Setting Up Remote Desktop Services on Windows Server 2022: A Field Guide
Windows Server

Setting Up Remote Desktop Services on Windows Server 2022: A Field Guide

3 min read

Remote Desktop Services remains the fastest way to give a distributed team one consistent, centrally managed working environment. A single well-sized host on Windows Server 2022 Standard comfortably serves 20 to 40 office users. Here is the deployment order that works, with the traps marked.

Before you start: sizing and licenses

Plan roughly 2 vCPU equivalents per 8 concurrent office users, 3 to 4 GB RAM per active session for browser-heavy work, and fast SSD storage: RDS performance dies on disk latency first. On the licensing side you need the server license, a base CAL per user or device, and an RDS CAL per user or device on top, for example the RDS 5 User CAL pack or the Device CAL variant for shared endpoints. The 120-day grace period is a rollout window, not a budget strategy.

Step 1: install the roles

Use Server Manager, Add Roles, and pick Remote Desktop Services installation, not the generic role checklist. For a single-server deployment choose the Quick Start with Session-based desktop deployment. The wizard installs RD Session Host, RD Connection Broker and RD Web Access together and reboots once.

Step 2: create the session collection

A collection groups session hosts and holds the user-facing settings. Create one collection per usage profile (for example Office and Warehouse) rather than one per department; fewer collections mean simpler group policy. Assign access via an Active Directory group, never individual accounts.

Step 3: set the licensing mode immediately

This is the step everyone postpones and later regrets. In Server Manager, RDS Overview, Deployment Properties:

  1. Point the deployment at your RD Licensing server (on small deployments, the same box).
  2. Set the mode: Per User or Per Device, matching the CAL type you bought.
  3. Install the RDS CALs on the licensing server.

A mismatch between mode and CAL type is the single most common finding in RDS reviews.

Step 4: replace the self-signed certificate

Users should not train themselves to click through certificate warnings. Issue a certificate from your internal CA or use a public one for the RD Web and Broker endpoints. It takes twenty minutes and permanently upgrades both security and user trust.

Step 5: publish apps or desktops

Full desktops suit teams living in many applications. RemoteApp suits one line-of-business program: users see just that window, and the server hides everything else. Both come from the same collection; you can mix.

Hardening quick list

  • Enforce Network Level Authentication (default on 2022, verify it stayed on).
  • Do not expose 3389 to the internet; put RD Gateway or a VPN in front.
  • Set session limits: disconnect after 4 hours idle, end disconnected sessions after 24.
  • Enable drive and clipboard redirection only where the workflow needs it.

A correctly licensed, certificate-clean RDS host is boring to operate, and boring is the goal. If you are sizing CALs for a specific headcount, our RDS CAL guide on this blog walks through the math, or send us the numbers and we will do it for you.

Back to all articles