I have the following Windows 2012 R2 RemoteApp Setup

  • Server1 - Role (Web Access, connection broker, RD Host)
  • Server2 - Role (connection broker, RD Host)

DNS Entries used for Round Robin

  • RDWA,
  • RDCB,

Connection Broker is setup using HA (Server1, Server2) - it uses the RDCB Alias for DNS Round Robin (ClientAccessName)

Collection Name: "General" and am publishing just Notepad. Applied wildcard Cert.

Configured IIS: Default Website Redirection to /RDWeb/..., Allowed for single Signon

GPEDIT on Client machines.. To allow for default Credential Delegation and allowed TERMSRV/* for my testing.

So basically. From a client if I open up my browser and point to RDWA (remote web access)... i get the remote web form.. I can see notepad. When I click on notepad. I get the following prompt:

Your credentials did not work

Your system administrator does not allow the use of default credentials to log onto the remote computer RDCB.TEST.LOCAL because its identity is not fully verified. Please enter new credentials.


Before I setup Connecton Broker HA, I was not prompted for this message. It would do the single sign-on OK. I was maybe thinking that I needed to setup a Kerberos identity called RDCB like I did in Windows 2008 R2. But this looks different in Windows 2012 and wasn't able to find the Powershell command to do this.

  • You state only one server has web app role. Is this correct? I think this is a red herring and not really the issue. I think the issue lies with the TERMSERV*. Can you create a test domain group and delegate access with that? – blaughw Dec 19 '14 at 4:00

I did a wee bit of digging around and read that 2012 doesn't use a Kerberos Identity like 2008 R2. So what I tried was enabling the following "Allow delegating default credentials with NTLM-only Server authentication".

This seem to do the trick and now I have single sign-on working correctly.

Thanks for your help. cheers


I start by suggesting you separate your roles, especially if you want to test pre-production. An issue with a session host would directly affect your CB and cause additional problems. If you are covered on dev licensing and using VMs, go nuts. CB role doesn't take much on resources, you could even do Server Core.

As for the issue, I suspect it stems from your permissions group assignment. Try a test domain group, or even just a user.

A lot of the tricks and nonsense from 2008 RDSH seems to be gone from 2012+, but it still has some kinks.

  • Oh man, I did some investigation and found this: blogs.msdn.com/b/rds/archive/2007/04/19/… . None of this info applies in RDS 2012. You get much better results out of the box. (Provided your clients are high enough version) – blaughw Dec 19 '14 at 5:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.