Deploying Microsoft Remote Desktop Services

This scenario describes how to deploy Microsoft Windows Server Datacenter with pre-installed Remote Desktop Services in Yandex Cloud. The Microsoft Windows Server with Remote Desktop Services instance consists of a single server with Remote Desktop Services and Active Directory installed. Images are available with preset quotas for 5, 10, 25, 50, and 100 users. Select the version with the necessary quota. All examples are given for a server with a quota for five users.

To deploy the Remote Desktop Services infrastructure:

1. Prepare your cloud.
2. Create a cloud network and subnets.
3. Create a script to manage a local administrator account.
4. Create a VM for Remote Desktop Services.
5. Install and configure Active Directory domain controllers.
6. Set up the firewall rules.
7. Set up the license server in the domain.
8. Set up the Remote Desktop Session Host role.
9. Create users.

If you no longer need the resources you created, delete them.

Prepare your cloudPrepare your cloud

Sign up for Yandex Cloud and create a billing account:

1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

Required paid resourcesRequired paid resources

The cost of installing Microsoft Windows Server with Remote Desktop Services includes:

• Fee for continuously running virtual machines (see Yandex Compute Cloud pricing).
• Fee for using dynamic or static public IP addresses (see Yandex Virtual Private Cloud pricing).
• Fee for outbound traffic from Yandex Cloud to the internet (see Yandex Compute Cloud pricing).

Create a cloud network and subnetsCreate a cloud network and subnets

Create a cloud network named my-network with subnets in all availability zones where your VMs will be located.

1. Create a cloud network:

   Management console

   CLI

   API

   To create a cloud network:

   1. Open the Virtual Private Cloud section of the folder where you want to create a cloud network.
   2. Click Create network.
   3. Enter the network name: my-network.
   4. Click Create network.

   If you do not have the Yandex Cloud command line interface yet, install and initialize it.

   The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

   To create a cloud network, run the command:

   yc vpc network create --name my-network
   

   Use the create REST API method for the Network resource or the NetworkService/Create gRPC API call.

2. Create a subnet in my-network:

   Management console

   CLI

   API

   To create a subnet:

   1. Open the Virtual Private Cloud section in the folder to create a subnet in.
   2. Click the name of the cloud network.
   3. Click Add subnet.
   4. Fill out the form: enter my-subnet-d as the subnet name and select the ru-central1-d availability zone from the drop-down list.
   5. Enter the subnet CIDR: IP address and subnet mask: 10.1.0.0/16. For more information about subnet IP address ranges, see Cloud networks and subnets.
   6. Click Create subnet.

   To create a subnet, run the following command:

   yc vpc subnet create \
     --name my-subnet-d \
     --zone ru-central1-d \
     --network-name my-network \
     --range 10.1.0.0/16
   

   Use the create REST API method for the Subnet resource or the SubnetService/Create gRPC API call.

Create a script to manage a local administrator accountCreate a script to manage a local administrator account

Create a file named setpass with a script that will set a password for the local administrator account when you create VMs via the CLI:

#ps1
Get-LocalUser | Where-Object SID -like *-500 | Set-LocalUser -Password (ConvertTo-SecureString "<your_password>" -AsPlainText -Force)

The password must meet the complexity requirements.

You can read more about the best practices for securing Active Directory on the MS official website.

Create a VM for Windows Server with Remote Desktop ServicesCreate a VM for Windows Server with Remote Desktop Services

Create a virtual machine for Windows Server with Remote Desktop Services. This VM will have internet access.

 yc compute instance create \
   --name my-rds-vm \
   --hostname my-rds-vm \
   --memory 8 \
   --cores 4 \
   --zone ru-central1-d \
   --network-interface subnet-name=my-subnet-d,ipv4-address=10.1.0.3,nat-ip-version=ipv4 \
   --create-boot-disk image-folder-id=standard-images,image-family=windows-2022-dc-gvlk-rds-5 \
   --metadata-from-file user-data=setpass

Install and configure Active Directory domain controllersInstall and configure Active Directory domain controllers

1. Restart my-rds-vm:

   Management console

   CLI

   API

   1. On the folder page in the management console, select Compute Cloud.
   2. Select the my-rds-vm VM.
   3. Click and select Restart.

   yc compute instance restart my-rds-vm
   

   Use the restart REST API method for the Instance resource or the InstanceService/Restart gRPC API call.

2. Connect to my-rds-vm through RDP. Use Administrator for username, and your password.

3. Assign Active Directory roles:

   PowerShell

   Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
   Restart-Computer -Force
   

4. Create an Active Directory forest:

   PowerShell

   Install-ADDSForest -DomainName 'yantoso.net' -Force:$true
   

   Windows will restart automatically. Reconnect to my-rds-vm. Use yantoso\Administrator for username, and your password. Relaunch PowerShell.

Set up the firewall rulesSet up the firewall rules

1. Add firewall rules that protect Active Directory from external network requests:

   PowerShell

   Set-NetFirewallRule `
     -DisplayName 'Active Directory Domain Controller - LDAP (UDP-In)' `
     -RemoteAddress:Intranet
   
   Set-NetFirewallRule `
     -DisplayName 'Active Directory Domain Controller - LDAP (TCP-In)' `
     -RemoteAddress:Intranet
   
   Set-NetFirewallRule `
     -DisplayName 'Active Directory Domain Controller - Secure LDAP (TCP-In)' `
     -RemoteAddress:Intranet
   

Set up the license server in the domainSet up the license server in the domain

1. Add the Network Service system user to the Terminal Server License Servers group in the Active Directory security group:

   PowerShell

   net localgroup "Terminal Server License Servers" /Add 'Network Service'
   

2. Set the licensing type.

   Note

   You can only use User CAL licenses.

   PowerShell

   New-ItemProperty `
   -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' `
   -Name 'LicensingMode' `
   -Value 4 `
   -PropertyType 'DWord'
   

3. Specify the RDS licensing service:

   PowerShell

   New-ItemProperty `
   -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' `
   -Name 'LicenseServers' `
   -Value 'localhost' `
   -PropertyType 'String'
   

4. (Optional) Limit the number of permitted concurrent server sessions:

   PowerShell

   New-ItemProperty `
   -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' `
   -Name 'MaxInstanceCount' `
   -Value 5 `
   -PropertyType 'DWord'
   

Set up the Remote Desktop Session Host roleSet up the Remote Desktop Session Host role

Install the Remote Desktop Session Host role on the server:

Install-WindowsFeature RDS-RD-Server -IncludeManagementTools
Restart-Computer -Force

Add the server to the AD security group and register it as SCPAdd the server to the AD security group and register it as SCP

Add the server to the Terminal Server License Servers group in the Active Directory security group and register it as the license service connection point (SCP) for users:

Create usersCreate users

1. Create test users:

   PowerShell

   New-ADUser `
     -Name ru1 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   New-ADUser `
     -Name ru2 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   New-ADUser `
     -Name ru3 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   New-ADUser `
     -Name ru4 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   New-ADUser `
     -Name ru5 `
     -PasswordNeverExpires $true `
     -Enabled $true `
     -AccountPassword ("P@ssw0rd!1" | ConvertTo-SecureString -AsPlainText -Force )
   

2. Issue the Remote Desktop Users permissions to users:

   PowerShell

   Add-ADGroupMember -Members 'ru1' -Identity 'Remote Desktop Users'
   Add-ADGroupMember -Members 'ru2' -Identity 'Remote Desktop Users'
   Add-ADGroupMember -Members 'ru3' -Identity 'Remote Desktop Users'
   Add-ADGroupMember -Members 'ru4' -Identity 'Remote Desktop Users'
   Add-ADGroupMember -Members 'ru5' -Identity 'Remote Desktop Users'
   

3. Set up RDP access permissions for the Remote Desktop Users group:

   PowerShell

   & secedit /export /cfg sec_conf_export.ini  /areas user_rights
   $secConfig = Get-Content sec_conf_export.ini
   $SID = 'S-1-5-32-555'
   $secConfig = $secConfig -replace '^SeRemoteInteractiveLogonRight .+', "`$0,*$SID"
   $secConfig | Set-Content sec_conf_import.ini
   & secedit /configure /db secedit.sdb /cfg sec_conf_import.ini /areas user_rights
   Remove-Item sec_conf_import.ini
   Remove-Item sec_conf_export.ini
   

How to delete the resources you createdHow to delete the resources you created

If you no longer need the created resources, delete the VM instances and networks.