Hi, I am interested in how to prevent users hitting Session Host machines directly via RDP client - if they are not members (directly or indirectly by being members of some other group) of Remote Desktop Users group on Session Host machines then they will not be able to log in there via RDP as on any other server with Remote Desktop enabled. In that case if the same users belong to group session collection is published to, they will be able to log in to Session Host machine from RDWeb URL?
Also if everything written above is correct, that means local admins on Session Host machines (or domain admins) will always be able to hit them via RDP - that is perfectly ok since machines could have issues and admins are logging there to solve those.