Deploy Windows Server 2008 Terminal Services RemoteApp

Updated: March 10, 2009

Applies To: Windows SBS 2008

You can use Terminal Services to provide access to Windows-based programs from almost any location to almost any computing device on the network. Terminal Services in Windows Server 2008 includes Windows Server 2008 Terminal Services RemoteApp (TS RemoteApp). RemoteApp programs are accessed remotely through Terminal Services, and they appear as if they are running on the user's local computer. Instead of being presented to the user in the desktop of the remote terminal server, the RemoteApp program is integrated with the client's desktop, running in its own resizable window with its own entry on the taskbar. Users can run RemoteApp programs side-by-side with their local programs. If a user is running more than one RemoteApp program on the same terminal server, the RemoteApp programs share the same Terminal Services session.

In Windows Server 2008, users can access RemoteApp programs in several ways, depending on the deployment method that you choose. The users can do any of the following:

• Access a link to the program on a Web site by using Terminal Services Web Access (TS Web Access).

• Double-click a Remote Desktop Protocol (.rdp) file that is created and distributed by the administrator.

• Double-click a program icon on their desktop or Start menu that is created and distributed by the administrator with a Windows Installer (.msi) package.

• Double-click a file that has an extension that is associated with a RemoteApp program. This can be configured by the administrator with a Windows Installer package.

The .rdp files and the Windows Installer packages contain the settings that are needed to run RemoteApp programs. After opening a RemoteApp program on the local computer, a user can interact with the program that is running on the terminal server as if it is running locally.

Client computer requirements

To access RemoteApp programs that are deployed as .rdp files or as Windows Installer packages, the client computer must be running Remote Desktop Connection (RDC) 6.0 or RDC 6.1. A supported version of the RDC client is included with Windows Server 2008 and with the Windows Vista® operating system. To download RDC 6.0 for Windows Server 2003 with Service Pack 1 (SP1) or for Windows XP with Service Pack 2 (SP2), see article 925876 in the Microsoft Knowledge Base at https://go.microsoft.com/fwlink/?LinkId=79373.

To access RemoteApp programs through TS Web Access, the client computer must be running RDC 6.1. RDC 6.1 is included with the following operating systems:

• Windows Server 2008

• Windows Vista with Service Pack 1 (SP1)

• Windows XP with Service Pack 3 (SP3)

Install programs on the terminal server

It is recommended that you install programs on the terminal server after you install the Terminal Server role service. If you install a program with a Windows Installer package, the program automatically installs in Terminal Server Install mode. If you are installing from another kind of Setup package, use either of the following methods to put the server into Install mode:

• Use the Install Application on Terminal Server option in Control Panel to install the program.

• Before you install a program, at the command prompt, type change user /install. After the program is installed, type change user /execute to exit from Install mode.

If you have programs that are related to each other or that have dependencies on each other, it is recommended that you install the programs on the same terminal server. For example, it is recommended that you install Microsoft Office as a suite instead of installing individual Office programs on separate terminal servers.

You should consider putting individual programs on separate terminal servers in the following circumstances:

• The program has compatibility issues that may affect other programs.

• A single program and the number of associated users may fill server capacity.

Add programs to the RemoteApp Programs list

To add programs to the RemoteApp Programs list

1. Start TS RemoteApp Manager, by clicking Start, clicking Administrative Tools, clicking Terminal Services, and then clicking TS RemoteApp Manager.

2. In the Actions pane, click Add RemoteApp Programs.

3. On the Welcome to the RemoteApp Wizard page, click Next.

4. On the Choose programs to add to the RemoteApp Programs list page, select the check box next to each program that you want to add to the RemoteApp Programs list. You can select multiple programs.

5. To configure the properties for a RemoteApp program, click the program name, and then click Properties. You can configure the properties that are listed in the table that follows this procedure.

6. When you are finished configuring the program properties, click OK, and then click Next.

7. On the Review Settings page, review the settings, and then click Finish. The programs that you selected appear in the RemoteApp Programs list.

RemoteApp program properties

Property you can change	Description
The program name that appears to users.	To change the name, type a new name in the RemoteApp program name box.
The path of the executable file for the program.	To change the path, either type the new path in the Location box or click Browse. Note You can use system environment variables in the path name. For example, you can substitute %windir% for the explicit path of the Windows folder (such as C:\Windows). You cannot use per-user environment variables.
The alias for the RemoteApp program.	The alias is a unique identifier for the program that defaults to the file name of the program (without the extension). It is recommended that you do not change this name.
Whether the RemoteApp program is available through TS Web Access.	By default, the RemoteApp program is available through TS Web Access setting is enabled. To change the setting, select or clear the check box.
Command-line arguments.	You can specify whether they are allowed, not allowed, or whether to always use the same command-line arguments.
The program icon.	To change the icon, click Change Icon.

Configure global deployment settings

You can configure global deployment settings that apply to all RemoteApp programs in the RemoteApp Programs list. These settings apply to any RemoteApp program that you make available through TS Web Access. Additionally, these settings are the default settings if you create .rdp files or Windows Installer packages from any of the listed RemoteApp programs.

Configure the terminal server settings

To define how users connect to the terminal server (or to the terminal server farm) to access RemoteApp programs, you can configure Terminal Server deployment settings.

To configure the terminal server settings

1. Open TS RemoteApp Manager, and then do one of the following:

   In the Actions pane, click Terminal Server Settings.

   or

   In the Overview pane, next to Terminal Server Settings, click Change.

2. Click the Terminal Server tab, and then, in Connection settings, verify or modify the server or farm name, RDP port number, and server authentication settings.

3. To link to the full terminal server desktop through TS Web Access, in Remote desktop access, select the Show a remote desktop connection to this terminal server in TS Web Access check box.

4. In Access to unlisted programs, choose either of the following:

   Do not allow users to start unlisted programs on initial connection (Recommended)

   To help protect against malicious users and against a user who unintentionally starts a program from an .rdp file on initial connection, it is recommended that you choose this setting.

or

**Allow users to start both listed and unlisted programs on initial connection**

5. After you finish making your selections, click OK.

Configure Terminal Services Gateway settings

To define whether users can connect to the terminal server across a firewall through Terminal Services Gateway (TS Gateway), you can configure TS Gateway deployment settings. For more information about TS Gateway, see the “TS Gateway Step-by-Step Guide” at the Microsoft Web site (https://go.microsoft.com/fwlink/?LinkId=85872).

To configure Terminal Services Gateway settings

1. Open TS RemoteApp Manager, and then do one of the following:

   In the Actions pane, click TS Gateway Settings.

   or

   In the Overview pane, next to TS Gateway Settings, click Change.

2. On the TS Gateway tab, configure the desired TS Gateway behavior. You can configure whether to automatically detect TS Gateway server settings, to use TS Gateway server settings that you specify, or to not use a TS Gateway server.

3. In the Windows SBS 2008 environment, Windows SBS 2008 is already configured as a TS Gateway server to enable Windows SBS Remote Web Workplace functions. It can also be a TS Gateway for the additional terminal server. Choose Use these TS Gateway server settings.

4. Configure the TS Gateway server name and the logon method.

   The server name must match what is specified in the SSL certificate for the TS Gateway server.

5. To locate the Windows Small Business Server 2008 SSL Certificate, on the server that is running Windows SBS 2008, click Start, and then click Administrative Tools.

6. Click Terminal Services, and then click TS Gateway Manager.

7. In the User Account Control window, click Continue.

8. In the TS Gateway Manager window, in the TS Gateway Manager list, right-click the server name, and then click Properties.

9. In the TS Gateway server properties dialog, click the SSL certificate tab, and then write down the server name that is in Issued to. Use it as the TS Gateway server name on the terminal server.

10. If you want the connection to try to use the same user credentials to access both the TS Gateway server and the terminal server, select the Use the same user credentials for TS Gateway and terminal server check box. However, users may still receive two prompts for credentials if conflicting credentials exist from any source (such as Group Policy settings) and those credentials do not work. Users may also receive two prompts for credentials if default credentials are used for the connection and those credentials do not work.

11. If you want the client computer to automatically detect when TS Gateway is required, select the Bypass TS Gateway server for local addresses check box. (Selecting this option optimizes the performance of the client computer.)

    To always use a TS Gateway server for client connections, clear the Bypass TS Gateway server for local addresses check box.

12. After you finish, click OK.

Configure digital signature settings

You can use a digital signature to sign .rdp files that are used for RemoteApp connections to the terminal server. This includes the .rdp files that are used for connections through TS Web Access to RemoteApp programs on the terminal server and to the terminal server desktop.

If you use a digital certificate, the cryptographic signature on the connection file provides verifiable information about your identity as its publisher. This enables client computers to recognize your organization as the source of the RemoteApp program or the remote desktop connection, and then start or prohibit the connection based on trust criteria. This helps protect against the use of .rdp files that are altered by a malicious user.

You can sign .rdp files that are used for RemoteApp connections by using a Server Authentication certificate (SSL certificate) or a Code Signing certificate. You can obtain SSL and Code Signing certificates from public certificate authorities (CAs) or from an enterprise CA in your public key infrastructure hierarchy.

If you are already using an SSL certificate for terminal server or TS Gateway connections, you can use the same certificate to sign .rdp files. In the Windows SBS 2008 environment, TS Gateway is already installed on the server that is running Windows SBS 2008 and is signed with an SSL certificate.

To export the Terminal Services Gateway certificate from Windows Small Business Server 2008

1. On the server that is running Windows SBS 2008, click Start, and then click Administrative Tools.

2. Click Terminal Services, and then click TS Gateway Manager.

3. In the TS Gateway Manager window, in the TS Gateway Manager list, right-click the server name, and then click Properties.

4. In the TS Gateway server properties dialog, click the SSL certificate tab, and then click Browse Certificate.

5. In the Install Certificate dialog, in the Certificate list, click the certificate that is currently installed, and then click View Certificate.

6. In the Certificate dialog, click the Details tab, and then click Copy to File.

7. In the Certificate Export Wizard, click Next.

8. Verify that Yes, export the private key is selected, and then click Next.

9. Verify that Include all certificates in the certificate path if possible and Export all extended properties are selected, and then click Next. Do not select Delete the private key if the export is successful.

10. Type a strong password to protect the certificate file, and then click Next.

11. To save the .pfx file (for example, C:\trustedcert.pfx), choose a secure location that only the administrator can access, and then click Next.

12. Complete the wizard.

Import the SSL certificate to the terminal server

1. Move the trustedcert.pfx file to the additional terminal server by using either the network or a USB device.

2. On the additional terminal server, double-click the .pfx file.

3. On the Certificate Import Wizard Welcome page, click Next.

4. Browse to the location of the saved .pfx file, and then click Next.

5. Type the password that you typed in the Export procedure, verify that Mark this key as exportable and Include all extended properties are selected, and then click Next.

6. On the Certificate Store page, select Place all certificates in the following store, click Browse, and then click Personal.

7. Click Next, and then finish the wizard.

To configure the digital certificate for use in RemoteApp

1. Open TS RemoteApp Manager, and then do one of the following:

   In the Actions pane, click Digital Signature Settings.

   or

   In the Overview pane, next to Digital Signature Settings, click Change.

2. Select the Sign with a digital certificate check box.

3. In the Digital certificate details dialog box, click Change.

4. In the Select Certificate dialog box, click the certificate that you want to use, and then click OK.

If users connect to RemoteApp programs from public or home computers, you must use either A certificate from a public certificate authority (CA) that is one of the Microsoft root certificate program members (https://go.microsoft.com/fwlink/?LinkID=59547) or an enterprise CA-issued certificate that is co-signed by a public CA that is one of the Microsoft root certificate program members (https://go.microsoft.com/fwlink/?LinkID=59547).

If you are using an enterprise self-issued certificate, you must install the security certificate for the server on your remote computer.

To install the security certificate for the server on your remote computer

1. From a computer that is in the Windows SBS 2008 network, open a Web browser and type the following address into the address bar: \\ServerName\public\downloads. (ServerName is the name of your server that is running Windows SBS 2008.)

2. Copy the Install Certificate Package.zip file to portable storage media, such as a CD or a USB drive.

3. Insert the CD or USB drive into the computer that is not joined to the Windows SBS domain and from which you want to access Remote Web Workplace.

4. In Windows Explorer, navigate to where you copied Install Certificate Package.zip.

5. Right-click Install Certificate Package.zip, and then click Extract All.

6. In the Extract Compressed (Zipped) Folders dialog box, type a folder location to which you want to extract the files, and then click Extract.

7. Open the folder where the extracted files are located, and then double-click InstallCertificate.

8. Select Install the certificate on my computer, and then click Install.

Deploy RemoteApp programs to users

You can use either of the following deployment methods:

• You can distribute RemoteApp programs as .rdp files or Windows Installer packages through a shared folder or through other distribution mechanisms such as Microsoft Systems Management Server or Active Directory software distribution.

• You can make RemoteApp programs available on a Web site by distributing the RemoteApp programs through TS Web Access.

Deploy RemoteApp programs through TS Web Access

Using TS Web Access, users can access RemoteApp programs from a Web site over the Internet or from an intranet. To start a RemoteApp program, users click the program icon. TS Web Access provides a solution that works with minimal configuration. The default TS Web Access page includes a customizable Web part that can be incorporated into a customized Web page.

To use TS Web Access to deploy RemoteApp programs, you must do the following:

1. Install the TS Web Access role service.

2. Populate the TS Web Access Computers security group.

3. Specify the terminal server from which to populate the list of RemoteApp programs that appear in the TS Web Access Web part.

Install the TS Web Access role service

You must install the TS Web Access role service on the server that you want users to connect to over the Web to access RemoteApp programs. When you install the TS Web Access role service, Microsoft Internet Information Services (IIS) 7.0 is also installed.

The server where you install TS Web Access is the Web server. The server does not have to be a terminal server. In a Windows SBS 2008 network, it is recommended that you install TS Web Access on the same server where you install Terminal Services or any other server in the Windows SBS domain, but not on the server that is running Windows SBS 2008.

To install the TS Web Access role service

1. Open Server Manager, by clicking Start, clicking Administrative Tools, and then clicking Server Manager.

2. If the Terminal Services role is already installed, do the following:

   i. In Roles Summary, click Terminal Services.

   ii. In Roles Services, click Add Role Services.

   iii. On the Select Role Services page, select the TS Web Access check box.

   If the Terminal Services role is not already installed, do the following:

   i. In Roles Summary, click Terminal Services.

   ii. On the Before You Begin page, click Next.

   iii. On the Select Server Roles page, select the Terminal Services check box, and then click Next.

   iv. Review the Terminal Services page, and then click Next.

   v. On the Select Role Services page, select the TS Web Access check box.

3. Review the information about the required role services, and then click Add Required Role Services.

4. Click Next.

5. Review the Web Server (IIS) page, and then click Next.

6. On the Select Role Services page, you are prompted to select the role services that you want to install for IIS. Click Next.

7. On the Confirm Installation Selections page, click Install.

8. On the Installation Results page, confirm that the installation successfully finished, and then click Close.

Populate the TS Web Access Computers security group

If the TS Web Access server and the terminal server that hosts the RemoteApp programs are separate servers, you must add the computer account of the TS Web Access server to the TS Web Access Computers security group on the terminal server.

To add the computer account of the TS Web Access server to the security group

1. On the terminal server, click Start, click Administrative Tools, and then click Computer Management.

2. In the User Account Control window, click Continue.

3. In the console pane, expand Local Users and Groups, and then click Groups.

4. In the details pane, double-click TS Web Access Computers.

5. In the TS Web Access Computers Properties dialog box, click Add.

6. In the Select Users, Computers, or Groups dialog box, click Object Types.

7. In the Object Types dialog box, select the Computers check box, and then click OK.

8. In the Enter the object names to select box, type the computer account of the TS Web Access server, and then click OK.

9. Click OK to close the TS Web Access Computers Properties dialog box.

Configure the data source for TS Web Access

You can configure TS Web Access to populate the list of RemoteApp programs that appear in the Web part from a specific terminal server or terminal server farm.

1. Specify the data source for TS Web Access.

   By default, TS Web Access populates its list of RemoteApp programs from a single terminal server and points to the local host. The Web part is populated by all RemoteApp programs that are enabled for TS Web Access on the RemoteApp Programs list for the terminal server.

   To complete this procedure, you must log on to the TS Web Access server by using the local Administrator account or an account that is a member of the TS Web Access Administrators group on the TS Web Access server. Do the steps in the procedure that follows this list.

   To test TS Web Access, see the following section, “Connect to TS Web Access.”

2. Connect to TS Web Access

   By default, you can access the TS Web Access site at the following location, where ServerName is the NetBIOS name or the fully qualified domain name of the Web server where you installed TS Web Access:

   https://ServerName/ts

   If you connect to TS Web Access from a public computer, such as a computer in an Internet café, you should uncheck the I am using a private computer that complies with my organization's security policy check box that appears in the lower-right corner of the Web part. In Public Mode, you are not provided with the option to save your credentials, and the caching of bitmaps is not enabled.

To specify which terminal server to use as the data source

1. Connect to the TS Web Access Web site. To do this, do either of the following:

   On the TS Web Access server, click Start, click Administrative Tools, click Terminal Services, and then click TS Web Access Administration.

   Use Internet Explorer to connect to the TS Web Access site. By default, the Web site is at the following address, where ServerName is the name of the TS Web Access server: https://ServerName/ts

2. Log on to the site by using either the local Administrator account or an account that is a member of the local TS Web Access Administrators group. (If you are already logged on to the computer as one of these accounts, you are not prompted for credentials.)

3. On the title bar, click the Configuration tab.

4. In the Editor Zone area, in the Terminal server name box, type the name of the terminal server that you want to use as the data source.

5. Click Apply.

Client computer requirements and configuration

To connect to TS Web Access, the client computer must be running RDC 6.1. RDC 6.1 is included with the following operating systems:

• Windows Server 2008

• Windows Vista with Service Pack 1 (SP1)

• Windows XP with Service Pack 3 (SP3)

Additionally, the Terminal Services ActiveX® Client control must be enabled. The ActiveX control is included with RDC 6.1.

If you are running Windows Server 2008 or Windows Vista with SP1, and you receive a warning message on the Internet Explorer Information bar that the site is restricted from showing certain content, click the message line, click Add-on Disabled, and then click Run ActiveX Control. You might see a security warning. Make sure that Microsoft Corporation is the publisher of the ActiveX control, and then click Run.

If you are running Windows XP with SP3, when you first access the TS Web Access site the page displays an error message that says the ActiveX control is not installed or is not enabled. Use the following procedure to enable the ActiveX control.

To enable the ActiveX control in Windows XP with SP3

1. Connect to the TS Web Access site, and then type your logon credentials.

2. Depending on the version of Internet Explorer that you are running, do one of the following:

   If you are using Internet Explorer 7, on the Tools menu, click Manage Add-ons, and then click Enable or Disable Add-ons.

   If you are using Internet Explorer 6, on the Tools menu, click Manage Add-ons.

   The Manage Add-ons dialog box appears. Make sure that the Show list is set to Add-ons currently loaded in Internet Explorer.

3. In Disabled, click either Microsoft Terminal Services Client Control (redist) or Microsoft RDP Client Control (redist), whichever is listed.

4. In Settings, click Enable. (If you are running Internet Explorer 6, click OK in the dialog box that says that you may need to restart Internet Explorer for the changes to take effect.)

5. Click OK to close the Manage Add-ons dialog box. If you are running Internet Explorer 7, click OK in the dialog box that says that you may need to restart Internet Explorer for the changes to take effect.

   Any available RemoteApp programs appear on the TS Web Access Web site.

Create an .rdp file from a RemoteApp program

You can use the RemoteApp Wizard to create an .rdp file from any program in the RemoteApp Programs list.

To create an .rdp file from a RemoteApp program

1. Click Start, click Administrative Tools, click Terminal Services, and then click TS RemoteApp Manager. TS RemoteApp Manager starts.

2. In the RemoteApp Programs list, click the program for which you want to create an .rdp file. To select multiple programs, press and hold the CTRL key when you click each program name.

3. In the Actions pane for the program or selected programs, click Create .rdp file.

4. On the Welcome to the Remote App Wizard page, click Next.

5. On the Specify Package Settings page, do the following:

   i. In Enter the location to save the packages box, either accept the default location or click Browse to specify a new location for the .rdp file.

   ii. In the Terminal server settings area, click Change to modify the Server or farm name, RDP port number, and Require server authentication setting. (For more information about these settings, see “Configure terminal server settings” in the Configure global deployment settings section of this document.) When you are finished, click OK.

   iii. In the TS Gateway settings area, click Change to modify or to configure whether client computers use a TS Gateway server to connect to the target terminal server across a firewall. (For more information about these settings, see “Configure TS Gateway settings” in the Configure global deployment settings section of this document.) When you are finished, click OK.

   iv. To digitally sign the .rdp file, in the Certificate Settings section, click Change to select or to change the certificate to use. Select the certificate that you want to use, and then click OK. (For more information about these settings, see “Configure digital signature settings (optional)” in the Configure global deployment settings section of this document.)

6. When you are finished, click Next.

7. On the Review Settings page, click Finish.

   When the wizard is finished, the folder where the .rdp file is saved opens in a new window. You can confirm that the .rdp file now exists.

Create a Windows Installer package from a RemoteApp program

You can use the RemoteApp Wizard to create a Windows Installer (.msi) package from any program in the RemoteApp Programs list.

To create a Windows Installer package from a RemoteApp program

1. Click Start, click Administrative Tools, click Terminal Services, and then click TS RemoteApp Manager. TS RemoteApp Manager starts.

2. In the RemoteApp Programs list, click the program for which you want to create a Windows Installer package. To select multiple programs, press and hold the CTRL key when you click each program name.

3. In the Actions pane for the selected program or programs, click Create Windows Installer package.

4. On the Welcome to the RemoteApp Wizard page, click Next.

5. On the Specify Package Settings page, do the following:

   i. In the Enter the location to save the packages box, either accept the default location or click Browse to specify a new location for the Windows Installer package.

   ii. In the Terminal server settings area, click Change to modify the Server or farm name, RDP port number, and Require server authentication setting. (For more information about these settings, see “Configure terminal server settings” in the Configure global deployment settings section of this document.) When you are finished, click OK.

   iii. In the TS Gateway settings area, click Change to modify or to configure whether client computers use a TS Gateway server to connect to the target terminal server across a firewall. (For more information about these settings, see “Configure TS Gateway settings” in the Configure global deployment settings section of this document.) When you are finished, click OK.

   iv. To digitally sign the .rdp file, in the Certificate Settings section, click Change to select or to change the certificate to use. Select the certificate that you want to use, and then click OK. (For more information about these settings, see “Configure digital signature settings (optional)” in the Configure global deployment settings section of this document.)

6. When you are finished, click Next.

7. On the Configure Distribution Package page, do the following:

   i. In the Shortcut icons area, specify where the shortcut icon for the program appears on client computers.

   ii. In the Take over client extensions area, configure whether to take over client file name extensions for the program.

   If you associate the file name extensions on the client computer with the RemoteApp program, all file name extensions that are handled by the program on the terminal server are also associated on the client computer with the RemoteApp program. For example, if you add Microsoft Word as a RemoteApp program, and you configure the option to take over client file name extensions, any file name extensions on the client computer that Word takes over are associated with the remote Word. This means that any existing program on the client computer longer handles file name extensions such as .doc and .dot. Note that users are not prompted about whether the terminal server should take over file extensions for the program.

   To view the file name extensions that are associated with a program on the terminal server, click Start, click Control Panel, and then double-click Default Programs. Click Associate a file type or protocol with a program to view the file name extensions and their default associated programs.

   To view the file name extensions that are associated with a program on the terminal server, click Start, click Control Panel, and then double-click Default Programs. Click Associate a file type or protocol with a program to view the file name extensions and their default associated programs.

8. After you configure the properties of the distribution package, click Next.

9. On the Review Settings page, click Finish.

   When the wizard is finished, the folder where the Windows Installer package is saved opens in a new window. You can confirm that the Windows Installer package now exists.

Additional references

For more information, see the following Web sites:

• For more information about Terminal Services in Windows Server 2008, see “Terminal Services” at the Microsoft Web site (https://go.microsoft.com/fwlink/?LinkId=131682).

• For more information about Terminal Services in Windows SBS 2008, see “Windows Small Business Server” at the Microsoft Web site (https://go.microsoft.com/fwlink/?LinkId=131684).