In RD Licensing Diagnoser on Server 2016, I get a message that the licensing mode for the Remote Desktop Session Host server is not configured. How does one set this. I cannot find the "RD Session Host Configuration Tool" like I we have used in the past with Windows Server 2008 R2 to accomplish this task.

Thanks
NK

We have a Windows 2008 R2 Terminal Server licensing Server in our environment. When checking the issued CALs in Remote desktop Licensing manager, i see Windows 2000 Server - Built-in TS Per Device CALs. I believe these are CALs which are issued by the Windows 2000 terminal Server itself to the Device or client. 

My question is:

1. Is there a way to find out which Terminal Server is issuing the CALs or can we revoke the licenses?

2. Can we stop Issuing Windows 2000 Server TS CALs?

 Help in this regards is much appreciated 

Thank You

So we have a few 2012 R2 Terminal Servers at my company that were working fine until we started the process of replacing our Domain Controllers with new Windows 2016 Servers.

Since then our users are getting intermittent "Access Denied" errors when they try to RDP to these terminal servers.

Generally the "Access Denied" error occurs when a terminal servers starts to use one of the newly added 2016 domain controllers. We can workaround the problem by sending an command telling the terminal server to use one of the older 2012 R2 domain controllers instead. Then things work again.

So the question:

Is there a misconfiguration with the new 2016 domain controllers or can an adjustment be made with the 2012 Terminal Servers?

Is the problem that Windows 2016 Domain Controllers are not compatible with 2012 R2 Remote Desktop Services servers?

We are having problems finding documentation on this.

What we do know is that if we decide to start upgrading to new 2016 Terminal Servers we will have to purchase new 2016 RDS Cals (not sure if we are budgeted for that...)

For those interested, you can find out the domain controller you are using by running the following elevated PowerShell command (this assumes the command is run remotely as you might be locked out due to the RDP access denied error):

nltest /Server:<your-terminal-server> /DSGETDC:<ad domain>

to specify the domain controller you want to be on (in our case we want to switch to back to a 2012 R2 domain controller), the command is:

nltest /Server:<your-terminal-server> /SC_RESET:<ad domain>\<specific domain controller>

I assumed its the 25 alpha of the OS of a connecting user, but all that i attempt to input fail.

Is it looking for another 25 alpha other than OS, connecting computers are win 7 pro and windows 10.

Server is setup in a workgroup.

When purchased on the last workgroup server in open volume licensing we received one 7  5 alpha character code and the remote desktop licensing accepts that license.

 Any input appreciated

I have a client that is on a single 2012 rds server now in azure using remote apps internally and externally.

We'd like to do two 2016 servers for more redundancy.  Is it possible to install the gateway/connection broker/web/session host roles on both servers and configure for high availability?  Otherwise could we do 2 session hosts and 1 server with the gateway/connection broker/web services on it.  A lot of the examples show 4,6 or more servers but they do not want to pay for that.  Just looking for some ideas here, thanks!

Dear All,

We are planning to deploy Windows 2016 RDS infrastructure. does Windows 2016 RDS support windows 2008 RD sessions?

Hi Everyone. We have a published app problem that occurs only under Windows 10. The app has been published from a Server 2012 R2 terminal services environment. The issue presents itself as a failure for the published app to redraw its screen after the user shifts focus to another application and then swaps back again.

Initially the fault presented itself as a Z order display issue, i.e. any dialogue boxes would display behind the published apps foreground / main interface. Clicking on the applications icon in the system tray would cause the dialogue box to come to the foreground. After hours of fault finding, I managed to fix that issue by disabling "Use advanced RemoteFx graphics for RemoteApp" on the Server 2012 R2 Terminal Server using gpedit.msc (in Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Remote Session Environment). I was happy and all seemed fine, but...

Now the fault presents itself as a complete failure to redraw the foreground. This happens after the user has swapped focus from the published app to another app and back again a few times. It does not happen immediately. The app focus is there, as you can still click menu items etc (fun when their location is not drawn) and they will behave normally (i.e. redraw occurs over the display area of the drop-down menu for example). The only way to fix this is to exit the published app and relaunch. It will then work for a while and then the fault repeats.

This issue does not happen in a full terminal services session, only if the app is run as a published app.

If anyone has any ideas to resolve this it would be much appreciated.

Hi,

We've recently moved a client's cloud server to a new data center. The process involved making a backup of the VM in the old environment, and restoring the VM in the new data center environment. This server runs the Remote Desktop Services role on Windows Server 2012 R2.

The migration seemed to go smooth, and the end-users can access their applications using RemoteApp, from any remote location. This particular client has a technical contact, who uses Server Manager on her Windows 10 PC to disconnect users from RDS as and when she needs to.

For some reason, since the migration, if we open Server Manager on the server itself, or on the technical contacts PC, we receive the infamous message:

The following servers in this deployment are not part of the server pool: 
1. [server_name] 
The servers must be added to the server pool.

The thing is, the server IS in fact visible in the list of Servers in Server Manager. I've tried re-adding it using the AD search, using the IP address in the DNS search, and even using the FQDN in the DNS search. All it seems to do is add another instance of the same server to the list of servers, but the above message is persistent and RDS can't be managed from Server Manager.

Has anyone seen this type of odd behavior before?

Hi Tech Support,

i cant able to connect to remote for other systems, im using windows 10 OS but we are facing this issue hence after windows updated, im sure this issue is because of windows update,  Please find below error & please support me on this, 



An authentication error has occured

the function requested is not supported

Remote computer 192.168.0.44

this would be due to credSSp encryption oracle remidiation.

for more information, see https://go.microsoft.com/fwlink/?linkid=866660

i hope i will get the exact solution, waiting for the reply

Thanks in Advance

Regards

ILIYAZ

We were running a Windows 2008 RDS server which had licenses just as old.

The licensing server crashed and we had to reinstall onto another server.

Before this, with 50 licenses, any random 50 devices could remote in.

There was no revoking necessary, and it never permanently assigned a license to someone's machine.

It would stop that 51st person from logging in simultaneously, but it didn't permanently assign a license to a machine where someone else couldn't log in for lack of licensing when less than the max were concurrently running.

Now, the first 50 people that have logged in are the only devices that can, and some of those devices are home machines, or personal mobile devices (like android and iPad tablets).

Did we install the licensing server incorrectly to make such a thing occur, or is this the way it is?

We need to be able to allow the number of users that we have licenses for to use remote access, and not simply the first 50 that got the 50 licenses.

Is there a way or type of license that allows this?

Is there a way to shorten the expiration time so that devices we can't control do not get licensing.

It is not possible to control what device a user uses to access remote services without adding other layers to the network that defeat our business requirements.

Any help would be appreciated.

Alert from Microsoft Forum

I have an external user who connects to a remote app via RdWeb. They had no issue until last week and no changes were made on the terminal servers.

THE ISSUE:

When they launch the remote app, the user gets a black screen if you click details. They can RDP to the server fine (using the Connect to another PC tab in IE).

The mstsc.exe process has to be killed via Task Manager. 

Another user in their office is having no issues.

Things I have tried:

1. Had the user with issues try from the PC of the user without issues. Same problem.

2. Had the user connect to 3 instances of this remote app in 3 different collections. 1 uses User Profile disks. 1 does not and sits on the same network as the previous. 1 does not use profile disks and sits in our DMZ. The user can get a successful connection from the server in the DMZ but the speed is an issue. 

3. Looked for a profile disk for the user on the network share and there was none (the user is in our Guest child domain which is not a 2 way trust), there was no profile disk, but there WAS a profile with the username and .backup on the actual terminal server.

4. Deleted the local user profile on the both internal servers and had the user try again. Same result.

5. Had the user RDP to the server and launch the app and it worked without issue. 

I am thinking it is related to the user's terminal server profile because the issue is repeatable from another user's workstation. However, the user is able to RDP to any of the terminal servers and work fine. 

The difference in the server in the DMZ and the internal servers is that the server in the DMZ uses a different encryption/compression policy. The internal policy forces the encryption level to "low", does not use an encryption algorithm and is set to not require NLA. The server in the DMZ was specifically created with a different encryption policy to resolve a previous issue with external users getting a black screen to the internal servers. The internal servers go through a Cisco WAAS in some cases and the internal policy was set to the recommendations for this setup. 

Keep in mind though, that everything worked fine last week and everything still works fine for everyone except this single user.

Any insight or steps for further troubleshooting would be appreciated.

Hi everybody,

I use a program calleed Acombat in remoteapp and it's use mapi to send email.

I get the popup of outlook 2013 open for send email without program and got no error while sending email.

I discovered that email did't reach destination and then I opened outlook 2013 in remoteapp and I seen all unsend email there.

Immediatly when I opened it they starting sending automaticly.

Each time it do the same thing, they stay theyre until I open outlook in remote app and opening send folder.

Not it's not a send folder like a folder for email already send, it's a folder that seem for email about to be send...

It's in french so I can't translate name of the folder but it's maybe you will understand where they was.

When I open this send folder I did't see email content but a list of them.

Thanks for your help.

Hi there,

I have setup a client site with a Server 2012 RDS with 5 CALs. They are being hit with the 2 users limit and a third connection is required to 'select a user to disconnect so you can logon'. 5 valid device CALs are installed. Event logs are clear, TS Licence Manager reports 5 CALS are active, any suggestions?

Screenshots attached of the installed licensing server and CALS.

Thank you

Hi All,

         Fairly experienced at putting in RDS farms for 5-1000 users.

Recently, we have had a client come to us asking for assistance with an RDS farm for 10000+ users.

This post is just on the off chance that someone else out there has deployed an RDS farm of this size (or larger) and can advise if they are (or even better, are not) any pitfalls that only effect farms of this size ?

Hi,

We have a RDS server ( Windows Server 2012 ) connected to a DC controller ( Windows 2016 ) : frequently users can't login because domain can't be reached.

We already pushed the server in the domain again but problem remains, the events logged are

- 36887 schannel

- 1061 : remote desktop session host server was unable to retrieve users licensing information from AD. Error 0x8007054b

- 5719 NETLOGON

After sometime ... adn without changes users can login again.

What could the problem be and how could we solve that ?

Best regards

Dirk

Hi Guys,

I have been trying to find a article that clearly describes best practices  on how to patch VDI Gold images.

Naturally we do not want to have to update the gold image every Tuesday and rebuild all images. 

My understanding is that we just need to patch the Clone images using normal process. EG WSUS and patch deployment program. (We do not have SCCM at the moment.)

This would keep the clone gold images updated. 

We would also need to update the Gold image so that when we rebuild any desktop it would include all the patches. 

If we want to install a new app or change version we would need to update the gold image then rebuild all clone images. 

Can someone confirm this for me, or give me more information?

Thanks for your time.

Craig 

Craig

I am looking for a way to use a single RD Web Access page to connect to different Collections. Here is what I have.

Session Collection 1 - Application published using farm webapp.domain.com (Five servers)
Session Collection 2 - Remote Desktop published using farm rds01.domain.com (Five servers)
Session Collection 3 - Remote Desktop published using farm rds02.domain.com (Five servers)

Each farm has a different use case and applications, hence the three farms. But I would like users to access any of them by logging into https://web.domain.com/RDWeb.

The farms are using round robin DNS, which could be part of the problem. I did this so if you use mstsc, the computer name points to rds01 which has an A record to all five servers.

The other potential problem could be that I used Set-RDPublishedName on the Connection Broker and changed the name to webapp.domain.com. I did this so the wildcard SSL certificate didn't issue any warnings.

It appears that the published name on the Connection Broker is what the Web Access server uses to launch everything. So instead of Remote Desktop going to RDS01 or RDS02, everything redirects to webapp. If what I am trying to do is possible, what do I need to change?

Hello,

I'm using freerdp to check RDP availability of a Win10 virtual machine running under Proxmox 5.2 (kvm). The command used is:

/usr/bin/xfreerdp /cert-ignore /auth-only /u:$USER /p:$PASS /v:$HOST

Every time this command is launched, the svchost.exe process related to "TermService" grows around 8MB in its "private bytes" memory. That amount is reduced to around 5MB if you set the display size in freerdp to 1x1 (/size:1x1). That memory is never returned to the system and in a few days some messages related to "resource exhaustion" are logged and eventually RDP stops working. At that time, that svchost.exe process has more than 10GB of "private bytes" (VM has 20GB total memory). Win10 needs to be restarted for RDP to work again, as restarting TermServices service does not help.

Adding memory or a bigger pagefile to the VM only delays the time when RDP stops working, it will eventually fail anyway.

I dont know if this is caused by FreeRDP shutting down the connection without notifying the RDP Server properly or if it is a Windows issue or a configuration issue. It's very easy to create a DoS to a Win10 Pro RDP
server if you have valid credentials. I haven't tested any other Windows version nor any other virtualization environment. Luckly, it doesn't happend if you dont have valid credentials.

Please, give it a look to find out what could be causing this behaviour.
Thanks a lot

Hello hoping someone has a quick answer. I have a 2012 R2 server I installed RDS on. After I installed RDS I attempted to configure a collection. I install the collection with pretty basic settings. I give it a collection name, I add the local server to the server pool ( its the only option) I remove the domain user group and add domain admin to the "User Groups". I unchecked user profile disks because its not required. I then hit create. It does its thing and comes back with the error " Unable to configure the RD Session Host server <SERVER / FQDN> Invalid operation.

When I hit close the collection is there. I have not been further than this to test anything. There is another issue. After I add the RDS role and do this. When I attempt to RDP back to the same server I can no longer RDP. I get an error the server refused the connection. When I remove the RDS role I can remote back to the device.  

I did find this article ( https://support.microsoft.com/en-us/help/3014614/you-cannot-create-a-session-collection-and-an-error-occurs-in-windows ). This did not help.  Any thoughts would be great.