Copyright information

Microsoft Azure: Desktop Hosting Deployment Guide
Basic Desktop Hosting Implementation on Microsoft Azure Infrastructure Services
Published: November 2014
Microsoft Corporation
Copyright information
This document is provided "as-is". Information and views expressed in this document, including URL and other Internet website references, may change without notice.
Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred.
This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes.
Microsoft, Active Directory, Hyper-V, SQL Server, Windows PowerShell, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.
© 2014 Microsoft Corporation. All rights reserved.
Contents
1Prerequisites 6
2Create tenant’s networking environment 6
3Create tenant’s virtual machines 6
4Configure the DNS address for the virtual network 7
5Deploy AD DS and DNS roles 8
6Prepare virtual machines for Remote Desktop Services deployment 9
7Create Remote Desktop Services deployment 10
8Connect to deployment from the client computer over the Internet 14
9Secure the Deployment 15
This document provides guidance for deploying a basic desktop hosting solution based on the Microsoft Azure Desktop Hosting Reference Architecture Guide. This document is intended to provide a starting point for implementing a Desktop Hosting service on Microsoft Azure virtual machines. A production environment will need additional deployment steps to provide advanced features such as high availability, customized desktop experience, RemoteApp collections, etc.
The primary audience for this reference architecture are hosting providers who want to leverage Microsoft Azure Infrastructure Services to deliver desktop hosting services and Subscriber Access Licenses (SALs) to multiple tenants via the Microsoft Service Provider Licensing Agreement (SPLA) program. A second audience for this reference architecture are end customers who want to create and manage desktop hosting solutions in Microsoft Azure Infrastructure Services for their own employees using RDS User CALs extended rights through Software Assurance (SA).
To deliver a desktop hosting solutions, hosting partners and SA customers leverage Windows Server® and the Windows Desktop Experience feature to deliver Windows users an application experience that is familiar to business users and consumers. Although Windows 8.1, Windows 7, and earlier Windows client versions are not licensed for hosting environments with shared hardware, the Desktop Experience feature in Windows Server 2012 R2 provides a similar user experience and application support.
The scope of this document is limited to:
Deployment guidance for a basic desktop hosting service based on Remote Desktop Services (RDS).
Advanced deployment guidance for desktop hosting is not covered in this document.
Session-based desktops that use Windows Server Remote Desktop Session Host (RDSH).
Windows client-based virtual desktop infrastructures are not covered because there is no Service Provider License Agreement (SPLA) for Windows client operating systems. Windows Server-based virtual desktop infrastructures are allowed under the SPLA, and Windows client-based virtual desktop infrastructures are allowed on dedicated hardware with end-customer licenses in certain scenarios. However, client-based virtual desktop infrastructures are out-of-scope for this document.
Microsoft® products and features, primarily Windows Server 2012 R2 or Windows Server 2012 and Microsoft Azure infrastructure Services.
Basic availability provided by Microsoft Azure Infrastructure Services.
Additional levels of high availability can be provided by guest clustering, but a general high availability solution is out-of-scope for this document.
Desktop hosting services for tenants ranging in size from 5 to 5000 users.
For larger tenants, this architecture may need to be modified to provide adequate performance. The Server Manager RDS graphical user interface (GUI) is not recommended for deployments over 500 users. PowerShell is recommended for managing RDS deployments between 500 and 5000 users.
Standalone desktop hosting cloud service that does not have Virtual Private Network links to an on premises network.
This can be added optionally but is out-of-scope for this document.
Self-signed certificates
For a production deployment, certificates should be obtained from a trusted root certificate authority and alternative deployment procedures used to install these certificates on the servers and client devices.
After reading this document, the reader should understand:
How to deploy a basic desktop hosting service in Microsoft Azure virtual machines using Windows Server 2012 R2 and Windows Server 2012.
There are multiple ways to deploy a desktop hosting solution. Throughout the document, specific examples are given that can be used as a starting point for a basic deployment. These examples are identified with the e.g. notation.
Prerequisites
This document assumes that the reader has already performed the following tasks.
Create a Microsoft Azure subscription. See Microsoft Azure Free Trial.
Launch and sign in to the Microsoft Azure Management Portal.
Create a storage account. See How to Create a Storage Account.
Create tenant’s networking environment
The following steps create the tenant’s networking environment within Microsoft Azure.
Create a Virtual Network
In the Microsoft Azure Management Portal select NETWORKS, +NEW, VIRTUAL NETWORK, and CUSTOM CREATE.
Enter a NAME for the tenant’s virtual network, e.g. Contoso-VNET
Under LOCATION select a location that is near the tenant’s users, e.g. West US
Skip the DNS servers setting for now.
Configure the ADDRESS SPACE and a SUBNET, e.g. 192.168.0.0/26 (64) and subnet-1 192.168.0.0/26 (64).
Create a Cloud Service
In the Microsoft Azure Management Portal select CLOUD SERVICES, +NEW, CLOUD SERVICE, and CUSTOM CREATE
Enter a URL, e.g. Contoso-CS1
Under REGION OR AFFINITY GROUP select the region used for the virtual network.
Create tenant’s virtual machines
The following steps create the virtual machines in the tenant’s environment that will be used to run the Windows Server 2012 R2 roles, services, and features required for a desktop hosting deployment. For this example of a basic deployment, the minimum of 3 virtual machines will be created. One virtual machine will host the Active Directory Services (AD DS) role, DNS role, the Remote Desktop Connection Broker and License Server role services, and a file share for the deployment. A second virtual machine will host the Remote Desktop Gateway and Web Access role services. A third virtual machine host the Remote Desktop Session Host role service. If using Windows Server 2012, the RD Connection Broker role service cannot be installed with AD DS role so an additional virtual machine must be created to host the RD Connection Broker role service. For larger deployments, the various role services may be installed in individual virtual machines to allow better scaling.
Create virtual machine to host the Active Directory Domain Services (AD DS)
In the Microsoft Azure Management Portal select VIRTUAL MACHINES, +NEW, COMPUTE, VIRTUAL MACHINE, and FROM GALLERY
Select Platform Images, Windows Server 2012 R2 Datacenter
Select the most recent VERSION RELEASE DATE
Enter a VIRTUAL MACHINE NAME, e.g. Contoso-AdCb1
Select the SIZE, e.g. Small
Enter a NEW USER NAME and a NEW PASSWORD to be added to the local administrators group
Select the CLOUD SERVICE created above
Accept the REGION/AFFINITY GROUP/VIRTUAL NETWORK for this Cloud Service.
Select the STORAGE ACCOUNT created above.
Set AVAILABILITY SET to (None). (Note: This can be changed later if a replica AD DS server is added for high availability.)
Accept the default ENDPOINTS, i.e. Remote Desktop and PowerShell.
Attach 2 Azure data disks to AD DS virtual machine for the shares and AD database.
In the Microsoft Azure Management Portal select VIRTUAL MACHINES
Select the VM created above for AD DS
Select DASHBOARD, ATTACH and Attach empty disk
Accept the defaults for VIRTUAL MACHINE NAME, STORAGE LOCATION, and FILE NAME
Enter the SIZE (GB) to be large enough to hold the NTDS databases, logs, and SYSVOL, e.g. 32GB (For more information, see Guidelines for Deploying Windows Server Active Directory on Microsoft Azure Virtual Machines.)
Set the HOST CACHE PREFERENCE to NONE
Repeat steps c. through f. and enter a size large enough to hold network shares for the tenant’s environment, including AD backups, user disks, etc., e.g. 140GB
Repeat step 1. for the other two virtual machines entering appropriate names for each, e.g. Contoso-WebGw1 and Contoso-RDSH1
Configure the DNS address for the virtual network
Get IP address of AD DS virtual machine
Open and sign-in to the Microsoft Azure Management Portal
Select VIRTUAL MACHINES, the AD DS virtual machine, and DASHBOARD
Scroll down and copy the INTERNAL IP ADDRESS
Set the DNS server name and address for the virtual network
Select NETWORKS, the virtual network for this tenant, and CONFIGURE
Paste the IP address of the DNS server VM into the IP ADDRESS field, e.g. 192.168.0.4
Enter the name of the DNS server, e.g. Contoso-AdCb1
Select SAVE
Wait for the operation to complete successfully
Restart the virtual machines
Select VIRTUAL MACHINES, the AD DS virtual machine, and DASHBOARD, and RESTART
Repeat step a for the other two virtual machines
Wait for the operation to complete successfully.
Deploy AD DS and DNS roles
This section provides the steps to create a stand-alone domain controller (DC) for Active Directory Domain Services (AD DS). Alternatively, virtual private networking (VPN) could be configured to connect the tenant’s Azure networking environment to the tenant’s on-premises network. In this alternative configuration, the DC in the Microsoft Azure environment would be configured as a replica of the on-premises DC.
Connect to the AD virtual machine using Remote Desktop Connection (RDC) client
In the Microsoft Azure Management Portal select VIRTUAL MACHINES
Select the virtual machine created above for AD DS
Select DASHBOARD, CONNECT, and OPEN to open the RDC client
On the RDC client, select Connect, Use another user account, and enter the user name and password for the local administrator account created above.
Select Yes when warned about the certificate.
Enable Remote Management
From Server Manager, select Local Server, and the Remote management current setting (disabled).
Check the box to Enable remote management for this server
Select OK
Optional: Temporarily set Windows Update to not automatically download and install updates.
(This avoids changes and reboots while deploying system.)
From Server Manager, select Local Server and the Windows Update current setting
In the Windows Update dialog select Change Settings and Check for updates but let me choose whether to download and install them
Initialize the data disks
From Server Manager, select Tools, Computer Management, and Disk Management
Initialize disks as Master Boot Record (MBR) partition style
Right click the attached disk for the AD DS files and select New Simple Volume…
Accept the default size, driver letter, etc.
Enter an appropriate Volume label, e.g. AD-DB-LOGS-SYSVOL
Repeat steps c. – e. on the attached disk for shared folders entering an appropriate Volume label, e.g. Shares
Install AD DS DNS Server and associated Features
From Server Manager, select Manage and Add Roles and Features
Page through the wizard accepting defaults until the Server Roles page
Check Active Directory Domain Services, DNS Server, and add the associated Features
Select Continue to ignore a warning about no static IP addresses.
Page to the end of the wizard and select Install (Note: A restart is not required.)
Promote the virtual machine to a domain controller
From Server Manager, select the notification warning icon and Promote this server to a domain controller
Select Add a new forest and enter the Root domain name, e.g. Contoso.com
Enter a Restore Mode Password
Enter The NetBIOS domain name, e.g. Contoso
Change the location of the Database folder, Log files folder, and SYSVOL folder to the attached data disk by creating new folders, e.g. F:\NTDS, F:\NTDS, and F:\SYSVOL, respectively.
Select Install
The server will restart to complete the promotion to a domain controller.
Create domain users and administrators
Connect to the AD DS virtual machine using RDC client (step 1 above)
From Server Manager, select Tools and Active Directory Users and Computers
Select the newly created domain, e.g. Contoso.com
Select Action, New, and User
Create standard domain users and domain administrators
Select the domain administrator account, Action, Add to a group… , and add the account to the Domain Admins group.
Create a file shares for the user disks and certificates
Launch File Explorer
Select This PC (or Computer on Windows Server 2012) and open the disk that was added for file shares, e.g. Shares (F:)
Select Home and New Folder
Enter a name for the user disks folder, e.g. UserDisks
Right click the new folder and select Properties, Sharing, and Advanced Sharing…
Check the Share this folder box and select Permissions
In the Permissions dialog select Everyone, Remove, Add…, enter administrators, and select OK
Check the Allow Full Control check box and select OK, OK, and Close
Repeat steps c. – h. to create a shared folder for certificates to be shared, e.g. Certificates.
Connect to the virtual machine using Remote Desktop Connection (RDC) client
In the Microsoft Azure Management Portal select VIRTUAL MACHINES
Select the RD RDSH virtual machine, e.g. Contoso-RDSH1
Select DASHBOARD, CONNECT, and OPEN to open the Remote Desktop Connect client
On the RDC client, select Connect, Use another user account, and enter the user name and password for the local administrator account.
Select Yes when warned about the certificate.
Enable Remote Management
From Server Manager, select Local Server and the Remote management current setting
In the Configure Remote Management dialog, check the box labeled Enable remote management for this server from other computers.
Select OK
Optional: Temporarily set Windows Update to not automatically download and install updates to avoid changes and reboots while deploying the system.
From Server Manager, select Local Server and the Windows Update current setting
In the Windows Update dialog, select Change Settings and Check for updates but let me choose whether to download and install them
Select OK
Add the virtual machine to the domain
From Server Manager, select Local Server and the Workgroup current setting
In the System Properties dialog, select Change… , Domain, and enter the domain name, e.g. Contoso.com
Enter domain administrator credentials
Restart the computer
Repeat steps 1 through 4 for the RD Web and GW virtual machine, e.g. Contoso-WebGw1
Create Remote Desktop Services deployment
Note: The virtual machine created to run the Remote Desktop Connection Broker (RD Connection Broker) role service will also run the Remote Desktop Management Services (RDMS). This virtual machine, referred to as the RDMS server, will be used to deploy and manage the rest of the servers in the tenant’s hosted desktop environment.
Connect to the RDMS server using Remote Desktop Connection (RDC) client
In the Microsoft Azure Management Portal select VIRTUAL MACHINES
Select the RDMS server virtual machine, e.g. Contoso-AdCb1
Select DASHBOARD, CONNECT, and OPEN to open the Remote Desktop Connect client
On the RDC client, select Connect, Use another user account, and enter the user name and password for a domain administrator account.
Select Yes when warned about the certificate.
Add all servers to Server Manager
From Server Manager, select Manage and Add Servers
In the Add Servers dialog select Find Now
Select all the servers and OK
Create a session-based deployment
From Server Manager, select Manage and Add Roles and Features
In the Add Roles and Features wizard select Remote Desktop Services Installation, Standard Deployment, and Session-based desktop deployment
Select the appropriate virtual machines for the RD Connection Broker server, RD Web Access server, and RD Session Host server, e.g. Contoso-AdCb1, Contoso-WebGw1, and Contoso-RDSH1, respectively.
Check the box labeled Restart the destination server automatically if required and select Deploy
Wait for the deployment to complete successfully
Add RD License Server
From Server Manager, select Remote Desktop Services, Overview, and + RD Licensing
In the Add RD Licensing Servers wizard, select the virtual machine that the RD license server is installed on, e.g. Contoso-AdCb1
Select Next and Add
Wait for the RD License server to be added successfully.
Activate the RD License Server and add to the License Servers group
From Server Manager, select Tools, Terminal Services, and Remote Desktop Licensing Manager
In RD Licensing Manager, select the server name, Action and Activate Server
Page through the Activate Server Wizard accepting defaults until the Company information page and enter your Company Information.
Page through the remaining pages accepting defaults until the final page then uncheck the Start Install Licenses Wizard now box and select Finish.
Select Review, Add to Group, and Register as SCP
Add RD Gateway server and certificate name
From Server Manager, select Remote Desktop Services, Overview, and + RD Gateway
In the Add RD Gateway Servers wizard, select the virtual machine with the RD Gateway server installed on it, e.g. Contoso-WebGw1
Enter the SSL certificate name for the RD Gateway server using the external fully qualified DNS Name (FQDN) of the RD Gateway server. In Azure, this will be of the form .cloudapp.net, e.g. Contoso-CS1.cloudapp.net.
Select Next and Add
Wait for the RD Gateway server to be added successfully.
Create and install self-signed certificates for the RD Gateway and RD Connection Broker servers
Note: This procedure will be different if using certificates from a trusted certificate authority.
From Server Manager, select Remote Desktop Services, Overview, Tasks and Edit Deployment Properties
In the Deployment Properties dialog and expand Certificates
Scroll down to the table and select RD Gateway and Create new certificate…
In the Create New Certificate dialog, enter the Certificate name using the external FQDN of the RD Gateway server, e.g. Contoso-CS1.cloudapp.net, and a Password.
Check the box labeled Store this certificate and select Browse …,
In the Save As dialog, navigate to the shared folder for certificates created above, e.g. \\Contoso-AdCb1\Certificates
Enter a File name, e.g. ContosoRdGwCert
Select Save.
Check the box labeled Allow the certificate to be added to the Trusted Root Certificate Authorities certificate store on the destination computers.
Select OK
In the Deployment Properties dialog select Apply.
Wait for the certificate to be successfully applied to the RD Gateway server.
Select RD Web Access and Select existing certificate…
In the Select Existing Certificate dialog, select Browse…
In the Open dialog, select the certificate created for the RD Gateway server, e.g. ContosoRdGwCert, and Open.
In the Select Existing Certificate dialog, enter the Password, check the box labeled Allow the certificate to be added to the Trusted Root Certificate store on the destination computers, and select OK
In the Deployment Properties dialog, select Apply
Wait for the certificate to be successfully applied to the RD Web Access server.
Repeat steps c. - r. for the RD Connection Broker – Enable Single Sign On and RD Connection Broker - Publishing services using the internal FQDN of the RD Connection Broker server for the new certificate’s name, e.g. Contoso-AdCb1.Contoso.com
Export self-signed public certificates and copy to a client computer
Note: This procedure is not required if using certificates from a trusted certificate authority.
Launch certlm.msc
In the left-hand pane, expand Personal and select Certificates
In the right-hand pane right click the RD Connection Broker certificate intended for Client Authentication, e.g. Contoso-AdCb1.Contoso.com
Select All Tasks > and Export …
In the Certificate Export Wizard accept defaults until the File to Export page.
Select Browse…
In the Save As dialog, navigate to the shared folder for certificates created above, e.g. \\Contoso-AdCb1\Certificates
Enter a File name, e.g. ContosoCbClientCert
Select Save, Next, and Finish
Repeat steps c. through i. for the RD Gateway and Web certificate, e.g. Contoso-CS1.cloudapp.net, giving the exported certificate an appropriate file name, e.g. ContosoWebGwClientCert
Open File Explorer and navigate to the folder where the certificates were stored, e.g. \\Contoso-AdCb1\Certificates
Select the two exported client certificates, right click on them, and select Copy
On the local client computer, launch File Explorer, navigate to an appropriate folder, right click and select Paste to copy the certificates to the client computer’s hard drive.
Configure the RD Gateway and RD Licensing deployment properties
From Server Manager, select Remote Desktop Services, Overview, Tasks and Edit Deployment Properties
In the Deployment Properties dialog and expand RD Gateway and uncheck the box labeled Bypass RD Gateway server for local addresses
Expand RD licensing and select Per User
Select OK
Create a session collection
From Server Manager, select Remote Desktop Services, Collections, Tasks, and Create Session Collection
In the Create Collection wizard, enter a Collection Name, e.g. ContosoDesktop, select an RD Session Host Server, e.g. Contoso-RDSH1, accept the default User Groups, e.g. Contoso\Domain Users, and enter the Universal Naming Convention (UNC) Path to the user profile disks created above, e.g. \\Contoso-AdCb1\UserDisks, and a Maximum size, and Create.
Wait for the collection to be created successfully.
Install Desktop Experience and set the audio service to start automatically on the RDSH server
From Server Manager, select All Servers, right click the RDSH server, and select Computer Management
In the Computer Management window, expand Services and Applications, and select Services
Scroll down, right click Windows Audio, and select Properties
In the Windows Audio Properties dialog, set the Startup type: to Automatic, and select OK
In Server Manager, right click the RDSH server, and select Add Roles and Features
In the Add Roles and Features Wizard, click through accepting defaults until reaching the Features page
Scroll down, expand the User Interfaces and Infrastructure feature, select Desktop Experience, Add features, Next, Restart the destination server automatically if required, and Install.
Wait for the Feature to install successfully and the RDSH server to restart.
Add the server running AD DS and RD Connection Broker to the RD Gateway server’s Resource Authorization Policies (RAP)
Note: This step is only required if the RD Connection Broker role service has been installed on the same server as AD DS role.
From Server Manager on the RDMS server, select All Servers, right click the RD Gateway server, and select Remote Desktop Connection
Logon to the RD Gateway server using a domain admin account
From Server Manager on the RD Gateway server, select Tools, Terminal Services, and RD Gateway Manager
In the RD Gateway Manager’s left pane, expand the Local computer (e.g. Contoso-WebGw1) and expand Policies
Right click Resource Authorization Policies, select Create New Policy, and Custom
In the New RD RAP dialog, enter a Policy name, e.g. AllowAdCbConnections
Select the User Groups tab and Add…
In the Select Groups dialog, enter Domain Users and select OK
In the New RD RAP dialog, select the Network Resources tab, the Select an existing RD Gateway-managed group or create a new one radio button, and Browse…
In the Select a RD Gateway-managed computer group dialog, select Create New Group…
In the New RD Gateway-Managed Computer Group dialog, enter a group Name, e.g. AdCbGroup
Select the Network resources tab, enter the fully qualified domain name of the server running RD Connection Broker and AD DS, e.g. Contoso-AdCb1.Contoso.com, and select Add, OK, OK, and OK
Connect to deployment from the client computer over the Internet
Add https (443) and UDP (3391) endpoints for RD Web and Gateway virtual machine
In the Microsoft Azure Management Portal, select VIRTUAL MACHINES, the virtual machine running RD Web Access and RD Gateway, e.g. Contoso-WebGw1, ENDPOINTS, + ADD
In the ADD ENDPOINT wizard, select ADD STANDALONE ENDPOINT, HTTPS, and accept the default ports (443).
Repeat step b. and add a UDP endpoint with ports set to 3391.
Install the self-signed client certificates on the client computer
This procedure is not required if a certificate has been obtained from a trusted root certificate authority.
Logon to the client computer with an administrative account, navigate to the folder where the certificates were copied, right click one of the certificate files, and select Install certificate.
In the Certificate Import Wizard, select Local Machine, Place all certificates in the following store, Browse…, Trusted Root Certification Authorities, OK, Next, Finish, and OK.
Repeat steps a. and b. for the other certificate.
Connect to the deployment through RD Web Access and RD Gateway
Note: There are multiple ways to connect from a client computer to the desktop hosting deployment. These are described in the TechNet Wiki article titled Distribution of Remote Apps and Desktops in Windows Server 2012. The steps in this section connect using the RD Web Access site.
Launch Internet Explorer
In the address field, enter the FQDN of the cloud service, e.g. https://Contoso-CS1.cloudapp.net/RDWeb
Sign in with a domain user account, e.g. Contoso\u1
Under RemoteApp and Desktops select one of the collections created for this deployment, e.g. ContosoDesktop
Select Connect
Secure the Deployment
Delete unused endpoints for the RD Web Access and RD Gateway virtual machine, e.g. Contoso-WebGw1
Hint: If later you choose to recreate these endpoints, use port numbers from the ephemeral port range (49152 to 65535) for the external port numbers.
In the Microsoft Azure Management Portal, select VIRTUAL MACHINES, the RD Web Access and RD Gateway virtual machine (e.g. Contoso-WebGw1), and ENDPOINTS
Select an endpoint (except the HTTPS and UDP endpoints) and DELETE
Wait for the endpoints to delete successfully.
Repeat steps b. and c. for each endpoint (except the HTTPS and UDP endpoints)
Repeat step 1 for each virtual machine in the tenant’s deployment, e.g. Contoso-AdCb1 and Contoso-RDSH1
|