Remote Desktop Services

The Windows agent on the RD Connection Broker puts every new or renewed certificate on your Remote Desktop deployment's roles with Microsoft's own Set-RDCertificate, checks it, and puts the previous one back if the check fails. No script and no stored password.

Setting it up

  1. Make sure the certificate covers the names users connect to: the RD Web Access / Gateway name (for example rds.example.com) and the broker's name if clients use another one. Add them on the certificate's page.
  2. Add a Microsoft Remote Desktop Services (agent, pull) host, pick the certificate and tick the roles under Use the certificate for (all four by default).
  3. Save, reopen the host and install the Windows agent on the RD Connection Broker with the install command at the top of the host's page. One host per deployment; with highly available brokers, install it on one of them.
  4. If a Gateway or Web Access server is not the broker, add the broker's computer account to that server's local Administrators group once: Add-LocalGroupMember -Group Administrators -Member 'DOMAIN\BROKER$'. The agent runs as SYSTEM, so RDS copies the certificate as the broker's computer account.

Roles

  • RD Gateway: the Gateway's certificate, on every Gateway server of the deployment.
  • RD Web Access: the /RDWeb site and the web client.
  • RD Connection Broker - Enable Single Sign On and RD Connection Broker - Publishing (signs the RDP files users download).

A ticked role the deployment doesn't have (no Gateway, for example) is skipped. When the Gateway and Web Access share a server they share its port 443, so tick both or neither. Changing the ticked roles applies at the agent's next check-in.

What happens on every new or renewed certificate

  1. The agent imports the certificate into the broker's Local Computer > Personal store.
  2. It reads the deployment (Get-RDServer, Get-RDCertificate), talking to the active broker when the brokers are highly available.
  3. Roles that already have this certificate, and whose Gateway / Web Access servers already serve it on port 443, are skipped. If nothing is left, nothing is changed.
  4. It runs Set-RDCertificate for each remaining role. RDS copies the certificate to every Gateway and Web Access server itself.
  5. For up to 3 minutes it checks that Get-RDCertificate shows the new certificate for every role it changed, that each RD Web Access server serves it on port 443 and /RDWeb answers, and that each Gateway server serves it on port 443.

If the check fails, the agent puts the previous certificate back on every role it changed, confirms it, shows the error under Agent status on the host's page and tries the new certificate again after 15 minutes. If one role can't be set (a Gateway server that's switched off, say), the roles that worked are kept and checked, and the next check-in finishes the rest.

The host's page shows the broker, the deployment's servers, each role's current certificate and the last change step by step.

Requirements

  • A session-based Remote Desktop deployment (Server Manager or New-RDSessionDeployment) on Windows Server 2016 or newer. The agent uses Windows PowerShell 5.1 and the RemoteDesktop module, which every broker has.
  • Works with a NeverLapse server on Windows, Linux or Docker.
Previous nginx NextApache Tomcat