How to install, setup and deploy a remote desktop server

I put this blog post and video together to document setting up a basic RDP Server for setting up access for organizations that need to quickly move users from an on site workstation based setup to a mobile VPN based work environment.  I had set this up in anticipation that my organization would be required to work from home because of CORVID-19.  To take care of the VPN I used our PFSENSE firewall to handle the VPN connection.

How the setup was done you can find the documentation here for site2site VPN  https://optionkey.blogspot.com/2019/12/setting-up-site-to-site-vpn-on-pfsense.html or  client2site VPN https://optionkey.blogspot.com/2017/03/setting-up-pfsense-with-openvpn-using.html.  Almost all users were setup using client to site.

For the setup of the server 2019 Hyper-V virtual I machine, I downloaded the Server 2019 ISO on a trial basis from microsoft https://www.microsoft.com/en-us/cloud-platform/windows-server-trial (RDP is 120 day trial).  The server was configured with the following specs 24 Gigabytes of dynamic ram (use non-dynamic setting for better performance), a quad core CPU and 127GB disk.  You can view a full video of the install, setup and configuration on my youtube channel https://www.youtube.com/watch?v=mQG8TN_yf6Q

What this post will do:

This post will help you get a RDP server setup without a domain and it will explain the process of letting local users to connect and use the RDS server, and then connect it to a domain to get some additional features such as App-V, additional user permissions, etc.

Setup:

After your initial install of Windows, you will want to go to the add and remove features tab in server manager.

Select a Role-based or feature-based installed

Install roles and features you want for a RDP Server I use the following:

● .net 3.5

● Multipath IO

● Network Load Balancing

● Remote Server Admin Tools

● Remote Desktop Services
● Remote Access
● Multipath IO

● Network Load Balancing

● Remote Desktop Licensing Diagnoser Tools

● RAS Connection Manager

● Windows Internal DB

● Windows Standards Based Storage Management

● Simple TCP/IP Services

When installing the services select the following:

● Remote Desktop Session Host

● Remote Desktop Connection Broker

● Remote Desktop Gateway

● Remote Desktop Licencing

● Remote Desktop Web Access

To install all these features you will need to specify the additional source as well in my case it is D:\sources\sxs

Installing these services and features will take several reboots.  Once the installation is finished local machine users can login to the server with remote desktop services.  However without a domain, we can't really use services like App-V.  The App-V service is available by ip/machine dns resolution https://$IPADDRESS/rdweb/ but will not have any published apps available.  If your setting up a remote desktop server your doing this because you have multiple users that need to login to your network remotely so most likely your going to use active directory for managing this.  So to get all the features for the remote desktop services you will need connect your system to the domain.  I renamed the machine from the auto generated WIN-HM7LU99C2OG TO RDSv8 and connected the server to the domain controller I was using.

Once you've rebooted the system and are on the domain, go manage -> Add Roles and Features

Select "Start the Remove Roles and Features Wizard"

Now select Remote Desktop Services Installation

Since we are using a single server select our server RDSv8 select the Quick Start.

We want to still use our session-based desktop deployment

Select the RDSv8 server

Once everything has finished installing reboot the server

After reinstalling the services after renaming the machine and connecting to the domain, you can then access remote app and published applications by the URL https://$COMPUTER.DOMAIN/rdweb.    Now your regular RDP session server is available but no you also have App-V and by default the calculator, paint and wordpad are default apps that are available for use.

Something which I recommend doing if your using the RDP server the traditional way instead of using app-v, I would recommend disabling the server manager at login.

Disable server manager on login:

Click on Start > Run.
Type GPEDIT> MSC > hit OK.
The Local Group Policy Editor snap-in will open.
The policy that we are interested in can be found by expanding the following: 

Computer Configuration\Administrative Templates\System\Server Manager.

Now if users can connect to the network using the VPN, you should be able to access the remote desktop server and have access to all the apps that are available on the server.

Once I finished installing the server, I installed Office 2019 as a trial.  Now we had got it licensed before the licence period expired; so I included a link in the Reference Links to how to extend the trial (though I have not tried it myself)

Download and install the trial version of office

https://products.office.com/en-ca/get-started-with-office-2019#office-ContentAreaHeadingTemplate-eri5pno

Reference Links

Install office 365, extend the trial for up to 180 days
https://www.howtogeek.com/148347/how-to-extend-your-office-2013365-trial-to-180-days/

Remote desktop load tester

https://www.microsoft.com/en-ca/download/details.aspx?id=2218

How to ssh into a Linux/Unix System without a password

Login to a Linux/Unix System without a password 

Setting up SSH/RSH Keys for Remote Administration Under Linux/Unix can be one of the most time saving things you can do.  I've set this up because I am managing a dozen Linux based kiosks based Lubuntu Linux and Mozilla FireFox on that need to remotely shutdown and startup.

For managing the kiosks I am using Ubuntu 12.04 LTS, on a VLAN network.  This server also remotely shuts down some Windows based stations and is used for Imaging using the FOG project.  I need to update the RSH Public and Private Key because I have replaced the server.

Setting up RSH Public and Private keys are trivial but this allows me to control the systems without having to enter a password every time I want to do something to the computer (besides something that requires root privileges).

The first thing I do on the computer I want to control the other computers with is generate a public and private key.  I've done this in a .ssh directory using the Terminal

$ mkdir -p $HOME/.ssh
$ chmod 0700 $HOME/.ssh
$ ssh-keygen -t dsa -f $HOME/.ssh/id_dsa -P ''

This should create two files, $HOME/.ssh/id_dsa (private key) and $HOME/.ssh/id_dsa.pub (public key).

In my case I'm using a script called dafturn-ofris which is kind of a steady state script for linux which prevents users from making changes to the system and rebooting restores the system to the state it was frozen in.  So I unfreeze the client system (the system I want to control remotely) and copy the public key from the "Server" to the client; I used SCP to accomplish this.

On the computer you created the key on open the Terminal move to the directory you generated the public key.  In my case it is the .ssh folder in the $HOME directory of the user I'm logged in as.

$ scp id_dsa.pub username@remotehost:directory/to/save/it/in/

Enter in your password and this will complete the file copy.

Then login the remote client move into the directory where you saved the public key and run the following commands.

$ cat id_dsa.pub >> $HOME/.ssh/authorized_keys2
$ chmod 0600 $HOME/.ssh/authorized_keys2

Depending on the version of OpenSSH your using the following commands may also be required.

$ cat id_dsa.pub >> $HOME/.ssh/authorized_keys
$ chmod 0600 $HOME/.ssh/authorized_keys

An alternative is to create a link from authorized_keys2 to authorized_keys; your choice.

$ cd $HOME/.ssh >> ln -s authorized_keys2 authorized_keys

Now you should be able to remote into the client computers you want to control from the server computer without being prompted for a password; with the exception of root access.  I use this for running rsh command that remotely shuts down client stations when its closing time.

Source Credit: http://csua.berkeley.edu/~ranga/notes/ssh_nopass.html