Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Question: How do i tell RDWeb to launch apps from rather then host.internaldomain.local?


Existing org with AD forest. New single Server 2012 running all Remote Desktop Services roles for session host. Used the new 2012 wizard to setup "QuickSessionCollection" with roles:

  • RD Session Host
  • RD Connection Broker
  • RD Gateway
  • RD Web Access
  • RD Licensing

Everything works with self-signed cert, but we want to prevent those.

The users are potentially non-domain machines so sticking a private root cert for on their machines isn't an option. Every part of the solution needs to use public cert.

Added public cert to all roles using Server Manager GUI:

  • RD Connection Broker - Enable Single Sign On
  • RD Connection Broker - Publishing
  • RD Web Access
  • RD Gateway

So now everything works beautifully except the last step:

  1. user logs into
  2. user clicks a app icon, which in background downloads a .rdp file that is signed by
  3. .rdp is set to use RD Gateway, which is
  4. .rdp says app is hosted on internal host.internaldomain.local, which doesn't match the RDP-tcp TLS cert of, and pops a warning.

It's this last step that I'd like to fix. Is there a config option in PowerShell, WMI, or .config to tell RDWeb/RemoteApp to use for all published apps so the TLS cert for RDP matches what the Session Host is using?

NOTE: This question talks about this issue, and this answer mentions how you might fix it in 2008, but that GUI doesn't exist in 2012 for RemoteApp, and I can't find a PowerShell setting for it.

NOTE: Here's a screenshot of the setting in 2008R2 that I need to change. It tells RemoteApp what to use for the Session Host server name. How can I set that in 2012?

enter image description here

share|improve this question
up vote 4 down vote accepted

This PowerShell worked: tell the Session Collection to add a alternate address for Session Host connections. This is also what you would do for a Session Host farm with round robin.

Once I ran this, launching apps from RDWeb would give a single prompt that now matches the three settings without warnings:

  • Publisher:
  • Remote computer:
  • Gateway server:

Set-RDSessionCollectionConfiguration –CollectionName QuickSessionCollection -CustomRdpProperty "use redirection server name:i:1 `n alternate full"

Depending on any other Custom RDP Properties, the above command may be different because you have to include them all in one command with a linefeed between each.

Background Info:

Adding custom RDP settings:

Using this setting for HA:

share|improve this answer

I am pretty sure that you need a cert valid for both the internal and external namespace. If you have .local internally (yuck) then you may have a hard time acquiring a cert with .local in either the Subject or Subject Alternative Name fields. If you can't get a cert from a public provider for this, then an internal PKI setup is your only option here.

share|improve this answer
Right, the assumption is I won't use a .local cert at all. This was possible in 2008R2 based on my screenshot above, but that was before Connection Brokers were required and the RemoteApp Manager GUI was removed. So, this should work fine with a non-hostname for RD Session Host, just need to find where 2012 expects us to set the setting above. – Bret Fisher Jul 17 '13 at 17:42

If you don't have a UC certificate you can use this powershell script to update the FQDN to match your external host name / certificate name:

share|improve this answer
I've read that this script can cause errors in RDS. "Please note that there are issues using RD Web feed after using this to change the client access name. RDS looks for a RDCB farm during the connection process and then fails." This tells me that this method is unsupported by Microsoft. Is there an alternative way to change the name that is supported? source:… under "Certificate Mismatches". – Thomas Dec 11 '15 at 0:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.