Using Terminal Services as a Remote Access Solution at Microsoft

1. Using Terminal Services as a Remote Access Solution at Microsoft Published: April 2008

2. The Terminal Services environment at Microsoft The Windows Server® 2008 Terminal Services pilot The Terminal Services Gateway (TS Gateway) feature Scalability—load-balancing configurations User experience enhancements Using TS Gateway as a remote access portal Best practices Conclusion Agenda

3. Windows® Terminal Services Network Load Balancing (NLB) SSL Domain Name System (DNS) configuration—DNS round robin Prerequisite Knowledge Level 200

4. Current Environment Terminal Services at Microsoft IT Three Windows Server 2003–based Terminal Services deployments worldwide Only a few applications are supported Seven internal business applications Microsoft® Office system applications such as Microsoft Office Word and Microsoft Office Excel® Experienced little usage—only 30 to 40 users each month

5. Current Environment Accessing terminal servers—challenges Terminal servers can be accessed only from within the internal corporate network Remote users must first establish a virtual private network (VPN) connection to the internal network VPN connection requires an appropriately configured computer Many organizations do not allow for outbound VPN connections VPN connections are less tolerant to network delays

6. Windows Server 2008Terminal Services deployment goals Test and validate the TS Gateway concept—remove the limitations of a VPN connection Test the scalability of a Windows Server 2008–based terminal server farm Increase the security of sensitive corporate documents Reduce the likelihood that users copy internal documents to remote computers

7. Terminal Services PilotDeployment strategy Phase 1: Configure a single TS Gateway environment Perform security tests to verify that the environment meets security requirements Open TS Gateway to approximately 200 developers to obtain initial feedback Phase 2: Extend the environment to multiple sites worldwide Open TS Gateway to multiple groups at Microsoft Perform load-balancing and scalability tests

8. Terminal Services GatewayOverview of the TS Gateway role A Web server component Provides the following functionalities Acts as the endpoint of an SSL connection Performs authentication and authorization of the connecting user Forwards the user’s connection to a resource by using Remote Desktop Protocol (RDP) Requires Terminal Services client (TSClient) version 6.0

9. TS Gateway DesignConnection process

10. Terminal Services PilotPhase 1—deployment characteristics Two TS Gateway computers Five Windows Server 2008–based terminal servers One Terminal Services Session Broker (TS Session Broker) computer All computers based on commodity hardware Dual 2.2-gigahertz (GHz) CPUs Four gigabytes (GB) RAM

11. Deployment ResultsPhase 1—initial feedback Approximately 200 users—Terminal Services developers group The TS Gateway concept proven Users could successfully connect from any location worldwide Connection speed met or exceeded that of a VPN connection Extremely popular with developers—easy connections to Remote Desktop–enabled workstations

12. Extending the DeploymentPhase 2—expanded goals Expand the deployment to that of a large enterprise-level deployment Test TS Gateway scalability By using NLB clusters By using third-party load balancers Test terminal server farm scalability Round-robin DNS TS Session Broker Implement user experience enhancements TS Portal—based on Terminal Services Web Access (TS Web Access) TS RemoteApp

13. Extending the DeploymentPhase 2—deployment characteristics Ten TS Gateway computers Nine terminal servers Three TS Session Broker computers Four locations worldwide Dublin Hyderabad Redmond Singapore

14. Deployment Characteristics A worldwide implementation

15. Worldwide DeploymentUsage statistics Deployment first opened to other developer groups—approximately 2,000 developers Deployment next opened to other groups at Microsoft—a goal of increased usage of typical terminal server resources Overall usage of approximately 7,500 people worldwide

16. Worldwide DeploymentUsage statistics—Dec 1, 2007, through Dec 31, 2007

17. Worldwide DeploymentLoad statistics—Dec 1, 2007, through Dec 31, 2007

18. TS Gateway ScalabilityNetwork Load Balancing NLB clusters are limited by overall traffic and not by the number of nodes A heavily loaded cluster may experience issues with convergence and with cluster node synchronization For Windows Server 2008–based NLB clusters Single node—supports approximately 700 simultaneous connections with a maximum of 1,300 connections Multiple nodes—supports approximately 1,500 simultaneous connections with a maximum of 2,600 connections For fault tolerance, it is best to deploy at least three nodes to support 1,500 connections For loads greater than 1,500 simultaneous connections, a third-party load balancer is best

19. TS Gateway Load BalancingTraffic flow

20. TS Gateway ClusteringBenefits IP affinity is not required—improves cluster efficiency TS Gateway automatically redirects the SSL traffic to the appropriate TS Gateway computer Enables TS Gateway to efficiently handle multiple connections from an organization that has only one external IP address Uses SSL for session encryption SSL connections are much more tolerant to network delays than are VPN connections SSL connections do not require specialized configuration

21. Terminal Server ScalabilityLoad balancing in a terminal server farm Implemented a typical DNS round-robin configuration Implemented TS Session Broker A new feature—builds on the functionality that is available in Terminal Services Session Directory Provides a load-balancing functionality and user session management Directs a reconnected session to the appropriate terminal server Directs new sessions to the least busy terminal server

22. TS Farm Load BalancingConnection process

23. TS Farm Load BalancingTS Session Broker benefits Easy to implement—no specialized configuration required TS Session Broker has low overhead—can be installed on a computer that hosts other roles Enables simple and effective load balancing in a terminal server farm TS Session Broker together with DNS round robin is the only load-balancing solution in three of the four Windows Server 2008–based terminal server farms

24. User Experience Enhancing Terminal Services usage Used TS Web Access to create an easy-to-use Web-based portal to access terminal server resources Implemented TS RemoteApp to create a seamless terminal server application experience Deployed many more Terminal Services applications—approximately 30 applications now available

25. TS Portal A customized TS Web Access portal Based on TS Web Access A consistent and intuitive Web application that appears when a user accesses TS Gateway A single location—enables easy access to terminal server resources

26. TS Portal Main page

27. TS Portal Applications page

28. TS RemoteApp Enhancing the application experience A Terminal Services component—wholly directed toward the end-user experience Enables Terminal Services applications to run seamlessly on the end-user desktop Enables Terminal Services applications to run in individual windows on the user’s desktop Includes notification icons in the notification area on the client computer Does not modify the way in which a terminal server makes the application available—only how the TSClient program displays the application

29. TS RemoteApp Deployment results Proved popular for opening large documents Documents opened quickly and appeared the same as if they were opened locally—easier and faster than copying the document to the local computer Some users determined that they no longer required locally installed Microsoft Office applications Fewer documents were copied to remote locations—improved security Users sometimes experienced issues with trying to drag information from a TS RemoteApp application Users would forget that the running application was a Terminal Services application—unable to drag information between a Terminal Services application and a local application

30. Conclusion TS Gateway enables the creation of a scalable SSL-based remote access solution TS Session Broker enables the creation of simple and effective load balancing for a terminal server farm The Windows Server 2008 Terminal Services pilot was so successful that the project did not end—instead, the environment is being integrated into the production environment at Microsoft IT

31. Next Steps Obtain the Windows Server 2008 Terminal Services Guidehttp://technet.microsoft.com/en-us/library/cc268349.aspx Visit the Microsoft TechNet Terminal Services Web sitehttp://technet2.microsoft.com/windowsserver2008/en/servermanager/terminalservices.mspx Obtain a trial copy of Windows Server 2008http://www.microsoft.com/windowsserver2008/en/us/trial-software.aspx

32. For More Information • Additional content on Microsoft IT deployments and best practices can be found on http://www.microsoft.com • Microsoft IT Showcase Webcastshttp://www.microsoft.com/howmicrosoftdoesitwebcasts • Microsoft TechNethttp://www.microsoft.com/technet/itshowcase