Archive for February, 2015

Windows 2012 R2 Single Sign On with RemoteAPP Web Access

It took me quite long to figure it out to get RemoApp on WebAccess working with “Web Single Sign On”.

Here the steps to get it done:

1. ISS Certificate for https

If you have an internal CA you need to create a certificate for IIS and make sure it is trusted on your client computer to connect via https to:
https:\\yourserver.domain.local\rdweb\

Certificate can be created or imported here in IIS:
1. Run inetmgr
2. Choose your IIS Server
3. Import or create a certificate in Server Certificates

Follow these steps to activate it in IIS:
1. Run inetmgr
2. Go to IIS Server\Sites\Default Web Site\Bindings\https:
3. Edit Setting and pick there the SSL Certificate

If you have an internal CA and it is already trusted on your client computer then you don’t require to do anything otherwise you need add the Root Certificate into the Trusted Root Certifications Container.

Important: You should also have valid certificates for your connection broker and rdp etc.

2. Change “Form Based Authentication” to SSO
1. Run inetmgr and enable only Windows Authentification in RDWeb Authentication

2. Backup and edit %SYSTEMROOT%\Web\RDWeb\pages\web.config

3. Change Authentification Method (Comment Forms out)
<authentication mode=”Windows”/>
<!–
<authentication mode=”Forms”>
<forms loginUrl=”default.aspx” name=”TSWAAuthHttpOnlyCookie” protection=”All” requireSSL=”true” />
</authentication>
–>

4. Change Security Mode (Comment it out)
<!–
<security>
<authentication>
<windowsAuthentication enabled=”false” />
<anonymousAuthentication enabled=”true” />
</authentication>
</security>
–>

4. Backup and edit %SYSTEMROOT%\Web\RDWeb\Pages\en-us\Default.aspx

5. Change to private mode
public bool bShowPublicCheckBox = false, bPrivateMode = true, bRTL = false;

3. IE Security
In my environment it just worked when I didn’t use you the FQDN for my Server in Internet Eplorer. As soon as I used the FQDN it asked me to put in the credentials and to avoid that I made sure that our internal domain is added to the Intranet Zone in Internet Explorer.

Create a GPO:
Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Site to Zone Assignment List

Add:
*.yourdomain.com with value 1

4. Trusted RDP Connection
Even you can login to the webapage now without beeing prompted you will still get a warning dialog as soon as you click on an icon.

Create a GPO:
Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Connection Client

And add the thumbprints of the RDP Certificates in “Specify SHA1 thumprints of certificates representing trusted .rdp publishers”

5. Allow Delegation of Default Credentials for RDP
So finally you get a last dialog which will ask yo to put in the credentials. If you don’t like that you can solve it with following GPO.

Create a GPO:
Computer Configuration\Policies\Administrative Templates\System\Credential Delegation\Allow delegation default credentials

And add: TERMSRV/*.yourdomain.com

No Comments »

admin on February 12th 2015 in IT, Windows Server




Check out new movies online website. Download and buy movies now.
1