Using Terminal Services as a Remote Access Solution at Microsoft Published: April 2008

● The Terminal Services environment at Microsoft ● The Windows Server® 2008 Terminal Services pilot ● The Terminal Services Gateway (TS Gateway) feature ● Scalability—load-balancing configurations ● User experience enhancements ● Using TS Gateway as a remote access portal ● Best practices ● Conclusion Agenda

● Windows® Terminal Services ● Network Load Balancing (NLB) ● SSL ● Domain Name System (DNS) configuration—DNS round robin Level 200 Prerequisite Knowledge

Current Environment Terminal Services at Microsoft IT ● Three Windows Server 2003–based Terminal Services deployments worldwide ● Only a few applications are supported ● Seven internal business applications ● Microsoft® Office system applications such as Microsoft Office Word and Microsoft Office Excel® ● Experienced little usage—only 30 to 40 users each month

Current Environment Accessing terminal servers—challenges ● Terminal servers can be accessed only from within the internal corporate network ● Remote users must first establish a virtual private network (VPN) connection to the internal network ● VPN connection requires an appropriately configured computer ● Many organizations do not allow for outbound VPN connections ● VPN connections are less tolerant to network delays

Windows Server 2008 Terminal Services deployment goals ● Test and validate the TS Gateway concept— remove the limitations of a VPN connection ● Test the scalability of a Windows Server 2008–based terminal server farm ● Increase the security of sensitive corporate documents ● Reduce the likelihood that users copy internal documents to remote computers

Terminal Services Pilot Deployment strategy ● Phase 1: Configure a single TS Gateway environment ● Perform security tests to verify that the environment meets security requirements ● Open TS Gateway to approximately 200 developers to obtain initial feedback ● Phase 2: Extend the environment to multiple sites worldwide ● Open TS Gateway to multiple groups at Microsoft ● Perform load-balancing and scalability tests

Terminal Services Gateway Overview of the TS Gateway role ● A Web server component ● Provides the following functionalities ● Acts as the endpoint of an SSL connection ● Performs authentication and authorization of the connecting user ● Forwards the user’s connection to a resource by using Remote Desktop Protocol (RDP) ● Requires Terminal Services client (TSClient) version 6.0

TS Gateway Design Connection process

Terminal Services Pilot Phase 1—deployment characteristics ● Two TS Gateway computers ● Five Windows Server 2008–based terminal servers ● One Terminal Services Session Broker (TS Session Broker) computer ● All computers based on commodity hardware ● Dual 2.2-gigahertz (GHz) CPUs ● Four gigabytes (GB) RAM

Deployment Results Phase 1—initial feedback ● Approximately 200 users—Terminal Services developers group ● The TS Gateway concept proven ● Users could successfully connect from any location worldwide ● Connection speed met or exceeded that of a VPN connection ● Extremely popular with developers—easy connections to Remote Desktop–enabled workstations

Extending the Deployment Phase 2—expanded goals ● Expand the deployment to that of a large enterprise-level deployment ● Test TS Gateway scalability ● By using NLB clusters ● By using third-party load balancers ● Test terminal server farm scalability ● Round-robin DNS ● TS Session Broker ● Implement user experience enhancements ● TS Portal—based on Terminal Services Web Access (TS Web Access) ● TS RemoteApp

Extending the Deployment Phase 2—deployment characteristics ● Ten TS Gateway computers ● Nine terminal servers ● Three TS Session Broker computers ● Four locations worldwide ● Dublin ● Hyderabad ● Redmond ● Singapore

Deployment Characteristics A worldwide implementation

Worldwide Deployment Usage statistics ● Deployment first opened to other developer groups—approximately 2,000 developers ● Deployment next opened to other groups at Microsoft—a goal of increased usage of typical terminal server resources ● Overall usage of approximately 7,500 people worldwide

Worldwide Deployment Usage statistics—Dec 1, 2007, through Dec 31, 2007 Usage statistic RedmondDublinHyderabadSingapore Total number of users 5, Users who have more than one logon in a month 4, Users who have more than 10 logons in a month 2, Total resources accessed 8,

Worldwide Deployment Load statistics—Dec 1, 2007, through Dec 31, 2007 Load statistic RedmondDublinHyderabadSingapore Total number of sessions 115,7873,0884,5802,750 Total gigabytes sent Total gigabytes received 2,

TS Gateway Scalability Network Load Balancing ● NLB clusters are limited by overall traffic and not by the number of nodes ● A heavily loaded cluster may experience issues with convergence and with cluster node synchronization ● For Windows Server 2008–based NLB clusters ● Single node—supports approximately 700 simultaneous connections with a maximum of 1,300 connections ● Multiple nodes—supports approximately 1,500 simultaneous connections with a maximum of 2,600 connections ● For fault tolerance, it is best to deploy at least three nodes to support 1,500 connections ● For loads greater than 1,500 simultaneous connections, a third-party load balancer is best

TS Gateway Load Balancing Traffic flow

TS Gateway Clustering Benefits ● IP affinity is not required—improves cluster efficiency ● TS Gateway automatically redirects the SSL traffic to the appropriate TS Gateway computer ● Enables TS Gateway to efficiently handle multiple connections from an organization that has only one external IP address ● Uses SSL for session encryption ● SSL connections are much more tolerant to network delays than are VPN connections ● SSL connections do not require specialized configuration

Terminal Server Scalability Load balancing in a terminal server farm ● Implemented a typical DNS round-robin configuration ● Implemented TS Session Broker ● A new feature—builds on the functionality that is available in Terminal Services Session Directory ● Provides a load-balancing functionality and user session management ● Directs a reconnected session to the appropriate terminal server ● Directs new sessions to the least busy terminal server

TS Farm Load Balancing Connection process

TS Farm Load Balancing TS Session Broker benefits ● Easy to implement—no specialized configuration required ● TS Session Broker has low overhead—can be installed on a computer that hosts other roles ● Enables simple and effective load balancing in a terminal server farm ● TS Session Broker together with DNS round robin is the only load-balancing solution in three of the four Windows Server 2008–based terminal server farms

User Experience Enhancing Terminal Services usage ● Used TS Web Access to create an easy-to-use Web-based portal to access terminal server resources ● Implemented TS RemoteApp to create a seamless terminal server application experience ● Deployed many more Terminal Services applications—approximately 30 applications now available

TS Portal A customized TS Web Access portal ● Based on TS Web Access ● A consistent and intuitive Web application that appears when a user accesses TS Gateway ● A single location—enables easy access to terminal server resources

TS Portal Main page

TS Portal Applications page

TS RemoteApp Enhancing the application experience ● A Terminal Services component—wholly directed toward the end-user experience ● Enables Terminal Services applications to run seamlessly on the end-user desktop ● Enables Terminal Services applications to run in individual windows on the user’s desktop ● Includes notification icons in the notification area on the client computer ● Does not modify the way in which a terminal server makes the application available—only how the TSClient program displays the application

TS RemoteApp Deployment results ● Proved popular for opening large documents ● Documents opened quickly and appeared the same as if they were opened locally—easier and faster than copying the document to the local computer ● Some users determined that they no longer required locally installed Microsoft Office applications ● Fewer documents were copied to remote locations—improved security ● Users sometimes experienced issues with trying to drag information from a TS RemoteApp application ● Users would forget that the running application was a Terminal Services application—unable to drag information between a Terminal Services application and a local application

Conclusion ● TS Gateway enables the creation of a scalable SSL-based remote access solution ● TS Session Broker enables the creation of simple and effective load balancing for a terminal server farm ● The Windows Server 2008 Terminal Services pilot was so successful that the project did not end—instead, the environment is being integrated into the production environment at Microsoft IT

Next Steps 1. Obtain the Windows Server 2008 Terminal Services Guide us/library/cc aspx us/library/cc aspx us/library/cc aspx 2. Visit the Microsoft TechNet Terminal Services Web site en/servermanager/terminalservices.mspx en/servermanager/terminalservices.mspx en/servermanager/terminalservices.mspx 3. Obtain a trial copy of Windows Server us/trial-software.aspx us/trial-software.aspx us/trial-software.aspx

For More Information ● Additional content on Microsoft IT deployments and best practices can be found on ● Microsoft IT Showcase Webcasts ebcasts ebcasts ebcasts ● Microsoft TechNet