SOLVED: How to Install and Configure A Server 2012 Remote Desktop Gateway

I have confirmed with Microsoft Partner Support that MS has no plans to update their 2008 R2 documentation to accomodate changes in Server 2012… thats not nice because this was one complex setup (if you are used to how simple Server 08 R1 TS Gateway was… like me).

The problem with these instructions are that I am writing most of them from memory.    So here goes, as best as I can remember.

Server 2012 Remote Desktop Gateway Deployment Guide

1. Base RD Gateway Install:

   1. Create a new Server 2012 (VM in my case) and join it to your domain
   2. Launch your Server 2012 “Server Manager” on your Remote Desktop Server (i.e. NOT the new VM you just created in step 1),
   3. Right Click on ALL SERVERS and select ADD SERVERS, find your new VM and add it.   Microsoft’s overview of this process is available HERE .
   4. In Server Manager, Click REMOTE DESKTOP SERVICES and in the DEPLOYMENT OVERVIEW window click the blue + on RD GATEWAY
   5. I don’t recall the details of this process but I recall it being pretty straight forward.  Just select the your new VM and do what is obvious.

2. Configure RD Gateway To Use Network Access Protection

   1. From here on everything is done on the RD Gateway VM
   2. Start the REMOTE DESKTOP SERVICES GATEWAY MANAGER and expand your server then POLICIES
   3. In CONNECTIONH AUTHORIZATION POLICIES, delete the existing policy (don’t worry the next step will build three new ones)
   4. Launch NETWORK POLICY SERVER and on the GETTING STARTED windows, click CONFIGURE NAP
   5. Select REMOTE DESKTOP GATEWAY from the drop down list and follow the wizard and complete the wizard which should create three NAP policies for you
      1. You can go into NETWORK POLICY SERVER > NETWORK ACCESS PROTECTION > SYSTEM HEALTH VALIDATORS > SETTINGS if you want to customize the options but the defaults were good for me
   6. Launch RD GATEWAY MANAGER > POLICIES > RESOURCE AUTHORIZATION POLICES then double click on the only policy and on the NETWORK REOURSE tab you might want to change the setting from whatever group you have to ALLOW USERS TO CONNECT TO ANY NETWORK RESOURCE .  This is because of you might see a “Your user account is not listed in the RD Gateway’s permission list.” as detailed in THIS thread and THIS thread.
   7. I found THIS Microsoft Article on configuring TS Gateway NAP to be the most useful

3. Source and Install a Certificate

   1. We sell certs for about $20 a year so don’t bother to play around with self signed certs
   2. Launch IIS MANAGER and select your server (not the SITE, but the server)
   3. Double click SERVER CERTIFICATES
   4. Right click and select CREATE A CERTIFICATE REQUEST, enter all of the information but be sure to change the BIT LENGTH to 2048
   5. Submit this to your CA of choice (like US) and go through their approval process
      1. After you have received your new cert you will need to import it and for me it was more complex because I had an intermediate certificate to import so I followed up to step 18 in THIS help file from GoDaddy.
   6. In SERVER MANAGER, click REMOTE DESKTOP SERVICES, and on the DEPLOYMENT OVERVIEW window click the TASKS drop down and select EDIT DEPLOYMENT PROPERTIES
   7. Expand CERTIFICATES, click on RD GATEWAY, and select SELECT EXISTING CERTIFICATE and follow the wizard.
      1. Note that to get this work I needed to rename my cert to end with .PFX and I did NOT enter a passoword
      2. To verify it was installed properly, I went to IIS MANAGER, clicked on my server, then SERVER CERTIFICATES and bingo, it looked happy

4. Configure the Client PC

   1. Download THIS simple sample script from Microsoft
   2. Edit the script to include your servers name
   3. Rename the file to end with .CMD
   4. Copy that file to a PC you want to test
   5. Right Click on that file and select RUN AS ADMINISTRATOR
   6. Check your SERVICES to confirm the NETWORK ACCESS PROTECTION AGENT service is now running

5. Test the RD Gateway

   1. At this point I wanted to see if it was all working
   2. I changed my RD Apps to NOT skip the RD GATEWAY when on the LAN
      1. SERVER MANAGER > REMOTE DESKTOP SERVICS > TASKS (on DEPLOYMENT OVERVIEW) > EDIT DEPLOYMENT TASKS > RD GATEWAY, UNcheck BY PASS RD GATEWAY SERVER FOR LOCAL ADDRESSES
      2. on my Windows 7 test PC, I went to REMOTEAPP AND DESKTOP CONNECTIONS > PROPERTIES > and selected UPDATE NOW
      3. Then I launched a few apps and bingo they still worked (after I made the change suggested in step 2.6 above)!

6. Connect the RD Gateway to the Web

   1. Install a second network card (in my case I had VM so this was not an issue)
   2. Connect that NIC to the web (in my case that meant port forwarding 3389 through to this server as I still wanted this VM to be behind some firewall protection)

Microsoft has a RD Gateway deployment guide available HERE.