Configuration du SSO sur une ferme RDS (Windows Server 2012/2016/2019)

#Pré-requis:

Certificat SSL public ou CA Interne avec le même nom partout (RD Web, gateway)

#Configuration sur le Broker

Renommer l’URL du RD Web pour matcher le certificat

Script: https://gallery.technet.microsoft.com/Change-published-FQDN-for-2a029b80

Set-RDPublishedName « remote.contoso.com »

Modifier les 2 fichiers suivants:

C:\windows\Web\RDWeb\Pages\Web.config

Ligne 71:

      <authentication mode= »Windows »/>

     

      <!–

      authentication mode= »Forms »>

          <forms loginUrl= »default.aspx » name= »TSWAAuthHttpOnlyCookie » protection= »All » requireSSL= »true » />

      </authentication> –>

      <webParts>

          <personalization defaultProvider= »TSPortalProvider »>

            <providers>

              <add name= »TSPortalProvider » type= »Microsoft.TerminalServices.Publishing.Portal.TSPortalProvider »/>

          </providers>

          <authorization>

              <allow users= »* » verbs= »enterSharedScope »>

              </allow>

          </authorization>

        </personalization>

      </webParts>

      <httpRuntime targetFramework= »4.5″ />

  </system.web>

  <system.webServer>

    <handlers>

        <add name= »PagesWebFeedHandler » path= »WebFeed.aspx » verb= »* » type= »Microsoft.TerminalServices.Publishing.Portal.PagesWebFeedHandler » preCondition= »integratedMode »/>

    </handlers>

    <!–modules runAllManagedModulesForAllRequests= »true »>

      <remove name= »FormsAuthentication » />

      <add name= »RDWAFormsAuthenticationModule » type= »Microsoft.TerminalServices.Publishing.Portal.FormAuthentication.TSDomainFormsAuthentication » />

    </modules> –>

    <!–security>

   

        <authentication>

            <windowsAuthentication enabled= »false » />

            <anonymousAuthentication enabled= »true » />

        </authentication>

    </security> –>

   

    <httpRedirect enabled= »false » />

  </system.webServer>

Et le fichier c:\Window\Web\RDWeb\pages\en-us\default.aspx

// Page Variables

    //

    public string sHelpSourceServer, sLocalHelp, sRDCInstallUrl, strWorkspaceName;

    public Uri baseUrl, stylesheetUrl, renderFailCssUrl;

    public bool bShowPublicCheckBox = false, bPrivateMode = true, bRTL = false;

# Faire une GPO avec les paramètres suivants:

Computer\Policies\Administrative Templates\System\Credential delegation

Allow delegating default credential

TERMSRV/rdsgw.domaine.com

TERMSRV/srv-rds1.domaine.local

TERMSRV/srv-rds2.domaine.local

TERMSRV/srv-broker.domaine.local

Allow delegating default credentials with NTLM-only server authentication

TERMSRV/rdgw.domaine.com
TERMSRV/srv-broker.domaine.local

Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone

Logon options Automatic logon with current username and password

Specify SHA1 thumbprints of certificates representing trusted .rdp publishers Enabled  
Comma-separated list of SHA1 trusted certificate thumbprints: DGFHFGHQM34552WFXV2121212QQ33
   

>> pour récuperer l’empreinte, sur le broker faire en powershell

Get-Childitem CERT:\LocalMachine\My

 

user\Windows Components/Remote Desktop Services/RD Gateway

Set RD Gateway authentication method Use locally logged-on credentials

# Faire une GPO pour publier les remote app dans le menu démarrer (windows 8 et ultérieur)

User\policies\Windows Components/Remote Desktop Services/RemoteApp and Desktop Connections

​#Modifier le nom du Work Resource

Sur le Broker:

Set-RDWorkspace -name « My Apps » -ConnectionBroker « srv-broker.domaine.local »​

Configuration du SSO sur une ferme RDS (Windows Server 2012/2016/2019)

User Profiles on Windows Server 2008 R2 Remote Desktop Services

By 

Introduction:

This blog post contains a high-level overview of different types of profiles, considerations for choosing a profile solution for your deployment, highlights of new profile features in Windows Server 2008 R2, and a best practices recommendation for deploying roaming user profiles with folder redirection in a Remote Desktop Services environment

suite: http://blogs.msdn.com/b/rds/archive/2009/06/02/user-profiles-on-windows-server-2008-r2-remote-desktop-services.aspx

User Profiles on Windows Server 2008 R2 Remote Desktop Services

Configure Internet Explorer IE 11 Home Page / Proxy Settings in Group Policy Preferences

Written by

With the recent release of Internet Explorer 11 / IE11, Microsoft have released a KB article on how to set Internet Explorer settings using Group Policy Preferences.

Microsoft KB2898604

However they are missing out one vital step when setting this up. If you follow those instructions, even editing the group policy on a Windows 8.1 machine does not resolve it.

suite: http://www.blackforce.co.uk/2013/12/04/configure-internet-explorer-ie-11-home-page-proxy-settings-in-group-policy-preferences

Configure Internet Explorer IE 11 Home Page / Proxy Settings in Group Policy Preferences

Optimizing Adobe Reader in XenApp

(Also available for TS/RDS Environment)

By Steven Krueger

Many administrators simply download and install Adobe Reader on their XenApp servers.  However, many small tweaks, which could improve end user experience and/or prevent users from corrupting Adobe Reader for other users on a server, should be considered as part of XenApp deployments.  This blog outlines configurations to modify a typical user’s experience while working in Adobe Reader.

suite:https://www.citrix.com/blogs/2014/06/16/optimizing-adobe-reader-in-xenapp/

Optimizing Adobe Reader in XenApp

Configuring Windows 2008 R2 Remote Desktop Farm with Connection Broker

By 

In my previous article about Windows 2008 R2 Remote Desktop Services (RDS) I set up a single server with the RD Session Host and Web Access roles.  Now I will expand on this and add an additional Session Host/Web Access server to create an RDS server farm for redundancy.  I will use the RD Connection Broker role to provide session reconnection and load balancing features.  Both of my RD servers are members of an Active Directory domain. This is a requirement for using the Connection Broker role.

suite: https://aaronwalrath.wordpress.com/2010/05/28/configuring-windows-2008-r2-remote-desktop-farm-with-connection-broker/

Configuring Windows 2008 R2 Remote Desktop Farm with Connection Broker

Step by Step Redirecting and Managing the modern Start Menu in Windows 2012(R2) RDS

By Arjan Mensch

I got several requests and questions about customizing and managing a redirected Start Menu when using a Full Desktop session collection. This post will cover the basics for doing that and is based on implementations we have done for real customers, on Windows Server 2012.
The methods I describe below are therefore meant for Windows Server 2012 RDS environment, but work on Windows 2012 R2 RDS as well.

suite: https://msfreaks.wordpress.com/2014/04/17/step-by-step-redirecting-and-managing-the-modern-start-menu-in-windows-2012r2-rds/

Step by Step Redirecting and Managing the modern Start Menu in Windows 2012(R2) RDS