We have three (completely separate) terminal servers, all in one boxes with session host, gateway, everything (I know it's not as secure but that's how it is for now). We're publishing some programs using RemoteApp. Users of the apps experience a lot of lag with them, clicking and no response, then it'll catch up, etc. This applies to both 2012 R2 and 2016 term servers.
I've been troubleshooting for a while and finally figured out what seems to be the problem, but I'm not sure what the proper solution is.
In the session collection properties under Security, I discovered if I set the security layer to "RDP Security Layer", it completely resolve the lag issue. 100% fixed. If I set it back to Negotiate or SSL, the lag returns. I've tested it on all three of the terminal servers and it resolves the problem on all of them.
The problem with leaving it set to RDP Security Layer is 1) Not as secure of course, and 2) There is a very long login delay when opening a RemoteApp, as well as it seems the login isn't passed to the server, so the user during the connection has to click the "Show Details" dropdown which shows the actual desktop, login to the remote desktop, THEN the RemoteApp will open up.
I'm at a bit of a loss as to why SSL/TLS would be causing such a big delay. Bandwidth and server/client resources (CPU/RAM/etc) are not an issue here.