Remote Desktop Services 301: Some Advanced RDS Setup Guidelines

Here are some of the key tenants we’ve picked up deploying standalone and farm based Remote Desktop Services (RDS) for our Small Business Solution (SBS) on-premises and in our cloud.

Virtual Desktop Infrastructure, or VDI for short, covers both Remote Desktop Services standalone, farm, and desktop operating system deployments.

This list, while not totally comprehensive, covers a lot of ground.

• Hardware, Storage, and Networking
• GHz and Cores are king
• Balance core count and GHz versus cost
• NOTE: Server 2016 licensing will be, and is as of this writing, based on core count!
• Today is 2 sockets tomorrow is a server total of 16 cores
• Additional Cores purchased in pairs
• Example 1: Dual Socket 8 Core pair = 16 Cores total so OK in current and 2016 licensing
• Example 2: Dual Socket 12 Core pair = 24 Cores total so base license of 16 Cores plus a purchase of 4 licenses (2 cores per license) would be required
• NOTE: Examples may not line up with actual license terms! Please verify when 2016 goes live.
• RAM is cheap so load up now versus later
• Balanced RAM setup is better than Unbalanced
• Balanced: 4x 16GB in primary memory channel slot
• Best performance
• Unbalanced: 4x 16GB in primary and 4x 8GB in secondary
• Performance hit
• ~500MB of RAM per user per session to start
• 25-50 IOPS per user depending on workloads/workflows RDS/VDI
• Average 2.5” 10K SAS is ~250 to 400 IOPS depending on stack format (stripe/block sizes)
• Latency kills
• Direct Attached SAS or Hyper-Converged is best
• Lots of small reads/writes
• Average 16bpp RDS session single monitor 23” or 24” wide: ~95KB/Second
• Average dual monitor ~150KB/Second
• Bandwidth use is reduced substantially with a newer OS serving and connecting remotely (RDP version)
• LoBs (Line of Business applications)
• QuickBooks, Chrome, Firefox, and Sage are huge performance hogs in RDSH
• Be mindful of LoB requirements and provision wisely
• Keep the LoB database/server backend somewhere else
• In larger settings dedicate an RDSH and RemoteApp to the resource hog LoB(s)
• User Profile Disks
• Office 2013 and Exchange 2013 are a wash in this setting
• Search is difficult if not broken
• Search Index database will bloat and fill the system disk! (Blog post with “fix”)
• Office 2016, though still a bit buggy as of this writing, and Exchange 2016 address UPDs and search
• Be mindful of network fabrics between UPDs and RDSH(s)
• Set the UPD initial size a lot larger than needed as it can’t be changed later without a series of manual steps
• UPDs are dynamic
• Keep storage limits in mind because of this
• Printing
• Printers with PCL 5/6 engines built-in are preferred
• Host-based printers are a no-go for us
• HP Professional series LaserJet printers are our go-to
• HP MFPs are preferred over Copiers
• Copier engines tend to be hacked into Windows while the HP MFP is built as a printer out of the box

Previous post on the matter: Some Remote Desktop Session Host Guidelines.

Here’s a snippet of Intel’s current Intel Xeon Processor E5-2600v4 line sorted by base frequency in GHz:

Depending on the deployment type we’re deploying either E5-2643v4 or E5-2667v4 processors for higher density setups at this time. We are keeping at or under eight cores per socket unless we absolutely require more due to the upcoming sockets to cores changes in Windows Server licensing.

If you’d like a copy of that spreadsheet ping us or visit the Intel Ark site.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book
Our Cloud

Remote Desktop Session Host: The System Partition is Getting Full?

In our on-premises and Cloud Desktop RDSenvironments we’ve discovered a number of different things that cause problems for users in Windows Server 2012 R2, Exchange 2013, and Office 2013.

All of our Remote Desktop Session Hosts (RDSHs) are set up with two VHDX files. One for the operating system and one for the data and User Profile Disks (UPDs).

Unfortunately, while UPDs give us a great flexbility option that allow us to have then on the network thus avoid local profile pains in a RDS Farm setting they have a number of different negative impacts on user experience and RDSH health.

One that impacts both is the mysterious filling up of the system partition.

As it turns out, Outlook 2013 and Exchange 2013 plus UPDs means Outlook search is almost completely broken.

But, that doesn’t stop the Windows Server Search Service from doing its best to catalog everything anyway!

What does that mean?

Well, eventually we have a search database that can grow to epic proportions.

Since all of our OS partitions are rather small we end up with session hosts getting their system partition filled rather quickly on a busy RDSH. This is especially true in a Farm setting.

So, what are our options?

Well, we could disable the Windows Search Service. This would be a bad idea since users wouldn’t be able to find _anything_ anymore. We’d go from the occasional complaint to constant complaints. So, not good.

The alternative is to reset the Windows Search index.

1. Start –> Indexing Options
2. Advanced button (UAC)
3. Click the Rebuild button

And, voila! In some cases we get 45GB to 60GB of space back in short order!

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Some Remote Desktop Session Host Guidelines

We’ve put about four years and two versions into our Small Business Solution (SBS). We have it running on-premises on standalone Hyper-V servers as well as on Hyper-V clusters (Clustered Storage Spaces and Hyper-V cluster we just deployed for a 15 seat accounting firm).

It is the foundation for the Cloud Office services we’ve been offering for the last year or so.

Since our Cloud Office solution runs in Remote Desktop Services we figured we’d share some pearls around delivering Remote Desktop Session Host based environments to clients:

• ~512MB/User is cutting it tight
• ~20 to 25 users in a 12GB to 16GB vRAM Hyper-V VM works okay with 2-3 vCPUs
• RDP via 8.1 RDP clients saturates a 1Mb DSL uplink at ~13-15 users depending on workload
• ALL browsers can bring the RDSHs to their knees
• Printing can be a bear to manage (Use Universal Print Drivers and Isolation where possible)
• Group Policy configuration and lockdown is mandatory
• Two partitions with User Profile Disks (UPDs), if used, on the second partition
• NOTE: UPDs + Office 2013 and earlier + Exchange 2013 and earlier = Broken Search!!!
• NOTE: RDSH Search Indexes for Outlook OSTs in UPDs can fill up the C: partition!
• Office 2016 and Exchange 2016 together are supposed to address the broken search situation in RDSH setups were UPDs are used. We have yet to begin testing the two together.

Our Cloud Office (SBS) is running on clusters we’ve designed based on Scale-Out File Server and Hyper-V.

Need a clustered solution for your SMB/SME clients? Drop us a line. They are _very_ affordable. ;)

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

RDS Error: RemoteApp - The digital signature of this RDP File cannot be verified.

The following error was received on a client’s system this morning:

 RemoteApp

The digital signature of this RDP File cannot be verified. The remote connection cannot be started.

In this case the RDSH is using self-issued certificates for both Broker services. They had expired.

1. Server Manager –> Remote Desktop Services –> Collections –> Tasks –> Edit Deployment Properties
2. Click Certificates
3. Click on the first Broker service and then the Create new certificate button
• 
4. Set a password and save to C:\Temp\2015-04-14-SelfIssuedSSL.pfx
5. Click on the second Broker service and Select an Existing Certificate
6. Choose the above newly created certificate

In the case where our client’s domains are .LOCAL or .CORP or some other non-Internet facing TLD we leave those two self-issued.

If we have an Internet facing domain then we use a third party trusted certificate as can be seen in the snip above.

Because we are deploying a lot of Remote Desktop Services solutions we always use an Internet TLD for the internal domain after making sure the client owns that domain and its registered for a decade.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Microsoft Ups Support Ticket to $499 – We Have a Great Alternative: Third Tier!

It seems that this may, or may not, depending on one’s thoughts of how Microsoft sees IT Pros in today’s “Cloud First Mobile First” be another shot at IT Pros that provide much of the front line support to SMB/SME clients.

• Redmond Magazine: Microsoft Increases Support Costs for IT Pros

I’ve been helping out with Third Tier for well over a year and a half now. I’ve been privileged to work on a team of amazing folks as well as work with a great group of IT Pros.

I believe that we at Third Tier offer a viable alternative to Microsoft’s $499 ticket (though I’m not sure what that will work out to in Canada as we pay substantially more than the US equivalent) for spot support or even ongoing support needs.

Given the experience our team has the Third Tier rate of $175/Hour is very reasonable. Active Directory, Exchange, Remote Desktop Services, Hyper-V, VMware, Cluster, and very soon a number of key vertical products and services to help our IT Pros get the job done right the first time!

• Third Tier Help Desk

Third Tier offers a Micro Staffing program where we can be a part of your IT Pro team for ongoing support challenges or staffing challenges. We can be a part of your team for a very reasonable cost.

I’m also excited about some of the things we’ve been working on at Third Tier to provide our IT Pros with a one-stop solution for their data centre that will allow them to provide IaaS and even our SBS (Small Business Solution) at a very reasonable cost per seat! More to come on that soon.

One final thought. If one is caught in a bind with a server down situation then the Microsoft ticket may be the best way. With Action Pack we still get BizCrit (Business Critical) support though via a call back model.

Our response model tends towards scheduled time for tickets as opposed to crash responses. So, please keep that in mind.

Here are some of the areas we can help you with:

• Disaster Recovery Planning and Practice
• Infrastructure planning, migration, support, and recovery
• Active Directory and Group Policy planning, support, and recovery
• Remote Desktop Services planning, support, and recovery
• Exchange planning, migration, support, and recovery
• SQL planning, migration, support, and recovery
• Hyper-V planning, support, and recovery
• Virtualization Solution Performance planning and support
• Specialized Bookkeeping Support and Services
• IT Business Models, Plans, Direction, Vision, and More

Whatever the task, we have a team member that can help. Not only that, one can expect the task to be done in short order and in a professional manner.

If you have not checked us out before please do now.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Allowing Expired or Forced Password Changes on RDWeb

When we deploy a greenfield Windows Server 2012 setup or migrate to one we always make the following small change to the RDWeb configuration:

• IIS --> Sites --> Default Web Site --> RDWeb --> Pages --> Application Settings

This allows the user to change their password if it has expired which would otherwise be a helpdesk call.

When the user goes to log on to RDWeb they will see the following:

• Your password is expired. Click here to change it.

Once they click the link:

The page will indicate the change was successful:

Click OK and the user will be directed back to the logon page.

When we access a user's profile for whatever reason we trigger a password change on the DC and they know to hit RDWeb to log on the first time if they are remote.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

RDWeb in Windows Server 2012 R2

If you have not seen RDWeb in Windows Server 2012 R2 yet, then a look at the feature along with the full Remote Desktop Services suite of abilities in Windows Server 2012 R2 is a must.

Our "Collaborate Anywhere" solution (sound familiar eh? ;) ) is based upon RDWeb and the AuthAnvil Secure Access Portal that we are investing heavily in.

We believe that Cloud has it's place however on-premises still provides the _same_ feature set and location flexibility to our clients that Cloud vendors extol to Cloud alone with the added benefit of data ownership and security.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
Third Tier: Enterprise Solutions for Small Business

RD Gateway and RemoteApp Error: Remote Desktop can't connect to the remote computer "RDS.Domain.Local" for one of these reasons:

We just finished setting up a Windows Server 2012 R2 Standard RDS server and began testing the RD Gateway, RDWeb, and RemoteApp features and hit this:

RemoteApp Disconnected

Remote Desktop can't connect to the remote computer "RDS.Domain.Local" for one of these reasons:

1) Your user account is not authorized to access the RD Gateway "remote.domain.ca"

2) Your computer is not authorized to access the RD Gateway "remote.domain.ca"

3) You are using an incompatible authentication method (for example, the RD Gateway might be expecting a smart card but you provided a password)

Contact your network administrator for assistance.

The third reason is out while the first two are not applicable since our access policies are set up correctly.

Our search brought us to:

• Network Blog: Remote Desktop Gateway client fails authentication with “Your user account is not authorized to access the RD Gateway”

Following Solution 1 we puzzled about trying to figure out where the NPS thing was!

Click on NAP in Server Manager and then right click on the server name. Choose Network Policy Server in the menu.

Once the NPS console comes up right click on the root node NPS (Local) and click Register server in Active Directory.

Click OK twice and then test again.

Good to go!

Philip Elder
Microsoft MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
Third Tier: Enterprise Solutions for Small Business

SSL Certificates: CSR Decoder to Verify Settings

When it comes to creating a certificate request sometimes we can miss a character or typo something.

If the processing takes longer than expected and the certificate provider does not provide much more than a "Processing" status it may be a good idea to verify the settings in the CSR file.

The CSR Decoder site can do that:

• CSR Decoder – Check CSR to verify its contents

We hit a snag with a CSR that was taking too long and sure enough there was a typo in the common name that caused it to hang up.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

RDP Client in Windows 8 and Server 2012 Neat Features

While working from a Windows 8 Enterprise system here in the shop we connected remotely to a Windows Server 2012 Hyper-V environment that we are in the process of setting up for a new client.

A couple of neat new features in the MSTSC (Click Start (WINKey+R) –> Run –> mstsc [Enter]), that is the Microsoft Remote Desktop Connection Client (MicroSoft Terminal Services Client) are the following:

There is a little drop down menu available on the far left of the RDP status bar at the top of the session that gives us access to Windows 8/Server 2012 specific features.

The other thing we noticed was the “wireless” status bars to the right of the Pin.

Click on that and we see the following:

The drop down menu will certainly be handy for windowed RDP sessions since that is how we run most of our remote management sessions.

The connection status bars not so much. It is pretty obvious when we are having connection issues.

Have a great day and thanks for reading! :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

Remote Desktop Services Error: One or more RD Licensing certificates has expired. Please re-register.

We have an Remote Desktop Services server that did the following when users tried to log in:

Since this particular system was headless we tried the /admin switch on an MSTSC command line start and fortunately we got into the server. A regular RDP file launch or MSTSC GUI client connection would fail with the above.

From the server’s Event Logs:

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Licensing
Date:          12/21/2012 6:16:51 PM
Event ID:      46
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      RDSServer.DOMAIN.LOCAL
Description:
One or more RD Licensing certificates has expired. Please re-register.

And:

Log Name:      System
Source:        Microsoft-Windows-TerminalServices-Licensing
Date:          12/21/2012 5:50:42 PM
Event ID:      4105
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      RDSServer.DOMAIN.LOCAL
Description:
The Remote Desktop license server cannot update the license attributes for user "FirstLast" in the Active Directory Domain "DOMAIN.LOCAL". Ensure that the computer account for the license server is a member of Terminal Server License Servers group in Active Directory domain "DOMAIN.LOCAL".
If the license server is installed on a domain controller, the Network Service account also needs to be a member of the Terminal Server License Servers group.
If the license server is installed on a domain controller, after you have added the appropriate accounts to the Terminal Server License Servers group, you must restart the Remote Desktop Licensing service to track or report the usage of RDS Per User CALs.
Win32 error code: 0x80070005

According to our search results we need to do the following:

1. Log onto the RD Licensing Server.
2. Start the RD Licensing Manager (LicMgr.exe).
3. Right click on the ServerName and Advanced –> ReActivate Server.
4. Make the following choices:
• 
5. Click Next
• 
6. We then had a successfully re-activated server.
• 

RemoteApps and RDS Desktop sessions were then available!

• QuickBooks via RemoteApp.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Windows Live Writer

RDP: Set up a Monitor Span for Non-Windows 7 Enterprise/Ultimate End Points

In order to get true multi-monitor client connections going both ends need to be Windows 7 Enterprise and/or Ultimate. Or, when connecting to Remote Desktop Services the client needs to be one of those client OSs.

To get around that for all other client OSs we can do the following:

1. Set up an SSL VPN connection (or PPTP).
• Disable the Use Remote Gateway setting for IPv4 and IPv6.
2. Start –> type: MSTSC [Enter]
• Machine.Domain.Local
• Full Screen
• Redirect needed resources.
• Do not change Gateway settings from default.
3. Save As onto the desktop.
4. Right click RDP file and Open With…
• C:\Windows\notepad.exe
5. Add the following line to the RDP file:
• span monitors:i:1
6. Save the RDP file.
7. Open the VPN connection.
8. Double click on the RDP Desktop file.
9. Log on to the desktop machine.

Users will need to get used to all dialogue boxes saddling the two monitors since that is where the “middle” of the spanned setup is.

The local monitor pair must be side-by-side and the same resolution.

We tested running the RDP file with a Remote Desktop Gateway setting and it seemed to only connect one monitor.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

A Virtualized SBS 2011 and RDS Setup Completed With Some Pics

One of the projects we are just in the process of closing up was the following:

• Intel Server System SR1695GPRX2AC
• Intel Xeon X3470 CPU, 32GB Kingston 1066MHz ECC, Intel RS2BL040 RAID + BBU, 300GB 15K SAS in RAID 10
• Intel Remote Management Module 3 (RMM3LITE) for KVM/out-of-band access to host.
• Cisco SA520-K9
• Cisco 48 Port Small Business Series Gigabit Switch
• APC SMT1500RM2U UPS
• Provides clean power to the networking components.
• APC SMT2200RM2U UPS + AP9630 Remote Management
• Provides clean power to the Intel Server System
• APC NetShelter VX 24U Enclosure (AR3104)

The software for this solution (Open Value Agreement with the 3 year spread payment option) that covers all users:

• Small Business Server 2011 Standard
• Small Business Server 2011 Premium Add-On
• Windows Server 2008 R2 Standard 1+1 for the host OS.
• Windows Remote Desktop Services CALs
• Office Standard
• Windows Desktop OS Software Assurance + MDOP

Here are some shots of the finished server deploy:

• APC AR3104 from the front.

• APC AR3104 from the rear.

The finished product:

We are using SBS 2011 native backup and Windows Server Backup on the RDS server to back up the VMs to Microsoft iSCSI Software Target based VHDs located on the hard drive in the drive dock.

The RDS server hosts an LoB (Line of Business) application being delivered by RD RemoteApp along with Microsoft Office.

This particular client has two satellite offices that will be connecting to the LoB and Office via RemoteApp with a standard DSL Internet connection (3Mbit down and 1Mbit up).

Remote printing via RD RemoteApp is via HP LaserJet Professional P1606dn printers using the most recent HP driver (5.0.1 as of this writing).

We brought in our shop vacuum to clean out the entire area that the server equipment is sitting in. The dust settles over time, so we made sure to start with a clean slate plus we will pop in with the vacuum once every six months or so to keep that area as clean as possible.

A point to consider when it comes to deploying any IT solution into an SMB/SME business is that much of what we do is “virtual”. Meaning that we set up some physical boxes with a bunch of software products and then manage it.

What that means is that “Presentation is Critical”!

Make sure that the solution is tidy with cables tucked neatly away, all surfaces clean (Windex works great), and no papers/paperwork is left lying around the workspace if any.

Another important point when it comes to setting up or visiting a client’s site for any work is to “Leave the scene cleaner than the way we found it”!

That means cleaning up the mess left by the phone line technician or alarm technician that was in that space before us. We may not realize it, but the client notices the state of their space and who makes the messes.

In this case, our client, the business owner is very happy with what they have seen and used on their new IT Solution.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2011 – Remote Desktop Gateway Management

The RD Gateway services are installed and configured by default during the SBS 2011 OS install and then by the Getting Started Tasks Wizards in the SBS Console.

Technically, we are licensed to use the RD Gateway service via the Remote Web Access portal.

If we create RDP files to gain direct access to our desktops on the SBS network or we install and configure an RDS server then we are required to have RDS CALs for each user.

When we have RD Gateway services being utilized in this manner though we may require access to the RD Gateway service.

To do so, we need to install the RD Gateway UI via an elevated command prompt.

• dism /online /Enable-Feature:Gateway-UI.

Note that there will be some errors that come up when opening the RD Gateway console that can be safely ignored. The errors are SBSisms.

• Microsoft Knowledgebase: KB2472211: How to Manage the Remote Desktop Gateway Service in SBS 2011.

Hat Tip: Susan Bradley

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS and RDS – Big Picture How To Set Up RDS On An SBS Network

Original posted to the SBS2K Yahoo Group. This list has been tweaked and updated a bit. :)

A quick overview of how to set up Remote Desktop Services and RD RemoteApps on an SBS network:

1. Win2K8 R2 SP1 OS install
2. Server drivers
3. Updates
1. Windows Server Updates (we group 6-10 at a time).
2. Windows Server Security Updates (again 6-10 at a time).
3. Others.
4. Manufacturer’s Server Management.
• Configure management settings.
5. Enable the RDS Role (RDS + Licensing).
• Leave mode for later.
6. Install Office 2010 with SP1 integrated.
7. RemoteApp deploy needed apps including Office, QB 2011, etc.
8. Create RDP Files in RemoteApp Manager
• We create an internal RDP file set to deploy to local user’s desktops.
• We also create an external RDP file set that includes RD Gateway setting.
• We customize each file name once created.
9. Create folder under SBS RWW/RWA called RDPs.
• C:\Program Files\Windows Small Business Server\Bin\WebApp\RemoteAccess\RDPs
10. Copy RDG enabled RDP files into this folder.
• Must be done from Windows Explorer on SBS.
11. Make MIME changes for .RDP (Charlie's SBS 08 book has this)
12. Edit RWW/RWA Links in SBS Console
• Example RWW/RWA URL: https://remote.domain.com/remote/rdps/winword.rdp
• Description: RemoteApp – Word

When users connect to RDS or RemoteApp they will get a certificate warning. Coach them to tick the "Don't bug me again" box near the bottom left of the window.

Done.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Providing IT Support – Out-of-Band Management Required

A paraphrase of a post to the SBS2K Yahoo Group.

In our opinion a server should _never_ be deployed without iDRAC Enterprise, iLO Advanced, Intel RMM, or other out-of-band (OOB) device. Period.

Professional grade tools for professionals.

We get:

• KVM, USB, and drive redirection to the server.
• BIOS, Firmware, RAID BIOS, etc access.
• BMC Management and sensor logs/data.
• Power cycle and reset ability (frozen OS).
• At-a-glance view of all firmware versions.

What this does for us:

• Immediate access to the _console_
• No travel time delays ... response is quick.
• No need for client intervention in most cases.

When patching or working on servers we create two connections to the box. One via RD Gateway and one via OOB. It is our preference to have physical access to that box at all times.

With the lack of a speaker on the Dell PERC RAID controllers and Open Manage may or may not e-mailing us about a failed drive we prefer to watch all reboot cycles for any anomalies.

If there is a failure, we can recover that server without any client intervention after the tier 1 tech has done their stuff.

I am sorry, but there is something totally unprofessional about, "I am sorry Mr. Customer, but could you sit at the server and see why I am locked out?" Or having to call a client’s user or contact in before or after business hours to find out why something broke. As IT Professionals we need to set the bar higher than that.

With gas at $1.10/Litre (US Gal = 3.78L, IMP Gal = 4.54L) here and rising at this time _not_ having to travel to client sites for out of scope work is a great thing.

Why?

Because they then _do_ see us when we are there for _positive_ things like rotating their backups or our bi-weekly "how are things?" visit (billable as soon as they say, "Can you fix this?" :*) ).

This aspect more than reinforces our _good_ presence in their business. Thus it strengthens our business relationship with our client contact and their users as we are seen and heard when things are good.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Transitioning From SBS At the 75 User/Device Limit How-To

The link came via the SBS2K Yahoo List.

Chris Puckett of Microsoft provides an excellent big picture view of how one would go about removing SBS from the picture once a client has grown past the 75 user/device limit.

• Microsoft TechNet Forums: Best way to expand past SBS 2008, 75 users, and a limited network

The post by Chris:

SBS 2011 Standard still has a 75 user limit, so if you're already approaching 75 it might make more sense to go to Windows Server.  You can migrate away from SBS 2008 by adding new server(s) running Windows Server 2008 R2 as domain controllers to the domain.  Then add Exchange Server 2007/2010 server to migrate your mail to and a Sharepoint Server for that data.

There is no single document for this scenario, but you can treat SBS 2008 as Windows 2008 DC and Exchange/IIS server. The steps would not be much different. The only caveat is once you move the FSMO roles you have 21 days to complete the rest of the migration process and you would have to take care of licensing requirements
A basic outline would be

1. ADprep SBS 2008 with the 08 R2 schema.
2. Join WS08R2 DC as a secondary domain controller in the SBS 2008 Domain
3. Install Exchange 2k7/2k10 on same server or different server.
4. Move mailboxes/public folders, address book generation etc to the new server.. (there should be a guide on migrating exchange 2007 to 2010 on technet)
5. Migrate any IIS websites they wish to keep
6. Migrate any data they wish to keep to the new server (Sharepoint)
7. If folder redirection/roaming profiles configured move that stuff over to the new server by updating the user account/group policy settings.
8. Move FSMO roles and GC to WS08R2 (Might want to wait a few days to make sure everything is remaining operational as you have 21 days from this point).
9. Uninstall Exchange 2007 from SBS 2008
10. DCPromo down SBS 2008
11. Remove the SBS 2008 server from the network

We have not run into this situation with any of our clients yet, but there are a few that are growing at a rate that may place them in this situation in the next year or two.

The above gives us an idea of how to go about keeping the core SBS features, but there are a few others that need to be considered when transitioning away from SBS:

1. Replacing the TS Gateway services setup to maintain remote connectivity to internal desktops and RDS services.
2. Replacing the Remote Web Workplace/Access portal with the Win2K8 R2 RDWeb application along with customizing it to meet a similar functionality to RWW/RWA.
• Microsoft KB 2276908: Windows Server 2008 R2 - RDWeb Access and RemoteApp Configuration.
• Microsoft TechNet: Overview of Remote Desktop Web Access (RD Web Access)
• Microsoft TechNet: Overview of Remote Desktop Connection Broker (RD Connection Broker).
3. Utilizing an MMC structure much like the SBS Native Tools to start with but possibly looking to System Center for an SBS Console like management experience.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2011 – Remote Desktop Gateway Not Available After Update Reboot?

We are in the process of running updates on our newly migrated to SBS 2011 server.

After the server came up from its post update install reboot every logon attempt came up with a “Remote Desktop Gateway service is not available” error.

We flipped over to the Intel Remote Management Module 3 KVM session to see what was going on (we always open a KVM session to watch the server’s reboot cycle) and found the SBS 2011 CTRL+ALT+DEL logon screen.

So, everything looked normal there.

After logging into the KVM session we tried to log on via RDP one more time and it worked.

A look into the Services MMC in the SBS Native Tools Console’s Computer node turned up the following:

• Remote Desktop Gateway: Started – Automatic (Delayed Start)

Ah, not to panic then. We just need to be a bit more patient as things come up after that boot cycle! :)

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS – Setting Limits To RDP Sessions

As the Windows Server operating system gets more advanced in the methods that we use to remotely connect to our Remote Desktop Services/Terminal Services servers or desktops behind TS/RDS Gateway we need to be mindful of the bandwidth requirements for the connections.

With SBS 2011 we can connect to our office based PC with multiple monitors, stream video, stream sound, and a lot more on that one connection.

So, out of the box we set some limits to what we can and cannot do with our RDP connection to an SBS network.

The above screenshot is of a GPO setting opened in our SBS 2011’s GPMC. In this setting we are putting a limit on the number of monitors that a remotely connected user can use for their connection at 2.

Note that in any GPO setting that allows for a comment, including the GPO itself, we put comments in as above or with a brief description as to why the policy was enabled or disabled. We try and do this to keep track of the changes we have made with the descriptions helping us to understand why things were they way they were later on in the life of the SBS network.

The rest of the settings in the Windows Computers Policy are as follows:

• Enforce removal of the remote PC’s wallpaper.
  • This one is pretty obvious as the high resolution colour images will hit the screen refresh rate significantly.
• Limit colours to 15 bits.
• Maximum remotely connected monitors: 2.
• Remove the “Disconnect” button from the Shutdown Dialogue.
  • We request that users always log off their remote sessions when done.
• Enable the Windows Security item on the Start menu.
  • This item gives them the ability to access the Windows Security menu to make changes if they get stuck.
  • 

The settings will be in a slightly different location for GPOs in SBS 2008 and SBS 2003 as RDS was Terminal Services in those editions.

In certain circumstances we will also enable the Restrict Remote Desktop Services users to a single Remote Desktop Services session setting.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

Remote Desktop Connection Manager – Multiple RDP Sessions Managed Easily

This is a pretty kewl utility:

We can set up all of the servers and desktops that we manage on a regular basis in the Connection Manager and have quick and easy access to them.

• Microsoft Download: Remote Desktop Connection Manager

The RDCM can store credentials as well so we will only allow that to happen on workstations or laptops that are BitLocker enabled.

Hat Tip: Jason Miller

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer