Hyper V and RDS

Question

Hyper V and RDS

Alien 0

Hi, I have a DC setup with RDS and Hyper-V roles. I have created RDS users and I am able to connect remotely to my server using RDS user credentials. The problem is RDS users cannot run any application without being elevated to Adminstrator from RDP session. I want to configure these users in such a way that they can run Hyper-V VMs hosted by DC from RDP session without using admin rights. Additionally, I want to limit these RDS users just to run VM and NOT be able to delete or change VM settings. Lastly, is it possible that when these RDS user logon to a session only Hyper-V is running and they don't have access to RDP session desktop. Appreciate your time and support. Cheers. Regards, ALIEN

Eric Siron 1,586 Reputation points MVP

2024-02-19T14:40:50.8733333+00:00

"DC" as in "domain controller"? This is why. Don't do that.
Alien 0 Reputation points

2024-02-20T04:34:08.4766667+00:00

Hi Eric, Yes domain controller, actually I don't need a domain but RDS and Hyper-V features. If I remove DC role, can I still use multiple RDS sessions & Hyper-V? Thanks.
Eric Siron 1,586 Reputation points MVP

2024-02-21T18:30:10.08+00:00
Well this sounds like a mess to me, but on the assumption that you only have the one physical unit, I would:

Add a Windows Server virtual machine

Make sure the guest has auto-start with a delay of 0

Install the DC role with global catalog in the guest

Transfer all the FSMO roles from the host to the DC guest

Demote the host

Add another Windows Server virtual machine

Make sure that one has auto-start with a delay of 0 or very short

Install the RDS broker and web role, also gateway if you're using that

Install RDVH role on the host

Set up the RDS VM pool

It's not great for a few reasons but it will solve the problem. Everyone will RDP directly into their assigned VM and can run software. You can give them admin rights or not, but it won't extend beyond their VM. If you want them to have VMs within VMs then nested virtualization is the way to go.

If you have two physical units, then I would have one running Hyper-V with a DC VM and a VM for the RDBroker/Web/Gateway (you can do this with a single WS standard edition license) and the second either as RDSH or RDVH as you choose. This is the preferred solution.

And because someone is going to come here and proclaim that you can't run Hyper-V using a domain controller that it hosts, you absolutely can, I can prove it (and have), and they can't disprove it. I really don't like running user VMs on a host that also has a DC VM, but it would take a breakout exploit to do anything with it so the risk is low.

As a really bad choice, you can follow the steps as listed above but at step 9, make it a session host instead. You'll still have a lot of permissions problems, primarily that controlling the Hyper-V VMs means that users will have path access to your DC's VHDX and console access to it even if they don't have a log in.

1 answer

Your answer

Eric Siron 1,586 Reputation points MVP

2024-02-19T14:40:50.8733333+00:00

"DC" as in "domain controller"? This is why. Don't do that.
Alien 0 Reputation points

2024-02-20T04:34:08.4766667+00:00

Hi Eric, Yes domain controller, actually I don't need a domain but RDS and Hyper-V features. If I remove DC role, can I still use multiple RDS sessions & Hyper-V? Thanks.
Eric Siron 1,586 Reputation points MVP

2024-02-21T18:30:10.08+00:00

Well this sounds like a mess to me, but on the assumption that you only have the one physical unit, I would:

Add a Windows Server virtual machine

Make sure the guest has auto-start with a delay of 0

Install the DC role with global catalog in the guest

Transfer all the FSMO roles from the host to the DC guest

Demote the host

Add another Windows Server virtual machine

Make sure that one has auto-start with a delay of 0 or very short

Install the RDS broker and web role, also gateway if you're using that

Install RDVH role on the host

Set up the RDS VM pool

It's not great for a few reasons but it will solve the problem. Everyone will RDP directly into their assigned VM and can run software. You can give them admin rights or not, but it won't extend beyond their VM. If you want them to have VMs within VMs then nested virtualization is the way to go.

If you have two physical units, then I would have one running Hyper-V with a DC VM and a VM for the RDBroker/Web/Gateway (you can do this with a single WS standard edition license) and the second either as RDSH or RDVH as you choose. This is the preferred solution.

And because someone is going to come here and proclaim that you can't run Hyper-V using a domain controller that it hosts, you absolutely can, I can prove it (and have), and they can't disprove it. I really don't like running user VMs on a host that also has a DC VM, but it would take a breakout exploit to do anything with it so the risk is low.

As a really bad choice, you can follow the steps as listed above but at step 9, make it a session host instead. You'll still have a lot of permissions problems, primarily that controlling the Hyper-V VMs means that users will have path access to your DC's VHDX and console access to it even if they don't have a log in.

Answer 1

Marcin Policht 49,640 MVP Volunteer Moderator

To use RDS, you need to purchase RDS licenses. Details at https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-client-access-license hth
Marcin

Alien 0 Reputation points

2024-02-18T04:49:46.6633333+00:00

Hi Marcin, Thanks for the reply. My issue is not related to licensing, it is related to Remote App Publishing for RDS user. I am able to RDS server which means there is no problem with licenses, also as per link you shared, there is 120 days grace period. I added Hyper-V in Remote App but still on RDS client it is asking for Admin user/pass for rights elevation. Thanks.
Marcin Policht 49,640 Reputation points MVP Volunteer Moderator

2024-02-19T00:42:50.32+00:00

Have you assigned sufficient permissions to your users to access the apps via RDS? Are they members of the Remote Desktop Users group? Pls refer to https://learn.microsoft.com/en-us/windows/win32/termserv/terminal-services-permissions for more information.

hth Marcin
Marcin Policht 49,640 Reputation points MVP Volunteer Moderator

2024-02-19T00:46:57.24+00:00

This actually appears to be related to the scenario-specific permissions - the action that you want your users to be able to perform needs to be delegated. The RDS context is probably not particularly relevant - the question is whether you can delegate this particular task (the same would apply if you had a user logging on locally, rather than via RDS)

hth Marcin
Marcin Policht 49,640 Reputation points MVP Volunteer Moderator

2024-02-19T00:59:06.68+00:00

Could you clarify what specifically you want your users to be able to do? In other words, what specifically do you mean by "run Hyper-V VMs"? Is it about the ability to start them/stop them, etc.? If so, then I don't really see why that would need to be done via a Remote Desktop session. These permissions can be delegated and the corresponding actions can be performed remotely (e.g. via PowerShell Remoting). The recommended approach in such case would be used PowerShell JEA. More at https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.4

hth
Marcin
Alien 0 Reputation points

2024-02-19T13:09:48.2733333+00:00

Hi Marcin, Thanks for taking time to reply. I have a remote virtualization server based on Win2K22 Server. The intent of this setup is to make server a hyper-V virtualization host. To access this server, I also have to make it RDS host as well because my users are sitting at different locations in the office, but they have Ethernet connection to access host. I have multiple users from different departments, and they will be working on different VM as per their need and engineering software they intend to use. They should be able to run/stop any VM they want, it is not required that all VM should be running all the time. These users are part of RDS users and can RD server with dedicated user account. This VDI experience is session based, they all have their dedicated desktops. The RDS part of this setup is working fine as per the requirement. Now comes the challenge, these users can't open Hyper-V manager despite I have assigned these users in Administrator group (for testing) and hyper-V managers but still whenever these RDS users launch hyper-V they are asked for Admin user/pass, only then they can launch the hyper-V manager and run the VM. I also tried by publishing hyper-V (mmc) as remote app but nothing changed. I have also tried creating a GPO for RDS users to launch (mmc.exe and directory virtmgr.msc) at startup but it is also not working even my GPO is not working for mspaint.exe which RDS users can access without any rights as mspaint is remotely published app, perhaps something wrong with my GPO config. I don't know if there is a better way to achieve this other than RDS. I previously have used one such setup based on Win2K12 server, where I used to RD server and connect directly to hyper-V manager without any access to desktop and run/stop VM of my need. Appreciate your support, cheers. Regards, Alien

Share via

Hyper V and RDS

1 answer

Your answer