Lesson 1

Remote Desktop Services (RDS) is the Windows Server platform for centralized application delivery and remote desktop access. Rather than installing software on every workstation, administrators install applications once on a server and users connect to that server to run them. This model reduces the cost of client hardware, simplifies software maintenance, and gives IT teams a single point of control for patching and security policy. Windows Server 2025 ships with a fully updated RDS stack that supports session-based desktops, RemoteApp application delivery, and Virtual Desktop Infrastructure (VDI) from a single Server Manager workflow.

From Terminal Server to Remote Desktop Services

Microsoft shipped the original Terminal Server as a separate product in 1998. With Windows Server 2008, the component was folded into the operating system and renamed Remote Desktop Services, reflecting a shift from raw terminal access to a broader platform covering three distinct capabilities:

1. RemoteApp: individual applications published to remote users so they appear to run on the local desktop rather than inside a visible remote session window.
2. Session-based desktop virtualization: full Windows desktop sessions hosted on a shared RD Session Host server, with each user working in an isolated session.
3. Virtual Desktop Infrastructure (VDI): personal or pooled virtual machines delivered through RD Virtualization Host, giving each user a dedicated VM rather than a shared session.

RemoteFX, introduced with Windows Server 2008 R2, added GPU-accelerated graphics rendering to remote sessions, making RDS practical for users who needed more than basic desktop rendering. Windows Server 2025 continues this trajectory with improved adaptive graphics compression, support for multi-monitor high-DPI configurations, and integration with Azure Virtual Desktop for hybrid deployment scenarios.

Module Roadmap

This module walks through the full RDS deployment lifecycle on Windows Server 2025. The lessons cover the following topics in sequence:

1. Install Remote Desktop Services: role installation, deployment type selection, and license server activation through Server Manager.
2. Configure RDS: post-installation configuration of the RD Connection Broker, RD Web Access, and RD Session Host roles.
3. Install the Remote Desktop Services Client: deploying and configuring the Remote Desktop client on Windows, macOS, iOS, and Android endpoints.
4. Remote Desktop Protocol: how RDP operates at the network level, port configuration, encryption, and Network Level Authentication (NLA).
5. Install Applications on the Remote Desktop Server: using Install mode to deploy applications correctly in a multi-user session environment.
6. Application Compatibility Scripts: running compatibility scripts to adapt legacy applications to a shared session host environment.
7. Configuring Compatibility Script Parameters: customizing script parameters to handle per-user registry paths, temporary directories, and INI file redirection.
8. Optimize Performance and Security: Group Policy settings for session limits, idle timeout, clipboard redirection, drive mapping, and printer redirection.

RDS Role Architecture on Windows Server 2025

A production RDS deployment on Windows Server 2025 distributes its workload across several distinct roles. Understanding the role of each component before installation prevents configuration errors that are difficult to correct after deployment.

1. RD Session Host: the server that hosts the actual user sessions and runs the published applications or desktops. This is the workhorse of the deployment and the role that consumes the most CPU, memory, and storage I/O under load. Organizations with more than a handful of concurrent users typically deploy multiple RD Session Host servers behind the RD Connection Broker for load distribution.
2. RD Connection Broker: manages load balancing across multiple RD Session Host servers and handles session reconnection when a user returns to an existing session. In a single-server lab or small deployment the Connection Broker can run on the same machine as the Session Host, but in production it is typically a dedicated server or a high-availability pair.
3. RD Web Access: provides the web portal through which users can launch RemoteApp programs and full desktops from a browser or from the Remote Desktop client's feed URL. Windows Server 2025 ships an updated RD Web Access interface with improved compatibility for modern browsers.
4. RD Licensing: manages Remote Desktop Services Client Access Licenses (RDS CALs). Every user or device that connects to an RD Session Host requires a valid CAL. The RD Licensing role can be installed on any server in the deployment; it does not need to be co-located with the Session Host. Licensing mode is either Per User or Per Device, and the choice is locked at the deployment level rather than per session.
5. RD Gateway: allows authorized remote users to connect to RDS resources over HTTPS without requiring a VPN. The gateway terminates the HTTPS connection and forwards traffic to the internal RD Session Host over RDP, keeping the Session Host off the public internet. Windows Server 2025 supports RD Gateway with certificate-based authentication and integrates with Azure AD for conditional access policies in hybrid environments.

Licensing Requirements

Remote Desktop Services requires both a Windows Server license for the host and RDS Client Access Licenses for the connecting users or devices. Windows Server 2025 supports two CAL types: RDS Per User CALs, which follow the user account regardless of which device they connect from, and RDS Per Device CALs, which are assigned to the connecting device and allow any user to connect from that device.

Per User CALs are the more common choice for organizations where employees use multiple devices such as a workstation, a laptop, and a mobile endpoint. Per Device CALs suit environments such as shift-work facilities where multiple employees share a single terminal or kiosk. The licensing mode must be set before the 120-day grace period expires; connections are refused after the grace period if no license server has been configured and activated.

Microsoft licenses RDS CALs separately from Windows Server CALs. An organization already running Windows Server 2025 Standard or Datacenter still needs to purchase RDS CALs if it plans to deploy Remote Desktop Services for more than two administrative connections. The two built-in administrative connections do not require RDS CALs and are intended for server management only, not for general user access.

Planning the Deployment

Before opening Server Manager, three planning decisions will determine the shape of the entire installation.

Deployment type. Server Manager offers Quick Start and Standard Deployment. Quick Start installs all RDS roles on a single server in a single wizard pass, which is appropriate for lab environments and small organizations with under ten concurrent users. Standard Deployment lets you assign each role to a different server, which is the correct choice for any production environment that requires role separation, high availability, or future scale-out of the Session Host tier.

Deployment scenario. Session-based desktop deployment uses RD Session Host to provide shared multi-user sessions, which is the most resource- efficient model and the most common in enterprise environments. Virtual machine-based desktop deployment (VDI) uses RD Virtualization Host and Hyper-V to give each user a personal virtual machine. VDI provides stronger session isolation and supports user-installable software, but it requires significantly more hardware and storage than a session-based deployment for the same number of users.

Network topology. Determine whether users will connect from inside the corporate network only, or whether external connections are required. External connections require the RD Gateway role and a publicly trusted TLS certificate. Internal-only deployments can use a self-signed certificate or an internal CA certificate for RDP encryption.

System Requirements for Windows Server 2025 RDS

Windows Server 2025 requires a 64-bit processor with a minimum of 4 GB of RAM for the base operating system. RDS workloads add to this baseline in proportion to the number of concurrent sessions. Microsoft's general guidance for session-based RDS is to plan for 100 to 200 MB of RAM per concurrent session for typical office productivity workloads, with additional headroom for the applications themselves. A server hosting 50 concurrent sessions running Microsoft 365 applications should be sized with at least 16 GB of RAM dedicated to session overhead above the OS baseline.

Storage I/O is the most common performance bottleneck in session-based deployments. User profile disks (UPDs) or FSLogix profile containers generate continuous read and write activity as users log on and work. SSDs or a shared storage array with SSD-tier caching are strongly recommended for the profile storage path. Spinning disk is acceptable for application binaries and OS images but should not be used for profile storage in a deployment with more than a small number of concurrent users.

What Comes Next

The next lesson, Install Remote Desktop Services, covers the step-by-step Server Manager installation sequence for Windows Server 2025, including role assignment, deployment type selection, server specification for each role, and the post-deployment steps to activate the RD License Server and create the first session collection.

For further reading on securing a Remote Desktop Services deployment, the following resource covers hardening RDS against common attack vectors including credential stuffing, RDP brute-force, and lateral movement via session hijacking: