RDS 2012 - Starting RemoteApp from RDWeb Prompts for credentials

Question

I have the following Windows 2012 R2 RemoteApp Setup

• Server1 - Role (Web Access, connection broker, RD Host) 192.168.100.1
• Server2 - Role (connection broker, RD Host) 192.168.100.2

DNS Entries used for Round Robin

• RDWA 192.168.100.1, 192.168.100.2
• RDCB 192.168.100.1, 192.168.100.2

Connection Broker is setup using HA (Server1, Server2) - it uses the RDCB Alias for DNS Round Robin (ClientAccessName)

Collection Name: "General" and am publishing just Notepad. Applied wildcard Cert.

Configured IIS: Default Website Redirection to /RDWeb/..., Allowed for single Signon

GPEDIT on Client machines.. To allow for default Credential Delegation and allowed TERMSRV/* for my testing.

So basically. From a client if I open up my browser and point to RDWA (remote web access)... i get the remote web form.. I can see notepad. When I click on notepad. I get the following prompt:

Your credentials did not work

Your system administrator does not allow the use of default credentials to log onto the remote computer RDCB.TEST.LOCAL because its identity is not fully verified. Please enter new credentials.

Note:

Before I setup Connecton Broker HA, I was not prompted for this message. It would do the single sign-on OK. I was maybe thinking that I needed to setup a Kerberos identity called RDCB like I did in Windows 2008 R2. But this looks different in Windows 2012 and wasn't able to find the Powershell command to do this.

Solution

I did a wee bit of digging around and read that 2012 doesn't use a Kerberos Identity like 2008 R2. So what I tried was enabling the following "Allow delegating default credentials with NTLM-only Server authentication".

This seem to do the trick and now I have single sign-on working correctly.

Thanks for your help. cheers

Comments

[blaughw]

You state only one server has web app role. Is this correct? I think this is a red herring and not really the issue. I think the issue lies with the TERMSERV*. Can you create a test domain group and delegate access with that?

[blaughw]

Oh man, I did some investigation and found this: blogs.msdn.com/b/rds/archive/2007/04/19/… . None of this info applies in RDS 2012. You get much better results out of the box. (Provided your clients are high enough version)