Remote Desktop Services Overview

Build and Deploy RDS

Choose the Supported Platform

Windows 10 and Windows 11 Professional, Enterprise, and Education can accept incoming Remote Desktop connections, but a normal Windows client installation is not a supported multiuser session host. Adding several users to Remote Desktop Users permits those accounts to connect; it does not create concurrent, isolated desktop sessions.

Use Windows Server Remote Desktop Services, specifically the RD Session Host role, when multiple users need simultaneous sessions on one server. Each user or device also needs the applicable Windows Server access license and RDS CAL. See Microsoft’s RDS CAL guidance.

Windows Server permits up to two remote sessions for server administration without RDS CALs. Those sessions are only for administering the server, not for delivering applications or desktops to regular users. Connect to an administrative session with:

mstsc.exe /admin

This guide does not use RDP Wrapper or patch termsrv.dll. Those methods modify or intercept protected Windows components, can stop working after updates, and do not provide valid multiuser licensing.

Plan the RDS Deployment

A basic session-based deployment contains these roles:

• RD Session Host: Runs the users’ desktops and applications.
• RD Connection Broker: Assigns users to sessions and reconnects them to existing sessions.
• RD Web Access: Publishes desktops and RemoteApps through a web portal and client feed.
• RD Licensing: Issues and tracks RDS CALs.
• RD Gateway: Provides external RDP access over HTTPS without exposing TCP 3389 directly.

For a domain deployment, prepare domain-joined Windows Server hosts with static addressing, working DNS, current updates, and valid TLS certificate names. A lab can combine roles on fewer servers, but separate roles are easier to secure and scale.

Deploy a Session-Based Desktop

Sign in to the server that will manage the deployment with an appropriate domain administrator account.

1. Open Server Manager and select Manage > Add Servers.
2. Add every server that will participate in the RDS deployment.
3. Select Manage > Add Roles and Features.
4. Choose Remote Desktop Services installation.
5. Choose Standard deployment, then Session-based desktop deployment.
6. Select the servers for RD Connection Broker, RD Web Access, and RD Session Host.
7. Allow the destination servers to restart if required, then select Deploy.
8. Wait until every role reports a successful installation.

These steps follow Microsoft’s RDS infrastructure deployment. Use Quick Start only for a small test environment where all core roles intentionally run on one server.

Add and License the RD Licensing Server

In Server Manager:

1. Open Remote Desktop Services > Overview.
2. Select RD Licensing, choose the license server, and add the role.
3. Open Remote Desktop Licensing Manager from the license server.
4. Right-click the server and select Activate Server.
5. Complete the activation wizard using the appropriate connection method.
6. Right-click the activated server and select Install Licenses.
7. Select the license program and install the purchased RDS CALs.

See Activate the RD Licensing server and Install RDS CALs.

Configure the deployment to use the license server:

1. Open Server Manager > Remote Desktop Services > Overview.
2. Select Tasks > Edit Deployment Properties.
3. Open RD Licensing.
4. Select Per User or Per Device according to the licenses purchased.
5. Add the activated license server and apply the settings.

Domain-joined deployments can use Per User or Per Device licensing. Microsoft requires Per Device licensing for workgroup RD Session Hosts. See License RD Session Hosts.

Create a Session Collection

1. Open Server Manager > Remote Desktop Services > Collections.
2. Select Tasks > Create Session Collection.
3. Enter a descriptive collection name.
4. Select one or more RD Session Host servers.
5. Specify the user groups allowed to connect. Avoid granting access to a broad group unless it is intentional.
6. Configure user profile disks or your selected profile-management solution when required.
7. Create the collection.

A collection makes a full session desktop available to its assigned users. To provide individual applications, select the collection and use RemoteApp Programs > Publish RemoteApp programs. See Create an RDS collection.

Configure Concurrent Session Policies

Apply these settings to the RD Session Host servers through a domain Group Policy Object. For an isolated server, use gpedit.msc locally.

Open:

Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections

Configure:

• Allow users to connect remotely by using Remote Desktop Services: Enabled.
• Limit number of connections: Enabled, with a value appropriate for the server’s capacity and licensed deployment.
• Restrict Remote Desktop Services users to a single Remote Desktop Services session: Enabled when each user should reconnect to one session, or Disabled only when the same user intentionally needs multiple separate sessions.

The connection limit is a technical ceiling. It does not replace RDS CALs or guarantee that the server has enough CPU, memory, storage I/O, and application licenses for that number of users.

Require Network Level Authentication under:

Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security

Set Require user authentication for remote connections by using Network Level Authentication to Enabled. Microsoft recommends NLA because authentication occurs before a complete remote session is created. See the Remote Desktop Services policy reference.

Apply updated policy and display the resulting computer policy:

gpupdate.exe /force
gpresult.exe /scope computer /r

A policy change can disconnect users or change reconnection behavior. Schedule disruptive changes during a maintenance window.

Grant User Access

Assign access through the session collection’s User Groups setting. The assigned users also need the right to sign in through Remote Desktop Services, normally granted through the local Remote Desktop Users group or domain policy.

Inspect the local group:

Get-LocalGroupMember -Group 'Remote Desktop Users'

On a standalone RD Session Host, add a domain group when appropriate:

Add-LocalGroupMember -Group 'Remote Desktop Users' -Member 'CONTOSO\RDS Users'

Replace the example domain and group. In a centrally managed environment, use Group Policy to maintain membership consistently.

Secure Remote Access

Keep TCP 3389 restricted to trusted internal networks. For access from the internet, use an RD Gateway with a trusted TLS certificate, a VPN, or another approved secure access path. Do not expose an RD Session Host directly through unrestricted router port forwarding.

Use strong account passwords, account lockout controls, supported multifactor authentication at the gateway or identity layer, and timely Windows updates. Limit clipboard, drive, printer, and device redirection according to the data handled by the environment.

Check the Remote Desktop firewall rules:

Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Select-Object DisplayName, Enabled, Direction, Action

Verify Active Sessions

Display sessions on the local RD Session Host:

qwinsta.exe

Query another session host:

qwinsta.exe /server:RDSH01

Display user-oriented session information:

quser.exe

The output shows the username, session ID, state, idle time, and sign-in time. See the qwinsta command reference.

Check the installed RDS roles from an elevated PowerShell session:

Get-WindowsFeature RDS-RD-Server, RDS-Connection-Broker, RDS-Web-Access, RDS-Licensing, RDS-Gateway

On the RD Connection Broker, inspect the deployment and collections:

Get-RDServer
Get-RDSessionCollection
Get-RDLicenseConfiguration

The RDMgmt cmdlets require the RDS management tools and a configured deployment.

Troubleshooting

Open Event Viewer and check:

• Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager.
• Applications and Services Logs > Microsoft > Windows > TerminalServices-RemoteConnectionManager.
• Applications and Services Logs > Microsoft > Windows > TerminalServices-Licensing.

Run the RD Licensing Diagnoser from Server Manager when users receive licensing errors.

• A second user disconnects the first user: Confirm that the host is Windows Server with the RD Session Host role and a session collection. Windows client editions are not multiuser RDS hosts.
• The same user reconnects to an existing session: Check Restrict Remote Desktop Services users to a single Remote Desktop Services session.
• Users cannot connect after the grace period: Confirm that the license server is activated, the correct mode is selected, and sufficient compatible RDS CALs are installed.
• A user is denied sign-in: Check collection membership, the Remote Desktop Users group, sign-in rights, NLA, and account status.
• Connections work internally but not externally: Check the RD Gateway, DNS, certificates, firewall rules, and client gateway settings.
• Sessions are slow: Review CPU, memory, disk latency, profile size, redirected devices, and application behavior on every RD Session Host.