Remote Desktop Services: RDP, RemoteApps and remote access

Start DC01, SRV01 and CL01. Take a “Before RDS” snapshot of SRV01 first. Work on SRV01 as SAATLAB\Administrator in PowerShell as administrator.

1Check how RDP is set up on SRV01

On SRV01, run this:

(Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
(Get-CimInstance -Namespace root\cimv2\TerminalServices -ClassName Win32_TSGeneralSetting -Filter "TerminalName='RDP-Tcp'").UserAuthenticationRequired
Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Select-Object DisplayName, Enabled
Get-LocalGroupMember 'Remote Desktop Users'

You should see something like this:

0
1

DisplayName                             Enabled
-----------                             -------
Remote Desktop - User Mode (TCP-In)        True
Remote Desktop - User Mode (UDP-In)        True
Remote Desktop - Shadow (TCP-In)           True

fDenyTSConnections 0 means RDP is on (you enabled it in Lesson 6), and UserAuthenticationRequired 1 means NLA is required. Remote Desktop Users is empty, so only administrators can connect today. That’s a good starting point for a server.

✅ Checkpoint: RDP is on, NLA is required and only admins can connect to SRV01.

2Deploy the RDS roles

On SRV01, run this. SRV01 restarts during the deployment:

Import-Module RemoteDesktop
New-RDSessionDeployment -ConnectionBroker SRV01.saatlab.internal -WebAccessServer SRV01.saatlab.internal -SessionHost SRV01.saatlab.internal

The command installs the three roles, restarts SRV01 and finishes the setup after the restart. It can take 10 minutes. Sign in again as SAATLAB\Administrator when it’s back.

Then check the deployment:

Get-RDServer -ConnectionBroker SRV01.saatlab.internal | Select-Object Server, Roles

You should see something like this:

Server                 Roles
------                 -----
SRV01.saatlab.internal {RDS-CONNECTION-BROKER, RDS-WEB-ACCESS, RDS-RD-SERVER}

✅ Checkpoint: Get-RDServer lists SRV01 with the Connection Broker, Web Access and Session Host roles.

3Create a session collection

On SRV01, run this:

New-RDSessionCollection -CollectionName Office -SessionHost SRV01.saatlab.internal -ConnectionBroker SRV01.saatlab.internal -CollectionDescription 'Lab apps for staff'
Set-RDSessionCollectionConfiguration -CollectionName Office -UserGroup 'SAATLAB\Domain Users' -ConnectionBroker SRV01.saatlab.internal
Get-RDSessionCollectionConfiguration -CollectionName Office -UserGroup -ConnectionBroker SRV01.saatlab.internal

You should see something like this:

CollectionName UserGroup
-------------- ---------
Office         {SAATLAB\Domain Users}

The collection’s user group decides who may connect to its session hosts. For a real farm you’d use a dedicated group, such as GG_RDS_Office, instead of all Domain Users.

✅ Checkpoint: The Office collection exists with SAATLAB\Domain Users as its user group.

4Publish Notepad as a RemoteApp

On SRV01, run this:

New-RDRemoteApp -CollectionName Office -DisplayName 'Notepad' -FilePath 'C:\Windows\System32\notepad.exe' -ConnectionBroker SRV01.saatlab.internal | Out-Null
Get-RDRemoteApp -CollectionName Office -ConnectionBroker SRV01.saatlab.internal | Select-Object DisplayName, FilePath, ShowInWebAccess

You should see something like this:

DisplayName FilePath                        ShowInWebAccess
----------- --------                        ---------------
Notepad     C:\Windows\System32\notepad.exe True

Any program installed on the session host can be published this way. In real life it’s usually the line-of-business app that’s hard to install on every laptop.

✅ Checkpoint: Notepad is published in the Office collection and shown in Web Access.

5Open the RemoteApp from CL01

On CL01, sign in as SAATLAB\priya.sharma. In Edge, open https://srv01.saatlab.internal/RDWeb. The deployment uses a self-signed certificate, so accept the warning for the lab (Lesson 34 fixes this).

Sign in as saatlab\priya.sharma, click Notepad, open the downloaded .rdp file and click Connect. Notepad opens in its own window, but it’s running on SRV01: open File, Save As and you’ll see SRV01’s drives.

On SRV01, look at the session:

Get-RDUserSession -ConnectionBroker SRV01.saatlab.internal | Select-Object UserName, HostServer, SessionState, CollectionName

You should see something like this:

UserName     HostServer             SessionState CollectionName
--------     ----------             ------------ --------------
priya.sharma SRV01.saatlab.internal STATE_ACTIVE Office

From here you could send a message to the user, shadow the session with their permission, or log them off. Session host admins do this daily.

✅ Checkpoint: Priya runs Notepad as a RemoteApp, and Get-RDUserSession shows her active session on SRV01.

Close Notepad, then take a snapshot of SRV01 called “RDS”.

VBoxManage snapshot SRV01 take "RDS"