Configure Remote Desktop Web Access

After you published some applications on your RD Session Host server(s), you need to make those applications available to users. There are three ways to do that, one is to make them available from the Start Menu (Windows 7 only), the second one is to send them the .RDP file, and the last one is from a web browser. Off course the last one is better because you don’t have to keep sending them .RDP files over the email every time you change something to the application, like the published path or the Session Host server.

For this lab every Remote Desktop Service role its on a separate machine running Windows 2008 R2. If you don’t have the hardware you can install them on a single server; so…I have one RD Session Host server, one RD Web Access server, one License server and one Domain Controller. All servers are part of the domain vkernel.local. After you install the RDS roles on every server, it’s time to continue with the RD Web Access configuration. First we need to add the RD Web Access server to the TS Web Access Computers local group on the RD Session Host server. If this operation is not done when you try to configure the RD Web Access web site an error is displayed “RD Web Access was not able to access RD Host server. Verify that the computer account of the RD Web Access server is added to the TS Web Access Computers security group on the RD Session Host server.”

Let’s add the RD Web Access server to that local group on the RD Session Host server. On the RD Session Host server open Server Manager, expand Configuration > Local Users and Groups, and click the Groups folder. As you can see here is a group named TS Web Access Computers. Right-click the group and choose Properties.

Click the Add button on the window that just popped-up then click the Object Types button. Check the box next to Computers, and click OK.

On the Enter the object names to select box type the name of your  RD Web Access server, and click OK twice.

Off course, if you have more than one RD Session Host server, you will need to go to every one of them and add the RD Web Access server to that group; applies only if you want those published applications to be visible on the RD Web Access site. Now that our RD Web Access server has access to the RD Session Host server applications it’s time to configure the site. Open a browser from a client or even from one of the servers and type https://RD Web Access server/rdweb, and in my case is https://rds-web/rdweb; where rds-web is the name of the RD Web Access server. You need put https or you will get an access denied error.

After you launch the web site you will have a certificate error since the RD Web Access site is secured with a self-signed certificate. Click Continue to this website (not recommended) to pass the error.

Here we need to log in with a domain administrator account to be able to configure the web site. Type your domain admin credentials then hit the Sign in button.

Go to the Configuration tab, and replace localhost in the Source name box with the name of your RD Session Host server(s) name(s). Click OK when you’re done.

Now if you go to the RemoteApp Programs tab you ca see the published applications (if you published some) on the RD Session Host server(s); if you have permission to see them off course, but let’s say you have in this case.

Click the application to see if it’s working. Don’t worry about the warning that pops-up, you can fix it later by reading this guide Digitally Signing RemoteApp Programs on Windows Server 2008 R2. And now Paint is launched. If you go to the RD Session Host server and take a look at the Users tab you can see the user Administrator is log in from RDS-Web, which is my RD Web Access server.

Tweaks can be done in DNS so user don’t have to memorize the name of the RD Web Access server, instead they will have a nice web site name. You can create redirections or URL rewrites on the web site so the page is automatically redirected in https mode.