Skip to main content
Version: Developer

Connect Kasm Workspaces to Microsoft RDS

Overview​

Microsoft Remote Desktop Services (RDS) lets multiple users share desktops and applications hosted on a server. This guide connects Kasm Workspaces to an RDS deployment, so users reach RDS desktops and RemoteApps through isolated, browser-native sessions with Kasm data loss prevention (DLP) controls. Kasm integrates with RDS as a single fixed server that points to the RDS deployment. The result is governed, browser-based access to RDS resources without exposing the RDS servers directly to users.

Prerequisites​

Before you begin, confirm the following:

  • An existing Microsoft RDS deployment. For setup help, see Microsoft's RDS documentation.
  • Active Directory single sign-on configured in Kasm. An RDS deployment appears to Kasm as a single fixed server that serves multiple users, so single sign-on is required. See Single sign-on with Active Directory.
  • Administrator access to the Kasm Workspaces deployment.
  • Microsoft RDS Client Access Licenses (CALs) and any other applicable Microsoft licenses. See the Microsoft licensing section of the Windows support overview.

Solution approach​

This guide progresses through the following phases:

  1. Add a server that points to the RDS deployment.
  2. Create a desktop workspace.
  3. Create a RemoteApp workspace.
  4. Apply recommended Group Policy settings.

Detailed steps​

Create a server​

Kasm allows one desktop session per user per individual server. Kasm allows multiple concurrent RemoteApp sessions per user per individual server.

  1. In the Kasm Admin Dashboard, go to Infrastructure > Servers > Servers.
  2. In the server list, click Add.
  3. Select the Enabled checkbox.
  4. Provide a friendly name.
  5. Provide an IP address or hostname for the RDS deployment.
  6. Select RDP as the Connection Type.
  7. Provide a Connection Port. RDP uses 3389 by default.
  8. Follow the Single sign-on with Active Directory guidance for the Connection Credential Type, Connection Username, and Connection Password fields.
  9. Optional: use the Connection Info field to override settings that the UI does not expose.
  10. Set the maximum number of concurrent user sessions that the RDS deployment can support. Set a value greater than 1.
  11. Choose a deployment zone.
  12. Optional: select a server pool. A pool distributes users across the servers in the pool.
tip

For RemoteApp workspaces, consider a server that allows a single concurrent user but multiple concurrent sessions. For example, one user with 10 sessions can run up to 10 RemoteApps at once on the same server. Microsoft RDS CALs and other licensing restrictions may apply.

Create a desktop workspace​

  1. In the Kasm Admin Dashboard, go to Workspaces > Workspaces.
  2. In the workspaces list, click Add Workspace.
  3. Select Server from the Workspace Type dropdown, unless you added the server to a pool. For a pool, select the pool type instead.
  4. Provide a friendly name shown to users.
  5. Provide a description shown to administrators.
  6. Optional: provide a URL to a thumbnail shown on the user dashboard.
  7. Select the Enabled checkbox.
  8. Select the server or pool from the dropdown.
  9. In the RDP Client Options dropdown, select one of the following:
    • Web native client to access the Windows instance through the in-browser method.
    • RDP local client to access the Windows instance through the endpoint's RDP client, authenticated through the Kasm RDP gateway.
  10. Click Save.

Users then see the workspace on their dashboard and can create sessions.

Create a RemoteApp workspace​

  1. In the Kasm Admin Dashboard, go to Workspaces > Workspaces.
  2. In the workspaces list, click Add Workspace.
  3. Select Server from the Workspace Type dropdown, unless you added the server to a pool. For a pool, select the pool type instead.
  4. Provide a friendly name shown to users.
  5. Provide a description shown to administrators.
  6. Optional: provide a URL to a thumbnail shown on the user dashboard.
  7. Select the Enabled checkbox.
  8. Select the server or pool from the dropdown.
  9. In the RDP Client Options dropdown, select one of the following:
    • Web native client to access the Windows instance through the in-browser method.
    • RDP local client to access the Windows instance through the endpoint's RDP client, authenticated through the Kasm RDP gateway.
  10. Enable the Enable RemoteApp setting.
  11. Provide a RemoteApp Friendly Name, which may be shown to the user.
  12. Provide a RemoteApp Program Name/Path. Prepend registered RemoteApp names with double pipes, for example ||Microsoft Excel. For details, see the Workspaces RemoteApp section.
  13. Optional: provide arguments to pass to the RemoteApp program.
  14. Click Save.

Apply Group Policy configurations​

Some Kasm Workspaces behaviors call for Group Policy adjustments on the Windows servers.

Remove the logout button​

Remove the logout button from the Windows desktop. Users should end their Kasm session from the session control panel or the Kasm user dashboard instead. Pair this with an auto logout policy.

Remove the disconnect button​

Remove the Windows disconnect button. When a user clicks the Windows disconnect button, Windows disconnects the session and Kasm displays a disconnected blue screen. The user must then use the Kasm control panel to return to the dashboard. Removing the button avoids this confusion.

Configure auto logout​

Currently, when a user destroys a session, Kasm does not log the user off the Windows server. For static or multi-session VMs, configure an auto logout policy that logs a user out of Windows after an inactivity timeout.

Common troubleshooting steps​

  • Multiple users cannot connect to the RDS deployment. Configure single sign-on. See Windows authentication.
  • Users remain signed in to Windows after ending a Kasm session. Configure an auto logout policy through Group Policy.
  • The Windows disconnect button shows a disconnected blue screen. Remove the disconnect button through Group Policy, and direct users to end sessions from the Kasm control panel.
  • A user cannot launch a second RemoteApp instance. Windows limits users to a single RemoteApp instance by default. See Enable multiple RemoteApps for a single user.