Server 2012 Hyper-V + RDP + RemoteFX = a Delicious "Sangwich" of Cheap VDI

Oh man. Microsoft has done well on this; VDI/RDP/HyperV/RemoteFX have come together very nicely in 2012. The incremental improvements over the last 4 or so years to RDP, Hyper-V, and RemoteFX have made a great platform for cost effective VDI. This article will outline setting this entire environment up on one Server 2012 Datacenter box, but this could be scaled to as many machines as you need. (Add VMM for management in a large deployment) In this article I'll be walking through a basic setup of a Hyper-V Virtualization Host, Connection Broker, Web Access, a pool, the whole 9.

Assumptions:

• You have at least one 2012 Hyper-V host setup.
• You've got at least one 2012 server ready to go as the other roles. This can be a VM. 
• You've got a sangwich. You'll need one, this is a bit of a lengthy install. 

Starting in seemingly reverse order will make this while thing easier; you'll see why.

Create an Template/Image to use For VDI

BTW, more template info here.

1. Create a Virtual Desktop template by making a new VM with (generally) default settings. Insert the ISO and install the OS and make sure your product key is applicable to be in a your target VDI environment  (i.e. MAK with a SA or KMS as applicable) 
2. After installing the OS, execute sysprep or something similar. On windows 8, that will be located under %SystemRoot%\system32\sysprep\sysprep.exe. Make sure you generalize and restore to OOB Experience; select shutdown when complete. 

Install Remote Desktop Services Components

1. Prior to starting the RDS installation, you need to add all servers involved in your deployment to server manager to enable them as options during deployment. To do so, click "Add Servers To Manage" from the start screen of server manager and add any servers that will be part of the setup. (Hyper-V host, RDS Connection Broker, Session Host, etc.) 
2. After adding the server(s) in question, start the RDS deployment by clicking "Manage->Add Roles and Features" from within server manager. 
3. Proceed to the "Installation Type" and select "Remote Desktop Services installation" and click "Next".  

4. On "Deployment Type" select "Standard deployment" and click "Next". Unless you've been through this before, I don't recommend Quick Start as it skips some things you should know. 
5. On "Deployment Scenario" we'll be going through "Virtual machine-based desktop deployment". Select it and click "Next". Note that both options here have their uses, we're just covering VDI because it's a newer option. For more information on the differences, see this blog post by Yung Chou. 

6. Based on our choices, it should notify you that RD Connection Broker, RD Web Access, and RD Virtualization Host will be installed. Review and click "Next". 
7. You will be prompted to select a machine from your pool to host the RD Connection Broker role. Select the host(s) you would like for this role, move them to the right plane, and then click "Next". The Connection Broker distributes load across multiple hosts (if applicable) and maintains session information to ensure users are directed to the proper session or virtual desktop. For more information, see this TechNet article. This role can be hosted by a virtual machine. 
8. Now you'll be prompted to select the RD Web Access server. In smaller deployments it is very common to place this on the same server as the RD Connection Broker. In larger environments you'll need to take external connection needs and security into account. Either click "Install the RD Web Access role service on the RD Connection Broker server" or select the server(s) you do want and click "Next". This role can also be hosted by a virtual machine. 
9. Time to select virtualization host(s). This role cannot be hosted by a virtual machine for obvious reasons. Select the machne(s), move them over, and click "Next". 
10. You'll be presented with the confirmation screen; review the information and click "Deploy" to create the whole setup. 
11. The progress of each role installation will be displayed; do not be suprised if this takes some time. 

Setup a VDI Collection

1. In server manager, click "Remote Desktop Services" and then click "3> Create Virtual Desktop Collections" 

2. Click "Next" to bypass the before you begin section and then give your collection an appropriate name and click "Next" again. 
3. Select the type of collection you want, Pooled virtual desktops or Personal virtual desktops. There is a lot that goes into this decision, but as a rule of thumb you can think of it like this: Pooled virtual desktops = many (users) to one relationship and Personal virtual desktops=one to one relationship. For my lab I'll be doing Personal virtual desktops, so please note that the options listed after this may be slightly different should you want Pooled. Unless you know you want otherwise leave "Automatically create and manage virtual desktops" checked and click "Next".
4. When prompted with "Virtual Desktop Template" select the template we created in the first step and click "Next". 
5. (This step unnecessary for pooled desktops) In most cases, you'll want to leave "Enable automatic user assignment" selected because that will give the requesting user access to a newly provisioned VD. If you desire, select "Add the user account to the local administrators group on the virtual desktop" and click "Next". 

6. For "Virtual Desktop Settings" you should provide your Sysprep answer file; this will contain all the provisioning settings for your company. Since this is a lab setup in my case, I'll be selecting "Provide unattended installation settings". Click "Next".
7. You need to know where you want to place automatically created VDI objects in Active Directory. After making that determination you'll need to paste in the path to the OU. Then, we'll need to generate a powershell script and execute it on a machine that has the Active Directory management tools installed on it. First things first, navigate to a machine with the Active Directory management tools installed and logon as an account with appropriate domain privs. On that machine:
8. Open Active Directory Administrative Center and navigate to where you would like the VDI machines go to; create the OU if necessary and double click to go into it. Select the navigation plane (next to the arrow keys on the top) and it will give the DN. Copy and paste this DN to specify in setup. 
9. Switch back to the RDS server. Set the time zone and then select "Specify the distinguished name of the organizational unit" and paste in our DN from the other server; DO NOT click Next yet. 
10. After pasting the DN in, click the "Generate script" at the bottom of the window and copy all the contents of the script.

11. Switch back to the AD server and open notepad. Copy the script into notepad and save it to a temporary location, i.e. C:\temp\Grant-RDSRights.ps1.
12. (Still on AD server) Open Powershell as an administrator. If needed, execute "Set-ExecutionPolicy unrestricted" to allow script execution. 
13. (Still on AD server) Execute the script you just saved. If your rights are correct you will get a success message. 

14. Switch back to the RDS server and click "Next". If it doesn't work you may need to wait for the permissions to replicate. BUG WARNING: Ensure you do not have any "." characters in your DN. (I.E. in you OU names) If you do, this will not work. You will get the message "The RD Connection Broker server does not have access to add the virtual desktops to the Active Directory domain. Configure access by using the Active Directory page of Deployment Properties." despite the fact that permissions are in fact correct. (I wish I could bill someone for time wasted figuring that out) 
15. Select the Active Directory Group, # of initial virtual desktops, the machine prefix, and the machine suffix. I recommend making one AD group per collection to accurately track who has access to what. As for a machine prefix/suffix, pick something that will work for your organization. I use VDI- for a prefix. Click "Next". 
16. The "Virtual Desktop Allocation" screen will come up and allow you to distribute your VDI machines across multiple hosts if desired. Distribute accordingly and click "Next". 
17. For "Virtual Desktop Storage" select what type of storage you would like to utilize for these VDI machines. You have all your standard options here, including Cluster Shared Volumes. For more on CSVs, check this out. Select your desired disk location and hit "Next". 
18. The confirmation screen will come up; use this to review your settings and click "Create". 
19. This may take awhile depending on your disk configuration and it may even report to the window that it's not responding. Don't worry, it'll complete eventually. 

That does it! You've now got your stable of virtual machines ready to dole out to deserving employees. If you're particularly astute you will be able to convince management that there is a monthly cost for each desktop payable to your bank account.

Managing Your Collection

Adding a Desktop

1. Open Server Manager either on the RDS server or a machine with that server registered in its server manager. 
2. Click "Remote Desktop Services"
3. Under "Collections", click your collection name. 
4. Under "Virtual Desktops" on the right, click "Tasks->Add Virtual Desktop"
5. Specify how many virtual desktops you would like to add. 
6. Specify on which server you would like to add them.
7. Click "Create"
8. You will be notified when the creation request is complete. 

Assigning a Desktop

1. Open Server Manager either on the RDS server or a machine with that server registered in its server manager. 
2. Click "Remote Desktop Services"
3. Under "Collections", click your collection name. 
4. Right click on the VDI machine you would to assign and select "Assign Virtual Desktop". 
5. Specify a user to assign to and click "Assign". Note this user must be in the group you specified as the user group for this collection above. 

Configuring Licensing

This is a topic for a whole other article, but for now have a look a this Technet article and this one as well. 

Accessing Your Collection

There is enough here for another article, but to get you started: 

1. Using IE (preferably) navigate to https://your.rdweb.server/RDWeb 
2. You'll probably get a cert warning; you can fix that later by installing the proper web cert on your IIS server. 
3. Log in with your assigned user and double click on the collection you created. 

4. Enjoy your fresh install of Dos 5.0. (I'm assuming that's what you are using) 

Next up, RemoteFX. Update: RemoteFX Article here.

Quick Hyper-V VM Templates

Here's a quick guide on how to clone Server 2012 machines in Hyper-V:

Assumptions:  

• You've decided on a standard for you VM folder structure. I won't go into detail in the steps, but if you haven't I'll make a recommendation here. This is how I do it: 
• {Drive}:\VM\VMName\Virtual Hard Disks
• {Drive}:\VM\VMName\Virtual Machines
• You know the basics of VM creation, etc. Perhaps I'll cover that stuff in another article. :)
• You're making a template server 2012, which comes with sysprep. If you're doing another MSFT OS, you should DL and leave sysprep on the image before you shut it down. If it's Linux don't worry about it.

Make the Template

Note: Do not take any snapshots of the template machine because our simple copy method won't work with snaps. If you must have them, you'll need to use the Hyper-V export functionality.

1. Setup a new Hyper-V VM from scratch. The defaults on hardware allocation should be fine unless you're templating an older OS that uses a SMP or Uni processor kernel; in that case give it one or multiple CPUs as you desire. Set the boot disk size to your standard size now and keep it thin provisioned. (you can expand after building if needed) I recommend 60GB or more for newer versions of Windows server. After a couple years that SXS folder will get pretty big.  
2. When naming the machine, pick something meaningful like "_Template_Server_Datacenter_2012_NoGUI" or "ZZZ_Template_CentOS_6_3" or "_Template_OS/2_3_0_Warp_with_emulated_MCA"
3. After doing basic setup, patch the machine up as much as possible.
4. If you want to install/configure anything else on this template so that it will be present on any machine, do so now.
5. (Windows Only)Navigate to the sysprep folder. (c:\windows\system32\sysprep on 2012) and execute sysprep.exe
6. (Windows Only)On the sysprep screen, select "Enter System Out-of-Box Experience (OOBE)" (that's a mouthful) and check "Generalize" then change the "Shutdown Options" to "Shutdown" and click "OK". Sysprep will do the work and then shut down the server.





7. Document the admin password & shut it down. 

How to Use the Template

1. Make a new folder for your VM per your standards.(named appropriately, etc.)
2. Copy the vhdx (or vhd) to your new folder. 
3. In the HyperV manager create a new VM (named the same as you did in step 1) and spec the hardware appropriately but stop when you get to the disk. 





4. Specify the disk you just copied over from the template and finish the wizard.
5. Fire up the new VM
6. (Windows Only) Complete the "OOBE" including entering a product key and a new admin password.

You did it! Depending on how often you use the template it will eventually make sense to fire up the template as a vm, customize it, patch it, and re-sysprep it. Note that according to this, the SID is generated upon reboot, so this template should provide a unique SID every time. 

Setup Share Nothing Hyper-V Live Migration: Step-by-Step

Forward

Share nothing live migration in 2012 is pretty cool; it allows you to move a running VM from one Hyper-V host to the other with NO elements shared between the two prior to the move. For more information about the feature, see:

Microsoft: Live Migration Description
Aidan Finn: Live Migration Demo

How-To

Setup Constrained Delegation

First we need to setup constrained delegation so we don't run into permissions issues during this operation. For more information regarding constrained delegation, see Matthijs Seldam's description and this Technet description. 

Perform the following for each Hyper-V host in your environment: 

1. Find the computer object in Active Directory Administrative Center (preferably) or AD Users and Computers
2. Drill into the properties and locate the "Delegation" location/tab
3. Select "Trust this computer for delegation to specified services only" and "Use Kerberos Only"
4. (Repeat for EVERY Hyper-V host you intend to use other than the host you are editing) Click "Add" and type the machine name for the other Hyper-V host in question. Click "OK". 
5. Select the following: (CTRL Click for multiple targets)

1. Microsoft Virtual System Migration Service/COMPUTER
2. Microsoft Virtual System Migration Service/COMPUTER.FQDN
3. cifs/COMPUTER
4. cifs/COMPUTER.FQDN
6. (Optional if using file servers for ISOs or VHD storage) For each file server repeat step 4 and then 5 adding ONLY the cifs services
7. Click "OK" to save & close the properties of the host. Ensure you repeat step 4&5 for each Hyper-V host. 

Setup Hyper-V

Important: repeat this process for each Hyper-V host.

1. In the Hyper-V manager, open the properties of the host you want to edit. 
2. Select "Live Migrations" on the left. 
3. On the Live Migrations property page, Check "Enable incoming and outgoing live migrations". Under Authentication protocol, select "Use Kerberos", under Incoming Live Migrations select "Use these IP addresses for live migration" and then add each IP address on this host you would like to use for migrations. More IPs=more available bandwidth. 
4. Click "OK" to accept changes and close the properties. Make sure to repeat these steps for each host.  

Move that thing!

1. In Hyper-V manager, right click the guest you want to migrate and select "Move"
2. Click "Next" on the Before you Begin page. 
3. Keep "Move the virtual machine" selected and click "Next"
4. Specify the name of the destination Hyper-V server and click "Next"
5. Keep "Move the virtual machine's data to a single location" and click "Next"
6. Select the destination folder on the target server and click "Next". 
7. At this point the wizard will present you with any other decisions that need be made concerning the move; one common one is which HyperV Switch should be used on the target host
8. Click "Finish"

It should migrate; (if not see below) the guest migration will trigger after the disk has copied over. Migration time will depend  on your disk read performance reading on the former host, writing perf on the target host, and network bandwidth. 

OH NO!

So let's say you're migrating between hosts with differing processors; they could even be the same brand. In my case, for example, I am migrating between a "Core 2 Quad" era Xeon and an "Ivy Bridge" Xeon. If the differences are substantial enough the machine won't move because the features exposed to the VM are missing on one of the platforms. Unfortunately you'll have to power down the guest to perform this fix, but it's a one time deal so next time the live migration will work. Lets do it: 

1. Power down the guest. 
2. Open the settings and expand the CPU specification
3. Under "Compatibility" select "Migrate to a physical computer with a different processor version"
4. Hit "OK" and start the guest back up. Live migration should now work. 

Microsoft: Hyper-V Processor Compatibility Mode

A Note on Performance: 

While the live migration performs well, the weakest link in your chain will be the speed things move at. Take this example: 

Read from: 4x 7200RPM SATA in RAID 10 

Write To: 6x 7200RPM SATA in RAID 5

LAN: 3x 1GB Full-Duplex w/Jumbo Frames

It does seem to automatically use SMB 3.0 Multi-Channel, but I am having a bit of problem scaling performance. While the screenshot above is held back by the source read speed, I didn't realize much more performance reading from the RAID 5 array, which has very good read speeds, to a different SSD-based RAID 10 array, which has crazy write speeds. I'll post any additional performance info I find. 

Server 2012 Fixes HyperV VM Import Process

When copying VHD files from one machine to another or re-creating a VM, Windows 2008r2 and 2008 required you to manually grant rights to the VM Specific SID after import to successfully start the VM. The import process wouldn't stamp the copied files with the proper machine ACLs resulting in a "General Access Denied" error. (fix here) Server 2012 seems to have fixed that problem. When importing a HyperV guest to 2012, the correct rights are automatically applied. This is a welcome time-saving fix and thus far I'm very impressed with the Hyper-V improvements in 2012. More to come on that... this is obviously small relative to the major functionality changes, but I'm happy they paid attention to the details as well.

Hyper-V, HyperV, HyperADD, whatever

So, after the Microsoft "Heroes Happen Here" launch event, I'm playing around with my copies of software. I've got all new hardware for a dedicated HyperV machine as my main lab setup and I'm experimenting with setting up a new infrastructure with PKI, IPSec, AD Services, Exchange, etc.

Here are some Hyper-V specific notes:

- Emulated hosts are SLOW. Holy cow! I can't believe how slow hosts are on this platform before installing the Integration Services (VMware addons equiv.) It is BY FAR slower than VMWare ESX, VMWare Server, or Virtual Server 2005R2 without the addons. After installation the performance is great, but it took me hours to get a 2003 host setup and patched before that installation, since the minimum requirements are somewhat steep for the guest OS to support the IS software. This is disappointing.

- Can't boot from emulated SCSI, only emulated IDE. I have links about this, I'll post 'em later.

- Most annoying "quirk" sofar: When you create a fixed size disk, which is what I prefer to do for performance reasons, all related activity on that set of drives STOPS. Guests that rely on that drive set will nearly lock up until the completion of the disk is completed. This is byfar the most annoying thing I've seen sofar. It's not a low performance I/O setup I've got here; An adaptec 3405 SAS/SATA RAID card with 4x WD 5000KCS drives in a RAID 5EE array. I realize it's not enterprise class, but it should be well enough to do two things at once. The creation routine for the fixed disk is far to agressive with I/O in my opinion.

This whole post is a touch light on details. I'll add more later.

Edit: Add..

Another annoying quirk; Since the addons that shipped with Win2k8 were a beta, the RC0 addons are not fully compatible. Because of that, they don't work until you manually update them with this update: http://www.microsoft.com/downloads/details.aspx?FamilyId=DDD94DDA-9D31-4E6D-88A0-1939DE3E9898&displaylang=en