Andy Milford – Page 5

How Not To Lose Your A$$ When Deploying Windows Virtual Desktop

July 10, 2019 By Andy Milford Leave a Comment

Hello my friends. It’s now July, and Microsoft continues to lurch ever closer to a full, generally available, release of Windows Virtual Desktop in this back half of the year. Lots of MSPs and hosters are extremely interested in it, with great uptake in the public preview, because ostensibly WVD is a lower cost way to deploy session-based desktops in the public cloud. But is it really? In my opinion, Windows Virtual Desktop is only affordable if you are extremely cautious about any extra Azure services you choose to deploy with it. And, in all cases, stay the hell away from WVD overlays like Citrix Managed Desktop… unless you are an unrepentant spendthrift with money to burn! Let’s dive a little deeper and see why:

Why WVD Is Potentially Cheaper Than Hosting Regular Remote Desktop Services In Azure

In classic RDS deployments inside Azure, you need to allocate additional virtual machine resources to host the supporting Remote Desktop roles (such as the Remote Desktop Gateway server, the Connection Broker, RD Web Access, and Licensing). In some non-highly available deployment scenarios, it’s possible to combine some of these roles onto a single VM but, no matter how you slice it, you will be paying monthly compute costs for these additional VMs.

In Windows Virtual Desktop, Microsoft handles all of the infrastructure roles (Gateway, Broker, Web Access, etc) for you, encapsulating them into highly available Azure PaaS services that serve your tenants alongside all others. This theoretically saves you money, because you are now only paying for the compute costs associated with the session host VMs (e.g. Windows Server or Windows 10 Multisession), plus your RDS CAL or Windows/Office 365 licensing that allows access to the service..

Why WVD Is Not Necessarily Cheaper Than Hosting Classic RDS in Azure

Put simply, what you save by avoiding the compute costs associated with VMs running infrastructure roles, you can easily add back by deploying other “recommended” Azure services.

Hidden Azure Service Costs

For example:

Starting an Azure Security Center subscription for Just-In-Time VM Access (approximately $15 per VM per month)
Deploying Azure Log Analytics and Azure Monitor to do performance and health monitoring (variable pricing based on data volumes and logs monitored but easily $5 or more per VM per month)
Using Azure Active Directory Premium P1 or P2 OR the Enterprise Mobility Suite to provide multi-factor authentication, identity and access management, etc (approximately $3 to $9 per user extra per month)

Extra VMs Needed For Geographically Diverse Clients

There are other factors to consider as well. As discussed in my purerds.org blog article, Windows Virtual Desktop does not currently support dual transport protocols for RDP – it is TCP only. This makes distance between WVD clients and the WVD host pool in a specific Azure region highly relevant. As I’ve written about at length, one of the greatest improvements ever made to the Remote Desktop Protocol was when Microsoft joined UDP with TCP for more responsive transfer of data, video streams, etc over lossy networks or higher latency/longer distance network links. If WVD did support UDP transport in RDP to clients, Azure region choice would become less relevant because of the ability of UDP to adapt to those higher latencies caused by geographic distance.

What does this mean? It means a greater likelihood of an MSP or hoster needing to establish multiple WVD host pools, in different Azure data centers, to serve the needs of geographically disparate clients/companies with worldwide offices. True, the WVD internals may be able to use intelligent routing via Azure Traffic Manager, especially as Microsoft builds out the WVD control plane into all Azure regions but, until UDP dual transport is added back IMO, performance will suffer. More host pools equal more money spent on VM compute.

Extra VMs Needed for Validation Host Pools

Update cadences are much faster when you leverage the Windows 10 Multisession OS in your WVD host pools, as compared to server operating systems like 2012, 2016, and 2019. This means that there is a greater likelihood that a Windows Update might break an existing deployed app. Microsoft’s answer to this problem is to deploy a validation host pool, which is a special set of VMs that get the Windows 10 updates applied to them first. These effectively become the “canary in the coal mine”, to alert you to application incompatibilities post update- before all of your users call you up to air their grievances. However, an additional host pool of VMs is an additional cost to you.

Deploy Citrix Managed Desktop For WVD If You Really Want To Hemorrhage Money Fast

Say No To Citrix Managed Desktop — Want to Lose Money? Deploy Citrix Managed Desktop.

As mentioned in my PureRDS.org article on the subject, Citrix Managed Desktop adds another $21 per user per month on top of your Windows Virtual Desktop costs. That’s an insane level of extra overhead for an MSP, hoster, or SMB company to bear. Frankly, there’s no need for it- especially if you are smart about what third-party software and services you choose to add to your WVD deployment. Which leads me to…

Smart Ways To Keep Your WVD Deployment Within Budget

Here are some tips and tricks that you can use to keep WVD costs to the bare minimum, as you host your apps and desktops.

Managing Windows Virtual Desktop On a Budget

The web interface and PowerShell cmdlets for managing WVD are extremely basic and rather feature limited. On top of that, attempting to monitor WVD by building your own queries with Azure Monitor and Azure Log Analytics gets expensive fast- especially when you factor in staff time to design everything.

Instead, you can publish our Remote Desktop Commander Client as a RemoteApp within one of your WVD host pools, and instantly have a robust management platform for WVD– including shadowing and remote support. Or, if you don’t want to leverage RemoteApp, you can elect to deploy the new Azure Bastion service– which gives you secure access to all of the WVD VMs in your host pools, and connect to a VM with our Remote Desktop Commander Client installed. Azure Bastion only costs a flat $68 per month plus data transfer, regardless of how many VMs you need to access from it, and our Remote Desktop Commander Client is free, with optional enhancements via Premium Management Features. This is certainly much cheaper than paying $15 per VM per month for Just-In-Time access to VMs via raw RDP.

Monitoring Windows Virtual Desktop On a Budget

Of course, if you need to actively monitor your Windows Virtual Desktop deployments, you can leverage our Remote Desktop Commander Suite solution, and pair it with an Azure SQL Database (for data collection and storage). As opposed to paying hefty data ingestion rates (plus per performance counter and per log monitoring costs via Azure Monitor and Azure Log Analytics), you can rapidly deploy our solution that: a.) already knows what items to monitor out of the box, b.) can monitor performance much more granularly than Azure Monitor, c.) has a built in reporting engine with scheduler, and d.) is priced at a flat $9.99 per WVD VM per month, with volume discounts. Azure SQL costs for most deployments typically only run $30 to $60 per month, with up to 250 GBs of storage provided. This is a much more economical way to monitor your infrastructure. Moreover, if you’re a hoster/MSP/CSP, we offer a special multi-tenant version of our solution that allows you to keep tabs on all of your WVD deployments from a single access point.

Remote Desktop Commander Core Architecture — Remote Desktop Commander Core Deployments Allow You To Centrally Monitor and Report On Multi-Tenant Environments (e.g. MSP Private Clouds and WVD in Azure)

Consider Running Classic RDS in Azure Instead of WVD

Even with the launch of WVD, you can still deploy traditional RDS inside Windows Azure using Server 2012, 2016, or 2019; including the ability to run Office 365 on those server operating systems. Doing so gives you complete control over the RDS architecture, and allows you to utilize RDP with UDP and TCP to provide a better experience to geographically diverse clients.

Partner With an Azure Expert

The sheer number of Azure services and pricing I covered in this article probably has left you feeling dizzy. Given the speed at which new Azure services are offered, one of the smartest things you can do is to partner with an Azure services expert like MyCloudIT.
mycloudStacked_color

The folks at MyCloudIT constantly stay on top of the different Azure service offerings, and are experts at provisioning only the services you need. They work hard to keep you within budget and on top of Azure service costs. They’re also experts at deploying our Remote Desktop Commander Suite solution into RDS and WVD deployments, which they’ve already done for a number of their “RDS in Azure” clients. Partnering with them is a much smarter option than going with an WVD overlay like Citrix Managed Desktop- at a fraction of the cost.

If you’ll be attending Microsoft Inpire next week, come visit them at Booth 3106 to see both their approach to hosting Remote Desktop Services in Azure AND how our Remote Desktop Commander Suite enhances their management and monitoring offerings. And please tell them Andy from RDPSoft sent you!

We Fixed Remote Desktop Shadowing (And Some Other Stuff)

May 8, 2019 By Andy Milford Leave a Comment

One of the continuous laments that we’ve heard from our customer base, for years now concerns user session shadowing in Remote Desktop Services. This is a shame, because the internal architecture for shadowing from Windows Server 2012 R2 onwards is pretty amazing.

Using MSTSC to shadow however, eh, not so much.

Let’s Face It: Remote Desktop Shadowing Hasn’t Been a Great Experience For, Well . . . Forever!

The litany of complaints includes problems like:

lack of proper shadowing support (zoom out) for multiple monitor sessions
dreaded permissions errors
the unfortunate requirement for help desk users to be administrators on the terminal servers they want to shadow
the inability for Windows 7 systems to initiate shadowing on Server 2012/2016/2019 systems and Windows 8 and 10 workstations.

There was also the small issue that there were no tools for shadowing/remote assistance inside Windows Virtual Desktop in Azure.

As a result, admins and IT staff have been paying an arm and a leg for remote assistance tools to bridge this gap – tools that require heavy install footprints, hundreds or even thousands of dollars per technician per year, and tedious invitation URLs, etc are required to start helping users.

Which Reminds Us: Delegation of Administration Options for Remote Desktop Services Have Been Nonexistent For Way Too Long!

The other need that we hear frequently from our customers is the ability to precisely delegate Remote Desktop Services management permissions to their help desk and front line support staff. To date, the only real option has been to give help desk staff admin rights on session hosts and connection brokers. Not an ideal situation from a security, or a “whoops I just rebooted a terminal server with 30 user sessions running line of business apps” perspective.

We tried to resolve some of these issues with our RDSConfig utility, that allowed permissions reassignment for users and groups on session hosts. However, in larger RDS collections, you need a way to apply those permissions to a huge swath of session hosts all at once – especially as new session hosts are brought online. Also, to do their jobs, help desk staff need rights to query the Connection Broker to dynamically list RDS collections and the servers that are members of each, plus they should have the ability to read RDS-related performance counters on those session hosts, so they can troubleshoot things like network latency from the client to the server.

So, We Figured Out How To Make Shadowing Much Better AND Created a Wizard To Let You Delegate RDS Management Tasks To Your Help Desk Staff

We call these new tools in the Remote Desktop Commander Client Premium Management Features. For $99.99 per admin or help desk user per year, all of the aforementioned problems go away. Want to shadow Server 2012+ systems from Windows 7? No problem. Want to monitor multiple user sessions at once in live view in one window? We do that. Do you have RDS users with multiple monitors that you haven’t been able to shadow before? Again, we’ve got you covered.

Watch this quick video on YouTube to see these features in action:

Next, download the latest copy of the Remote Desktop Commander Lite client. Once you install it, you’ll be able to preview the SuperShadow features for 15 days. The RDS Management Delegation Wizard becomes available after you purchase a subscription from us.

Once you start your subscription, you’ll immediately be emailed a license file that will unlock all of those features.

**Note 1: With the release of Premium Management Features in Remote Desktop Commander Lite, legacy shadowing support for Windows Server 2008 and legacy shadowing through the MSTSC client were retired. These features remain available in our Remote Desktop Commander Suite solution however.

**Note 2: If you are an existing Remote Desktop Commander Suite customer who would like to test these new Premium Management Features, please install the latest client on a VM or system OTHER than the system running the core Remote Desktop Commander Suite components.

Updated: November 2020.

Windows Virtual Desktop Officially Announced – My Take

September 24, 2018 By Andy Milford Leave a Comment

This week at Ignite, Microsoft is announcing the introduction of Windows Virtual Desktop, a multi-user version of Windows 10 Enterprise that is deployable in Azure. Please see their blog post here about it.

I will have much more to say about this in future blog posts, but coupled with their heavy investments in “Remote Desktop Modern Infrastructure” (a.k.a RDmi for short) where RDS roles like the Connection Broker, Web Access, and Gateway are now simply PaaS components in Azure, this is going to upend the EUC/virtualization industry in an extreme way. The downward cost pressure Microsoft will place on user desktop and app hosting with this play will be tremendous. In the future at this blog and in webinars we host, we will analyze Windows Virtual Desktop licensing (with RDmi and compute costs factored in) versus traditional on-premise or datacenter-based Remote Desktop Services hosting on Server 2016/2019.

At first glance, I don’t think Windows Virtual Desktop will be good for Citrix, and I certainly think it will threaten Amazon’s DaaS offering. It’s also probably going to put a good swath of non-Azure based MSPs and CSPs out of business. I could be wrong, of course, but that’s my read on it right now.

Fortunately for our customers, we will be Windows Virtual Desktop ready in Q1 2019, and will be able to monitor multi-user Windows 10 instances just like Windows Server RDS session hosts. We look forward to continue to serving the Remote Desktop Services management and monitoring needs of all organizations, whether they run Windows Server or Windows 10 on premise, in the datacenter, or in Azure.

Azure RemoteApp – Sayonara!

August 12, 2016 By Andy Milford Leave a Comment

Microsoft Announces Today That They’re Phasing Out Azure RemoteApp, and Transitioning Customers Over to a Citrix Solution Instead

Gabe Knuth first blogged on this possibility August 3rd, and now it has been confirmed.

From the Microsoft Enterprise Mobility Blog:

Today we are announcing the next step in our broad partnership with Citrix in the remote desktop and applications space, which we recently expanded to address new scenarios for our joint customers on the Azure cloud.

Customers have provided us consistent feedback that they want a comprehensive, end-to-end, cloud-based solution for delivering Windows apps. The best way for us to deliver this is with Citrix through XenApp “express”, currently under development. XenApp “express” combines the simplicity of application remoting and the scalability of Azure with the security, management, and performance benefits of XenApp, to deliver Windows applications to any employee on any device. We will have much more to share on this offering through the coming months.

Key takeaways:

New purchases of Azure RemoteApp will end October 1st, 2016.
End of life date for existing Azure RemoteApp deployments will be August 31st, 2017. Migration of some sort will be required before then.

My thoughts – this is a smart move. As Gabe mentioned, Azure RemoteApp had issues with rapid scaling during logon storms and other load balancing issues. Also, there’s the practical aspect that most organizations, if they move their apps to the Cloud, also need to move the supporting infrastructure (e.g. database servers, CRM/ERP servers, Active Directory, etc). In that sense, it makes better sense to either leverage this new Citrix solution OR simply stand up a full Remote Desktop Services IaaS deployment in Azure. This will only be easier to do with the upcoming release of Microsoft Windows Server 2016.

Why I Created the PureRDS.org Resource Site

July 24, 2016 By Andy Milford Leave a Comment

Let’s Face It, Small Shops Running SBC Solutions Are Not Well Supported

In the Server-Based Computing (SBC) community (e.g. Citrix, Microsoft RDS, VMware Horizon, etc), it’s fairly well-known that the vast majority of SBC implementations consist of 500 users or less. In contrast, the majority of marketing resources from vendors in the space go after chasing companies with 500 users or more. There’s a perception in our industry, rightly or wrongly, that the little shops are simply too expensive when it comes to acquiring their business and supporting them.

My area of expertise in the SBC community is Microsoft Remote Desktop Services, as I design monitoring software for that platform, and am currently a Microsoft MVP in this space. For many smaller shops who need to run SBC environments for teleworking, Microsoft RDS has been the platform of choice, as it only requires a single client access license (the RDS CAL), as opposed to Citrix, which requires not only the Microsoft RDS CAL, but the Citrix Concurrent License that runs on top.

Microsoft Has Recently Made Remote Desktop Services on Windows Server 2012 Harder To Deploy and Manage

Recently, I think that the partitioning of the SBC market that I talked about above (in terms of vendors only wanting to acquire and support medium to larger sized customers) has started to affect product architectural decision making as well. Citrix has continued to move up market, so much so that implementing their products almost always requires outside consulting expertise. In contrast, for the longest time, Microsoft RDS was relatively easier to deploy for even the smallest of shops – you’d turn some of your Windows Servers into Remote Desktop Session Hosts, and if you were a larger farm, you’d consider adding a Connection Broker Server, Remote Desktop Web Server, and Remote Desktop Gateway Server into that mix. Management was done through a handful of tools (TSAdmin, TSConfig, etc) that were fairly straightforward to use.

Enter Microsoft Windows Server 2012. Remote Desktop Services got a radical overhaul in Server 2012, and that overhaul has caused a considerable amount of pain for shops trying to migrate their RDS implementations from Server 2008 to Server 2012. One of the biggest painpoints in the Server 2012 ecosystem has been the restructuring of management tools for RDS. In order to manage user sessions and other configuration aspects, Microsoft moved these features out of those simple tools I mentioned earlier (TSAdmin, TSConfig, etc) into the Remote Desktop Services Manager overlay in the Windows Server Manager utility. Moreover, to even get the RDSM to work at all, the RDS implementation now must have a connection broker installed. And don’t even think about trying to stand up a full Windows Server 2012 RDS implementation in a workgroup – a domain environment is required.

If your implementation of RDS does not have enough roles to activate the RDSM in Server Manager, to date you’ve been forced to manage your session host servers predominantly with PowerShell scripts and command line tools.

PureRDS.org – a Resource Site For the Neglected Small Shops Running Microsoft Remote Desktop Services

All the above said, there are tons of organizations, with 500 users or less, who need quality resources for both their conventional (e.g. all RDS roles deployed) and unconventional (e.g. some RDS roles deployed, workgroup environments) RDS deployments. Thus, I decided to create PureRDS.org. Over time, it will become a rich repository of PowerShell management scripts, free tools, and other tips/tricks for smaller RDS deployments. The RDS community, while small compared to Citrix, continues to grow and deserves more resources. I hope PureRDS.org will help further fill that niche. Please check it out now and take advantage of all it can offer you!