Installing Remote Desktop Services

Remote Desktop Services (RDS) is a server role that runs on Windows Server 2025. Microsoft officially supports RDS on Windows Server 2025, and the installation process uses either Server Manager or PowerShell to deploy the relevant role services across one or more Windows Server 2025 machines. The role services available for installation include RD Session Host, RD Connection Broker, RD Web Access, RD Gateway, and RD Licensing.

RDS provides the infrastructure that allows users to access desktops and applications hosted on a central server from any supported endpoint device. Before installing, it is important to understand the distinction between the server-side role services and the client-side connection software.

• Server side: Full multi-user session-based desktops, RemoteApps, session collections, licensing, and related services are provided by the RDS roles installed on Windows Server 2025. This is where the installation work takes place.
• Client side: Users connect using the Remote Desktop client, which is built into Windows and available for macOS, iOS, Android, and via the browser-based web client. The RDS server roles are not installed on Windows client operating systems such as Windows 10 or Windows 11.
• Basic vs. full RDS: The classic single-user Remote Desktop feature that allows administrators to connect to a server for management is not the same as the full Remote Desktop Services role. Full RDS supports multiple concurrent user sessions with published applications, session collections, and centralized licensing management.

Windows Admin Center (WAC) is a browser-based management tool that can be installed on a Windows Server or a Windows client machine. WAC provides remote management capabilities for Windows Server 2025 machines and can enable basic Remote Desktop access for administrative connections. From WAC you can perform tasks including:

• Remotely manage Windows Server 2025 machines via a browser interface
• Enable basic Remote Desktop access for administrator connections
• Assist with administering existing RDS deployments

WAC does not install the RDS role services onto a client operating system. The actual RDS infrastructure must run on Windows Server 2025 machines. WAC serves as a management layer on top of an existing RDS deployment rather than a replacement for the Server Manager installation process.

Server Manager provides a guided wizard for installing RDS role services on Windows Server 2025. The wizard handles dependency resolution automatically and prompts for restart when required. Follow these steps to install RDS using Server Manager:

1. Open Server Manager on the target Windows Server 2025 machine. Server Manager opens automatically after login or can be launched from the Start menu.
2. Click Manage in the top-right menu, then select Add Roles and Features.
3. On the Installation Type page, select Remote Desktop Services installation rather than Role-based or feature-based installation. The RDS installation option installs all required role services together and configures them as a coordinated deployment.
4. On the Deployment Type page, choose the deployment model that matches your environment:
   • Quick Start: installs RD Session Host, RD Connection Broker, and RD Web Access on a single server. Suitable for small organizations, lab environments, or proof-of-concept deployments where simplicity is the priority.
   • Standard Deployment: distributes role services across multiple servers, allowing the RD Connection Broker, RD Web Access, and RD Session Host to run on separate machines. Required for production environments where availability, load balancing, and scalability are important.
5. On the Role Services page, select the role services to install. RD Session Host is required. The remaining role services are selected based on your deployment requirements:
   • RD Session Host (required): hosts user sessions and published RemoteApp applications. This is the workhorse of every RDS deployment and is present in all configurations.
   • RD Connection Broker: load balances user connections across multiple RD Session Host servers and manages reconnection of disconnected sessions. Recommended for all but the smallest single-server deployments.
   • RD Web Access: provides the browser-based RemoteApp and Desktop Connection portal at https://[server]/RDWeb. Users can launch published applications and desktops from any modern browser without a locally installed RD client.
   • RD Gateway: enables secure external access to internal RDS resources over HTTPS without requiring a VPN connection. Recommended for organizations where users connect from outside the corporate network.
   • RD Licensing: manages client access licenses for the RDS deployment. Required to sustain operation beyond the 120-day grace period built into Windows Server 2025.
6. Review the confirmation page and click Deploy. The wizard installs the selected role services. A server restart may be required after installation completes, depending on which role services were selected.

PowerShell provides a faster and scriptable alternative to the Server Manager wizard. The Install-WindowsFeature cmdlet installs RDS role services by their feature name. This method is preferred for scripted deployments, Windows Server 2025 Server Core installations where the GUI is not present, and Azure Virtual Machine provisioning via Desired State Configuration (DSC).

To install all five RDS role services with their management tools:

Install-WindowsFeature -Name RDS-RD-Server,
    RDS-Connection-Broker,
    RDS-Web-Access,
    RDS-Gateway,
    RDS-Licensing `
    -IncludeManagementTools

After installation completes, verify the installed RDS role services using:

Get-WindowsFeature | Where-Object {$_.Name -like "RDS-*" -and $_.Installed}

PowerShell installation is the preferred approach for the following scenarios:

• Scripted deployments across multiple servers simultaneously using Invoke-Command for remote execution
• Windows Server 2025 Server Core installations where the Server Manager GUI is not available
• Azure Virtual Machine provisioning using Desired State Configuration to enforce consistent server state
• Automated test environment builds that require repeatable, documented installation steps

After the role services are installed, several configuration steps are required before the deployment is ready for user connections. The Server Manager Remote Desktop Services dashboard provides a central view of the deployment status and flags items that require attention.

Activate RD Licensing

Open Server Manager, navigate to Remote Desktop Services, and select Overview. The RD Licensing role service will show as "Not activated" immediately after installation. Right-click the licensing server and select Activate Server. After activation, install the appropriate CAL type matching your Microsoft licensing agreement. Windows Server 2025 RDS supports two CAL models:

• Per Device: a CAL is assigned to each device that connects to the RDS deployment, regardless of how many users access it from that device.
• Per User: a CAL is assigned to each user account that connects, regardless of how many devices they use to connect.

Create a Session Collection

In Server Manager, navigate to Remote Desktop Services and select Collections. Click Tasks, then Create Session Collection. Provide a collection name, assign one or more RD Session Host servers to the collection, and specify the user groups that are allowed to connect. Session collections group session hosts and define the published applications and desktops available to assigned users.

Verify RD Web Access

Open a browser and navigate to https://[server]/RDWeb to confirm the Web Access portal is accessible. Log in with a domain account that is a member of an authorized user group. The portal should display the RemoteApp programs and desktops published through the session collection. If the portal is not accessible, verify that the RD Web Access role service is bound to the correct server and that the firewall allows inbound HTTPS traffic on port 443.

Configure RD Gateway

If RD Gateway was installed, open Remote Desktop Gateway Manager from Administrative Tools. Two authorization policies must be created before external users can connect through the gateway:

• RD CAP (Connection Authorization Policy): defines which users or user groups are allowed to connect through the RD Gateway server.
• RD RAP (Resource Authorization Policy): defines which internal servers or server groups users are allowed to reach after passing through the gateway.

Role Service	Function	Required
RD Session Host	Hosts user sessions and published RemoteApp applications	Yes
RD Connection Broker	Load balances connections and manages session reconnection	Recommended
RD Web Access	Browser-based portal for RemoteApp and Desktop Connection	Recommended
RD Gateway	Secure external HTTPS access without a VPN connection	Optional
RD Licensing	Manages Per-Device or Per-User client access licenses	Yes (after grace period)

The next lesson examines how to configure Remote Desktop Services after installation, covering RD Connection Broker settings, session collection properties, certificate assignment for secure RDP connections, and Group Policy settings for session limits and idle timeouts.