Quick overview of system:
I have a business (IT) domain and a process control network (PCN) domain joined via a pair of firewalls and a DMZ (DMZ servers part of PCN domain also). PCN domain servers are 2016. IT is a mix of various workstations and servers.
I want to allow IT users to access a view only session of the plant control HMI from a RDS on the PCN via a RD Gateway in the DMZ. This is straightforward until I get to licensing. These users are already licensed IT RD Users via a RD Licence Server on the IT network. I figured I had two options here, either:
- allow 2-way trust between domains so that the RDS on PCN can use the IT license server, or
- buy new RDP user CALs and setup a license server on PCN for this.
Concern with option 1 is security being reduced between networks. For option 2 it is cost.
But now I am wondering whether I can set up another RDS in the IT network that becomes the first hop for the clients and then initiates a RDP session from there to the PCN RDS with the HMI app (ie nested RDP sessions). I could then just do a device based RDP CAL assigned to the IT RDS and hosted by a licence server in the PCN (device = IT RDS). I don't think this is multiplexing because I am still allocating a user based RDP CAL in the IT domain (as well as a device RDS CAL in the PCN domain).
Obvious downside of this would be no passthrough of devices, printers etc and a slightly impaired performance - but I think it would work OK.
I don't have a very specific question regarding this other than whether I am missing something obvious that would make it not work or have some other fatal flaw. I guess I am also putting it out there in case someone has a better solution.