Welcome to Parallels® Remote Application Server (Parallels RAS), an integrated solution to virtualize your applications, desktops and data. Parallels RAS publishes applications and delivers remote and virtual desktops to any device on your network, anywhere.

Before installing Parallels RAS, please verify that your hardware and software meet or exceed the hardware and software requirements described below. Please note that although Parallels RAS can be used in Workgroup environment, Parallels recommends using Active Directory to manage users, groups, and machine accounts via group policies.

This chapter describes how to install and activate Parallels RAS.

Parallels RAS 20

The following new features were added in Parallels RAS 20:

• Ability to launch applications from local devices

• AWS Availability Zones support for RDSH and VDI host pools

• Added support for SC//HyperCore 9.4

• Added support for the Swiss and Belgian keyboard layouts in the policies

Parallels RAS 19.4.2

The following new features were added in Parallels RAS 19.4.2:

• Ability to redirect local disk drives as read-only.

• Ability to limit clipboard to plain text.

• Ability to use SAML SSO together with credentials for user authentication.

• Ability to add a custom background for User Portal.

• Ability to select whether unenrolled users can see the The user name or password is incorrect error when they enter incorrect credentials for TOTP, Google Authenticator, and email OTP.

• Ability to automatically connect to an alternative Connection Broker.

Parallels RAS 19.4.1

The following new features were added in Parallels RAS 19.4.1:

• Ability to select if Parallels Client detection is triggered on sign-in to User Portal or after the user confirms it via a prompt

• Ability to configure a Service URL through which User Portal will detect the IP of the browser it is running on

• Added an option to map the Windows key to a key combination when running User Portal on Chrome OS

Parallels RAS 19.4

The following new features were added in Parallels RAS 19.4:

• Ability to send OTP via email.

• Ability to automatically upgrade Agents on RD Session Hosts, VDI, and Azure Virtual Desktop.

• Support for IGEL 11 and 12.

• Extended image management for Nutanix AHV (AOS).

• Support for Scale Computing SC//HyperCore 9.2.

• Ability to enable tunneling for the <Default> Theme.

• Ability to edit the message that will be shown by Parallels Client when users sign in using MFA for Radius and TOTP.

• Active Directory (AD) based permissions for session management.

• Ability to add a customizable URL that points to internal support from RAS Console and Management Portal.

• Administrator permissions to view license information.

• Ability to configure the minimum key size of certificate authority templates.

• Validation of HTTP host headers to protect against host header injections.

• New predefined reports:

  • Sessions disconnections for host pools

  • Transport protocol for host pools

  • Bandwidth availability for host pools

  • Latency for host pool

  • Connection quality for host pool

  • UX Evaluator for host pool

  • Logon duration for host pool

• Azure Virtual Desktop improvements.

Parallels RAS 19.3.1

The following new features were added in Parallels RAS 19.3.1:

• Ability to automatically reset sessions on user logoff.

• Azure Virtual Desktop improvements.

For the complete list of new features and improvements, see Release notes: https://kb.parallels.com/en/129018.

Parallels RAS 19.3

The following new features were added in Parallels RAS 19.3:

• Template versioning for RD Session Hosts, VDI, and Azure Virtual Desktop. This feature includes the following:

  • Version management

  • Version tags

  • The ability to assign template versions to host pools for RD Session Hosts, VDI, and Azure Virtual Desktop.

  • Scheduled template recreation for RD Session Hosts, VDI, and Azure Virtual Desktop.

• Ability to configure user profiles and other settings on the host pool level.

• Ability to change user passwords via third-party IdPs.

• New policy for configuring drive redirection cache.

• New policy for prohibiting saving username.

• Ability to drain and power off hosts based on the workload.

• FSLogix Office Containers support and enhanced management for FSLogix.

• Dynamic printer mapping.

• Azure Virtual Desktop improvements.

• Add multiple provider addresses for the SC//HyperCore provider.

• Ability to hide billing information on Tenants.

• Ability to recreate hosts keeping the existing MAC addresses on the SC//HyperCore provider.

• TLS 1.3 support.

• FIPS 140-2 compliance.

• Terminology updates:

  • References to Pools/Groups have been standardized as "Host Pools".

  • Reference to Desktop/Guests have been standardized as "Hosts".

• New predefined reports:

  • Session activity

  • Disconnection reasons

For the complete list of new features and improvements, see Release notes: https://kb.parallels.com/en/129018.

Parallels RAS 19.2.3

The following new features were added in Parallels RAS 19.2.f3:

• Ability to turn off audit database synchronization across Connection Brokers.

• Support for drive redirection cache in a session initiated by Parallels Client for macOS.

For the complete list of new features and improvements, see Release notes: https://kb.parallels.com/en/129018.

Parallels RAS 19.2.2

The following new features were added in Parallels RAS 19.2.2:

• Ability to modify the license type of a host when it joins a host pool. You can also manually change the license type of any host within a host pool.

• Ability to lock or log off from a computer when all user sessions are closed.

For the complete list of new features and improvements, see Release notes: https://kb.parallels.com/en/129018.

Parallels RAS 19.2

The following new features were added in Parallels RAS 19.2:

• Integration with MSIX app attach for AVD.

• Disk storage cost optimization for VDI and AVD.

• Ability to choose the transport protocol for connections between Parallels Client and a server on RDSH, VDI, and Remote PC.

• Ability to use RDP Shortpath for single-session and multi-session AVD hosts.

• Ability to connect to AVD resources using Parallels Web Client.

• New policy for selecting the display configuration.

• Ability to assign persistent hosts by the client device hostname.

• Ability to recreate RD Session Hosts and hosts with their original BIOS UUID on ESXi and vCenter (works automatically).

• Added Microsoft Authenticator as a TOTP provider.

Deprecations and updated system requirements:

• See Software Requirements for updated system requirements for components and clients.

For the complete list of new features and improvements, see Release notes: https://kb.parallels.com/en/129018.

Parallels RAS 19.1

The following new features were added in Parallels RAS 19.1:

• Integration with MSIX app attach for VDI.

• Search for client policies.

• Ability to update all agents in an AVD host pool simultaneously.

• New policy for configuring dynamic desktop resizing for published applications.

• New policy for configuring multimedia redirection on Azure Virtual Desktop.

• Ability to register public domain addresses when using a secret key for joining a RAS Tenant Broker.

• Ability to supply public domain addresses when joining a tenant to a RAS Tenant Broker using a secret key.

• Ability to easily view the details of a failure to create a hosts.

• New predefined reports:

  • Transport protocol (TCP/UDP)

  • Network latency

  • Connection quality

  • Bandwidth availability

Deprecations and updated system requirements:

• See Software Requirements for updated system requirements for components and clients.

For the complete list of new features and improvements, see Release notes: https://kb.parallels.com/en/129018.

Parallels RAS 19.0

The following new features were added in Parallels RAS 19.0:

• Support for Amazon Web Services as a cloud provider and ability to use EC2 instances.

• Integration with MSIX app attach.

• Let's Encrypt certificate management.

• New Parallels Client for Windows for ARM64.

• Expression-based client policies, filtering for published resources and MFA configuration.

• Power management: starting up and shutting down servers on schedule. Schedules can be created for RD Session Hosts, VDI, and AVD hosts.

• Email-based account discovery that gives users quick access to the RAS resources when using the Parallels Client.

• Logon hours restrictions that allow to restrict user access to published resources during specified time frames.

• Ability to assign different MFA providers to different Themes.

• Ability to specify URLs to be redirected to local end user device or to be launched in the remote session.

• Ability to delegate to Custom administrators permissions for working with specific publishing folders.

Deprecations and updated system requirements:

• See Software Requirements for updated system requirements for components and clients.

For the complete list of new features and improvements, see Release notes: https://kb.parallels.com/en/129018.

For information about Microsoft license requirements, such as Remote Desktop Services Client Access Licenses (RDS CALs) and Virtual Desktop Access (VDA) licenses, please see Appendix: Microsoft license requirements in Parallels RAS.

RAS Connection Broker and RAS Secure Gateway (64-bit versions only)

RAS Connection Broker and RAS Secure Gateway are supported on the following operating systems:

• Windows Server 2016 up to Windows Server 2022

• On Windows Server 2016, 2019, and 2022 both Server Core and Desktop Experience installations are supported

RAS Web Administration Service

Same OS requirements as for RAS Connection Broker (see above). Note that for larger environments (2000 or more concurrent connections), it is recommended to install the component on a dedicated server. For details, please see https://kb.parallels.com/en/124988.

RAS RD Session Host Agent

RAS RD Session Host Agent is supported on the following operating systems:

• Windows Server 2012 R2 up to Windows Server 2022

• Windows Server 2016 and newer must be installed using the "Desktop Experience" installation option.

• Windows Server 2012 R2 — Server Core installation option is not supported.

RAS Provider Agent

• Windows Server 2016 up to Windows Server 2022

For the list of supported Providers, see RAS Provider Agent Installation Options.

RAS Guest Agent

• Windows Server 2012 R2 up to Windows Server 2022

• Windows 10 up to Windows 11

Remote PC Agent

• Windows Server 2012 R2 up to Windows Server 2022

• Windows 10 up to Windows 11

Parallels RAS PowerShell

• Windows Server 2016 up to Windows Server 2022

• Windows 10 up to Windows 11

• Windows Management Framework 3.0 and .NET Framework 4.5.2 must be installed

Parallels RAS Console

• Windows Server 2016 up to Windows Server 2022

• Windows 10 up to Windows 11

RAS Enrollment Server

• Windows Server 2016 up to Windows Server 2022

RAS Performance Monitor

• Windows Server 2016 up to Windows Server 2022

RAS Reporting

See System requirements

Parallels Client

Parallels Client is approved for the following operating systems (both 32-bit and 64-bit systems are supported, where applicable):

• Windows 10, 11

• Windows Server 2012 R2 up to Windows Server 2022

• macOS 12 Monterey to macOS 15 Sequoia. Parallels Client runs natively on Intel and Apple silicon processors.

• iOS 15 up to iOS 18, iPadOS 15 up to iPadOS 18

• Android 9 up to 15

• Chrome OS

Parallels Client for Linux supports the following Linux distributions (x64 versions only):

• Ubuntu 22.04 LTS, 24.04 LTS

• Debian 11 (Bullseye), Debian 12 (Bookworm)

• Fedora 37, 38

• Linux Mint 20, 21

• IGEL OS 11, 12

• Dell ThinOS 2303, 2306, 2308

For a list of supported thin clients and supported hardware from Technology Partners such as Igel, HP, 10Zig, and more, please see the following KB article: https://kb.parallels.com/124606.

To install Parallels RAS:

1. Make sure you have administrative privileges on the computer where you are installing Parallels RAS.

2. Double click the RASInstaller.msi file to launch the Parallels RAS installation wizard. If you see a message that begins with "This version of Parallels RAS is only for testing purposes.", it means that it's not an official build and should not be used in a production environment.

3. Follow the onscreen instructions.

1. Proceed to the Select Installation Type page and select from the following:

   • Parallels Remote Application Server. The default installation that will install RAS Console, RAS Management Portal, RAS Connection Broker, RAS Secure Gateway, RAS RD Session Host Agent, RAS PowerShell, and RAS Web Administration Service on the same machine. This is ideal for testing or small production environments.

   • Parallels RAS Tenant Broker. This option installs Tenant Broker. Please note that Tenant Broker must be installed on a server separate from the existing RAS farms. For more information about Tenant Broker, please see the RAS Multi-Tenant Architecture chapter.

   • Custom. Select and install only the components that you require. You can select individual components after you click Next. Note that if a component cannot be installed on the current server, it will not be available for installation. See Software Requirements.

2. Click Next.

3. Review the notice on the Important Notice wizard page. If there's a port conflict on your computer, the information will be displayed here. You can resolve the conflict later.

4. Click Next.

5. On the Firewall Settings page, select Automatically add firewall rules to configure the firewall on this computer for Parallels RAS to work properly. See Port Reference for details.

6. Click Next and then click Install. Wait for the installation to finish and click Finish.

7. If you are upgrading your RAS installation, it is recommend to reboot all servers where components are upgraded.

When you need to install a particular Parallels RAS component on a different server, run the installation wizard again, select Custom and choose the component(s) you wish to install.

This chapter will help you get started with Parallels RAS. Read it to learn how to use the Parallels RAS Console and how to set up a simple RAS environment.

In this tutorial, we have configured a simple Parallels RAS Farm with a single RD Session Host and one published application. We then configured a mailbox for outgoing emails and sent an invitation email to end users with instructions on how to install Parallels Client, connect to the Parallels RAS Farm, and run the published application. Essentially, we've created a fully functional Parallels RAS Farm serving remote applications to end users.

If you wish, you can repeat the tutorial and add more RD Session Hosts, publish more applications, or send an invitation email to users who use different types of devices. The instructions remain essentially the same.

The rest of this guide explains in detail how to configure and use various features of Parallels RAS.

The Deploy Azure Virtual Desktop section in the Start category is an optional feature, which allows you to deploy Azure Virtual Desktop in Parallels RAS. The feature is described in detail in the Azure Virtual Desktop chapter.

Parallels RAS Farm is a logical grouping of objects for the purpose of centralized management. A Farm configuration is stored in a single database which contains information about all objects comprising the Farm. A Site is the next level grouping in the Farm hierarchy which contains servers and other objects providing connection and remote application services.

This guide is intended for system administrators responsible for installing, configuring, and administering Parallels RAS. This guide assumes that the reader is familiar with Microsoft Remote Desktop Services and has an intermediate networking knowledge.

Parallels RAS provides vendor independent virtual desktop and application delivery from a single platform. Accessible from anywhere with platform-specific clients and web enabled solutions, like the built-in Parallels Web Client, Parallels RAS allows you to publish remote desktops, applications and documents, improving desktop manageability, security and performance.

Parallels RAS extends Windows Remote Desktop Services by using a customized shell and virtual channel extensions over the Microsoft RDP protocol. Parallels RAS supports all major hypervisors from Microsoft, VMware, and other vendors including Hyperconverged solutions such as Nutanix AHV (AOS) and Scale Computing and Cloud platforms and services such as Microsoft Azure and Azure Virtual Desktop (formerly known as Windows Virtual Desktop), enabling the publishing of virtual desktops and applications to Parallels Client.

The product includes powerful universal printing and scanning functionality, as well as resource-based load balancing and management features.

With Parallels Device Manager Module for Parallels RAS you can also centrally manage user connections and PCs converted into thin clients using the free Parallels Client.

How does it work?

When a user requests an application or a desktop, Parallels RAS finds a least loaded RD Session Host or a guest VM on one of the least loaded Providers and establishes an RDP connection with it. Using Microsoft RDP protocol, the requested application or desktop is presented to the user. Note that in addition to RD Sessions Hosts and VDI, Parallels RAS can also be used to configure, manage and publish Azure Virtual Desktop resources.

Users can connect to Parallels RAS using Parallels Client (available at no charge), which can run on Windows, Linux, macOS, Android, Chrome, iOS and iPadOS. Users can also connect via an HTML5 browser or Chromebook.

As newer versions of Windows keep on being developed as time goes by, you need to defend the migration cost to your business. Parallels RAS can help. Desktop replacement allows you to extend the lifespan of your hardware and delay migration to the latest OSs to a time that suits you best. The Parallels RAS solution allows you to be very flexible: you can lock machine configurations on the user side, placing your corporate data in an extremely secure position; or you can opt to allow users to run some local and remote applications. Parallels Client Desktop Replacement is able to reduce the operability of the local machine by disabling the most common local configuration options, while guaranteeing the same level of service and security afforded by thin clients, directly from your existing PCs.

If you have more than one Parallels RAS Farm in your organization, you can use the same Parallels RAS Console instance to manage any of them. By default, the Parallels RAS Console is installed on the same server where you install other Parallels RAS components, but you can install the console on any computer on your network.

Connecting to a Parallels RAS Farm for the first time

When you open the Parallels RAS Console for the first time, it displays the logon dialog on which you need to specify the following:

• Farm: A Parallels RAS Farm to connect to. Enter the FQDN or IP address of the server where you have RAS Connection Broker installed.

• If you've installed the Parallels Single Sign-On component when installing the RAS Console, you will see the Authentication type field from which you can select whether to log on using your credentials or SSO. If you reboot after the installation and select SSO, select Single Sign-On and then click Connect. Your Windows credentials will be used to log in to the RAS Farm. If you select Credentials, enter your credentials as described below.

• Username: A user account with administrative privileges on the server where Parallels RAS is installed (usually a domain or local administrator). The account name must be specified using the UPN format (e.g. administrator@domain.com). The specified user will be automatically configured as the Parallels RAS administrator with full access rights.

• Password: The specified user account password.

• If you select the Remember credentials option, this dialog will not be shown the next time you launch the Parallels RAS Console.

After entering the connection properties, click Connect to connect to the Farm and open the RAS Console.

Note that the Edit Connections button will not display any information on first connect (it is used to edit Farm connections that already exist), so you can ignore it at this point. We will talk about using this button closer to the end of this section.

Connecting to a different Parallels RAS Farm

When you need to connect to a different Parallels RAS Farm, you first need to log off from the Parallels RAS Console in order to see the logon dialog again. To do so:

1. In the Parallels RAS Console, click on the arrow icon next to your user name in the upper right-hand corner and then choose Log Off in the context menu.

2. The console will close and the RAS logon dialog will open. The dialog will be populated with the current Farm connection properties.

3. To connect to a different Farm, type the FQDN or IP address of the server where the other Farm is located. Once again, this should be the server where you have the RAS Connection Broker installed.

4. Specify a username and password and click Connect. The Parallels RAS Console will connect to the Farm using the connection properties that you specified.

Switching between Parallels RAS Farms

After you connect to more than one Farm from the same Parallels RAS Console instance, you can easily switch between them as follows:

1. In the Parallels RAS Console, click the Location drop-down list in the upper left-hand corner (right below the main application menu, where the current Site name is displayed).

2. The lower portion of the drop-down list will contain names of the Farms to which you connected at least once in the past (the upper portion contains one or more Site names for the current Farm). Click a desired Farm name to connect to it.

3. When you click the Farm name, the console will close momentarily and will re-open connected to the Farm that you selected.

Note that you can also switch between Farms by logging off from the console and choosing a desired Farm from the Farm drop-down list in the RAS logon dialog. The method described above is more convenient, so this one is just another way to do it.

Editing Parallels RAS Farm connections

As was mentioned in the beginning of this section, the RAS logon dialog has the Edit Connections button. When you click it, the Manage Parallels RAS Farm Connections dialog opens.

On the left side of the dialog, the Farm Connections pane lists Parallels RAS Farms to which you connected at least once in the past. If a connection is no longer relevant, you can remove it by selecting it and clicking the "minus sign" icon at the top. Once a connection is removed, it will no longer appear in the RAS logon dialog and in the Parallels RAS Console (the Location drop-down list).

On the right side of the dialog, the Connection Brokers pane lists RAS Connection Brokers for the selected Farm connection. By default, the primary Connection Broker is included in the list, but you can add more Connection Brokers if needed. When connecting to a Farm, the Parallels RAS Console will try the primary Connection Broker first. If a connection cannot be established, it will try other Connection Brokers in the order they are listed in the Connection Brokers pane. To add a Connection Broker to the list, click the "plus sign" icon and then specify the server FQDN or IP address.

Connecting to a Parallels RAS Farm via Command Prompt

You can connect to a Farm using Windows Command Prompt. This can be useful when you want to automatically connect to specific Farms.

To connect to a Farm using Windows Command Prompt:

1. Navigate to the folder where 2xConsole.exe is located.

2. Open Command Prompt and enter the following command: 2xconsole.exe <arguments>. The possible arguments are described below.

Arguments

Examples

Create a new Farm without a friendly name and store the credentials: 2xconsole.exe -s 10.124.4.113 -u administrator@prls.dev -p password -savecreds

Connect to the previously created Farm using the IP: 2xconsole.exe -s 10.124.4.113

Create a new Farm with a friendly name and store the credentials: 2xconsole.exe -f myfarm -s 10.124.5.123 -u administrator@prls.dev -p password -savecreds

Connect to the previously created farm using the friendly name: 2xconsole.exe -f myfarm

The following table lists the Parallels RAS release history. Parallels RAS documentation is updated for every release. This guide refers to the latest Parallels RAS release from the table below. If you are using a newer Parallels RAS release or version, please download the current version of the guide from https://www.parallels.com/products/ras/resources/.

Parallels RAS is extensively tested on both physical and virtual platforms. The minimum hardware requirements approved to run Parallels RAS are outlined below.

• Physical Machines – Dual Core Processor and a minimum of 4GB RAM.

• Virtual Machines – Two Virtual Processors and a minimum of 4GB of RAM.

The server hardware requirements to install and configure Parallels RAS can vary according to end-user requirements.

Typically for an installation of 30 users or under, Parallels RAS can be installed on one high specification server and the resources published directly from it. For more than 30 users, multiple servers may be required.

The below should be considered during the planning stage of a Parallels RAS deployment:

• High specification servers should be used, consisting of multiple CPU cores, a high specification disk transfer rate and plenty of RAM.

• A hypervisor-based virtual machine can be used as long as the resources needed to serve end-users are calculated accordingly.

• It is recommended that RAS Secure Gateway does not exceed 1200 users per server for incoming connections using the Gateway SSL mode.

• HALB usage should not exceed 2000 user sessions per HALB appliance. See https://kb.parallels.com/125229.

• When planning VDI Hypervisor resource requirements, extra requirements such as RAM usage per virtual machine and disk space should be taken into account.

When configuring RD Session Hosts, VDI, or Azure Virtual Desktop, please keep in mind that different types of workloads require different session host configurations. For the best possible experience, scale your deployment depending on your users' needs. The following table gives you an idea of how different workload types affect session host configurations.

For port requirements, please see the Port Reference section.

First, you need to add an RD Session Host to the Farm. In this tutorial, we'll add the local server on which Parallels RAS is installed.

To add an RD Session Host to the Farm:

1. Click Add RD Session Hosts. The Add RD Session Hosts wizard opens.
2. Click the Tasks menu (or click the [+] icon) and select one of the following:

   • Add from Active Directory: Adds an RD Session Host from Active directory.

   • Add Manually: Adds RD Session Host by entering its FQDN or IP address.

   Note that if you enter the server FQDN, it will be used as the primary method of connecting to this server from other Parallels RAS components and clients. If you enter the IP address, it will be automatically resolved to FQDN, but only if the global option to resolve to FQDN is enabled. To see the current setting of this global option, click Tools > Options on the main menu. In the Options dialog, examine the Always attempt to resolve to fully qualified domain name (FQDN) when adding hosts option. When the option is selected, the IP address of every server/component in the RAS Farm is always resolved to FQDN. When the option is cleared, whatever is specified for a server (IP address or name) is used to communicate with a server. This makes a difference in deployments where an IP address cannot be used to access a server, such as when a server is hosted in the cloud. For more information, see Host Name Resolution.

3. Click Next.

4. The page with general settings opens:

   Specify the following settings:

   • Add firewall rules. Add firewall rules required by Parallels RAS in Windows running on the server. See Port Reference for details.

   • Install RDS role. Install the RDS role on the server if it's not installed. You should always select this option.

   • Enable Desktop Experience. Enable the Desktop Experience feature in Windows running on the server. This option is enabled only if the Install RDS role option (above) is selected. The option applies to Windows Server 2008 R2 and Windows 2012 R1/R2 on which the Desktop Experience feature is not enabled by default.

   • Restart server if required. Automatically restart the server if necessary. You can restart the server manually if you wish.
5. Click Next.

6. Add the server (or servers) to a host pool. Select the desired host pool or create a new host pool. If you are not sure what host pool to choose, select Default Host pool. Host pools are described in detail in the Manage host pools (RD Session Hosts) section.

7. Click Next.

8. In order for end users to access published resources on the RD Session Host, they must be added to the Remote Desktop Users group in Windows running on the server. This can be done one of the following ways:

   • Adding each user or group directly on the server using standard Windows administrative tools.

   • Adding users or groups through Active Directory.

   • Using the wizard page described below, which is provided for your convenience.

   If you already added your users to the Remote Desktop Users group on the given server (or if for any reason you want to use one of the other methods listed above), you can simply click Next and skip this page.

   To add users to the Remote Desktop Users group using the wizard, select the Specify users or groups to be added to the Remote Desktop Users group option and then click the [+] icon. In the Select Users or Groups dialog, specify a user or group and click OK. The selected user/group will be added to the list on the wizard page.
9. Click Next.

10. The User profile page allows you to select a technology to manage user profiles.

    You can select from User profile disk or FSlogix. User Profile Disks are virtual hard disks that store user application data on a dedicated file share. Microsoft FSLogix Profile Container is the preferred Profile Management solution as the successor of Roaming Profiles and User Profile Disks (UPDs). It is set to maintain user context in non-persistent environments, minimize sign-in times and provide native profile experience eliminating compatibility issues. You can keep the default settings for now. We will talk in detail about user profiles later in this guide.
11. The Optimization page allows you to specify settings that will be used to optimize Windows on the RD Session Host for best performance in a Parallels RAS environment.

    You can select Windows components, services, and other options that will be disabled, removed, or optimized to ensure a more efficient, streamlined, and improved delivery of virtual apps and desktops. You can keep the default settings or you can modify (or disable if not sure) optimization for now. Optimization is described in detail later in this guide.
12. On the next page, review the settings and click Next.

13. The Install RAS RD Session Host Agent dialog opens. Follow the instructions and install the agent. When the installation is finished, click Done to close the dialog.

14. Back in the wizard, click Finish to exit.

If you would like to verify that the RD Session Host has been added to the Farm, click the Farm category (below the Start category in the left pane of the Parallels RAS Console window) and then click RD Session Hosts in the navigation tree (the middle pane). The server should be included in the RD Session Hosts list. The Status column may display a warning message. If it does, reboot the server. The Status column should now say, "OK", which means that your RD Session Host is functioning properly.

Read on to learn how to publish an application from an RD Session Host.

In this section, we'll set up a basic Parallels RAS Farm where all required components run on a single server.

To set up a Parallels RAS Farm:

1. Log in to the Parallels RAS Console.

2. In the console, select the Start category. This category gives you access to three wizards that you can use to easily perform essential tasks, such as adding RD Session Hosts, publishing applications, and inviting users to Parallels RAS.

The Parallels RAS Console is a Windows application used to configure and administer a Parallels RAS Farm.

To open the Parallels RAS Console, navigate to Apps > Parallels and click Parallels Remote Application Server Console. Note that you can open multiple instances of the Parallels RAS Console on the same computer if you want to manage more than one Farm or Site simultaneously without switching between them inside the console. This works with a locally installed Parallels RAS Console and when you run it as a remote application from Parallels Client.

The following screenshot and the description below it give you an overview of the Parallels RAS Console.

The Parallels RAS Console consists of the following sections:

After you added an RD Session Host, you can publish applications from it.

To publish an application:

1. In the Parallels RAS Console, select the Start category and click the Publish Applications item in the right pane.

2. The Publish Applications wizard opens. On the first page, select one or more servers from which the application should be published. You can select all servers, server host pools, or individual servers.
3. Click Next.

4. On the next page, select one or more applications you want to publish.

   If you've selected more than one server on the previous screen, the Show applications not available on all target servers option becomes enabled. If the option is cleared (default), the folder tree will contain applications that are available on each and every server that you selected. If the option is enabled, the tree will contain applications that may be available on some server(s), but not on the others.
5. Click Next. Review the summary information and click Next again.

6. Click Finish when ready.

To verify that an application has been successfully published, select the Publishing category in the RAS Console. The application should be included in the Published Resources list (the middle pane).

After you've installed Parallels RAS, run the RAS Console and activate your new Parallels RAS Farm.

Start the Parallels RAS Console

By default, the Parallels RAS Console is launched automatically after you click Finish on the last page of the installation wizard. To launch the console manually, navigate to Start > Apps > Parallels and click on Parallels Remote Application Server Console.

When the Parallels RAS Console is launched for the first time, you are presented with the login dialog. In the dialog, specify the following:

• Farm: A Parallels RAS Farm to connect to. Enter the FQDN or IP address of the server where you have RAS Connection Broker installed.

• If you've installed the Parallels Single Sign-On component when installing the RAS Console, you will see the Authentication type field from which you can select whether to log on using your credentials or SSO. If you reboot after the installation and select SSO, select Single Sign-On and then click Connect. Your Windows credentials will be used to log in to the RAS Farm. If you select Credentials, enter your credentials as described below.

• Username: A user account with administrative privileges on the server where Parallels RAS is installed (usually a domain or local administrator). The account name must be specified using the UPN format (e.g. administrator@domain.local). The specified user will be automatically configured as the Parallels RAS administrator with full access rights.

• Password: The specified user account password.

• If you select the Remember credentials option, this dialog will not be shown the next time you launch the Parallels RAS Console.

The Edit Connections button opens a dialog where you can manage your RAS connection. This dialog becomes useful if this is not the first time you are connecting to one or more of your RAS Farms. The left pane of the dialog displays RAS Farms to which previously connected (you can remove a Farm from the list by clicking the [-] icon if you no longer need it). The right pane displays at least the primary Connection Broker for the selected Farm. If you've added a secondary Connection Brokers to a Farm, you can add it to this list by clicking the [+] icon and typing its hostname or IP address (click the "recycle" icon to verify the agent status). This way the RAS Console will try to connect to the primary Connection Broker first and if it fails (e.g. the agent is offline or cannot be reached), it will try to connect to the secondary Connection Broker. For more information about secondary Connection Brokers, please see chapter.

When you are done entering the connection information, click the Connect button to connect to the Parallels RAS Farm.

Sign in to Parallels My Account

To activate Parallels RAS, you must register for a Parallels business account. After you logged in to Parallels RAS, you'll see the Sign In to Parallels My Account dialog. If you already have an account, type the email address and password you used to register the account and click Sign In.

Note: If you use an HTTP proxy server on your network, you will see a dialog asking you to configure the proxy server connection settings. Click the Configure Proxy button. In the dialog that opens, select one of the following: Use system proxy settings (the default proxy settings from the Internet Explorer will be used) or Manual HTTP proxy configuration (specify the settings manually). If your proxy configuration changes, you can re-configure it later by navigating to Administration > Settings and clicking the Configure Proxy button.

If you don't have a Parallels business account, you can register for one as follows:

1. In the Sign In to Parallels My Account dialog, click Register. The Register Parallels My Account dialog opens.

2. Enter your name and email address, choose and type a password, and enter your company info (all fields are required).

3. Follow the links to Parallels Privacy Policy and Terms of Use. After reading them (and if you agree) select the I have read and agree to the Parallels Privacy Policy and Terms of Use checkbox.

4. Click Register to register an account. This will create a personal account for yourself and a business account for your organization to which you will be assigned as administrator.

Activate Parallels RAS

After you sign in to Parallels My Account, the Activate Product dialog opens asking you to activate the Parallels RAS Farm.

If you already have a Parallels RAS license key, select the Activate using license key option and enter the key in the field provided. You can click the button next to the field to see the list of subscriptions and/or permanent license keys you have registered in Parallels My Account. If the list is empty, it means that you don't have any subscriptions or license keys and need to purchase one first.

If you don't have a Parallels RAS license key, you have the following options:

• Purchase a subscription online by clicking the Purchase a license link.

• Activate Parallels RAS as a trial by selecting the Activate trial version option.

After entering a license key (or selecting to activate a trial version), click Activate. You should see a message that the Parallels RAS Farm was activated successfully. Click OK to close the message box.

The first dialog that you see informs you that you have no servers configured that can be used to host published resources. This means that to begin using Parallels RAS, you need at least one RD Session Host, Provider, or a Remote PC configured. We'll talk about configuring a Parallels RAS Farm in the next chapter. For now, click OK to close the message box. You will then see the Applying Settings dialog. Wait for the initial configuration of Parallels RAS to complete and click OK. You will now see the main Parallels RAS Console window where you can begin configuring the Parallels RAS Farm.

Read on to learn how to quickly add an RD Session Host, publish resources, and invite your users to Parallels RAS.

Your Parallels RAS Farm is now fully operational. You have an RD Session Host and published application(s). All you need to do now is invite your users to install the Parallels Client software on their devices and connect to the Parallels RAS Farm.

Note: Consider allowing users to access the published resources by using their email instead of Secure Gateway IP address or hostname. For information on how to do it, see .

To invite users:

1. In the Parallels RAS Console, select the Start category and click the Invite Users item.

2. The Invite Users wizard opens. On the first page, specify the mailbox information that should be used to send invitation emails to users.

   Specify the following options:

   • Mailbox Server: Enter the mailbox server name. For example, mail.company.com:500

   • Sender Address: Enter the email address.

   • TLS / SSL: Choose whether to use the TLS/SSL protocol.

   • SMTP server requires authentication: Select this option if your SMTP server requires authentication. If it does, also type the username and password in the fields provided.

   In the Test Email section, type one or more email addresses to which a test email should be sent (separate multiple address with a semicolon). Click the Send Test Email button to send the email.
3. Click Next.

4. On the next page of the wizard, specify target platforms and connection options:

   • In the target devices list, select the types of devices to send an invitation to. Each target device of a particular type will receive an email with instructions on how to download, install, and configure the Parallels Client software on that device type.

   • In the Public address field, specify a public FQDN or IP address. This setting is used by the Preferred routing functionality to redirect client connections. Please see .

   • In the Connection Mode drop-down list, select the RAS Secure Gateway connection mode. Please note that SSL modes require the gateway to have SSL configured. More information can be found in the section.

   • In the Authentication mode drop-down list, select the authentication mode for your users. For the list of authentication modes, see subsection Primary connection in the section.

   • Optionally, click the Advanced button to open the Advanced Settings dialog. This dialog allows you to specify a third-party credential provider component. If you use such a component to authenticate your users, specify its GUID in this dialog. For more information, see .
5. Click Next.

6. On the next page, specify the email recipients. Click the [...] button to select users or groups.
7. Review the invitation email template displayed in the Review the invitation e-mail box. You can modify the template text as needed. The template also uses variables, which are explained below.

   • %RECIPIENT% — Specifies the name of a recipient to whom the email message is addressed.

   • %SENDER% — The sender's email address that you specified in the first step of this wizard when you configured the outgoing email server settings.

   • %INSTRUCTIONS% — Includes a custom URL hyperlink for automatic configuration of Parallels Client. The URL uses the Parallels Client URL scheme. For more info, see .

   • %MANUALINSTRUCTIONS% — Includes instructions for manual configuration of Parallels Client.

   The variables are defined dynamically depending on the type(s) of the target devices and other settings. Normally, you should always include them in the message, so your users will receive all the necessary instructions and links. If you don't include any of the variables, you will see a warning message, but including all of them is not a requirement. To preview the message, click the Preview button. This will open the HTML version of the message in a separate window. This is the email message that your users will receive.

8. Click Next, review the summary and click Next again to send the invitation email to users.

When users receive the invitation email, they will follow the instructions that it contains to install and configure Parallels Client on their devices. Once that's done, the users will be able to connect to Parallels RAS and launch published resources.

Site-specific settings configured for a given Site can be replicated to all other sites in a Farm. Refer to the table below for the information about which settings can be replicated to other sites.

To replicate Site settings to all other sites, select Farm> <site>> Settings and then select the Replicate settings option (at the bottom of the Auditing tab). Please note that this option is disabled if you have just one Site in the Farm.

Overriding Site Replicated Settings

If an administrator who has permissions to enable or disable replication settings makes a change to a specific setting, such setting is replicated to all other sites. If an administrator has access to a particular Site only, upon modifying Site settings which have been replicated, the replicated settings are overridden and the option Replicate Settings is automatically cleared, therefore such settings will no longer be replicated to other sites.

A Parallels RAS Farm consists of at least one Site, but may have as many sites as necessary.

Sites are often used to separate management and/or location functions. For example, by creating a Site, you can delegate permissions to a Site administrator without granting them full Farm permissions. Or you can have separate sites for different physical locations with the ability to copy the same settings to each Site while using RD Session Hosts, Providers, or PCs that are closer to end users or (depending on your needs) to back-end servers. For instance, it would make sense for a client/server application querying a database to be published from an RD Session Host which is located closer to the database server.

Each Site is completely isolated from other sites within the same Farm. The Farm simply groups sites logically and stores configuration properties of each Site (and the objects that comprise it) in a single database. sites don't communicate with each other and don't share any objects or data. The only exception to this rule is the RAS Licensing Site which periodically communicates with other sites to obtain statistics.

Individual object settings in a given Site can be replicated to all other sites. This does not mean that settings will be shared between sites. The settings that you choose will simply be applied to other sites. For more information, see the section.

When you install Parallels RAS, a Farm with a single Site is created automatically. This first Site becomes the RAS Licensing Site and the host for the main Parallels RAS configuration database. When you add more sites to the Farm, the data in this database is automatically synchronized with every Site that you add. When changes are applied to a particular Site, the main configuration database is automatically updated to reflect the changes.

Each Site must have at least the following components installed in order to publish remote applications and desktops for end users:

• Primary RAS Connection Broker

• RAS Secure Gateway. Note that if a Site is joined as Tenant to RAS Tenant Broker, RAS Secure Gateway is not needed. For details, see .

• RD Session Host, VDI, or PC

When you install Parallels RAS using default installation options, the primary RAS Connection Broker and the RAS Secure Gateway are automatically installed on the server on which you perform the installation. You can then add one or more RD Session Hosts to the Site to host published resources. You can also add more sites to the Farm if needed and configure individual components for each Site as you desire.

To add a Site to the Farm:

1. In the RAS Console, select the Farm category in the left pane and then select the Farm in the middle pane.

2. In the Tasks drop-down list (the right pane, above the Site list), click Add (or click the + icon).

3. In the Add Site dialog:

   • In the Site field, specify a Site name.

   • In the Server field, specify the IP address or FQDN of the server where the Primary Connection Broker and Secure Gateway should be installed.

   • Select the Enable HTML5 Gateway option to automatically create a self-signed certificate, enable SSL, and enable HTML5 support. For more info, please see .

4. Click Next.

5. The Site Properties dialog opens. First, it verifies if RAS Connection Broker is installed on the specified Site server. If it isn't, it will indicate this in the Status field.

6. Click the Install button to install the agent.

7. In the Install RAS Connection Broker dialog, highlight the server name on which the RAS Connection Broker is to be installed.

8. (Optional) Select the option Override system credentials to specify and use different credentials to connect to the server and install the agent.

9. Click Install to install the Connection Broker and Secure Gateway. Click Done once it has been successfully installed.

Once a new Site is created, you can view and manage its configuration by right-clicking the Site in the RAS Console and choosing Switch to this Site.

To view existing sites in the Parallels RAS Console, select the Farm category in the left pane. Existing sites are listed in the right pane.

The Farm category displays the configuration of only one Site at a time. If you log in as the Farm administrator, the configuration of the RAS Licensing Site will be displayed. If you log in as an administrator who has access to a specific Site (but not the Farm), the configuration of that Site will be displayed.

Current Site

Click on the Farm item in the middle pane to view the list of available sites. The Site which configuration is currently loaded in the console is marked as "Current Site" in the Type column. The column also displays other Site attributes. For example, "Licensing Site / Local Site / Current Site".

Switching between sites

To switch to a particular Site, select Farm in the middle pane, then right-click the Site in the right pane and choose Switch to this Site. The Site configuration will be loaded into the RAS Console.

The other way of switching between sites is to click the Location drop-down list in the upper left-hand side of the RAS Console. The menu lists sites for the current Farm and may also list other Farms if you used this RAS Console to connect to them. For more info, see .

Renaming a Site

To rename a Site, right-click it and choose Rename Site.

Site configuration and health view

When you select the Site node in the middle pane, the Site Info tab in the right pane displays the list of Parallels RAS components that have been configured for the Site with interactive performance monitoring metrics for each component. Depending on the Site configuration, the list may include RD Sessions Hosts, VDI, Remote PCs, Secure Gateways, Connection Brokers, Azure Virtual Desktop, HALB Virtual Servers and devices, Tenant Broker, Host pools, and Enrollment Server.

To collapse or expand a component group, click an "arrow up" or "arrow down" icon on the right side of the list. Note that if no servers of a particular type have been added to the Site, the group name will not be displayed in the list.

The following information is displayed for each component (the information is updated at an interval of approximately 2 minutes):

• Address: Server FQDN or IP address.

• Status: Indicates whether the agent software is installed on the server and is functioning properly.

• CPU: Current CPU utilization.

• RAM: Current RAM utilization.

• Disk Read Time: Disk read time.

• Disk Write Time: Disk write time.

• Sessions: The number of currently active user sessions.

• Preferred PA: The name of the RAS Connection Broker designated as preferred for this server.

• Operating System: Operating system version installed on the server.

• Agent Version: The agent version installed on the server.

• Hypervisor: The hypervisor the server is running on.

You can customize this view by clicking Tasks > Monitoring Settings. This opens a dialog where you can specify which colors should be used to display different performance counters and their values.

Performing tasks on a component

You can perform a number of tasks on a component displayed in the Site Info tab. These tasks are described below.

To configure a component, do one of the following:

• While the Site node is selected in the middle pane, right-click a component in the right pane and choose Show in the editor.

• Select a component category in the middle pane (e.g. RD Session Hosts, Providers, etc.).

Using the Site Designer

Select the Site node in the middle and then click the Designer tab in the right pane. The tab displays a visual representation of the Site infrastructure. Use the icons at the top to add more components to the diagram as desired. Note that adding a component to the diagram will actually add it to the Site. Double-click a component to view and configure it in a corresponding editor.

To add an administrator account to the Parallels RAS Farm:

1. In the RAS Console, navigate to Administration> Accounts.

2. Click the Tasks drop-down list and choose Add (or click the [+] icon).

3. The Account Properties dialog opens.

4. Click the [...] button next to the Name field. In the Select User or Group dialog, select a user or a group.

5. Specify an email address and mobile phone number. Both fields are optional and are disabled if the account specified in the Name field is a group.

6. In the Permissions drop-down list select a role to assign to the administrator:

   • Root administrator. Grants the administrator full permissions to manage the Farm.

   • Power administrator. Grants the administrator full permissions by default but allows you to limit them if needed. To grant or deny specific permissions, click the Change Permissions button. For additional info, see Administrator Account Permissions.

   • Custom administrator. This role doesn't have any permissions by default and allows you grant very specific permissions for a particular category, area, or object in the RAS Console. See Administrator Account Permissions for details.

7. In the Receive system notifications via drop-down list, select Email to send all system notifications to the specified email address, or select None to disable email system notifications for this account.

8. Click OK to add the new administrator account to the Farm.

Modifying an administrator account

To modify an account, select it in the list and click Tasks > Properties. This opens the Account Properties dialog where you can modify the account information.

To enable or disable an account, select or clear the Enable account option at the top of the Account Properties dialog.

If you have a number of administrators using the RAS Console to manage the same Farm, you can configure when an idle RAS Console session should be disconnected. By default, when an administrator opens the console and connects to a Farm but then forgets to log off and goes away, the session will stay active indefinitely possibly locking some of the categories for other administrators. You can change that by specifying the time period after which an idle session will be disconnected (thus unlocking the categories).

To configure idle sessions:

1. In the RAS Console, navigate to Administration > Settings.

2. Locate the Miscellaneous section (at the bottom) and choose a desired time period in the Reset idle RAS Console session after drop-down list.

When a session stays idle for close to the specified time period, the administrator (session owner) will be notified a few minutes in advance that the session is about to be disconnected. If the administrator chooses to stay connected, the time period is reset. If the administrator does nothing, the session will be disconnected when the time expires.

To view existing administrator accounts, select the Administration category in the RAS Console. The Accounts tab lists existing accounts and their properties, including:

• Group or user name. Account name, which can be a user or group name.

• Type. Account type. Can be one of the following: User, Group, Group User. The User and Group are self-explanatory. The Group User is a user who receives Parallels RAS administrative permissions via a group membership. When you initially add a group to the list of Parallels RAS administrators, its members are not displayed on the Accounts tab. As soon as a member of the group logs in to Parallels RAS, the account name is added to the list of administrators as a Group User and remains there. Note that you cannot change Parallels RAS permissions for such an account individually outside the group permissions.

• Permissions. A security role assigned to an administrator.

• Email. Email address.

• Mobile. Mobile phone number.

• Group. Group name. This column has a value for Group Users only (see the Type column description above).

• Last Modification By. The name of the user who modified this account in Parallels RAS the last time.

• Changed On. The last account modification date.

• Created By. The name of the user who created this account in Parallels RAS.

• Created On. The date when this account was added to Parallels RAS.

• ID. Internal Parallels RAS ID.

Modifying an account

To modify an account:

1. Right-click an account and choose Properties in the context menu.

2. Use the Administrator Properties dialog to modify the necessary information. For more info, see Adding an Administrator Account.

Handling locked objects

When an administrator is working with an object (e.g. a tab in the RD Session Host properties dialog), the object is locked for all other administrators. Therefore, upon trying to access a locked object, an administrator will be alerted with an error that the object is locked and will be denied access to it.

A root administrator (but not power or custom administrator) can release a locked object as follows:

1. On the Administration > Accounts tab, click the Tasks drop-down list and choose Show Sessions.

2. In the Sessions dialog, select the administrator who is locking an object and then click the Send Message icon (at the top).

3. If the administrator doesn't reply and doesn't release the object, you have an option to click Log Off, which will log them off and will unlock the category.

RAS Connection Broker provides load balancing of published applications and desktops. A RAS Connection Broker is automatically installed on a server on which you install Parallels RAS and is designated as the primary Connection Broker. Each Site must have a primary RAS Connection Broker but can also have secondary Connection Brokers added to it. The purpose of a secondary Connection Broker is to ensure that users do not experience any interruption of the service due to possible failure of the primary RAS Connection Broker. This chapter describes how to add RAS Connection Brokers to a Site and how to configure them.

Parallels Customer Experience Program helps us to improve the quality and reliability of Parallels RAS. If you accept to join the program, we will collect information about the way you use Parallels RAS. We will not collect any personal data, like your name, address, phone number, or keyboard input.

To join the program:

1. In the RAS Console, select the Administration category.

2. In the right pane, click the Settings tab.

3. Select the Participate in the Customer Experience Program option.

After you join the program, CEP will automatically start to collect information about how you use Parallels RAS. Data collected from you and other participants is combined and thoroughly analyzed to help us improve Parallels RAS.

The Licensing Site should always be online even if you have other sites in your Farm. If your Licensing Site goes offline, your other sites can still use the maximum number of individual licenses included in your subscription but only for a period of 72 hours. During this time, you need to do one of the following:

• Restore your Licensing Site.

• Promote a different Site to be the Licensing Site in the Farm (see below for instructions).

Please note that if the Licensing Site is offline from 48 to 72 hours and back online three times per month, you will be required to re-activate it using your Parallels RAS licensing key after the third time.

To promote a secondary Site to be the Licensing Site in the Farm:

1. In the RAS Console, navigate to Farm > Farm.

2. In the right pane select a Site and then click Tasks > Set as licensing Site.

3. You will be asked to activate the new Licensing Site using your Parallels RAS license. Follow the instructions and activate the Site.

You can perform standard computer management tasks on a server hosting the RAS Connection Broker right from the RAS Console. These include Remote Desktop Connection, remote PowerShell, Computer Management, Service Management, Event Viewer, IPconfig, Reboot, and others. To access the Tools menu, select a server, click Tasks > Tools and choose a desired tool. For requirements and usage information, see Computer Management Tools.

Parallels RAS administrators logged on to the same Farm can communicate with each other using a built-in instant messenger.

To use the instant messenger:

1. In the RAS Console, select the Administration category.

2. Expand the drop-down list next to your name (top-right corner of the console screen) and click Chat.

3. The Parallels Remote Application Server Chat window opens.

To send a message:

1. Type the message text in the lower input panel.

2. In the Logged on administrators list box, select a specific administrator or All to send the message to an individual or all logged on administrators.

3. Click Send.

Your message history is displayed in the Messages panel. To clear the history, click Clear All.

You can also view the chat history listing all messages between all administrators (not just your own messages). To do so, select the Administration node in the console and then select the Chat History tab.

RAS Secure Gateway tunnels all Parallels RAS data on a single port. It also provides secure connections and is the user connection point to Parallels RAS.

At least one RAS Secure Gateway must be installed and configured in every Site. Note that if a Site is joined as Tenant to RAS Tenant Broker, RAS Secure Gateway is not needed. For details, see RAS Multi-Tenant Architecture.

Multiple gateways can exist depending on your requirements. Read this chapter to learn how to add, configure, and manage RAS Secure Gateways.

To view RAS Connection Brokers installed in a Site, navigate to Farm > <Site> > Connection Brokers in the RAS Console. The installed Connection Brokers are listed on the Connection Brokers tab in the right pane.

A Site must have at least the primary Connection Broker installed, which is marked so in the Priority column. You can also add secondary agents to a Site for redundancy (described in the section that follows this one).

To modify the configuration of a Connection Broker, select it and then click Tasks > Properties (or right-click > Properties). The Properties dialog opens where you can modify the following:

• Enable Server in site: Enables or disables the Connection Broker. The option is enabled for secondary Connection Brokers only. It is disabled for the primary Connection Broker.

• Server: Specifies the FDQN or IP address of the server that hosts the Connection Broker. To automatically resolve IP address to FQDN, enable the global Name Resolution option. For details, see Host Name Resolution.

• IP: Specifies the server IP address. Click the Resolve button to obtain the IP address automatically using the FQDN specified in the Server field. This IP address is used so that multiple Connection Brokers share information in real time.

• Alternate IPs: Specifies one or more alternate IP addresses separated by a semicolon. These addresses will be used if RAS Secure Gateways fail to connect to the RAS Connection Broker using its FQDN or the address specified in the IP field. This can happen, for example, if Secure Gateways are connecting from a network which is not joined to Active Directory.

• Description: A user-defined description.

• Standby: If selected, puts a secondary Connection Broker into a standby mode. This means that no agent will connect to this Connection Broker until another Connection Broker goes offline. This option is enabled automatically for any new secondary Connection Broker in excess of the three agents that already exist. It is not recommended to have more than three active Connection Brokers because it may degrade system performance. Using this option you can have more than three agents, but have them in standby mode until they are needed. For more information, see Secondary Connection Brokers.

When done making the changes, click OK and then click Apply in the main RAS Console window.

The Tasks drop-down list on the Connection Brokers tab has the following items:

• Add. Adds a RAS Connection Broker to the Site. See the section that follows this one for the information on how to add secondary Connection Brokers.

• Upgrade all Agents. Upgrades agents to the current version. The item is disabled if all agents are up to date.

• Tools. Gives you access to a set of standard server management tools.

• Troubleshooting. The Check agent menu item verifies that the Connection Broker is functioning properly. It opens a dialog where you can see the verification results and optionally install (or uninstall) the Connection Broker. The Logging menu item allows you to configure logging and retrieve or clear log files. For more information, see Logging.

• Promote to primary. Promotes a secondary Connection Broker to primary. The current primary becomes a secondary Connection Broker.

• Refresh. Refreshes the Connection Brokers list.

• Delete. Deletes a secondary Connection Broker from the Site. To delete the primary Connection Broker, you first need to promote a secondary Connection Broker to primary.

• Settings audit. Opens the Settings Audit dialog where you can view the changes that were done to the Connection Broker. For more information, see Settings Audit.

• Move up and Move down. Changes the priority of a secondary Connection Broker (moves it up or down in the priority list).

• Properties. Opens the Connection Broker Properties dialog (see above).

RAS Connection Brokers overview

In addition to the Connection Broker editor described above, you can also see the summary about the available RAS Connection Brokers. To do so:

1. In the RAS Console, navigate to the Farm > <Site> .

2. The available RAS Connection Brokers are displayed in the Connection Brokers group on the Site Info tab.

3. To go to the Connection Brokers editor, right-click a RAS Connection Broker and choose Show in the editor.

For additional info, see Sites in the RAS Console.

Automatically connect to an alternative Connection Broker

You can configure Parallels RAS to automatically connect to an alternative Connection Broker when one of Connection Brokers is not responding.

To enable automatic connection to an alternative Connection Broker:

1. In the RAS Console, click Tools > Options on the main menu (that's the menu at the top of the RAS Console window).

2. In the Options dialog, select the Automatically connect to an alternative Connection Broker when required option.

3. Click OK.

To set permissions for a RAS administrator, do the following:

1. In the RAS Console, navigate to Administration > Accounts.

2. Select an administrator in the list and click Tasks > Properties.

3. Click the Change Permissions button in the Administrator Properties dialog. The following happens depending on what is selected in the Permissions field:

   • Root administrator. The Change Permission button is disabled because the root administrator always has full permissions.

   • Power administrator. The Account Permissions dialog opens. In the left pane, select one or more sites for which to grant permissions to the administrator. In the right pane, select specific permissions. See the Power administrator permissions subsection below for details.

   • Custom administrator. A different Account Permissions dialog opens where you can set custom permissions. Compared to the Power administrator role (see above), this option allows you to grant any permission (view, modify, add, etc.) for entire categories or specific areas or objects in the RAS Console. If a Custom administrator doesn't have permissions to even view a category or tab page, they will not even appear in the RAS Console. Using the Custom administrator role, you can limit permissions to one or more very specific tasks. For details, see Custom administrator permissions below.

Power administrator permissions

The following permissions can be set for a Power administrator:

• Allow viewing of site information. Whether the administrator can view the Site information.

• Allow site changes. Permissions to modify the following categories: Site, Load Balancing, Universal Printing, Universal Scanning. This option is disabled if the Allow viewing of Site information option is cleared.

• Allow session management. Permission to manage running sessions. This option is disabled if the Allow viewing of site information option is cleared.

• Allow publishing changes. Permission to modify the Publishing category.

• Allow connection changes. Permission to modify the Connection category.

• Allow viewing of RAS reporting. Permission to view reports generated by RAS Reporting.

• Allow client management changes. Permission to modify the Device Manager category.

In the Global permission area, set the following:

• Allow viewing of policies. Whether to allow the administrator to view the Policies category.

• Allow policies changes. Whether to allow the administrator to modify the Policies category.

Custom administrator permissions

To set custom administrator permissions, you must be either a root administrator or a power administrator with the "Allow site changes" permission granted.

When you first create an administrator of this type, they will have no permissions. To add permissions, select a Site in the left pane and then click the Change permissions button. The Account Permissions dialog opens. In the dialog, select a permission type in the left pane.

The permission types are:

• RD Session hosts groups. The Groups tab in Farm > RD Session hosts.

• Manage Sessions by AD Groups. Permission for managing user sessions for users that belong to the same AD group as the custom administrator.

• Remote PCs. The Farm > Remote PCs view.

• Secure Gateways. The Farm > Secure Gateways view.

• Connection Brokers. The Farm > Connection Brokers.

• HALB. The Farm > HALB view.

• Themes. The Farm > Themes view.

• Publishing. Permissions for individual folders in the Publishing category.

• Connection. The entire Connection category.

• Device Manager. The entire Device manager category.

• Certificates. The Farm > Certificates view.

• Application Packages. The Farm > Application Packages view.

To change global permissions, instead of a specific Site select Global in the left pane and then click the Change permissions button.

The global permission types are:

• Monitoring. The Monitoring category.

• Reporting. The Reporting category.

• License. The License category.

After you select a permission type, you can set the actual permissions in the right pane. Different permission types may have different sets of permissions. The following list describes all available permissions:

• View. View only.

• Modify. View and modify.

• Add. View, modify, and add new objects (e.g. servers).

• Delete. View, modify, and delete an object.

• Control. View and control an object. This permission enables the Tasks > Control menu (where available), which includes enable and disable logons, cancel pending reboot, install RDS role, reboot, and some other options. Also enables power operations (start, stop, etc., where available).

• Manage sessions. View and manage sessions.

The lower portion of the right pane lists individual objects (e.g. servers) if the selected permission type has them. Here, you can set individual permissions for a specific object (not the entire tab, for instance, which otherwise would include all available objects).

The Global permissions options at the top of the right pane enables all permissions for all objects for the selected permission type.

Clone permissions

As a root administrator (or a power administrator with sufficient privileges), you can apply (clone) permissions of an existing administrator account to another existing account. This way, you can configure permissions for one account and then quickly apply the same configuration to all other accounts that require them.

To clone permissions, select a source administrator account and click Tasks > Clone permissions. In the dialog that opens, select a destination account (or multiple accounts) and click OK.

Delegate permissions

There could be a situation when a power administrator needs to grant some permissions to a custom administrator. This cannot be done by modifying permissions because power administrators cannot manage administrator accounts directly. Instead, they can delegate some of their own permissions in a given Site to a custom administrator of their choice.

For example, if a power administrator wants the custom administrator to be able to manage a particular RD Session Host, he/she selects that host in the RAS Console and click Tasks > Delegate permissions. This opens a dialog where the administrator can select a custom administrator and specify which permissions (view, modify, etc.) that administrator should have. The Tasks > Delegate permissions menu option is available for many objects, such as Providers, host pools (desktops), and some others. If the menu is not available for an object, it means that this functionality is not available for objects of this type.

Enabling or disabling a secondary Connection Broker

To enable or disable a secondary Connection Broker in a Site, select it in the Connection Brokers list and then select or clear the check box at the beginning of the row.

Changing the secondary Connection Broker priority

Each secondary Connection Broker is given a priority. To change the priority, select a secondary Connection Broker and use the "Up arrow" and "Down arrow" icons (or Tasks > Move up, Move down) to move it up or down the list. The higher the agent is in the list, the higher the priority.

Promoting a secondary Connection Broker to primary

If the primary Connection Broker cannot be recovered, you can promote a secondary Connection Broker to primary as follows:

1. Open the RAS Console on the Connection Broker server that you would like to promote (all required files are automatically installed when a server is added to a Site as a secondary Connection Broker).

2. Select the Farm category and navigate to the Connection Brokers node.

3. Select the Connection Broker and then click Tasks > Promote to primary.

4. Click OK once the process is finished.

Configuring auto-promotion

If the primary Connection Broker goes offline, you will need to promote a secondary Connection Broker to take its place. The auto-promotion feature can do it automatically after a specified time period.

By default, auto-promotion is turned off. To enable it, do the following:

1. In the RAS Console, navigate to Farm > <Site> > Connection Brokers.

2. Select the Auto-promotion tab in the right pane.

3. Select the Enable auto-promotion option and specify the time period after which the next secondary Connection Broker should be promoted to primary. The time period can be set between 15 minutes and 72 hours (the default value is 30 min).

4. Select the Enable failback option if you want the original Connection Broker to become primary again should it go back online. For the Licensing Site, this eliminates license activation if failback happens within 72 hours. The license activation countdown is always displayed in the RAS Console, so the administrator can check if the original primary Connection Broker recovers within this time period or not. If the original agent goes back online after the 72-hour period (and if the Farm has been already reactivated), it will become a secondary Connection Broker.

Please also note that auto-promotion must be disabled if you have a single Site with Connection Brokers split across different locations with bad WAN links. If there's no link between Connection Broker located remotely, the third Connection Broker acts as a witness to prevent split-brain.

When auto-promotion takes place, the RAS administrator will receive notifications via email about the following events:

• A secondary Connection Broker has been promoted to primary.

• Auto-promotion of a secondary Connection Broker has failed.

• Auto-promotion failback completed.

Deleting a secondary Connection Broker

To delete a secondary Connection Broker, select it in the list and then click Delete in the Tasks drop-down list.

You need to install at least one RAS Secure Gateway for Parallels RAS to work. You can add additional Gateways to a RAS Site to support more users, load-balance connections, and provide redundancy.

Installing a RAS Secure Gateway on a dedicated server

If you are installing a RAS Secure Gateway on a dedicated server, you can also install the Parallels RAS console on the same server. The console will have limited functionality but will allow you to perform some important management operations on the Gateway, including:

• Setting the Gateway operation mode (normal or forwarding, see below for details).

• Assigning a RAS Connection Broker that will manage the Gateway.

• Setting the Gateway communication port.

• Viewing the Gateway information, such as host OS version, Parallels RAS version, available IP addresses, and other.

The RAS Console in such an installation scenario (when connected to the local computer, not the RAS Farm) will only have two categories that you can select in the left pane: Gateway and Information. To manage the Gateway settings, select Gateway and then click Change Ownership in the right pane. To view the information select the Information category.

When the RAS console is connected to a Parallels RAS Farm (i.e. the server where RAS Connection Broker is running), you can manage RAS Secure Gateways by navigating to Farm > <Site> > Secure Gateways.

How a RAS Secure Gateway works

The following describes how a RAS Secure Gateway handles user connection requests:

1. A RAS Secure Gateway receives a user connection request.

2. It then forwards the request to the RAS Connection Broker with which it's registered (the Preferred Connection Broker setting by default).

3. The RAS Connection Broker performs load balancing checks and the Active Directory security lookup to obtain security permissions.

4. If the user requesting a published resource has sufficient rights, the RAS Connection Broker sends a response to the gateway which includes details about the RD Session Host the user can connect to.

5. Depending on the connection mode, the client either connects through the gateway or disconnects from it and then connects directly to the RD Session Host server.

RAS Secure Gateway operation modes

RAS Secure Gateway can operate in one of the following modes:

• Normal Mode. A RAS Secure Gateway in normal mode receives user connection requests and checks with the RAS Connection Broker if the user making the request is allowed access. Gateways operating in this mode can support a larger number of requests and can be used to improve redundancy.

• Forwarding Mode. A RAS Secure Gateway in forwarding mode forwards user connection requests to a preconfigured gateway. Gateways in forwarding mode are useful if cascading firewalls are in use, to separate WAN connections from LAN connections and make it possible to disconnect WAN segments in the event of issues without disrupting the LAN.

Planning for high availability

When adding RAS Secure Gateways to a Site, the N+1 redundancy should be configured to ensure uninterrupted service to your users. This is a general rule that also applies to other Parallels RAS components, such as Connection Brokers or RD Sessions Hosts.

To manually install a RAS Secure Gateway and add it to the Farm, follow these steps:

1. Log into the server where you'll be installing the RAS Secure Gateway using an administrator account.

2. Copy the Parallels RAS installation file (RASInstaller.msi) to the server and double-click it to launch the installation wizard.

3. Follow the onscreen instruction and proceed to the installation type page. Select Custom and click Next.

4. Click on RAS Secure Gateway in the feature tree and select Entire Feature will be installed on local hard drive.

5. Ensure that all other components in the selection tree are cleared and click Next.

6. Click Install to start the installation.

7. When the installation is completed, click Finish to close the wizard.

8. Open the RAS Console and specify the RAS Connection Broker that will manage the gateway.

To configure a RAS Secure Gateway:

1. In the RAS console, navigate to Farm > <Site> > Secure Gateways.

2. In the right pane, right-click a Secure Gateway and click Properties.

3. The RAS Secure Gateway Properties dialog opens.

Read on to learn how to configure the RAS Secure Gateway properties.

• Use IP version: Select the IP version(s) to use.

• IP(s): Specify one or more IP addresses separated by a semicolon, or click Resolve to resolve the IP address automatically. These are the available addresses on the Secure Gateway server. To specify IP addresses that should be used for client connections, use the Bind to IP section (see below).

• Bind to IP: Use this section to specify on which IP address (or addresses) the Secure Gateway will listen for client connections. You can select a specific address or <All available addresses>, in which case all of the IP addresses specified in the IP(s) field will be used.

• Remove system buffers for: These fields (one for each IP version) can be used when the connection between the Secure Gateway and the Parallels Client has a high latency (such as the Internet). This option will optimize traffic for better experience on the Parallels Client side. You can select a specific address, all available addresses, or none. What this option will do is delay the internal socket to match the performance of the external socket. If the internal network is fast and the external is slow, RDP detects the fast internal socket and sends a lot of data. The problem is that this data cannot be sent fast enough from the Secure Gateway to the Client, thus ending up with a bad user experience. Enabling this option will optimize the data exchange.

You can specify the following IP options:

IP addresses for incoming client connections for a Secure Gateway are specified on the General tab of the RAS Secure Gateway Properties dialog. RAS Secure Gateway recognizes both IPv4 and IPv6. By default, IPv4 is used.

A RAS Secure Gateway is enabled by default. To enable or disable a Secure Gateway, open the RAS Secure Gateway Properties dialog and select or clear the Enable RAS Secure Gateway in site option on the General tab.

You can have more than one administrator in Parallels RAS. At least one administrator (called the root administrator) must be present at all times. Other administrators can be given the following roles:

• Root administrator. Has full permissions to manage a Parallels RAS Farm.

• Power administrator. Has most permissions granted by default, but can be configured to have limited permissions to manage certain sites or categories.

• Custom administrator. Has no permission by default and can be granted specific permission to view or modify very specific areas or objects in the Parallels RAS Farm.

Read on to learn how to create and manage administrator accounts.

RAS Secure Gateway Properties dialog consists of tabs, each containing their own specific set of options. All tabs, except Properties, have one common option Inherit default settings. When you select this option, all fields on a tab are grayed out and the settings are inherited from Site defaults. To view (and modify if necessary) Site default properties for Secure Gateways, click the Site Defaults link, which is available on all tabs mentioned above. The link opens the Site default properties dialog. You can also open this dialog by clicking Tasks > Site defaults while on the Farm > Site > Secure Gateways tab.

The subsequent sections describe individual tabs and available options in the Secure Gateway Properties dialog.

The Network Load Balancers access section is intended for deployment scenarios where third-party front-end load balancers such as Amazon Web Services (AWS) Elastic Load Balancers (ELBs) are used. It allows you to configure an alternate hostname and port number to be used by the Network Load Balancer (NLB). This is needed to separate hostnames and ports on which TCP and HTTPS communications are carried out because AWS load balancers don't support both specific protocols over the same port.

The following options are available:

• Use alternate hostname: Select this option and specify an alternate hostname. When the alternate hostname is enabled, all platform-specific Parallels Clients will use this hostname to connect to the RAS Farm or Site.

• Use alternate port: Select this option and specify an alternate port number. The port must not be used by any other component in the RAS Farm or Site. To reset the port number to the default value, click Default. When the alternate port is enabled, all platform-specific Parallels Clients will use this port to connect to the RAS Farm or Site. Note that RDP sessions in Web Client will still be connecting to the standard SSL port (443).

In addition, the AWS Application Load Balancer (ALB), which handles HTTP/s traffic required by the Parallels Web Client, only supports specific cookies that are usually automatically generated. When a load balancer first receives a request from a client, it routes the request to a target and generates a cookie named AWSALB, which encodes information about the selected target. The load balancer then encrypts the cookie and includes it in the response to the client. When sticky sessions are enabled, the load balancer uses the cookie received from the client to route the traffic to the same target, assuming the target is registered successfully and is considered healthy. By default, Parallels RAS uses its own ASP.NET cookie named _SessionId, however in this case you must customize the cookie specifying the mentioned AWS cookie for sticky sessions. This can be configured using the Web cookie field on the Web Requests tab. Please note that this functionality is available in Parallels RAS 17.1 or newer.

To enable or disable User Portal, select or clear the Enable User Portal option. This disables User Portal, so users will no be able to connect to User Portal using the Web Client.

Tunneling policies can be used to load balance connections by assigning a group of RD Session Hosts to a specific RAS Secure Gateway or RAS Secure Gateway IP address.

To configure tunneling policies, navigate to Farm > <Site> > Secure Gateways and then click the Tunneling Policies tab in the right pane.

The <Default> policy is a preconfigured rule and is always the last one to catch all non-configured Secure Gateway IP addresses and load balance the sessions between all servers in the Farm. You can configure the <Default> policy by right-clicking it and then clicking Properties in the context menu.

Adding a new Tunneling Policy

To add a new policy:

1. Click Tasks > Add.

2. Select a Secure Gateway IP address.

3. Specify to which RD Session Host(s) the users connecting to that specific Secure Gateway should be forwarded. If you select None (no forwarding), read the Restricting RDP access section below.

Managing a Tunneling Policy

To modify an existing Tunneling Policy, right-click it and then click Properties in the context menu.

Restricting RDP access

You can use tunneling policies to restrict RDP accesses through the RAS Secure Gateway port. To do so, on the Tunneling Policies tab, select the None option at the bottom of the tab (this is the default setting in a new Parallels RAS installation). By doing so, you are restricting native MSTSC from accessing the gateway through its port (the default port is 80). As a result, when someone tries to use MSTSC at IP-address:80, the access will be denied. Same will happen for an RDP connection from a Parallels Client.

There are a couple of reasons why you would want to restrict RDP access. The first one is when you want your users to connect to the RAS Farm using the Parallels RAS connection only, but not RDP. The second reason is to prevent a DDoS attack.

A common indication of a DDoS attack taking place is when your users cannot login to a RAS Farm for no apparent reason. If that happens, you can look at the Controller.log file (located on the RAS Connection Broker server, path C:\ProgramData\Parallels\RASLogs) and see that it is full of messages similar to the following:

• [I 06/0000003E] Mon May 22 10:37:00 2018 - Native RDP LB Connection from Public IP x.x.x.x, Private IP xxx.xxx.xx.xx, on Secure Gateway xxx.xxx.xx.xx, Using Default Rule

• [I 06/00000372] Mon May 22 10:37:00 2018 - CLIENT_IDLESERVER_REPLY UserName hello@DOMAIN, ClientName , AppName , PeerIP xxx.xxx.xx.xx, Secure GatewayIP xxx.xx.x.xx, Server , Direct , desktop 0

• [I 05/0000000E] Mon May 22 10:37:00 2018 - Maximum amount of sessions reached.

• [I 06/00000034] Mon May 22 10:37:00 2018 - Resource LB User 'hello' No Servers Available!

• [W 06/00000002] Mon May 22 10:37:00 2018 - Request for "" by User hello, Client , Address xxx.xxx.xx.xx, was not served error code 14.

These messages tell us that a DDoS attack is in progress on the RDP port. By restricting RDP access through Secure Gateway tunneling polices, you can prevent this from happening.

You can view the summary information for all available RAS Secure Gateways in one place as follows:

1. In the RAS Console, select the Farm category and then select the Site node in the middle pane.

2. The available RAS Secure Gateways are displayed in the Gateways group in the right pane.

3. To go to the main Gateway view/editor, right-click a server and choose Show in the Editor.

You can also view the detailed information about a RAS Secure Gateway by navigating to Information > Site in the Parallels RAS Console. The information on this page includes general information, such as OS version, RAS version, Gateway mode, as well as the information about various types of connections, sessions, cached sockets, and threads.

RD Session Hosts are used to host published resources (applications, desktops, documents, etc.) in a Parallels RAS Farm. Read this chapter to learn how to add, configure, and administer RD Session Hosts.

You may need to install the RAS RD Session Host Agent manually if the automatic push installation cannot be performed. For instance, an SMB share may not be available or the firewall rules may interfere with the push installation, etc.

Installing RAS RD Session Host Agent manually

1. Log in to the server where the RAS RD Session Host Agent is to be installed using an administrator account and close all other applications.

2. Copy the Parallels RAS installation file (RASInstaller.msi) to the server and double-click it to launch the installation.

3. Follow the onscreen instructions and proceed to the installation type page. Select Custom and click Next.

4. Click on RAS RD Session Host Agent and select Entire Feature will be installed on local hard drive from the drop-down list.

5. Ensure that all other components are deselected and click Next.

6. Click Install to start the installation.

7. Click Finish once the installation is finished.

The RAS RD Session Host Agent doesn't require any configuration. Once the agent is installed, highlight the server name in the RAS Console and click Troubleshooting > Check Agent in the Tasks drop-down list to update the server status.

Uninstalling RAS RD Session Host Agent

To uninstall RAS RD Session Host Agent from a server:

1. Navigate to Start > Control Panel > Programs > Uninstall a Program.

2. Find Parallels Remote Application Server in the list of installed programs.

3. If you don't have any other Parallels RAS components on the server that you want to keep, right-click Parallels Remote Application Server and then click Uninstall. Follow the instructions to uninstall the program. You may skip the steps below.

4. If you have other RAS components that you want to keep on the server, right-click Parallels Remote Application Server and then click Change.

5. Click Next on the Welcome page.

6. On the Change, repair, or remove page, select Change.

7. On the next page, select Custom.

8. Select RAS RD Session Host Agent, then click the drop-down list in front of it, and click Entire feature will be unavailable.

9. Click Next and complete the wizard.

A secondary Connection Broker is added to a Site for redundancy. This way if the primary Connection Broker fails, the secondary Connection Broker is still available to handle the requests. Connection Brokers work in active/active manner to ensure high availability. In case of a Connection Broker failure, the next agent is always ready to handle the load. In general, the N+1 redundancy approach should be used per Site. Note that for auto-promotion you shouldn't have more than three Connection Brokers (auto-promotion is described later in this section).

When you have one more secondary Connection Brokers installed, the runtime data is replicated on each agent, so if any service fails, the downtime is reduced to a minimum. In addition, any active Connection Broker is used for authentication purposes with both the AD and any 2nd level authentication provider used.

The primary Connection Broker performs the same tasks as secondary Connection Brokers but has additional responsibilities. It manages certain processes that must be managed by a single Connection Broker. The following table lists processes managed by the primary Connection Broker and secondary Connection Brokers:

As a demonstration of how load distribution between multiple Connection Brokers works, consider the following example:

• Suppose we have two Connection Brokers: PA1 (primary) and PA2 (secondary).

• Suppose we also have 10 RD Session Hosts: RDS1, RDS2 ... RDS10

The resulting load will be distributed as follows:

• RDS1, RDS2 ... RDS4 will use PA1 as their preferred Connection Broker.

• RDS5, RDS6 ... RDS10 will use PA2 as their preferred Connection Broker.

Planning for secondary Connection Brokers

RAS Connection Brokers running on the same Site communicate with each other and share the load. The amount of data being transmitted from one agent to another is quite large, so a reliable high-speed communication channel must be ensured (e.g. a subnetwork can be configured for Connection Broker communications).

When adding a secondary Connection Broker to a Site, you specify an IP address for it. Make sure that the IP addresses of all agents belong to the same network segment. The port that Connection Brokers use to communicate with each other is TCP 20030.

There's no physical limit to how many Connection Brokers you can add to a Site. However, the best results are achieved with only two-three agents present. The three-agent scenario is highly recommended, especially when you have Providers and want to enable high availability for VDI. Adding more than two secondary Connection Brokers to a Site may have a reverse effect and actually degrade the system performance. Note that this does not apply to secondary Connection Brokers in standby mode, which is explained in Configuring RAS Connection Brokers.

Adding a secondary RAS Connection Broker to a Site

To add a secondary Connection Broker:

1. In the RAS console, navigate to Farm > <Site> > Connection Brokers.

2. Click the Tasks drop-down list and choose Add to launch the Add RAS Connection Broker wizard.

3. The Server field specifies the FDQN or IP address of the server that hosts the RAS Connection Broker. To automatically resolve IP address to FQDN, enable the global Name Resolution option. For details, see Host Name Resolution.

4. The IP field specifies the server IP address. Click the Resolve button to obtain the IP address automatically using the FQDN specified in the Server field.

5. The Alternative IPs field specifies one or more alternative IP addresses, separated by a semicolon. These addresses will be used if RAS Secure Gateways fail to connect to the RAS Connection Broker using its FQDN or the address specified in the IP field. This can happen, for example, if Secure Gateways are connecting from a different network, which is not joined to Active Directory.

6. Select the Install a Secure Gateway with a Connection Broker option if you also want to install a RAS Secure Gateway on the specified server. If you select this option, you may also select the Enable HTML5 Gateway option (for more info, see Configure User Portal).

7. Select the Add Firewall Rules option to automatically configure the firewall on the server. See Port Reference for details.

8. Click Next.

9. On the next page, click Install to install the RAS Connection Broker on the server. The Installing RAS Redundancy Service dialog opens.

10. Select the server on which the RAS Connection Broker is to be installed and click Install.

11. Click Done.

12. Click OK to add the server to the Farm.

The Public address field on the General tab specifies a public FQDN or IP address of the Secure Gateway. This setting is used by the Preferred routing functionality for redirecting a client connection. Please see .

To add a RAS Secure Gateway to a Site, follow these steps:

1. In the RAS Console, navigate to Farm > <Site> > Secure Gateways.

2. With the Secure Gateways tab selected in the right pane, click Tasks > Add to start the Add RAS Secure Gateway wizard.

3. Enter the server FQDN or IP address (or click the [...] button to select a server from the list). To automatically resolve IP address to FQDN, enable the global Name Resolution option. For details, see .

4. Select the gateway mode from the Mode drop-down list.

5. If you selected the Forwarding mode in the step above, select the destination gateway in the Forward To drop-down list. You can also select a specific IP address in the On IP drop-down list if the Gateway server has more than one.

6. Select the Enable HTML5 Gateway option to automatically create a self-signed certificate, enable SSL, and enable HTML5 support. For more info, please see

7. Select the Add Firewall Rules to automatically configure the firewall on the server hosting the gateway. See Port Reference for details.

8. Click Next.

9. On the next page, click Install to start the RAS Secure Gateway installation.

10. Click Done when the installation is finished.

A RAS Secure Gateway can operate in . To set the desired mode and configure related settings click the Mode tab in the RAS Secure Gateway Properties dialog.

Using Site defaults

To use Site default settings, click the Inherit default settings option. To specify your own settings, clear the option. For more info, see .

Setting the normal mode

To set the normal mode, in the Gateway mode drop-down list, select Normal.

The Forward requests to HTTP Server option allows you to forward requests that do not belong to RAS Secure Gateways (gateways handle HTML5 traffic, Wyse, and URL scheme). To specify multiple servers, separate them with a semicolon. An HTTP server can be specified using an IPv6 address if necessary. Please note that the HTTP server must support the same IP version as the browser making the request.

The Preferred Connection Broker drop-down list allows you to specify a RAS Connection Broker that the Secure Gateway should connect to. This is helpful when Site components are installed in multiple physical locations communicating through WAN. You can decrease network traffic by specifying a more appropriate Connection Broker. For the Secure Gateway to select a Connection Broker automatically, select the Automatic option.

Setting the forwarding mode

To configure the forwarding mode, in the Gateway mode drop-down list, select Forwarding.

Specify (or select) one or more forwarding Secure Gateways in the Forwarding RAS Secure Gateway(s) field.

When configuring RAS Secure Gateway to use SSL encryption, you should pay attention to how the SSL server is configured to avoid possible traps and security issues. Specifically, the following SSL components should be rated to determine how good the configuration is:

• The certificate, which should be valid and trusted.

• The protocol, key exchange, and cipher should be supported.

The assessment may not be easy to perform without specific knowledge about SSL. That's why we suggest that you use the SSL Server Test available from Qualys SSL Labs. This is a free online service that performs an analysis of the configuration of an SSL web server on the public Internet. To perform the test on a RAS Secure Gateway, you may need to temporarily move it to the public Internet.

The test is available at the following URL: .

You can read a paper from Qualys SSL Labs describing the methodology used in the assessment at the following URL: .

User Portal is a functionality built into RAS Secure Gateway that allows users to connect to Parallels RAS and open published resources from a web browser using the Parallels Web Client. The client works similarly to a platform-specific Parallels Client, but does not require any additional software to be installed on users' computers or devices. All that users need is an HTML5-enabled web browser.

This section describes how to configure User Portal in the Parallels RAS Console. For the information about how to use it, please refer to the chapter.

To configure User Portal, click the User Portal tab in the RAS Secure Gateway properties dialog and then set the options described in the subsequent sections.

For the information on how to configure the Web Client URL and how to access the client from a web browser, please .

The Network tab is used to configure RAS Secure Gateway network options.

Using Site defaults

To use Site default settings, click the Inherit default settings option. To specify your own settings, clear the option. For more info, see .

Configuring network

By default RAS Secure Gateway listens on TCP ports 80 and 443 to tunnel all Parallels RAS traffic. To change the port, specify a new port in the RAS Secure Gateway Port input field.

RDP port 3389 is used for clients that require basic load balanced desktop sessions. Connections on this port do not support published resources. To change the RDP port on a gateway select the RDP Port option and specify a new port. When setting your own port, please make sure that the port number does not conflict with the standard "RD Session Host Port" setting.

Broadcast RAS Secure Gateway Address. This option can be used to switch on the broadcasting of the Secure Gateway address, so Parallels Clients can automatically find their primary Secure Gateway. The option is enabled by default.

Enable RDP UDP Data Tunneling. To enable UDP tunneling on Windows devices, select this option (default). To disable UDP tunneling, clear the option.

Device Manager Port. Select this option to enable management of Windows devices from the Device Manager category. The option is enabled by default.

Enable RDP DOS Attack Filter. When selected, this option denies chains of uncompleted sessions from the same IP address. For example, if a Parallels Client initiates multiple successive sessions with each session waiting for the user to provide credentials, Parallels RAS will deny further attempts. The option is enabled by default.

To use Site default settings on the User Portal tab, click the Inherit default settings option. To specify your own settings, clear the option. For more info, see .

The traffic between Parallels RAS users and a RAS Secure Gateway can be encrypted. The SSL/TLS tab allows you to configure data encryption options.

Using Site defaults

To use Site default settings, click the Inherit default settings option. To specify your own settings, clear the option. For more info, see .

Enforcing HSTS

The Configure button in the HSTS section allows you to enforce HTTP Strict Transport Security (HSTS), which is a mechanism that makes a web browser to communicate with the web server using only secure HTTPS connections. When HSTS is enforced for a RAS Secure Gateway, all web requests to it will be forced to use HTTPS. This specifically affects the , which typically accepts only HTTPS requests for security reasons.

When you click the Configure button, the HSTS Settings dialog opens where you can specify the following:

• Enforce HTTP strict transport security (HSTS): Enables or disables HSTS for the Secure Gateway.

• Max-age: Specifies the max-age for HSTS, which is the time (in our case in months) that the web browser should remember that it can only communicate with the Secure Gateway using HTTPS. The default (and recommended) value is 12 months. Acceptable values are 4 to 120 months.

• Include subdomains: Specifies whether to include subdomains (if you have them).

• Preload: Enables or disables HSTS preloading. This is a mechanism whereby a list of hosts that wish to enforce the use of SSL/TLS on their Site is hardcoded into a web browser. The list is compiled by Google and is used by Chrome, Firefox, Safari, Internet Explorer 11, and Edge browsers. When HSTS preload is used, a web browser will not even try to send a request using HTTP, but will use HTTPS every time. Please also read the important note below.

Please also note the following requirements:

• Your website must have a valid SSL certificate. See .

• All subdomains (if any) must be covered in your SSL Certificate. Consider ordering a Wildcard Certificate.

Configuring SSL

By default, a self-signed certificate is assigned to a RAS Secure Gateway when the gateway is installed. Each RAS Secure Gateway must have a certificate assigned and the certificate should be added to Trusted Root Authorities on the client side to avoid security warnings.

To configure SSL for a Secure Gateway:

1. Select the Enable SSL on Port option and specify a port number (default is 443).

2. In the Accepted SSL Versions drop-down list, select the SSL version accepted by the RAS Secure Gateway.

3. In the Cipher Strength field, select a desired cipher strength.

4. In the Cipher field, specify the cipher. A stronger cipher allows for stronger encryption, which increases the effort needed to break it.

5. The Use ciphers according to server preference option is ON by default. You can use client preferences by disabling this option.

6. The <All matching usage> option will use any certificate configured to be used by Secure Gateways. When you create a certificate, you specify the "Usage" property where you can select "Gateway", "HALB", or both. If this property has the "Gateway" option selected, it can be used with a Secure Gateway. Please note that if you select this option, but not a single certificate matching it exists, you will see a warning and will have to create a certificate first.

Encrypting Parallels Client connection

By default, the only type of connection that is encrypted is a connection between a Secure Gateway and backend servers. To encrypt a connection between Parallels Client and the Secure Gateway, you also need to configure connection properties on the client side. To do so, in Parallels Client, open connection properties and set the connection mode to Gateway SSL.

To simplify the Parallels Client configuration, it is recommended to use a certificate issued by a well-known third-party Trusted Certificate Authority. Note the Windows certificate store is used by some web browsers (Chrome, Edge etc.) when connecting to RAS User Portal.

Parallels Clients configuration

In case the certificate is self-signed, or the certificate issued by Enterprise CA, Parallels Clients should be configured as follows:

1. Export the certificate in Base-64 encoded X.509 (.CER) format.

2. Open the exported certificate with a text editor, such as notepad or WordPad, and copy the contents to the clipboard.

To add the certificate with the list of trusted authorities on the client side and enable Parallels Client to connect over SSL with a certificate issued from an organization’s Certificate Authority.

To add the certificate in Parallels Client for Windows:

1. On the client side in the directory C:\Program Files\Parallels\Remote Application Server Client\ there should be a file called trusted.pem. This file contains certificates of common trusted authorities.

2. Paste the content of the exported certificate (attached to the list of the other certificates).

To add the certificate in Parallels Client for Linux:

• On IGEL OS 12:

  1. Open the file named customtrusted.pem in the directory /userhome/.config/2X/Client/. If this file does not exist, create it. This file will store your custom trusted certificates.

  2. Paste the content of the exported certificate to the file. If the file exists and contains other certificates, add the certificate to the end of the file.

• On other Linux distributions:

  1. Identify the location of your trusted.pem file. On most systems, this should be the /opt/2X/Client/lib directory.

  2. Open the file named customtrusted.pem in the directory where trusted.pem is located. If this file does not exist, create it. This file will store your custom trusted certificates.

  3. Paste the content of the exported certificate to the file. If the file exists and contains other certificates, add the certificate to the end of the file.

Securing RDP-UDP connections

A Parallels Client normally communicates with a RAS Secure Gateway over a TCP connection. Recent Windows clients may also utilize a UDP connection to improve WAN performance. To provide the SSL protection for UDP connections, DTLS must be used.

To use DTLS on a RAS Secure Gateway:

1. On the SSL/TLS tab, make sure that the Enable SSL on Port option is selected.

The Parallels Clients must be configured to use the Gateway SSL Mode. This option can be set in the Connections Settings > Connection Mode drop-down list on the client side.

Once the above options are correctly set, both TCP and UDP connections will be tunneled over SSL.

To publish applications from the Parallels RAS to thin clients using the Wyse ThinOS, select the Enable Wyse ThinOS support option on the Wyse tab.

By enabling this option, the RAS Secure Gateway will act as a Wyse broker. You need to make sure that DHCP option 188 on your DHCP server is set to the IP address of this gateway for thin clients that will be booting via this Secure Gateway. Once the DHCP server is configured, click the Test button to verify the DHCP server settings.

The Do not warn if server certificate is not verified option can be selected (enabled) if a Wyse device shows an SSL warning when connecting to a RAS Secure Gateway because the hostname does not match the certificate. When the option is selected, the Secure Gateway will send Wyse clients the following parameters in the wnos.ini file: SecurityPolicy=low TLSCheckCN=no, which will disable SSL checks. Note that the option is not required if a certificate has the following:

• The CNAME set to the FQDN of the RAS Secure Gateway.

• The SAN set to the RAS Secure Gateway IP address.

Note that if you use a custom wnos.ini in "C:\Program Files (x86)\Parallels\ApplicationServer\AppData\wnos" folder on Secure Gateway, the Secure Gateway will not send the SSL check parameters.

If you configure DHCP option 188 to set the broker address to a given Secure Gateway, you can verify this by clicking the Test button.

The Client section allows you to specify application launch methods and other Web Client settings.

• Launch sessions using: When a user tries to open a resource from the User Portal web page, the resource can open right in the web browser or it can be launched in a platform-specific Parallels Client installed on the user's computer (e.g., Parallels Client for Windows). This option specifies which client will be used. Compared to Web Client, platform-specific Parallels Client includes a richer set of features and provides end users with a better overall user experience. Select one of the following:

  1. Browser Only: Users can run remote applications and desktops using Parallels Web Client only. Use this option if you don't want your users to install a platform-specific Parallels Client.

  2. Parallels Client Only: Users can run remote applications and desktops in Parallels Client only. When a user connects to Parallels RAS using Parallels Web Client, they will be asked to install the platform-specific Parallels Client before they can launch remote applications and desktops. A message will be displayed to the user with a link for downloading the Parallels Client installer. After the user installs Parallels Client, they can still select a remote application or desktop in Parallels Web Client but it will open in Parallels Client instead.

  3. Parallels Client with fallback to Browser: Both Parallels Client and a browser (HTML5) can be used to launch remote applications and desktops. Parallels Client will be the primary method; Parallels Web Client will be used as a backup method if a published resource cannot be launched in Parallels Client for any reason. A user will be informed if a resource couldn't be opened in Parallels Client and will be given a choice to open it in the browser instead.

• (Parallels Client with fallback to Browser and the Parallels Cient only) Additionally, you can configure Parallels Client detection by clicking on the Configure button:

  • Detect client: Select when Parallels RAS tries to detect platform-specific Parallels Client.

    • Automatically on sign in: Parallels RAS tries to detect platform-specific Parallels Client immediately.

    • Manually on user prompt: Parallels RAS shows users a prompt where can they select whether they want to detect platform-specific Parallels Client .

  • Client detection timeout: Time period during which Parallels RAS tries to detect platform-specific Parallels Client.

• Allow users to select a launch method: If selected, users will be able to choose whether to open remote applications in a browser or in Parallels Client. You can enable this option only if the Launch session using option (above) is set to Parallels Client with fallback to Browser (i.e. both methods are allowed).

• Allow opening applications in a new tab: If selected, users will be able to open remote applications in a new tab in a web browser.

• Use Pre Windows 2000 login format: Enables legacy (pre-Windows 2000) login format.

• Allow embedding of User Portal into other web pages: If selected, the User Portcal web page can be embedded in other web pages. Please note that this may be a potential security risk due to a practice known as clickjacking.

• Allow file transfer command: Enables file transfer in a remote session. To enable file transfer, select this option and click the Configure button. In the dialog that opens, select Client to server only (transfer files from client to server only), Server to client only (transfer files from server to client only), Bidirectional (transfer files in both directions). For more information, see .

• Allow clipboard command: Enables clipboard operations (copy/paste) in a remote session. To enable the clipboard, select this option and click the Configure button. In the dialog that opens, select Client to server only (copy/paste from client to server only), Server to client only (copy and paste from server to client only), Bidirectional (copy and paste in both directions). For more information about using the clipboard, see .

• Allow cross-origin resource sharing: Enables cross-origin resource sharing (CORS). To enable CORS, select this option and click the Configure button. In the dialog that opens, specify one or more domains for which access to resources should be allowed. If you don't specify any domains, the option will be automatically disabled. In the Browser cache time field, specify for how long the end-user's browser will cache a resource.

• Use a client IP detection service: If selected, allows configuring an IP detection service to report IP addresses of connected Parallels Web Client applications. To enable a client IP detection service, select this option and click the Configure button. In the dialog that opens, provide the URL to the IP detection service you want to use. You can press the Test button to ensure the API works as expected. When you click the Test button, the Connection Broker will take the role of the client and call the API. If successful, you will be presented with a window showing the IP address of the Connection Broker.

A RAS Secure Gateway is monitored and logs are created containing relevant information. To configure logging and retrieve or clear existing log files, right-click a gateway, choose Troubleshooting > Logging in the context menu, and then click Configure, Retrieve, or Clear depending on what you want to do. For the information on how to perform these tasks, see the section.

You can perform standard computer management tasks on server hosting the RAS Secure Gateway right from the RAS Console. These include Remote Desktop Connection, PowerShell, Computer Management, Service Management, Event Viewer, IPconfig, Reboot, and others. To access the Tools menu, select a server, click Tasks (or right-click) > Tools and choose a desired tool. For requirements and usage information, see .

You can allow or deny user access to a Secure Gateway based on a MAC address. This can be accomplished using the Security tab in the RAS Secure Gateway Properties dialog.

Using Site defaults

To use Site default settings, click the Inherit default settings option. To specify your own settings, clear the option. For more info, see Site defaults (Gateways).

Configuring security

To configure a list of allowed or denied MAC addresses, click the Security tab and select one of the following options:

• Allow all except. All devices on the network will be allowed to connect to the Secure Gateway except those included in this list. Click Tasks > Add to select a device or to specify a MAC address.

• Allow only. Only the devices with the MAC addresses included in the list are allowed to connect to the Secure Gateway. Click Tasks > Add to select a device or to specify a MAC address.

Please note that the Secure Gateway MAC address filtering is based on ARP, so client and server must be on the same network for the filtering to work. It does not work across network boundaries.

The Web tab allows you to tweak settings necessary for load balancing in certain scenarios. Here you can specify a redirection URL for web requests and a session cookie name to maintain persistence between a client and a server.

Redirection URL

An original web request can reach the gateway one of the following two ways:

• The request is sent directly to the gateway over the local network using its IP address or FQDN. For example, https://192.168.10.10.

• The request is sent to a HALB device that load-balances this and other gateways in the Farm. The HALB device often faces the Internet (i.e. located in DMZ) and so its DNS name can be used in the original request URL. For example, https://ras.msp.com. The HALB device is then distributes the request to a gateway.

When the gateway receives the web request, it takes the URL specified on the Web tab and sends it back to the web browser for redirection.

Technically, you can enter any URL here, and the original web request will be redirected to that URL. The primary purpose of this field, however, is to give end users an easy way to access User Portal from their web browsers. Here's how it works:

1. A user enters the Load Balancer DNS name in a web browser. For example, https://ras.msp.com.

2. The Load Balancer receives the request and distributes it to the least-busy RAS Secure Gateway for processing.

3. The gateway receives the original URL and replaces it with the URL specified in the Default URL field. See the Default URL format subsection below.

4. The replaced URL is then sent back to the web browser, which uses it to open the User Portal login page.

Default URL format

The default URL format is the following:

https://%hostname%/userportal

• The %hostname% variable is automatically replaced with the name of the server that received the original request, which in our example is the Load Balancer DNS name. If you wish, you can replace the variable with a specific host name or IP address (e.g. this or some other gateway). For example, https://192.168.5.5/userportal. If you do this, the web requests will always be forwarded to the specified host and will open the User Portal on it. Hard-coding a host may not be very practical, but you can do this nevertheless.

• userportal is a constant and is the path to the User Portal login page.

In our example, the resulting URL that the web browser will use to access the User Portal is the following:

https://ras.msp.com/userportal

The fact is, a user could simply use the above URL from the start, but thanks to the redirection feature, users only need to enter the server DNS name (or FQDN/IP-address on the local network) instead of the entire URL.

Opening a specific User PortalTheme

User Portal Themes is a feature that allows you to custom design the User Portal look and feel for different groups of users. Themes are described in detail in Parallels Web Client and User Portal.

The default web request URL opens the default Theme. To make it open a specific Theme, add the Theme name at end of the URL as follows:

https://%hostname%/userportal/?theme=<theme-name>

where <theme-name> is the name of a Theme without brackets or quotes.

For users to open a specific Theme, the URL that they enter in a web browser must contain the Theme name, but in this case the format is as simple as the following:

https://<server-name>/<theme-name>

Using our Load Balancer DNS name example from above, the URL may look like the following:

https://ras.msp.com/Theme-E1

For additional information, please see Configure Themes > URLs.

Web cookie

The Web cookie field is used to specify a session cookie name. RAS Web Client session persistence is normally set by the user IP address (source addressing). If you can't use source addressing in your environment (e.g. your security policy doesn't allow it), you can use the session cookie to maintain persistence between a client and a server. To do so, you need to set up a load balancer that can use a session cookie for persistence. The default cookie name is ASP.NET_SessionId. Note that if you are using Amazon Web Services (AWS) or other third-party load balancers, you may need to specify their own cookie name. See Network load balancers access for more information.

Read this section to learn how manage RD Session Hosts components in Parallels RAS.

RD Session Host requirements

An RD Session Host must have the Remote Desktop Services (RDS) role installed. You can install RDS right from the RAS Console, as described later in this section.

To push install the RAS RD Session Host Agent on a server, the following requirements must be met:

• The firewall must be configured on the server to allow push installation. Standard SMB ports (139 and 445) need to be open. See also Port reference for the list of ports used by Parallels RAS.

• SMB access. The administrative share (\\server\c$) must be accessible. Simple file sharing must be enabled.

• Your Parallels RAS administrator account must have permissions to perform a remote installation on the server. If it doesn't, you'll be asked to enter credentials of an account that does.

• The RD Session Host should be joined to an AD domain. If it's not, the push installation may not work and you will have to install the Agent on the server manually. See Installing the Agent manually section.

Add an RD Session Host

To add an RD Session Host to a Site:

1. In the RAS Console, navigate to Farm > Site > RD Session Hosts.

2. Click Tasks > Add. This opens the Add RD Session Hosts wizard. Note that you can also open the wizard from the Start category as describe in Set up a basic Parallels RAS Farm.

3. Click the Tasks menu (or click the [+] icon) and select one of the following:

   • Add from Active Directory: Adds an RD Session Host from Active directory.

   • Add Manually: Adds RD Session Host by entering its FQDN or IP address.

   Note that if you enter the server name (hostname or FQDN), it will be used as the primary method of connecting to this server from other RAS components and clients. If you enter the IP address, it will be automatically resolved to FQDN, but only if the global option to resolve to FQDN is enabled. To see the current setting of this global option, click Tools > Options on the main menu. In the Options dialog, examine the Always attempt to resolve to fully qualified domain name (FQDN) when adding hosts option. When the option is selected, the IP address of every server/component in the RAS Farm is always resolved to FQDN. When the option is cleared, whatever is specified for a server (IP address or name) is used to communicate with a server. This makes a difference in deployments where an IP address cannot be used to access a server, such as when a server is hosted in the cloud. For more information, see Host name resolution.

4. Click Next.

5. On the next page, specify the following options:

   • Add firewall rules. Add firewall rules required by Parallels RAS in Windows running on the server. See Port reference for details.

   • Install RDS role. Install the RDS role on the server if it's not installed. You should always select this option.

   • Enable Desktop Experience. Enable the Desktop Experience feature in Windows running on the server. This option is enabled only if the Install RDS role option (above) is selected. The option applies to Windows Server 2008 R2 and Windows 2012 R1/R2 on which the Desktop Experience feature is not enabled by default.

   • Restart server if required. Automatically restart the server if necessary. You can restart the server manually if you wish.

   • Add server(s) to host pool. Add the server (or servers) to a host pool. Select the desired host pool in the list box located below this option. If you are not sure what host pool to choose, select Default Host pool. Host pools are described in detail in the Manage host pools (RD Session Hosts) section.

6. Click Next.

7. Add the server (or servers) to a host pool. Select the desired host pool or create a new host pool. If you are not sure what host pool to choose, select Default Host pool. Host pools are described in detail in the Manage host pools (RD Session Hosts) section.

8. Click Next.

9. The next page allows you to add users and groupsto the Remote Desktop Users groups in Windows running on the server. This is necessary for your Parallels RAS users to be able to access published resources hosted by an RD Session Host. To specify users and/or groups, select the option provided and then click the [+] icon. In the Select Users or Groups dialog, specify a user or a group and click OK. The selected user/group will be added to the list on the wizard page.

1. Click Next.

2. The User profile page allows you to select a technology to manage user profiles. You can select from User profile disk or FSlogix. User profile disks are virtual hard disks that store user application data on a dedicated file share. Microsoft FSLogix Profile Container is the preferred Profile Management solution as the successor of Roaming Profiles and User Profile Disks (UPDs). It is set to maintain user context in non-persistent environments, minimize sign-in times and provide native profile experience eliminating compatibility issues. For complete instructions, please see User profile.

3. The Optimization page allows you to specify settings that will be used to optimize Windows on the RD Session Host for best performance in a Parallels RAS environment. You can select Windows components, services, and other options that will be disabled, removed, or optimized to ensure a more efficient, streamlined, and improved delivery of virtual apps and desktops. For the complete description, please see Optimization.

4. On the next page, review the settings and click Next.

5. The Install RAS RD Session Host Agent dialog opens. Follow the instructions and install the agent. When the installation is finished, click Done to close the dialog.

6. Back in the wizard, click Finish to close it.

If you would like to verify that the RD Session Host has been added to the Farm, click the Farm category (below the Start category in the left pane of the Parallels RAS Console window) and then click RD Session Hosts in the navigation tree (the middle pane). The server should be included in the RD Session Hosts list. The Status column may display a warning message. If it does, reboot the server. The Status column should now say, "OK", which means that your RD Session Host is functioning properly.

Read on to learn how to publish an application from an RD Session Host.

Creating a host pool

To create an RD Session Host host pool:

1. In the RAS console, navigate to Farm > <Site> > RD Session HostsHost pools.

2. Click Tasks > Add (or click the [+] icon).

3. Select Enable Host pool in site to enable the host pool. Specify the name and the description for the new host pool.

4. Click Next.

5. On the Provisioning page, select whether this host pool will contain template-based or standalone hosts:

   • Template: (Template-based RD Session Hosts only) Hosts will be created dynamically from a template. You will need to create or select an existing template in the next step or later. Choosing Template as the provisioning type ensures a homogeneous host pool, which is recommended to provide consistent user experience across the host pool. For more information about creating template-based RD Session Hosts, see section Add a template-based RD Session Host.

   • Standalone: (Template-based and standalone RD Session Hosts) Select one or more hosts that already exist. You'll be able to do it in the next step or you can do it later. Prior to adding hosts to host pools, ensure that hosts are domain joined and have network access to the domain environment. Note that the Standalone provisioning is considered "unmanaged" as it lacks some of the functionality, such as Autoscaling.

6. Click Next.

7. Depending on the selection made on the Provisioning page (above), do one of the following

   • Standalone: Select one or more hosts from the list to be included in the host pool (you can also add hosts to the pool later).

   • Template: Select a template from the list or click Create new to create a new template and specify the template settings. Versions: If you selected an existing template, select one of its versions. Enable autoscale: (Multi-session hosts) Enable and configure autoscale.

8. Click Next.

9. (Templates only) On the Provisioning page, specify the following options:

   • Template name: Choose and type a template name.

   • Host name: A pattern to use when naming new hosts.

   • Number of hosts deployed on wizard completion: The number of hosts to deploy once the template is created. Please keep in mind that this will take some time because the hosts will be created one at a time.

   • Host state after the preparation: Select the power state that should be applied to a host after it is prepared. Choose from Powered on, Powered off, or Suspended. Note that when the power state is set to Power off or Suspended, the number of running (fully ready and waiting for incoming connections) hosts is controlled by the Keep available buffer setting (see above). For example, let's say the Maximum hosts value is set at 200, the number of guest hosts deployed on wizard completion is 100, and the power state after preparation is Powered off. The result of such a configuration will be 100 clones deployed and powered off.

   • Maximum hosts: Specify the maximum number of hosts that can be created from this template.

   • (Only for templates created from AWS instances) Virtual networks: Select Availability Zones for the host pool. Choose from Use the subnet associated with the template and Use specific subnets available in the VPC. If you select Use specific subnets available in the VPC, then after clicking Next you can manaully select one or several Availability Zones.

   • Autoscale settings: Configure autoscale settings as described in Manage host pools (RD Session Hosts).

10. Click Next.

11. On the User profile page, you can select from Do not manage by RAS (user profiles will not be managed) or FSlogix. Microsoft FSLogix Profile Container allows to maintain user context in non-persistent environments, minimize sign-in times and provides native profile experience eliminating compatibility issues. For complete instructions, please see User profile.

12. Click Next.

13. On the Summary page, review the template summary information. You can click the Back button to correct some of the information if needed.

14. Finally, click Finish to create the host pool and close the wizard.

After you create a host pool and later publish resources from it, you can view the list of resources by right-clicking a host pool and choosing Show published resources (or click Tasks > Show Published Resources). For more information, see Viewing published resources hosted by RD Session Hosts.

When you publish resources in Parallels RAS, you need to specify one or more servers that host them. Host pools allow you to combine multiple RD Session Hosts and then publish the resources from the host pool instead of specifying individual servers.

The main benefits of using RD Session Host host pools are as follows:

• They simplify the management of published resources.

• They allow you to use RD Session Hosts created from a template. More on this later in this section.

Each RD Session Hosts must belong to a host pool. Parallels RAS comes with a built-in host pool named <Default> that you can use. Note that an RD Session Host can be a member of one host pool only. You cannot add the same server to multiple host pools.

Moving an RD Session Host to another host pool

To move an RD Session Host from one host pool to another:

1. In the RAS console, navigate to Farm > <Site> > RD Session Hosts.

2. Select an RD Session Host.

3. Click Tasks > Assign to host pool or right-click the RD Session Host and select Assign to host pool in the context menu.

4. In the Assign to Host pool dialog, select the host pool you need.

Autoscale

The settings on the Autoscale tab of the host pool properties determine how RD Session Hosts are created from the specified template. The settings are described below.

Template: Specifies the template assigned to the host pool.

Enable autoscale: Enables autoscale.

Configure: Configures the autoscale settings:

• Min number of hosts to be added to the host pool from the Template: Specifies the minimum number of servers that will be added to the host pool automatically when the template is assigned to the host pool. This number of servers will remain in the host pool irrespective of utilization.

• Max number of hosts to be added to the host pool from the Template: This option allows you to set a limit on how many servers in total can be added to the host pool from the template. A template can be shared between host pools. By setting a limit for each host pool, you can ensure that the combined number of servers in each host pool will not exceed the template limit. Consider the following examples:

  • If the template is used by a single host pool, then this number can be up to the Maximum hosts setting of the template.

  • If two or more host pools share the same template, then the combined number from all host pools must be less or equal to the Maximum hosts settings of the template.

  When you save a host pool, a validation will be performed against other host pools (if any) and you will see an error message if the numbers don't match. Note that when a server cannot be created on request due to an error, a "Template error" event is triggered and the administrator will receive an alert message.

• Add new or power on existing hosts when workload is above (%): Specifies a workload threshold in percent. When the actual workload is above this value, a new server (or servers) will be created and added to the host pool (if not already available). The host pool workload percentage is calculated using the following formula:

  Host pool Workload = (Current Sessions / Max Sessions) * 100

  In the formula above:

  • Current Sessions is the total number of all sessions on all servers in the host pool. This includes static (standalone) servers and servers created from the template (host pools). Note that servers that are disabled, being drained, or have the agent status of ‘Not Verified’ are not included in the calculation.

  • Max Sessions is a setting that you specify on the Agent Settings tab (either inherited from Site defaults or overridden for this host pool) and the maximum number of sessions allowed for the host pool.

  Consider the following examples:

  RAS Host pool 1 — mixed server types (static and host pools), different agent status:

  • RDSH-1, Status: OK, Max Sessions 10, Current Sessions: 2, Type: Static

  • RDSH-2, Status: Disabled, Max Sessions 20, Current Sessions: 0, Type: Static

  • RDSH-3, Status: OK, Max sessions 10, Current Sessions: 4, Type: Host

  • RDSH-4, Status: Drain Mode, Max sessions 10, Current Sessions: 3, Type: Host

  For the host pool above, the workload is calculated as (Current Sessions / Max Sessions) * 100 or ((2 + 4) / 20) * 100 = 30%

  Note that servers RDSH-2 and RDSH-4 are not included in the workload because the former has the agent disabled and the latter is in drain mode.

  RAS Host pool 2 — mixed server types (static and host pools), different agent status:

  • RDSH-1, Status: OK, Max Sessions 10, Current Sessions: 0, Type: Host

  • RDSH-2, Status: OK, Max Sessions 10, Current Sessions: 2, Type: Host

  • RDSH-3, Status: Not Verified, Max sessions 10, Current Sessions: 0, Type: Host

  Host pool Workload = (Current Sessions / Max Sessions) * 100 or ((0 + 2) / 20) * 100 = 10%

  Please note that a host pool will always make sure that it has at least one server available, even if the workload is zero percent.

• Number of hosts to be added to the host pool per request: Specifies how many servers should be created when the workload goes above the threshold value. This setting works together with the Add servers from template when workload is above (%) setting described above. When a host pool sends a request to the template to create additional servers, the value specified here will determine the number of servers that will be created.

• Drain and power off hosts from host pool when workload is below (%): Specifies a workload threshold in percent. When the actual workload is below this value and remains there for a period specified in the Workload remains below this level field, excessive hosts will be switched to drain mode or powered off. The period of time can be selected from the drop-down list or you can type your own integer value using "weeks", "days", "hours", "minutes", or "seconds" as a unit measure. The server(s) with the least number of sessions will be switched to drain mode. As soon as all users are logged off from a server, it is unassigned from the host pool. At that point, the server becomes available to other host pools on demand.

• Remove hosts from host pool after drain and power off: Specifies if hosts should be removed from the host pool after being drained and powered off.

Tip: Servers are unassigned from the host pool only when all user sessions on that particular server are logged off. In case user sessions are still present, such as user sessions in idle, active or disconnected state, autoscaling does not log off user sessions and does not unassign the server from a host pool.

Using host pool defaults

RD Sessions Hosts assigned to a host pool have various settings that they can inherit from the host pool defaults. This makes it simpler to configure a single set of settings for all servers instead of configuring each server individually. A Site also has its own default settings (Site defaults). Moreover, an RD Session Host host pool can inherit these Site defaults. This gives you the following choices when inheriting default settings by an RD Session Host:

• Configure Site defaults and make the host pool inherit these settings. The RD Session Hosts assigned to the host pool will therefore also inherit Site defaults. This is the default scenario for a new host pool. Site defaults can be configured by navigating to Farm > <Site> > RD Session hosts and clicking Tasks > Site defaults.

• Configure default settings for a given host pool. This way you can have multiple host pools, each having its own host pool defaults (different from Site defaults). Therefore, the servers assigned to a host pool will inherit the host pool's defaults.

To configure default settings for a host pool, open the Host pool Properties dialog (Tasks > Properties), select a desired tab (except the General tab, which doesn't have any defaults) and select or clear the Inherit default settings option. If you clear the option, you can specify your own defaults. All servers that are (or will be) assigned to this host pool will inherit these settings. Note that inheritance works independently for each individual tab on the host pool properties dialog.

For information on how default settings are configured for an RD Session Host, see View and modify RD Session Host properties.

Requirements

To complete the tasks described in this section, the following requirements must be met:

• Requirements described in the "Requirements" subsection of Creating a VM template.

• Network Discovery UDP port 137 must be enabled for a domain firewall profile in the guest OS. This can be done via domain group policies or manually in the guest OS.

Manual agent installation

Normally, you will push install the necessary agent software in a source VM right from the Parallels RAS console. However, you can also install the software manually by running the Parallels RAS installer in Windows in the VM. When doing so, use the Custom installation option and select the following agent components RAS Guest Agent and RAS RD Session Host Agent to be installed in the source VM.

Create a template

To create an RD Session Host template:

1. Add one of the supported provides, as described in Add a Provider.

2. Go to Farm > Site > RD Session Hosts > Templates tab.

3. In the Tasks drop-down menu, click Add (or click the [+] icon).

4. In the dialog that opens, select a host from which you would like to create a template and click OK.

5. The Create Parallels Template Wizard opens. Each wizard page is described below in the order they appear on the screen.

6. Verify that the Agent is installed and install it manually if needed as described in Step 1: Check and install the Agent. This step only appears if an on-premises Provider is used.

7. Configure the template as described in Step 2: Configure the template.

When you create RD Session Host host pools, you can assign a template to a host pool. This can be done when you create or modify a host pool, or it can be done from the Templates tab.

To assign a template to a host pool:

1. Go to Farm > Site > RD Session Hosts > Templates tab.

2. On the Templates tab, select a template.

3. Click Tasks > Assign to host pool.

4. Select the template version in the Version dialog.

5. A dialog opens listing existing RD Session Host host pools. Host pools that already have a template assigned are not shown in this list by default. To display them, select the Show host pools with assigned template option. The template that they are currently using is displayed in the Template column.

6. Select one or more host pools and click OK.

To remove a template from a host pool or host pool:

1. Select a template and click Tasks > Remove from host pool.

2. A dialog opens listing all host pools to which this template is assigned.

3. Select the host pools to remove the template from and click OK.

Note that if a host pool has hosts created from the template that you are removing, they will be removed as well. A message is displayed where you need to confirm the removal.

You can enable and configure automatic updates for all RD Session Host Agents in a host pool.

Schedule Agent auto-upgrade

To schedule Agent auto-upgrade:

1. Go to Farm > Site > RD Session Hosts > Host pools > Properties > Auto-upgrade tab.

2. Clear the Inherit default settings options if you want to modify them for this host pool.

3. Select the Enable auto-upgrade maintenance window option. During the maintenance window, all hosts in the host pool will try to download Agent upgrades. The upgrades will be downloaded and installed as soon as all users log out of their hosts. New logons from users are prohibited (drain mode). If the users don't log off during a maintenance window, the upgrades won't be installed until the next window.

4. Specify the start date and time, duration, and recurrence settings for this event. To make this a one-time event, select Never in the Recur drop-down list.

5. (Optional) If you want to forcefully log off all users and download the upgrades at the end of a maintenance window, select the Force logoff of current sessions at the end of the maintenance window duration option.

6. (Optional) Configure a message that will be sent to users before or during a maintenance window. Click the Configure messages button and specify the message title, body, and the time period when it should be sent.

Cancel Agent auto-update

To cancel Agent auto-update:

1. Go to Farm > Site > RD Session Hosts > Host pools.

2. Select Tasks > Cancel auto-upgrade maintenance window.

A template-based RD Session Host is a clone of a virtual machine running on a hypervisor or a cloud-based provider. When you create a template, you select a preconfigured VM with the operating system and applications already installed. Individual hosts (VMs) are then created as clones of the template. The clones can be created in advance or on as-needed basis (configurable when you create a template). This functionality allows you to create and configure an RD Session Host running in a virtual machine and then create as many copies of it as you require.

To add a template-based RD Session Host to a Site:

1. Create a template as described in Creating an RD Session Host template.

2. Assign the template to a host pool as described in Assigning a template to a host pool.

3. Add individual RD Session Hosts to the host pool. Do one of the following:

   • If you want to add RD Session Hosts manually, go to the host pool properties, select the Servers tab and click Tasks > Add (or click the [+] icon). In the dialog that opens, select the number of RD Session Host you want to create and click OK.

   • If you want Parallels RAS to add RD Session Hosts automatically when certain conditions are met, configure autoscaling as described in Manage host pools (RD Session Hosts).

RD Session Host templates are designed specifically to give you the ability to replicate RD Session Hosts running in virtual machines. Hosts created from an RD Session Host template are treated by Parallels RAS almost like regular RD Session Hosts. The main difference is, you can create as many hosts from a single template as you require, thus automating RD Session Host provisioning according to your needs.

RD Session Host templates are supported on the following VDI platforms:

• Microsoft Hyper-V

• Microsoft Hyper-V Failover Cluster

• VMware VCenter

• VMware ESXi

• SC//HyperCore

• Nutanix AHV (AOS)

• Microsoft Azure

• Amazon Web Services

RD Session Host templates support Windows Server 2008 R2 up to Windows Server 2022 as a guest OS. Compared to regular RD Session Hosts, servers created from an RD Session Host template do not support earlier versions of Windows Server. The reason is, these servers run in VMs and require the RAS Guest Agent installed in them, so the guest OS requirements are limited by Windows Server versions supported by RAS Guest Agent.

Please note that the following standard RAS VDI features are not available when using RD Session Host templates:

• Pool management

• Persistent hosts

• Session management

• Publishing from a specific Template

• Some other strictly RAS VDI specific features.

For the information on how to provision RD Session Hosts created from a template, see Manage host pools (RD Session Hosts).

You can assign an RD Session Host to a different Site in your Farm if needed. Please note that this functionality is only available if you have more than one Site in your Farm.

To change the Site assignment:

1. Right-click an RD Session Host and then click Change Site in the context menu. The Change Site dialog opens.

2. Select a Site in the list and click OK. The server will be moved to the RD Session Hosts list of the target Site (Farm > <new-site-name> > RD Session Hosts).

An RD Session Host must have RAS RD Session Host Agent installed in order to publish remote applications and desktop from it. In addition to this, Remote Desktop Services (formerly Terminal Services) must also be installed.

Normally when you add an RD Session Host to a Site, the RD Session Host Agent and Remote Desktop Services are installed by default. However, if you skipped the installation (or uninstalled the agent or RDS from the server), you can check their status and take appropriate actions if needed.

To check the status of RD Session Host Agent and RDS, do the following:

1. First, check the Status column in the RD Session Hosts list. The column should display "OK". If so, the Agent is installed and functioning properly. If not, read on.

2. In addition to the description, the Status column uses a color code to indicate the agent status as follows:

   • Red — not verified

   • Orange — needs update

   • Green — verified

3. Right-click a server and click Troubleshooting > Check agent in the context menu. The Agent Information dialog opens.

4. If the agent is not installed on the server, click the Install button and follow the instructions on the screen.

After the agent installation is complete, you may need to reboot the RD Session Host. You can do it right from the Parallels RAS Console by selecting the server and clicking Tasks > Control > Reboot.

Beginning with Parallels RAS v16.5, you can create and add to a RAS Farm the following types of RD Session Hosts:

• Individual servers. These can be physical boxes or virtual machines treated as physical servers. For information on how to create these types of servers, see Adding an RD Session Host.

• Virtual machines (VMs) created from a template, which is a part of RAS Virtual Desktop Infrastructure (VDI). The main advantage of using VMs is the ability to create as many of them as you require from a single template. For information on how to create these types of servers, see Add a template-based RD Session Host.

Considering that template is a part of RAS VDI, some aspects of creating, provisioning, and managing RD Session Hosts based on a template differ from the regular RD Session Hosts (individual servers). When reading these sections, please pay attention to whether or not a particular functionality applies to RD Session Hosts based on a template.

To view the list of RD Session Hosts for the current Site:

1. In the RAS Console, navigate to Farm > <Site-name> > RD Session Hosts.

2. The available RD Session Hosts are displayed on the RD Session Hosts tab in the right pane.

You can filter the RD Session Hosts list as follows:

1. Click the magnifying glass icon, which is located on a toolbar above the list.

2. An extra row is displayed at the top of the list where you can type a string in one or more columns that will be used to filter the list.

3. For example, if you want to search for a server by its name, enter the text in the Server column. You can type the entire server name or the first few characters until a match is found. The list will be filtered as you type and only the matching server(s) will be displayed.

4. If you type a filter string in more than one column, they will be combined using the logical AND operator.

5. To remove the filter and display the complete list, click the magnifying glass icon again.

6. If you click the magnifying glass icon one more time, you'll see that the filter that you specified earlier is still there. To remove it completely, simply delete the filter string(s) from the column(s).

Viewing RD Session Host summary

In addition to the RD Session Hosts editor described above, you can also see the summary about the available RD Session Hosts. To do so:

1. In the RAS Console, select the Farm category and then select the Site node in the middle pane.

2. The available servers are displayed in the RD Session Hosts host pool in the right pane.

3. To go to the RD Session Host editor (described above), right-click a server and choose Show in the Editor.

For additional info, see Sites in the RAS Console.

Available menu options

You can perform a number of tasks on the an RD Session Host using menus. To do so, click the Tasks drop-down list and choose a desired option, or right-click a host and choose an option from the context menu.

Please note that not all menu options are available for RD Session Hosts based on a template. If an option is not available for this host type, it will be either disabled or hidden. These include:

• Assign to host pool. Host pool assignment is performed automatically for template-based hosts.

• Delete. Deleting a host (which is a VM) can only be done on the template level (the Host List dialog).

• Properties. RD Session Hosts of this type don't have individual properties. Some essential properties are inherited from Default Server Properties (see View and Modify RD Session Host Properties > Agent Settings).

• Control (logon commands). Drain mode is managed automatically by the host pool to which a template-based host belongs.

Viewing RD Session Hosts based on a specific template

To view the list of RD Session Hosts based on a specific template:

1. Go to Farm > <Site> > RD Session Hosts > Templates.

2. Select a template and click Tasks > Show servers.

Site defaults

RD Session Hosts based on a template inherit the template settings. To view the settings, note on which template an RD Session Host is based and then view properties of that template, specifically the Settings and Security tabs. For more information, see Site defaults. Note that you a template can inherit Site default settings or you can specify your own custom settings for it.

Checking the RAS Guest Agent status

A guest RD Session Hosts based on a template must have RAS Guest Agent installed and the agent must match the Parallels RAS version. The agent is installed by default when an RD Session Host is created from a template. If the RD Session Host was created using the native hypervisor tools, it may not have the agent installed in it. In such a case, the RD Session Host will be able to serve only the remote desktop. To enable it to server applications or documents, you'll need to install the agent yourself.

To check if the RAS Guest Agent is installed and up to date:

1. Go to Farm > <Site> > RD Session Hosts > RD Session Hosts.

2. Continue as described in Managing hosts, subsection "Checking the RAS Guest Agent status".

The RD Session Host template must also have the RAS RD Session Host Agent installed.

To check if the RAS RD Session Host Agent is installed and up to date:

1. Go to Farm > <Site> > RD Session Hosts > Templates.

2. Select a template in the list and then click Tasks > Troubleshooting > Check agent.

Deleting an RD Session Hosts based on a template

See Managing hosts, subsection "Deleting a host".

Managing RD Session Hosts based on a template that failed preparation

See Managing hosts, subsection "Managing hosts that failed preparation". Notice than in case of RD Session Hosts, you have to go to Farm > <Site> > RD Session Hosts > RD Session Hosts and click Tasks > Site defaults to see Site Defaults.

Recreating an RD Session Hosts based on a template

If something happens to a RD Session Hosts based on a template and it becomes unusable, you don't have to delete it and create a new one. Instead, you can recreate it keeping its name, MAC address, and other properties. This way none of the other Site settings, which may rely on a broken RD Session Host, will be affected. Another reason for recreating an RD Session Host is to apply changes made to the template (when you exit from maintenance without executing the Recreate command).

Please note that recreated RD Session Hosts can keep the the following properties:

• MAC address is kept on ESXi, vCenter, Hyper-v, Hyper-v Failover Cluster, Nutanix AHV (AOS), and SC//HyperCore.

• BIOS UUID is kept on ESXi and vCenter.

• DRS groups are kept on vCenter.

To recreate one or more guest RD Session Host:

1. In the Parallels RAS Console, navigate to Farm > <Site> > RD Session Hosts > Templates.

2. To recreate all deployed RD Session Host, click the Tasks drop-down list and choose Recreate all servers.

3. To recreate a specific host (or multiple hosts), click Tasks > Show servers. This will open the dialog which will list RD Session Hosts. Select one or more RD Session Hosts and then click the Tasks > Recreate.