Deploying Microsoft Remote Desktop Services

In this tutorial, we will deploy a Yandex Cloud Microsoft Windows Server Datacenter consisting of a single server with pre-installed Active Directory and Remote Desktop Services. You can select one of the images with preset quotas for 5, 10, 25, 50, and 100 users. In our example, we will select a 5-user quota.

To deploy the Remote Desktop Services infrastructure:

1. Get your cloud ready.
2. Create a cloud network and subnets.
3. Create an administrator account management script.
4. Create a Remote Desktop Services VM.
5. Install and configure Active Directory.
6. Set up firewall rules.
7. Set up a domain license server.
8. Set up the Remote Desktop Session Host role.
9. Create users.

If you no longer need the resources you created, delete them.

Get your cloud readyGet your cloud ready

Sign up in Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or register a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can navigate to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The cost of Microsoft Windows Server with Remote Desktop Services infrastructure includes:

• Fee for continuously running virtual machines (see Yandex Compute Cloud pricing).
• Fee for dynamic or static public IP addresses (see Yandex Virtual Private Cloud pricing).
• Fee for outbound traffic from Yandex Cloud to the internet (see Yandex Compute Cloud pricing).

Create a cloud network and subnetsCreate a cloud network and subnets

Create a cloud network named my-network with subnets in all availability zones that will host your VMs.

1. Create a cloud network:

   Management console

   CLI

   API

   To create a cloud network:

   1. Open the Virtual Private Cloud section of the folder where you want to create a cloud network.
   2. Click Create network.
   3. Specify the network name: my-network.
   4. Click Create network.

   If you do not have the Yandex Cloud CLI yet, install and initialize it.

   The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

   To create a cloud network, run this command:

   yc vpc network create --name my-network
   

   Use the create REST API method for the Network resource or the NetworkService/Create gRPC API call.

2. Create a subnet in my-network:

   Management console

   CLI

   API

   To create a subnet:

   1. Open the Virtual Private Cloud section in the folder where you want to create a subnet.
   2. Click the cloud network name.
   3. Click Add subnet.
   4. Fill out the form: enter my-subnet-d as the subnet name and select the ru-central1-d availability zone from the drop-down list.
   5. Enter the subnet CIDR: IP address and subnet mask 10.1.0.0/16. For more information about subnet IP address ranges, see Cloud networks and subnets.
   6. Click Create subnet.

   To create a subnet, run this command:

   yc vpc subnet create \
     --name my-subnet-d \
     --zone ru-central1-d \
     --network-name my-network \
     --range 10.1.0.0/16
   

   Use the create REST API method for the Subnet resource or the SubnetService/Create gRPC API call.

Create an administrator account management scriptCreate an administrator account management script

If you are going to create your VM via the CLI, create the setpass file with a script that will set the administrator password:

#ps1
Get-LocalUser | Where-Object SID -like *-500 | Set-LocalUser -Password (ConvertTo-SecureString "<your_password>" -AsPlainText -Force)

The password must meet the complexity requirements.

You can read more about the best practices regarding Active Directory safety on the MS official website.

Create a Windows Server Remote Desktop Services VMCreate a Windows Server Remote Desktop Services VM

Create an internet-facing VM with pre-installed Windows Server and Remote Desktop Services.

 yc compute instance create \
   --name my-rds-vm \
   --hostname my-rds-vm \
   --memory 8 \
   --cores 4 \
   --zone ru-central1-d \
   --network-interface subnet-name=my-subnet-d,ipv4-address=10.1.0.3,nat-ip-version=ipv4 \
   --create-boot-disk image-folder-id=standard-images,image-family=windows-2022-dc-gvlk-rds-5 \
   --metadata-from-file user-data=setpass

Install and configure Active DirectoryInstall and configure Active Directory

1. Restart my-rds-vm:

   Management console

   CLI

   API

   1. On the folder dashboard in the management console, select Compute Cloud.
   2. Select the my-rds-vm VM.
   3. Click and select Restart.

   yc compute instance restart my-rds-vm
   

   Use the restart REST API method for the Instance resource or the InstanceService/Restart gRPC API call.

2. Connect to my-rds-vm through RDP. Use Administrator as the username and your password.

3. Assign Active Directory roles:

   PowerShell

   Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
   Restart-Computer -Force
   

4. Create an Active Directory forest:

   PowerShell

   Install-ADDSForest -DomainName 'yantoso.net' -Force:$true
   

   Windows will restart automatically. Reconnect to my-rds-vm. Use yantoso\Administrator as the username and your password. Relaunch PowerShell.

Set up firewall rulesSet up firewall rules

1. Add firewall rules protecting Active Directory from external network requests:

   PowerShell

   Set-NetFirewallRule `
     -DisplayName 'Active Directory Domain Controller - LDAP (UDP-In)' `
     -RemoteAddress:Intranet
   
   Set-NetFirewallRule `
     -DisplayName 'Active Directory Domain Controller - LDAP (TCP-In)' `
     -RemoteAddress:Intranet
   
   Set-NetFirewallRule `
     -DisplayName 'Active Directory Domain Controller - Secure LDAP (TCP-In)' `
     -RemoteAddress:Intranet
   

Set up a domain license serverSet up a domain license server

1. Add the Network Service user to the Terminal Server License Servers Active Directory group:

   PowerShell

   net localgroup "Terminal Server License Servers" /Add 'Network Service'
   

2. Set the licensing type.

   Note

   You can only use User CAL licenses.

   PowerShell

   New-ItemProperty `
   -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' `
   -Name 'LicensingMode' `
   -Value 4 `
   -PropertyType 'DWord'
   

3. Specify the RDS licensing service:

   PowerShell

   New-ItemProperty `
   -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' `
   -Name 'LicenseServers' `
   -Value 'localhost' `
   -PropertyType 'String'
   

4. Optionally, limit the number of concurrent server sessions:

   PowerShell

   New-ItemProperty `
   -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' `
   -Name 'MaxInstanceCount' `
   -Value 5 `
   -PropertyType 'DWord'
   

Set up the Remote Desktop Session Host roleSet up the Remote Desktop Session Host role

Install the Remote Desktop Session Host role on the server:

Install-WindowsFeature RDS-RD-Server -IncludeManagementTools
Restart-Computer -Force

Add your license server to the Active Directory security group and register it as SCPAdd your license server to the Active Directory security group and register it as SCP

Add your license server to the Terminal Server License Servers group Active Directory group and register it as the license service connection point (SCP):

Create usersCreate users

1. Create test users:

   PowerShell

   New-ADUser `
     -Name ru1 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   New-ADUser `
     -Name ru2 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   New-ADUser `
     -Name ru3 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   New-ADUser `
     -Name ru4 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   New-ADUser `
     -Name ru5 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   

2. Grant Remote Desktop Users permissions to the new users:

   PowerShell

   Add-ADGroupMember -Members 'ru1' -Identity 'Remote Desktop Users'
   Add-ADGroupMember -Members 'ru2' -Identity 'Remote Desktop Users'
   Add-ADGroupMember -Members 'ru3' -Identity 'Remote Desktop Users'
   Add-ADGroupMember -Members 'ru4' -Identity 'Remote Desktop Users'
   Add-ADGroupMember -Members 'ru5' -Identity 'Remote Desktop Users'
   

3. Set up RDP access permissions for the Remote Desktop Users group:

   PowerShell

   & secedit /export /cfg sec_conf_export.ini  /areas user_rights
   $secConfig = Get-Content sec_conf_export.ini
   $SID = 'S-1-5-32-555'
   $secConfig = $secConfig -replace '^SeRemoteInteractiveLogonRight .+', "`$0,*$SID"
   $secConfig | Set-Content sec_conf_import.ini
   & secedit /configure /db secedit.sdb /cfg sec_conf_import.ini /areas user_rights
   Remove-Item sec_conf_import.ini
   Remove-Item sec_conf_export.ini
   

How to delete the resources you createdHow to delete the resources you created

If you no longer need the resources you created, i.e., VMs and networks, delete them.