Configuration du SSO sur une ferme RDS (Windows Server 2012/2016/2019)

#Pré-requis:

Certificat SSL public ou CA Interne avec le même nom partout (RD Web, gateway)

#Configuration sur le Broker

Renommer l’URL du RD Web pour matcher le certificat

Script: https://gallery.technet.microsoft.com/Change-published-FQDN-for-2a029b80

Set-RDPublishedName « remote.contoso.com »

Modifier les 2 fichiers suivants:

C:\windows\Web\RDWeb\Pages\Web.config

Ligne 71:

      <authentication mode= »Windows »/>

     

      <!–

      authentication mode= »Forms »>

          <forms loginUrl= »default.aspx » name= »TSWAAuthHttpOnlyCookie » protection= »All » requireSSL= »true » />

      </authentication> –>

      <webParts>

          <personalization defaultProvider= »TSPortalProvider »>

            <providers>

              <add name= »TSPortalProvider » type= »Microsoft.TerminalServices.Publishing.Portal.TSPortalProvider »/>

          </providers>

          <authorization>

              <allow users= »* » verbs= »enterSharedScope »>

              </allow>

          </authorization>

        </personalization>

      </webParts>

      <httpRuntime targetFramework= »4.5″ />

  </system.web>

  <system.webServer>

    <handlers>

        <add name= »PagesWebFeedHandler » path= »WebFeed.aspx » verb= »* » type= »Microsoft.TerminalServices.Publishing.Portal.PagesWebFeedHandler » preCondition= »integratedMode »/>

    </handlers>

    <!–modules runAllManagedModulesForAllRequests= »true »>

      <remove name= »FormsAuthentication » />

      <add name= »RDWAFormsAuthenticationModule » type= »Microsoft.TerminalServices.Publishing.Portal.FormAuthentication.TSDomainFormsAuthentication » />

    </modules> –>

    <!–security>

   

        <authentication>

            <windowsAuthentication enabled= »false » />

            <anonymousAuthentication enabled= »true » />

        </authentication>

    </security> –>

   

    <httpRedirect enabled= »false » />

  </system.webServer>

Et le fichier c:\Window\Web\RDWeb\pages\en-us\default.aspx

// Page Variables

    //

    public string sHelpSourceServer, sLocalHelp, sRDCInstallUrl, strWorkspaceName;

    public Uri baseUrl, stylesheetUrl, renderFailCssUrl;

    public bool bShowPublicCheckBox = false, bPrivateMode = true, bRTL = false;

# Faire une GPO avec les paramètres suivants:

Computer\Policies\Administrative Templates\System\Credential delegation

Allow delegating default credential

TERMSRV/rdsgw.domaine.com

TERMSRV/srv-rds1.domaine.local

TERMSRV/srv-rds2.domaine.local

TERMSRV/srv-broker.domaine.local

Allow delegating default credentials with NTLM-only server authentication

TERMSRV/rdgw.domaine.com

TERMSRV/srv-broker.domaine.local

Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone

Logon options

Automatic logon with current username and password

Specify SHA1 thumbprints of certificates representing trusted .rdp publishers	Enabled
Comma-separated list of SHA1 trusted certificate thumbprints: DGFHFGHQM34552WFXV2121212QQ33

>> pour récuperer l’empreinte, sur le broker faire en powershell

Get-Childitem CERT:\LocalMachine\My

 

user\Windows Components/Remote Desktop Services/RD Gateway

Set RD Gateway authentication method

Use locally logged-on credentials

# Faire une GPO pour publier les remote app dans le menu démarrer (windows 8 et ultérieur)

User\policies\Windows Components/Remote Desktop Services/RemoteApp and Desktop Connections

Default connection URL:

https://rdgw.domaine.com/rdweb/Feed/webfeed.aspx

​

​#Modifier le nom du Work Resource

Sur le Broker:

Set-RDWorkspace -name « My Apps » -ConnectionBroker « srv-broker.domaine.local »​

How to Configure Office 365 SMTP Relay

via How to Configure Office 365 SMTP Relay – Blog by Raihan Al-Beruni

SDelete v1.51

SDelete implémente la norme de suppression et de nettoyage DOD 5220.22-M du ministère de la Défense des États-Unis, ce qui garantit qu’une fois supprimées avec SDelete, les données de vos fichiers ne peuvent plus être récupérées.

Source : SDelete v1.51

Managing PST Import-Export process in Exchange Server 2013 (Part 2) – TechGenix

In this article, the author covers how to import and export PSTs using Exchange Management PowerShell.

Source : Managing PST Import-Export process in Exchange Server 2013 (Part 2) – TechGenix

Uninstalling WSUS on Primary Site server causing HTTP Error 500 – CCMEXEC.COM – Enterprise Mobility

Source : Uninstalling WSUS on Primary Site server causing HTTP Error 500 – CCMEXEC.COM – Enterprise Mobility

TechNet PowerShell Function to create home folder for AD Users (Set-ADUserHomeFolder)

Set-ADUserHomeFolder Function creates a home folder for specified AD users. The function also grants each user Full Control Permision to the user’s  folder and configures the folder to map via a specified drive letter. Users will not have access to other users folders############

Source : TechNet PowerShell Function to create home folder for AD Users (Set-ADUserHomeFolder)

Remove TAPI3Directory when migrating from Windows Server 2003 to 2008 and up – MILOSZENGEL.com

First login to the old 2003 and open command prompt, then type:

tapicfg show

you will get something like:

SCP  = TAPI3Directory.domain.local (Default) on domain controller 2003.dc.local

Next step is to delete the partition, type:

tapicfg remove /Directory:TAPI3Directory.domain.local /Server:2003.dc.local

Source : Remove TAPI3Directory when migrating from Windows Server 2003 to 2008 and up – MILOSZENGEL.com

Exchange E-mail Addresses and the Outlook Address Cache – Simple Talk

Because Exchange auto-complete cache uses X.500 addresses for e-mail sent to addresses within the Exchange organization, it will bounce back messages from a re-created mailbox even after you give the user account all the old SMTP addresses. This is because the old X.500 address in the auto-complete cache is missing, and this causes Exchange to reject the messages. Ben Lye explains how to solve this common problem.

Source : Exchange E-mail Addresses and the Outlook Address Cache – Simple Talk

Step-By-Step: Changing The UPN Suffix For An Entire Domain Via PowerShell – CANITPRO

Import-Module ActiveDirectory$oldSuffix = « canitpro.local »$newSuffix = « rebeladmin.com »$ou = « DC=canitpro,DC=local »$server = « DCM1″Get-ADUser -SearchBase $ou -filter * | ForEach-Object {$newUpn = $_.UserPrincipalName.Replace($oldSuffix,$newSuffix)$_ | Set-ADUser -server $server -UserPrincipalName $newUpn}

Source : Step-By-Step: Changing The UPN Suffix For An Entire Domain Via PowerShell – CANITPRO

How to: Disk Cleanup in Windows Server 2012 (R2) – DISM – Windows Server – Sysadmins of the North

Regain used disk space with DISMDeployment Image Servicing and Management (DISM) is a command-line tool that allows you to install, uninstall, configure, and update Windows features, packages, drivers, and international settings. The /Cleanup-Image parameter of dism.exe provides advanced users more options to further reduce the size of the WinSxS folder.

Source : How to: Disk Cleanup in Windows Server 2012 (R2) – DISM – Windows Server – Sysadmins of the North