
Installing the TS Licensing Role Service
Steps for installing the TS licensing role service:
1.
Install the TS licensing role service 2.
Activate the license server via the Internet, Web browser, or telephone 3.
Install the TS CALs by using the Install Licenses Wizard in the TS Licensing Manager snap-in
TS Licensing Manager Snap-In
Configuring the Terminal Server for Licensing
You need to specify the following:
• TS licensing mode • License server discovery mode
Lab: Installing the TS Server Role
Exercise 1 : Install the TS Server Role and Licensing Role Service
Configuring and Troubleshooting Terminal Services Connections Configuring the TS Connection Properties Configuring the TS Connection Properties by Using Group Policy Troubleshooting TS Connections
Terminal Server Main office
Configuring the TS Connection Properties
Introduction to TS Properties Introduction to the TS Connection Properties Configuring the Maximum Number of Simultaneous Connections Demonstration: Configuring the Time-Out and Reconnection Settings Configuring Authentication and Encryption Configuring the Desktop Experience Configuring the Plug and Play Device Redirection Framework
Introduction to TS Properties
Configure Connection Properties Device and Resource Redirection Remote Session Environments Session Time Limits Profiles
Configuring the Plug and Play Device Redirection Framework
The Plug and Play (PnP) device redirection framework:
• Is enabled by the .rdp file created by the RemoteApp Wizard • Is automatically installed when the session on the remote computer is launched • Displays notifications on the taskbar of the remote computer
Configuring the TS Connection Properties by Using Group Policy
Using Group Policy to Configure the TS Connection Properties Introduction to Single Sign-On Considerations for Configuring Single Sign-On
Using Group Policy to Configure the TS Connection Properties
By using Group Policy, you can configure the following connection properties:
• Maximum number of sessions that can connect to the server • Client connection encryption level • Automatic start program on a user logon • Enable and disable remote control • Time-out and reconnection • Client settings such as connecting drives and printers, mapping client devices, and limiting the maximum color depth
Introduction to Single Sign-On
SSO has the following key features:
● Using SSO, users are not required to enter credentials each time they log on to a remote session ● SSO can be deployed in Line of Business (LOB) and centralized applications ● SSO facilitates low maintenance costs ● Users can also attain SSO by using Active Directory
Multiple Logons with Single Credential
Considerations for Configuring Single Sign-On
SSO can be used:
• For an RDC connection from a Microsoft Windows Vista® based-computer to a Microsoft Windows® 2008 Server-based TS • For an RDC connection from a Microsoft Windows 2008-based server to a Microsoft Windows 2008 Server-based TS • By users who have appropriate rights to log on to both TS and Windows Vista client • On the client computers and terminal server that are part of a domain
Windows Vista Terminal Server Terminal Server
Configuring Terminal Services RemoteApp and Easy Print Installing Applications Configuring RemoteApp Programs Configuring Printers
Main office Application Remote Application Printer
Configuring RemoteApp Programs
Introduction to TS RemoteApp Programs Advantages of Using RemoteApp Programs Methods for Deploying RemoteApp Programs Using TS Web Access to Deploy RemoteApp Programs Considerations for Connecting to TS Web Access Demonstration: Using an MSI File to Deploy RemoteApp Programs
RemoteApp integrates with the Windows Desktop
Introduction to TS RemoteApp Programs
A RemoteApp™ program on a terminal server:
• Can be accessed remotely through TS • Displays on the client as if it is running on the local computer • Has its own resizable window and entry on the taskbar of a client desktop • Can run along with local programs on the client computer • Can share a TS session with another RemoteApp program on the same terminal server
Advantages of Using RemoteApp Programs
Using RemoteApp programs:
• Centralizes and minimizes administration • Enhances experience for users who securely access remote programs • Is useful in environments where users do not have computers assigned to them • Helps deploy multiple versions of an application without conflicts • Causes minimum problems while running different programs on multiple desktops
Methods for Deploying RemoteApp Programs
TS Web Access .msi
.rdp
Using TS Web Access to Deploy RemoteApp Programs
To deploy RemoteApp programs by using TS Web Access:
1.
Configure the settings on the terminal server 2.
Add the programs to the RemoteApp Programs list 3.
Configure the global deployment settings that apply to all programs in the list 4.
Install the TS Web Access role service 5.
Populate the TS Web Access Computers security group 6.
Specify the terminal server from which to populate the list of RemoteApp programs
Considerations for Connecting to TS Web Access
To connect to TS Web Access, the client computer must:
• Run Windows Server® 2008, Windows Vista® with SP1, or Windows® XP SP3 • Have the TS ActiveX client control approved by a standard user
Demonstration: Using an MSI File to Deploy RemoteApp Programs
In this demonstration, you will deploy RemoteApp programs by using a .msi file
Lab: Implementing TS RemoteApp
Install TS RemoteApp Role Service Add a program to the Allow list Publish an application trough RDP file Create a MSI file that installs an application Using RemoteApp Access
Configuring Printers
TS Easy Print Considerations for Using TS Easy Print Configuring Group Policy for Printer Redirection
TS Easy Print
TS Easy Print allows users to print:
• From RemoteApp programs and Remote Desktop sessions • To any client side printer with a printer driver loaded on the client machine
TS Easy Print has the following setting in Group Policy:
• Redirect only the default client printer in TS sessions
Considerations for Using TS Easy Print
To use TS Easy Print, clients must have:
• Windows Vista SP1 or Windows XP SP3
If the client computers do not support TS Easy Print:
• Ensure that local and network client printer drivers are installed on the terminal server • Add the local and network client printer drivers to a custom printer mapping file on the terminal server
Configuring Group Policy for Printer Redirection
Configure the following Group Policy settings:
• Use Terminal Services Easy “Print driver first” • Redirect only the default client printer
Configuring Terminal Services Web Access and Session Broker • Installing TS Web Access • Configuring TS Session Broker
Woodgrove Bank
Introduction to TS Web Access
TS Web Access is a role service that allows you to start RemoteApp™ programs without the need to download or run .msi or .rdp files
What's Different in Windows Server 2008 TS Web Access?
TS Web Access in Microsoft Windows Server® 2008:
• Does not require the Remote Desktop Connection (RDC) client to be manually started for launching a RemoteApp program • Allows you to run applications on a remote computer • Enables you to access RemoteApp programs seamlessly • Does not require a separate ActiveX control to be downloaded
Considerations for Installing TS Web Access
Consider the following points:
• Installation of TS Web Access will automatically install the required Microsoft® Internet Information Services (IIS) 7.0 components • The TS Web Access server need not be a terminal server • Client computers must be running RDC 6.1
• A standard user can approve an ActiveX Control
Installing and Configuring RemoteApp Programs by Using TS Web Access
To install RemoteApp programs:
1.
Configure RemoteApp programs on one or more terminal servers 2.
Enable RemoteApp programs for TS Web Access 3.
Install TS Web Access on the server 4.
Add the computer running TS Web Access server to the TS Web Access computers group on the terminal server 5.
Specify the terminal server or farm from which to populate the list of RemoteApp programs
User Terminal Server
Connecting to Remote Desktop Web by Using TS Web Access
Remote Desktop Web connection:
• Is available as a Remote Desktop tab on the TS Web Access page • Is installed as part of the TS Web Access role service • Provides features that can be controlled by the administrator • Supports Microsoft Windows® XP and Microsoft Windows® Server 2003
Introduction to TS Session Broker
TS Session Broker:
• Provides load balancing features and distributes connections across multiple servers • Provides fault tolerance features • Stores the following information: Session Ids Sessions’ associated user names Names of servers on which each session is started
Prerequisites for Configuring TS Session Broker
System requirements for configuring TS Session Broker load balancing:
• The terminal servers in the farm and the TS Session Broker server should be running Windows Server 2008 • All the terminal servers in the farm should have the same programs • Clients should have RDC 5.1, RDC 6.0, or RDC 6.1
• The server on which TS Session Broker will be installed should be a member of a domain • All servers should be running the same versions of Windows x86 or Windows x64
Lab: Implementing TS Web Access
Install TS Web Access Role Service Connect to TS Web Access and launch application
Introduction to TS Gateway
Requirements for TS Gateway
TS Gateway requires the following role services and features to be installed and functioning:
• Remote procedure call (RPC) over HTTP Proxy • Microsoft® Internet Information Server (IIS) 7.0 for the RPC over HTTP Proxy service to function • Local or remote Microsoft Windows® Server 2008 Network Policy Server (NPS)
Configuring TS Gateway
Steps:
1.
Obtain a certificate from a third party, such as Verisign, or from a corporate certificate authority (CA), or use a self-signed certificate 2.
Add the TS Gateway Manager snap-in 3.
Install the certificate on the TS Gateway server 4.
Map the TS Gateway server certificate 5.
View the certificate properties 6.
Establish trust with a client
Obtaining Certificates
Methods for obtaining a certificate:
• Using Auto-enrollment in the Certificates snap-in • Requesting certificates by using the Certificate Request Wizard • Requesting a certificate on the Web • Using the Certreq command
TS Connection Authorization Policies
User Group TS CAPs TS Gateway Server Computer Group
TS Resource Authorization Policies
Computer Group TS RAPs TS Gateway Server
Lab: Implementing TS Gateway
Install the TS Gateway Role Service Create and map a certificate for the TS Gateway Server Map a certificate for a different TS Gateway Server Create a Connection Authorization Policy (CAP) Create a Resource Authorization Policy (RAP) Configure Remote Desktop connection settings on the Client Computer
Managing the TS Connections
Log Off a TS Connection Control a User Session Remotely Disconnect a TS Connection Reset a Disconnected Session
Monitoring the TS Connections
Monitoring Tool
TS Gateway Manager Snap-In
Used to Monitor
• Connection status • Health • Events TS RemoteApp Programs Performance and Reliability monitor Microsoft System Center Operation Manager 2007 Windows Event Viewer System Connections Microsoft® Internet Security and Acceleration (ISA) Server Best Practices Analyzer TS Web Access outbound traffic
Introduction to Windows System Resource Manager
WSRM:
• Is a resource manager in a TS environment • Allows you to manage CPU and memory utilization by applications, services, and processes • Uses standard or custom resource policies
WSRM Memory CPU Printer Applications
Features of Windows System Resource Manager
WSRM:
• Can use preconfigured policies or create custom policies to allocate resources per process, user, and IIS application pool • Can use calendar rules to automatically apply policies at different times • Can select appropriate resource policies based on: Server properties Events Changes in physical memory Available processors • Can collect resource usage data locally or in a SQL database
Configuring Windows System Resource Manager • WSRM uses resource allocation policies to determine the performance of CPU resources, memory, and processes • You can configure the following resource allocation policies on the terminal server: Equal_Per_User Equal_Per_Session
Lab: Using Windows System Resource Manager (optional) Implement a Windows Resource Manager Policy