RDS Farm setting applied through GPO causing connection issues

I'm having a strange issue with some RDS GPO's. Since automating the RDS server build process through SCCM I've moved the RDS farm / connection broker settings to a GPO. This works fine, once the servers are built the GPO applies and the machines join the
farm.
However, when any GPO associated with the farm is changed, all the sessions connected to the farm are dropped. User can reconnect but this is very inconvenient for us to try and push shortcuts and what not during production.
After searching fro a while, to me, it seems like the GPO that assigns the farm settings is being reprocessed, causing the settings to drop and connections to be dropped.
I wouldn't think that this would be normal behavior? Can anyone confirm for me that this should work as I expect it to?
Thanks!

Ok so I finally figured it out.
It was what I expected, the GPO refresh was causing the settings to be dropped, this caused some registry keys to momentarily revert to their default.
Specifically:
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Terminal Server/fDenyTSConnections
The problem is that even if you set this registry key by hand, it will still revert during the GPO processing, which is what threw me off.
The solution is to simply apply a GPP to the computer that specifically sets this registry entry to '0'. By setting the GPP, it stops the setting from reverting when GPO is refreshed. After extensive testing, I can confirm that this is fixed.

Similar Messages

Could the iTunes suggested fixes (i.e. DNS flush) CAUSE connectivity issues

I too have recently downloaded the latest version of iTunes and tried unsuccessfully to connect to the iTunes store via my iPod Touch. iTunes even tried to update the latest iPod software but couldn't connect. But here is the my real concern, I tried all of the fixes suggested by iTunes/Apple with no success, however, since these "fixes", my other programs that have worked fine just prior to these "fixes" suddenly don't recognize an internet connection either. I tried to do a Java update...couldn't connect. I downloaded a new game from Gamehouse and tried to login to FunPass (as always)...couldn't connect, however, any game downloaded prior to yesterday's "fixes"...there is no problem connecting. I even yelled at AT&T Yahoo support thinking they were the problem (recent issue with their Protection Suite). Finally, I purchased, downloaded, and ran a new antivirus program thinking a possible virus or malware or adware or something...found & fixed stuff (mostly spyware), but it can't update or finish registering because it also thinks there isn't a connection. Could flushing the DNS (as suggested) cause connectivity problems with my other programs?? Or, any suggestions?? I am desperate

Flushing the DNS entries shouldn't be a problem, as they should just get rebuilt.
DNS stands for Domain Name System, it's just an "address" for all the different computers connected to the internet to find each other.
Here is a good explanation on that process:
+When a computer visits a website for the first time, it stores the website's DNS information in cache. The next time the computer visits a website, it looks in the cache to see if the website's information is present to use. This can cause problems if the website's DNS information has changed since the computer's last visit. Flushing the cache removes all the information stored in cache, forcing the computer to find the new DNS information for the website.+
Message was edited by: Katrina S.

Myspace causes connection issues

It is hard to describe this problem, and hard to search for. I can't seem to find an answer. If myspace was just slow to load, it would be fine, I'd just wait. But what happens is that any time I go to a myspace band page, it kills Firefox's connection to the Internet, and I have to restart firefox.
I have a 24" iMac (1st gen) running Leopard 10.5.1
I use Firefox 2.0.0.11
I have Safari 3.0.4
I am on AT&T DSL
When surfing the web with Firefox, if I try to open a myspace page, it kills firefox's connection to the Internet. Myspace is VERY slow to load, and it almost never completely does. Sometimes the music player loads and sometimes it doesn't. It always messes up firefox's connection. I have to quit firefox and reload it to get it to work again.
Safari does no better; it takes a long time to load and generally doesn't load the whole page either. Sometimes it works, sometimes half the page loads, sometimes I only get a blank screen with blue question marks.
I've tried running firefox in Rosetta. It did not help and actually made FF slower and use a lot more CPU time...
I just tried uninstalling firefox (with app zapper) and reinstalling. Clean install of firefox and it did the same thing. Myspace would load but when it is trying to load the music player it seems to take forever, and when I try to go to any other website it will not connect.
Now it seems worse...I accidentally opened a myspace page and it broke firefox's connection. I restarted firefox and everything worked again except for google mail. I had to restart the Mac to get firefox to access google mail again.
Maybe someone could give me a new direction to take on this, I'm at a loss.

Same issues overhere, sometimes Myspace works perfect and sometimes when logging in and when checking messages in Myspace the page won't load and my internet connection fails.
what i than do is:
1. clean up Safari (cookies and cache)
2. restart my belkin router ( with the Lan cable not connected to the cable modem)
3. connect my cable modem to my belkin router.
4. launch safari and my internet connection is working again.
this could be a OSX Leopard / Myspace bug because its strange that the internet connection gets lost.

Does the Zynga toolbar cause connection issues?

I am having trouble while playing Cityville on FB "trying to connect to server do not close your browser" Oops connection lost, refresh. some say this is due to the zynga game bar . I clean cache,history,cookies regularly and restart from time to time
What should I do? Delete something??

Just as a general comments:
* if you use more than one version of firefox you need to create separate profiles for each, or you probably will run into problems see [http://kb.mozillazine.org/Testing_pre-release_versions]
* if you are using the new 'firefox button' click on that and look for the toolbar viewing options, and any other options it lists
Sorry I do not use Zynga, and do not know whether it is even fully compatible with Firefox 4 beta, alternatively it may even use the apps tabs feature see [[What are App Tabs?]]

Activation failure - Requesting I need to activate Photoshop CS5.1 despite having done this previously & used Photoshop. Adobe can't connect to internet to activate, yet program is allowed through Firewall and not having connectivity issues through Browse

Hi,
I currently have Photoshop CS5.1 on Windows 7 (64 bit) and it's now requesting I need to re-activate it, despite having already done this with a serial number when I installed it and even used the program numerous times.
I get a screen saying "Product activation is required" but every time I try to activate it, it says there was a connection issue and asks me to connect to the internet.
I've checked my firewall settings and Adobe is allowed through. No connection issues using my Browser, Skype etc.
Anyone got any solutions?
Thanks,
Westy

Sign in, activation, or connection errors | CS5.5 and later

Virtual Machine - Connectivity Issues - West US

I have 4 VM running in same Virtual Network hosted in West US. I have been working on these VM for last 2-3 days. However, I am not able to connect to these VM for the past 6 hours. In the management
portal also I am not getting options to connect, restart etc.
Is there any outage in West US data center or is something in Azure West US environment causing connectivity issues?
Thanks,
Venkatesh

I have been down for over 30 dang hours, and my configuring tab just continues to load and not let me do a thing to change tier, which in another topic I created someone said to change it and change it back to fix it. I can't get the darn thing to stop doing
the loading. It does not do anything, and I have been waiting for so dang long for this crap to work. What the heck is going on?
I added an extra vm just before this happen to have availability setup, because it warns that not having 2 vm's will cause more downtime. Actually the problem started before I added the extra VM, but I thought I was getting downtime from one VM. I think
the extra VM is keeping me from changing tiers, but still I can't the thing to finish loading the website VM to even do a thing with it. It just like Microsoft is keeping me from having access.
Edit: I just got it back to the way I had, but the loading is still not working, and I can't change the tier worth crap. It just hangs on the loading. This is BS.

Setting up new ipad 2. Won't accept my PW for my Airport Extreme (Wi Fi network?) Where is the PW for my WiFi? I am stymied. Can I set up through My MacBook Pro, which IS connected to my WiFi network?

Setting up new ipad 2. Won't accept my PW for my Airport Extreme (Wi Fi network?) Where is the PW for my Wi Fi? I am stymied. Can I set up through my MacBook Pro, which IS connected to my WiFi network?

If you could provide the make and model number of the modem that the AirPort Extreme will be connecting to, we can likely tell you a bit more about what to expect in the way of getting the AirPort set up and working.
Unfortunately, "plug and play" does not apply here. You will need to set up and configure the AirPort Extreme using your iPad or iMac to name the AirPort as a device, assign a device password, name the wireless network, assign a device password and a few other things.
Once the AirPort Extreme is set up, you can connect the PC to one of the LAN <--> ports on the AirPort Extreme using an Etherent cable.
The iPad and iMac will connect to the wireless network that the AirPort Extreme provides.

Win2008r2 RDS farm with "Remote Session Environment" set, Need on screen keyboard as well.

I have an RDS farm with select users running an app for their session, I use the following GPO:
http://i.imgur.com/DaKpW76.jpg
This works great, however, I also want an on screen keyboard to load with it as well... This setting disables most login scripts I have tried.

Hi,
Thank you for posting in Windows Server Forum.
Sorry to disappoint you, but as per my research there is no any default path to set for all users to display on-screen keyboard. You need to start manually or need to develop some script to start on logon. For developing any script or program, I suggest you
to contact our MSDN forum.
Hope it helps!
Thanks.
Dharmesh Solanki

I did a full system restore to my phone along with the new 7.0 update. Now I went to restore my phone setting back through Itunes and it goes through all the steps but when it is completed it wont get past the "Connect to Itunes" screen

I did a full system restore to my phone along with the new 7.0 update. Now I went to restore my phone setting back through Itunes and it goes through all the steps but when it is completed it wont get past the "Connect to Itunes" screen

So what happens when you connect to iTunes?

External users cannot connect to RDS Farm (Azure).

Hi Experts,
I hope someone is able to help me with this. I have search high and low, but have not found a solution.
Here we go:
I have setup a RDS Farm in Microsoft Azur, consisting of the following servers:
KRPDC01 (Domain Controler / Active Directory / DNS Server)
KRPSH01 (Remote Session Host #1)
KRPSH02 (Remote Session Host #2)
KRPCB01 (Connection Broker)
I have installed the respective Remote session roles on the above server and added my group of users to the "Remote Desktop Users" group on each Session Host server.
At first glance it seems to work. I seem to be able to connect to the farm with the first user. But most of the times, when a second users tries to connect to the same farm, then login hangs for a time, and the connection is refused with this message:
"Remote Desktop cannot connect to the remote computer for one of the following reasons:
1) Remote Access to the server is not enabled
2) The Remote Computer is turned off
3) The Remote Computer is not available on the network
Make sure that the remote computer is turned on and connected to the network, and that remote access is enabled."
Sometimes not even the first user can connect to the farm at all with the same error message.
I have looked into the logs on the connection broker, and something interesting shows up.
It seems that whenever the connection broker wants to redirect a users connection request to a different server than the one that recieved the connection request, then the connection fails. If however the connection broker grants the connection to the same
server as the request is comming from, then the user is logged in.
Here are the log entries when the connection fails:
"RD Connection Broker received connection request for user xxx\testuser.
Hints in the RDP file (TSV URL) = tsv://MS Terminal Services Plugin.1.KRPCLOUD
Initial Application = NULL
Call came from Redirector Server = KRPSH01.xxx.net
Redirector is configured as Farm member"
Followed by:
"RD Connection Broker successfully processed the connection request for user xxx\testuser. Redirection info:
Target Name = KRPSH02
Target IP Address = 10.4.3.7
Target Netbios = KRPSH02
Target FQDN = KRPSH02.xxx.net
Disconnected Session Found = 0x0"
The a few minutes later this entry is found in the log:
"Remote Desktop Connection Broker Client failed to redirect the user xxx\testuser
Error: NULL"
These are the log entries when the connection is successfull:
"RD Connection Broker received connection request for user xxx\testuser
Hints in the RDP file (TSV URL) = tsv://MS Terminal Services Plugin.1.KRPCLOUD
Initial Application = NULL
Call came from Redirector Server = KRPSH02.xxx.net
Redirector is configured as Farm member"
Followed by:
"RD Connection Broker successfully processed the connection request for user xxx\testuser. Redirection info:
Target Name = KRPSH02
Target IP Address = 10.4.3.7
Target Netbios = KRPSH02
Target FQDN = KRPSH02.xxx.net
Disconnected Session Found = 0x0"
And then:
"Session for user KASSERAPPORTEN\krptest successfully added to RD Connection Broker's database.
Target Name = KRPSH02.kasserapporten.net
Session ID = 2
Farm Name = KRPCLOUD"
And:
"This connection request has resulted in a successful session logon (User successfully logged on to the end point). Remote Desktop Connection Broker will stop monitoring this connection request."
If I connect to one of the other servers on the network - the KRPDC01 - and from there connects to the RDS Farm (internally) then there is no problem recieving the connections. Also connections where the broker has to redirect the connection to a differing
Session Host is completed without problems.
I have noticed than when successfully connection from internally where the connection is redirected by the connection broker, then I actually recieved 2 certificate warnings. One first from the Session Host that have recieved the connection request, and the
shortly after from the second Session Host (when the connection broker is redirecting the connection) and then the connection is established.
When connection from the outside, I never get the second certificate warning.
In Azure I have setup indpoint for Remote Desktop - TCP/3389 on both Session Host servers and on the Connection broker.
As mentioned I am at a total loss, and I hope someone out there is able to help me solve this issue.
Thanks in advance :-)
Regards,
Daniél

Hi,
Seems this issue is related with Windows Azure Virtual Machine, I will move it to Windows Azure Virtual Machine Forum for a better help.
Thank you for your understanding!
Best Regards
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Computers Idle Lockout through GPO

I need to lock out specific computers after some idle period. I have already gone through links like http://gallery.technet.microsoft.com/Lock-Computers-In-Domain-b7f03800#content
where suggestions are to go to users configuration and then lockout using the screen saver. I have tried it and it works for users in an OU where this is applied. This is not what I want.
I want a policy that would lock the computers for users based on locations. For example, it should lock the computer at location X (say the computer name is location_X_PC) after 15 minutes and lock the computer at location Y (say Location_Y_PC) after 30
minutes of inactivity, when the user logs into these PCs.
Can this be achieved? The domain controllers are windows 2003.

That was what I was trying to say - that screensaver feature wouldn't work for me because it applies to users objects only. Sorry if I wasn't clear.
But when you say "You can cause a user setting, to be applied to all users of a computer, by enabling the "Loopback Processing" feature of GPO", can you please elaborate further?
I did go through the blog link but still trying to figure out how all these tie in to designing a GPO that caters my need. That is, lock the computers at certain locations after 15 minutes of inactivity and not apply this policy for computers at some
other location (or apply 30 minutes period).
For example;
If you have computer accounts at LocationX, contained in an AD OU named LocationX.
And you have computer accounts at LocationY, contained in an AD OU named LocationY.
Your user accounts are in a different OU.
In this example, you create a (secure-screen-saver) GPO with the desired 15minute secure-screen-saver, link that GPO to the OU named LocationX. It will not function, because it is linked to an OU which contains computers, not users. This is because the secure-screen-saver
setting applies only to users, and the linked OU does not contain users.
In this example, edit the (secure-screen-saver) GPO, enable the Group Policy Loopback Processing (Merge) setting.
This causes the GPO "engine" on the computers within that OU, to process the GPO twice (once, as a computer, and again as a user). This will apply the secure-screen-saver settings to any/all users who logon to the computers contained in the LocationX
OU. If you logon as Domain Admin to one of those computers, the secure-screen-saver settings will apply to you also.
Further, if you create a similar GPO for secure-screen-saver with desired 30minute timeout, enable Loopback Merge, link this to the LocationY OU, all computer accounts in LocationY OU will be subject to the 30minute settings.
If any user logs on to a computer in a different OU (e.g. Location Z), there is no linked GPO, no relationship to LocationX nor LocationY, the secure-screen-saver settings are not applicable.
In this way, the same user account, can experience different settings via GPO, depending upon which computer they are logged on to.
Note that Loopback processing can produce unexpected results (e.g. if there is a GPO linked to the user OU and another GPO linked to the computer OU, and Loopback Merge is enabled, the combination of user-settings and computer-settings can be confusing if
you are not familiar with it)
Martin has some nice blogs on the topic also here:
http://evilgpo.blogspot.com.au/2012/02/loopback-demystified.html
http://evilgpo.blogspot.com.au/2012/03/how-to-save-my-screen.html
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Best practice for licence server for RDS Farm & Certificate errors

Hello,
I am in the process of creating an RDS farm using Server 2008 R2. I have three Session Hosts and a Connection Broker.
I have a set of 10 user CALs available and also another 20 on our current RDS server which will need migrating once we go live with the farm.
I understand the User CALs need to be installed on another Server 2008 R2 and I am wondering what is best practice. We are running on an entirely virtual environment and it would be simple enough to create another server and install the CALs on there.
The only issue with that is that I would need to create a replica of this new machine for DR purposes, but this would take up valuable space which may not be necessary.
We are planning on creating replicas of one of the Session hosts and the broker for DR, so I am guessing I would need to install some CALs on the Session Host which is going to be replicated.
There are a few options and I am just wondering what is the best way to go about things.
Also, as an aside, I am getting an annoying certificate error each time I log a test user onto the RDS farm - I think this is because I am using the DNS alias of the RDS Farm to log on. Is there an easy way to get around this, other than the 'Do not show
this message again'. I have been doing some research and the world of Certificates is very confusing!!
Thanks,
Caroline
C.Rafferty

Hi Caroline,
Firstly for your License related issue, you can perform the step on any VM or can create the new VM as replica for RDSH server also. But please be sure that you have installed RD License server on it, activate it and then install RDS CAL on it. But be safe
if possible don’t install RD License server with RDCB, please make that out of it as little away. As you can also install RD License server with AD or make replica of that and install RDL on that.
Best practices for setting up Remote Desktop Licensing (Terminal Server Licensing) across Active Directory Domains/Forests or Workgroup
http://support.microsoft.com/kb/2473823
What’s the specified certificate error which you are receiving?
If you're going to allow users to connect externally and they will not be part of your domain, you would need to deploy certificates from a public CA. In meantime you can refer blog for getting insight for certificate case.
Certificate Requirements for Windows 2008 R2 and Windows 2012 Remote Desktop Services
http://blogs.technet.com/b/askperf/archive/2014/01/24/certificate-requirements-for-windows-2008-r2-and-windows-2012-remote-desktop-services.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

RDS Farms in Windows 2008 R2

Hi,
I have a lab with following structure.
RDWEB.test.com ---> RD web server
RDCB.test.com ----> Connection broker
RDSH01.test.com ----> Session server 1
RDSH02.test.com ----> Session server 2
RDSH03.test.com ----> Session server 3
RDSFarm01 (RDSH01, RDSH02, RDSH03) configured.
My Requirement:-
Now I have added two more servers (RDSH04 & RDSH05) in above lab. But this time I want to use RDSFARM02 for these two servers being connection broker (RDCB.test.com ) same as above.
Could you please let me know if it is possible to configure 2nd RDS Farm (RDSFARM02) with same connection broker server (RDCB.test.com) in windows 2008 R2 Environment?
System Engineer

Hi,
Yes, you can configure a second RDS farm using the same broker if you would like. If using DNS RR create the A records for the new FQDN (for example, rdsfarm02.domain.com) to point to RDSH04 and RDSH05, and in RD Session Host Configuration (tsconfig.msc)
on RDSH04 and RDSH05 set the farm name to RDSFARM02.
-TP

SSL & iChat Accounts Set-up Through Directory Utility

I am having a problem with iChat when connecting clients to the services on my server via Directory Utility.
Once set-up through Directory Utility, I launch iChat and cannot get into the account automatically set-up by the server. It just says "Disconnected Unexpectedly".
I can create a brand new account in iChat and it connects fine. The difference is that the account "managed by the system administrator" is set to "Use SSL" using Port 5223. If I create a new account, it uses Port 5222 with no SSL.
Does anyone know where this "Use SSL" option is set on the server (and how I can turn it off)?
I can have my users connect manually, but I'd rather have the server automatically manage buddy lists and stuff like that.
Thanks for any ideas.

I think I solved this.
For anyone else with this problem, you can change these settings in Workgroup Manager>Preferences>Details. Edit com.apple.iCHat.Managed. Change Often>XMPPAccount>AutoDiscoverHostAndPort> to integer:0 and UseSSL to integer:0.
This was not my problem, though. My real issue is caused by a case inconsistency in my hostname. Due to settings in NetBIOS and DNS on my network, I had to give the host an all caps name. iChat is looking for a lowercase name. This can also be fixed in Workgroup Manager>Preferences.

Please help! I try to connect to the Internet but appears inscription There is no expansion of kernel PPP. Yesterday I used internet through the same connection- Dsl pppoe

Please help! I try to connect to the Internet but appears inscription There is no expansion of kernel PPP. Yesterday I used internet through the same connection- Dsl pppoe. Wi fi cannot connect too. On ipad and iphone it is work.

That's odd.
Try this: Unplug your Time Capsule and your router. On your MBP, click the Wi-Fi icon and select "Open Network Preferences".
Click the lock icon to authenticate, then click the "gear" and select "set service order". Wherever AirPort (or Wi-Fi - I forget what Snow Leopard calls it) appears, drag it elsewhere in the list. Click OK, then Apply, then power up your router and TC.
If that doesn't result in any change, repeat the above but try making the service(s) you do not need "inactive".
The purpose of this is to reset or at least change your Network Preferences, which somehow got confused upon upgrading to SL.

RDS Farm setting applied through GPO causing connection issues

Similar Messages

Maybe you are looking for