Greetings and thanks for reading (apologies for the length).
I'm a new Sys Admin and I have a (potentially silly) question for the more seasoned veterans. I'm migrating our primary Domain Controller from Server 2003 (SrvA) to Server 2008 R2 (SrvB) and I'm making an effort to deduce which roles & features to include on SrvB.
SrvA has the Terminal Services role. In Windows Server 2008 & beyond that role is called "Remote Desktop Services" and this particular nomenclature has me assuming it's a requirement in being able to successfully MSTSC (RDP) into machines in our environment. My assumption could be wrong, but obviously that's an important feature since I need to be able to RDP (locally and over VPN) to manage servers centrally.
My question, I guess, is do I really need the RDS role installed (somewhere on the domain) to be able to do this? I ask because I've tested and my ability to RDP does not seem to hinge on SrvA being online (that being the DC that holds the terminal services role). This is the case for existing sessions as well as creating new sessions (I have not tested over VPN however).
As a side note (and something that has muddled my initial thoughts), I've read it is not a good practice to have the RDS role on a DC for a number of security reasons, not the least because you don't want people "remoting" into your DC to run centrally located applications. This particular best-practice (in combination with my test results above) has me scratching my chin.
Maybe RDS is less of a role that essentially "makes the remote desktop protocol possible on a domain". Maybe it's more of a role that "allows a widely varying number of concurrent users access to an 'application' server to launch centrally-located software." The latter being useful, but less critical than the former for my use case.
This bolsters my findings that RDS seems to require specific CAL(s) for concurrent users (not necessarily admin logins).
TLDR; I think my overarching question is "do I need RDS somewhere on my domain to allow RDP sessions", and if no then "why would I need/want RDS installed at all"?