I have set up Win2012R2 RDS and I have a pooled read only desktop collection. When I launch a desktop I get the following prompt:
The name on the certificate is the FQDN of the desktop and the issuer is the same: desktopname.mydomain.com
I am using a wildcard cert for the deployment and it is set up as shown below.
If I launch a RemoteApp from my session host collection I do not see the certificate prompt.
Any ideas how to eliminate the RDP certificate prompt on the virtual desktops?
I have a simple deployment with a single machines housing the RD Broker, RD Gateway, RD Web Access and RD Session Host roles. I have a public CA multi-domain certificate applied to all roles. I'm, however, having certificate mismatch issues that are very
strange. When go to launch an app in rdweb, I get an error that their is a certificate mismatch and that the name in the certificate is a server housing another RDS deployment. I have never co-mingled these servers, but somehow it thinks it's supposed to be
looking for a completely different machine. I have run the set-rdpublished cmdlet and run set-rdsessioncollectionconfiguration cmdlet, but it is not helping. The strangest part is that before this happens, I get an unknown publisher warning for the app (not
worried about this), but it shows the correct certificate name and remote computer name. To further investigate, I ran the WMIC command to see information about my certificate. I have marked sensitive information as *omitted*. The certificatename field is
incorrect:
PS C:\Users\administrator> Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservic
es
__GENUS : 2
__CLASS : Win32_TSGeneralSetting
__SUPERCLASS : Win32_TerminalSetting
__DYNASTY : CIM_ManagedSystemElement
__RELPATH : Win32_TSGeneralSetting.TerminalName="RDP-Tcp"
__PROPERTY_COUNT : 20
__DERIVATION : {Win32_TerminalSetting, CIM_Setting, CIM_ManagedSystemElement}
__SERVER : *omitted*
__NAMESPACE : root\cimv2\terminalservices
__PATH : \\*omitted*\root\cimv2\terminalservices:Win32_TSGeneralSetting.TerminalName="RDP-
Tcp"
Caption :
CertificateName : *omitted*
Certificates : {0, 0, 0, 0...}
Comment :
Description :
InstallDate :
MinEncryptionLevel : 2
Name :
PolicySourceMinEncryptionLevel : 0
PolicySourceSecurityLayer : 0
PolicySourceUserAuthenticationRequired : 1
SecurityLayer : 0
SSLCertificateSHA1Hash : *omitted*
SSLCertificateSHA1HashType : 3
Status :
TerminalName : RDP-Tcp
TerminalProtocol : Microsoft RDP 8.0
Transport : tcp
UserAuthenticationRequired : 1
WindowsAuthentication : 0
PSComputerName : *omitted*
Is there a way to change this? I can't seem to find a way. I have tried using the set certificatename=remote.domain.com command with the WMIC commands and it says it was set successfully, but I still shows the wrong domain name. What is going on?
I updated client servers with MS updates as usual over the weekend remotely. Tried to remotely log into 2 of the servers after they rebooted; Server 2008 R2 and 2008 Standard, and was denied with "Your credentials did not work" message at the top
of the dialog. Administrator, other IDs did not work. Only way to log into either server was to drive into the client (on Sunday) and login from the console. Once logged in from the console I was able to RD into each. If the server is rebooted RD is again
unavailable until logged in from the console. I am now seeing that remote access works for a while but in some cases becomes unavailable after a while. The problem only seems to affect server 2008 and 2012 variants.
Backed out the following updates and the problem remained: KB3002657, KB3033929, KB3046049, KB3035131, KB3034344, KB3032359, KB3039066, KB3035132, KB3035126, KB3033889, KB3032323, KB3030377. Then I restored the System State from the day before the updates but
the problem is still present.
Unfortunately, this particular client has around 30 remote users who need to login every day. The only workaround I've found is to log their IDs in at the console first. Then they can connect remotely. Others have reported this problem and one post leads me
to believe it could be an issue with 2008/2012 RDS boxes on a 2003 Domain Controller. Any help appreciated or, MS: Please Get This Fixed!
More info:
https://social.technet.microsoft.com/Forums/en-US/0a520543-29d4-4466-9967-e39d819d11f1/users-cannot-log-into-remote-desktop-after-3112015-update?forum=smallbusinessserver&prof=required
yaro
https://gallery.technet.microsoft.com/Change-published-FQDN-for-2a029b80
Do i just need to run this script on the gateway/broker/web server and will this stop the mismatch errors fro the session hosts?
Thanks
I've seen plenty of these but none that I've come across have particularly helped me. I have a website that has a link that, when clicked, activates a remote session. Whenever the remote session attempts to start, the application crashes, faulting ntdll.dll.
Here's the full report:
Version=1Any help would be greatly appreciated!
-Kyle
Hi there,
I have a bit of a weird problem regarding RDP connections.
This only happened a few day ago, I access a RDP server (server 2008 R2) from home using the external ip address of my works router i.e. i connect to 80.xx.xx.xx but i am now geting an error saying that my cerdentials don't work.
At the same time internal users who also connect to the same RDP server internaly using the local ip address of 192.168.1.230 are getting the same error.
Now if i connect to the RDP server using it's domain name it connects no problems. Once i've logged on and off the server i can reconnect to the same server using the ip address and it works fine. The next day i can't connect to the server using it's ip
address.
Internaly i can ping and nslookup the RDP server without any problems.
Now going back to the problem of accessing the server externaly i have to connect to my local network via a vpn logon to the server and log off, then when i drop the vpn i can connect to the server using the external ip address.
Many thanks
(ps sorry for any spelling mistakes)
Hi
I need help - desperately
I keep getting this error time and time again on Server 2012 R2 when trying to install Remote Desktop Services.
the server has been promoted to domain controller and other than that nothing else has been done.
Cannot find anything regarding this error on the server 2012 R2 all on the internet (there is an article for Server 2012 though, but hot fix does not apply to R2) , and my previous post has been all but ignored.
One of my RDS clients has a pretty robust server farm 2012R2, 4 RDSH servers.
Every once in a while for no apparent reason (have not grabbed logs yet) one of the servers will have trouble reconnecting sessions.
In other words, not the whole farm and never the same server. They use UPD, and after disconnecting the message on reconnect is (and i'm parapfrasing a user as i have not witnessed it) "Windows cannot load profile" and i'm forced to log that session off from the console, they attempt a new login and it works.
Anyone seen this before?
Hi all,
I have a Wyse WinTerm WT3125SE set to auto logon to a domain user.
In Server 2003 it works perfectly (no need to retype password)
In Server 2008 it shows me the logon screen (on the left = domain\user , on the right = Other User)
In other words, it does not "auto logon" I need to click on the user and type the password
Need help please...
I have the following Windows Server 2008 R2 servers:
addsdc.contoso.com, AD DS Domain Controller for contoso.com
adcsca.contoso.com, AD CS Enterprise CA, CDPs/AIAs published externally.
fileserver.contoso.com, RDS Session Host for Administration enabled
rdsgateway.contoso.com, RDS Gateway enabled
tmgserver.contoso.com, 'Publishing' rdsgateway.contoso.com but with pass-through authentication
And the following Windows 7 PCs:
internalclient.contoso.com
externalclient.fabrikam.com
There's no trust between the domains, the external client is completely separate on the internet but the CA certificate for contoso.com has been installed in the trusted Root CA store. All servers have certificates for secure RDP.
I enrolled for a custom 'Smart Card Authentication' certificate with Client Authentication and Smart Card Logon EKUs from the CA, stored on my new Gemalto smart card using the Microsoft Base Smart Card CSP.
From internalclient.contoso.com, I can RDP to fileserver.contoso.comusing the smart card just fine with no certificate errors.
From externalclient.fabrikam.com, I can RDP to fileserver.contoso.comvia rdsgateway.contoso.com using a username and password just fine with no certificate errors.
From externalclient.fabrikam.com, I can RDP to fileserver.contoso.comvia rdsgateway.contoso.com using the smart card to authenticate to the gateway, and a username and password to authenticate to the end server, just fine.
BUT from when using a smart card to authenticate to the end server via the gateway, it fails with:
The specified user name does not exist. Verify the username and try logging in again. If the problem continues, contact your system administrator or technical support.
When I move the client into the internal network and try the connection again (still via the RDS Gateway), it works fine - the only thing I can think of is being outside the network and not being able to contact the AD DS DC for Kerberos is causing the issue - but I'm pretty sure this is a supported scenario?
The smart card works fine internally, the subject of the certificate is the user's common name (John Smith) and the only SAN isUPN=johns@contoso.com which matches the UPN of the user account as it was auto-enrolled.
Does anyone have any ideas?
I've encountered a problem that I can't quite understand. I have two customers with the same problem.
The environment is based on 2003 SBS with a 2008 RDS. All clients are Windows 7
A couple of days ago I get a call telling me that they no longer can log on to the terminalserver.
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: username
Account Domain: DOMAIN
Failure Information:
Failure Reason: An Error occured during Logon.
Status: 0xc000006d
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: computername
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
Log on as domain admin, no problem.
Logging on the termianl server as the user from SBS2003, working!!!
Now trying to log on as the user externally, also working!!!
Can anybody explain this behaviour to me?
Multiple users logged into one server, each users printer has a different name, application needs ONE name to print to.
I'm NOT in any way a Terminal Services expert and I need help trying to get an application program working in a multi-user environment.
The issue is that the printer changes for every user that is logged in. The application needs to print NOT to the default printer, but to a "special" printer which is selected in the application... let's call it a label printer to simplify the explanation.
You have your default regular printer, easy for the application to find that one, and then you have a special printer that labels get printed onto. The application needs to know what printer is the label printer. So we allow the user to select that in the
application and the selection is stored in a config file in
C:\ProgramData\mfgr\prog\setting files
I don't have access to the application so I can't change how this works.
In the "regular" world, selecting the label printer driver to use should be per machine, NOT per user. When a new user logs into a machine, the physical printer doesn't go "poof" and a new printer suddenly appear. Same printer for all
users.
Yet in terminal services, the physical machine is "merged" with the virtual machine on the server. And there can be many users logged in at the same time. So each users real machine (and real printer) is injected into the "fake" terminal
services machine. The name of the printers is made unique for each user. So the printers DO go "poof" and change names depending on the user logged into terminal services.
So user "A" logs in and sets up the application to print to "LabelPrinterForUserA" (or whatever the name of the printer happens to be), that setting is stored in the ProgramData subfolder, and all is well. Later, user "B" logs
in, and when they print, the application tries to print to "LabelPrinterForUserA" which doesn't exist for user B or is only accessible by user A. If user B re-configures, that breaks it for user A.
SOLUTION 1: The way that /should/ work (in my mind) is that you define one "generic" printer in Terminal Services... call it "Virtual Label printer" and when the user wants to print to it, the print job gets re-directed back to whatever
physical printer is actually connected to their local workstation. There is a map of virtual printer to actual printer depending on the current user. The application is told once to print to "Virtual Label Printer" for all users.
SOLUTION 2: Or... there should be some way to make the ProgramData sub folders separate per user. E.g. when user "A" tries to access:
C:\ProgramData\mfgr\prog\setting files
they actually get
C:\UserData\UserA\AppData\mfgr\prog\setting files
and user "B" gets
C:\UserData\UserB\AppData\mfgr\prog\setting files
So the question I have is: Does either of those solutions exist hidden somewhere in the setup of terminal server? Or is there another way around this issue that I don't know?
Hi,
I've come across a problem today where I'm unable to connect to our locally hosted RD Gateway server. We have one Server 2012 R2 machine with the Remote Desktop Services installed. The system was setup following the configuration wizard in Remote Desktop Services section of Server Manager. One of our users has gone to connect to the main remote app hosted by this setup and received an expired certificate error. No problem I thought, checked the certificate on the server and it does indeed expire today. I'll re-issue a self signed certificate through the RD Gateway Manager and all should be ok. On loading the RD Gateway Manager, clicking Connect to RD Gateway Server and selecting Local Server I get the following error.
"The RD Gateway Manager snap-in console cannot connect to the server "SERVER" because it is not a RD Gateway server."
I've checked that the services for remote desktop are running which they are, and I can connect to the server using standard RDP remote desktop. Any ideas on where to go next to solve this problem?
Rob
Hi
I see similar questions here but not the same as I'm having. I have a server for testing the new server with RemoteFX. Physical server is installed with Windows Server Technical Preview. Enabled Hyper-V. All drivers are installed including NVidia drivers. Installed a guest server running the same OS.
As I can see from this post: http://blogs.msdn.com/b/rds/archive/2014/11/05/remotefx-vgpu-updates-in-windows-server-next.aspx it should be supported to have the RemoteFX graphic adapter in the guest OS with Windows server Tech Prev. I have a unknown device in my device manager that I cant install the driver for.
What have I missed?
Joakim
All of a sudden my Windows 7 x64 computer is unable to connect to random Windows 2008 R2 servers via Remote Desktop.
I can connect to the same servers from other Windows 7 machines.
The only fix I've come across so far is this, except that key doesn't exist on either my machine or on the server(s):
To resolve this issue, follow these steps:
Does anyone have any suggestions please as I'm at a total loss what is happening here.
Thanks.
We created new terminal server 2008 R2 and we have two domains and there is a trust between them. when people are trying to login to the server using the RDP shortcut, it doesn't work, and it does not show any errors.
But, when I use any user credentials to login directly to the terminal server it works fine. Then after that I can login using the RDP shortcut for that user and it keeps working. I have to do this fr all the users on the domain I made sure permissions are right and everything seems right.
We had a 2012 R terminal server that was working fine and stopped working last week when people were unable to connect to it nor ping it. We created the 2008 R2 terminal server and we checked and there was nothing changed on the network settings on both locations.
Not sure what exactly happening.
If anyone have an idea I would love to hear from you.
Hi,
I am deploying remote desktop gateway on Windows 2012 R2.
This is working and i can deploy a custom RDP file to my external machines that specifies to have the wallpaper enabled.
The RDP file contains the line
disable wallpaper:i:0
We have applied a GPO to set the users desktop wallpaper to use the corporate wallpaper, and this works great.
If however users access the gateway via Web access, the RDP file they download and run does not contain this. I can not find anything in the deployment GUI to set this. Is there anyway of enforcing it?
Thanks