Hi All,
So I've got an RDS farm as follows:
2 RCB + RCWA combined servers
4 Session Hosts
no web gateways.
I'm using NLB to balance the RCB/RCWA connections.
I have Win7 GPO's configure for SSO and configuring the "RemoteApp and Desktop Connections" client.
Now, it all works, the client configures correctly, apps can be launched, there are no errors, no logon prompts, nothing.
BUT, if i fail-over the WA servers, the client stops being able to update. RemoteApps can still be launched, but the scheduled tasks fail and manual update attempts immediately bring back a logon prompt.
so to reproduce the issue:
1. Win7 machine gets the GPO and connects to rds.mydomain.com, NLB routes this to RCB01 and gets its config ok.
2. RCB01 goes down for maintenance, NLB routes traffic to RCB02
3. Client update attempts fail
At first i thought maybe NLB was messing things up so i removed it and used RRDNS instead, the issues is still the same.
Then I thought maybe I've just fudged something else, so i tried creating a whole new fresh deployment, very vanilla but with the same setup, 2 servers to host Connection Broker and Web Access roles, a SQL box for the Broker HA DB, and 2 Session Hosts.
Correct valid certs applied.
I published 2 remoteapps (paint, calc) and had a brand new Win7 machine get the GPO and hacked the host file to point "rds.mydomain.com" to the IP of my new TESTRCB01.
Everything works like it should, re-wrote host file to point to TESTRCB02, same issue.
So the problem isn't unique to my live deployment...
I checked the IIS logs and I see this on the server it first does its config on:
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/Feed/webfeed.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 302 0 0 7
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/FeedLogin/WebFeedLogin.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 401 2 5 4
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/FeedLogin/WebFeedLogin.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 401 2 5 3
2019-03-11 11:32:52 "My RCB01 IP" GET /rdweb/feed/webfeed.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 302 0 0 5
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/FeedLogin/WebFeedLogin.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 401 2 5 4
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/FeedLogin/WebFeedLogin.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 401 2 5 3
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/FeedLogin/WebFeedLogin.aspx - 443 "mydomain\myusername" "My Win7 IP" TSWorkspace/1.1 - 200 0 0 145
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/Feed/webfeed.aspx - 443 S-1-5-21-842925246-1757981266-682003330-9437 "My Win7 IP" TSWorkspace/1.1 - 200 0 0 686
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/Feed/rdp/myapp1.ico - 443 S-1-5-21-842925246-1757981266-682003330-9437 "My Win7 IP" TSWorkspace/1.1 - 200 0 0 11
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/Feed/rdp/myapp2.ico - 443 S-1-5-21-842925246-1757981266-682003330-9437 "My Win7 IP" TSWorkspace/1.1 - 200 0 0 4
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/Feed/rdp/myapp1.rdp - 443 S-1-5-21-842925246-1757981266-682003330-9437 "My Win7 IP" TSWorkspace/1.1 - 200 0 0 4
2019-03-11 11:32:52 "My RCB01 IP" GET /RDWeb/Feed/rdp/myapp2.rdp - 443 S-1-5-21-842925246-1757981266-682003330-9437 "My Win7 IP" TSWorkspace/1.1 - 200 0 0 5
So all looking good, but then when i failover this is what i see on the other RCB:
2019-03-11 12:48:44 "My RCB02 IP" GET /RDWeb/Feed/webfeed.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 302 0 0 7
2019-03-11 12:48:44 "My RCB02 IP" GET /RDWeb/FeedLogin/WebFeedLogin.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 401 2 5 4
2019-03-11 12:48:44 "My RCB02 IP" GET /RDWeb/FeedLogin/WebFeedLogin.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 401 2 5 4
2019-03-11 12:48:44 "My RCB02 IP" GET /RDWeb/FeedLogin/WebFeedLogin.aspx - 443 - "My Win7 IP" TSWorkspace/1.1 - 401 2 5 4
You see I'm getting 401's? But then if i delete the connection and re-create it against the same server, it succeeds?
For some reason changing between the Web Access Servers breaks my SSO? but only the actual changeover??
I suspect its not an issue on the RD servers but Windows 7 is sending the wrong info to the server or something?
Please if anyone could help, I'm lost and this is causing issues as half my clients at a time can't update their app lists.