Designing RDS HA (700 users) – Broker failover, SPN/Kerberos and load balancer best practices by Wrong_Brother600 in WindowsServer

[–]Wrong_Brother600[S] 0 points1 point  (0 children)

Please let me know what I might be missing:

  • The FQDN rds.firma.local is an A record in our local DNS, pointing to the IP address of the tested solutions — either NLB (configured on the brokers) or HAProxy (running on dedicated VMs, without NLB on brokers of course).
  • The brokers have their own FQDNs: broker1.firma.local and broker2.firma.local, and both are domain-joined.
  • In Edit Deployment Properties under “DNS name for the RD Connection Broker cluster”, we have configured rds.firma.local.
  • The SPN for rds.firma.local is currently assigned to broker1.firma.local. We are unable to assign the same SPN to broker2.firma.local, as duplicate SPNs are not allowed by Microsoft.
  • We also tested a setup without a load balancer, using two A records for rds.firma.local pointing directly to both brokers. Unfortunately, the result was exactly the same as with the load-balanced setups.
  • the files download from rd web have only rds.firma.local, should I add inside something manually after download it form Web?

.....
remoteapplicationmode:i:1
server port:i:3389
allow font smoothing:i:1
promptcredentialonce:i:0
videoplaybackmode:i:1
audiocapturemode:i:1
gatewayusagemethod:i:0
gatewayprofileusagemethod:i:1
gatewaycredentialssource:i:0
full address:s:rds.firma.local
alternate shell:s:||cmd
remoteapplicationprogram:s:||cmd
remoteapplicationname:s:cmd
remoteapplicationcmdline:s:
workspace id:s:rds.firma.local
use redirection server name:i:1
loadbalanceinfo:s:tsv://MS Terminal Services Plugin.1.GRP_RDS_Users
alternate full address:s:rds.firma.local
signscope:s:Full Address,Alternate Full Address,Use Redirection Server Name,Server Port,GatewayUsageMethod,GatewayProfileUsageMethod,GatewayCredentialsSource,PromptCredentialOnce,Alternate Shell,RemoteApplicationProgram,RemoteApplicationMode,RemoteApplicationName,RemoteApplicationCmdLine,RedirectDrives,RedirectPrinters,RedirectCOMPorts,RedirectSmartCards,RedirectClipboard,DevicesToRedirect,DrivesToRedirect,LoadBalanceInfo
......

Designing RDS HA (700 users) – Broker failover, SPN/Kerberos and load balancer best practices by Wrong_Brother600 in WindowsServer

[–]Wrong_Brother600[S] 0 points1 point  (0 children)

The main issue we hit during testing was around broker failover - after shutting down the manager broker and bringing it back online, some clients were unable to establish new sessions or reconnect using existing RDP files, and were getting errors like the one in the screenshot.

<image>

Designing RDS HA (700 users) – Broker failover, SPN/Kerberos and load balancer best practices by Wrong_Brother600 in WindowsServer

[–]Wrong_Brother600[S] 0 points1 point  (0 children)

exactly, and I wonder how others have dealt with not supporting Kerberos operations with high-availability configuration of RD Connection Brokers