Skip to content

Commit d4c98f1

Browse files
Deland-HanDeland-Han
committed
add file
1 parent 2792f7c commit d4c98f1

2 files changed

Lines changed: 173 additions & 0 deletions

File tree

‎support/windows-server/remote/unable-to-install-rds-deployment-or-add-rds-roles.md‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
---
2+
title: Unable to install RDS deployment or add RDS roles
3+
description: Helps troubleshoot issues related to the installation of RDS roles.
4+
ms.date: 04/14/2025
5+
manager: dcscontentpm
6+
audience: itpro
7+
ms.topic: troubleshooting
8+
ms.reviewer: warrenw
9+
ms.custom:
10+
- sap:remote desktop services and terminal services\deployment,configuration,and management of remote desktop services infrastructure
11+
- pcy:WinComm User Experience
12+
---
13+
# Unable to install RDS deployment or add RDS roles
14+
15+
This article helps troubleshoot issues related to the installation of Remote Desktop Services (RDS) roles. The issue occurs either when deploying a brand new RDS deployment or when manually adding roles to a system or to a currently existing RDS deployment.
16+
17+
There are several possible causes, as well as different possible behaviors and error messages. This article addresses some of those common reasons on this article.
18+
19+
## Verify whether TLS 1.0 is disabled on the system
20+
21+
> [!NOTE]
22+
> This specific issue applies only on Windows versions until Windows Server 2016. From Windows Server 2019 and later versions, it is possible for the RD Connection Broker role to communicate with the WID using higher TLS versions, such as TLS 1.2.
23+
24+
### Symptoms
25+
26+
Assume that you use the inbox Windows Internal Database (WID) in Windows Server. If you disable Transport Layer Security (TLS) 1.0 when you configure security settings, you experience the following issues:
27+
28+
* The Remote Desktop Connection Broker role can't be installed.
29+
* The RDS service fails.
30+
* An existing RDS deployment that uses Remote Desktop Connection Broker and WID fails.
31+
* The Remote Desktop Management service (RDMS) does not start.
32+
* You receive the following error message when you try to start the RDMS:
33+
34+
> The Remote Desktop Management service on Local Computer started and then stopped. Some services stop automatically if they are not in use by other services or programs.
35+
36+
### Cause
37+
38+
This behavior is expected because of the current dependencies between RDS and WID. RDMS and Connection Broker depend on TLS 1.0 to authenticate with the database. WID doesn't currently support TLS 1.2. So, disabling TLS 1.0 breaks this communication.
39+
40+
> [!NOTE]
41+
> RDS deployments that use Connection Broker must establish an encrypted channel to WID by using one of the following methods:
42+
>
43+
> * TLS
44+
> * SSL 3.0
45+
> * FIPS
46+
47+
### Resolution
48+
49+
To fix this issue, use one of the following methods:
50+
51+
* Don't disable TLS 1.0 on a single Connection Broker deployment.
52+
* Configure a high availability Connection Broker deployment that uses dedicated SQL Server.
53+
* Upgrade the computers that run the RDS services to Windows Server 2019.
54+
55+
> [!NOTE]
56+
> Microsoft has released [TLS 1.2 support for Microsoft SQL Server](../../sql/database-engine/connect/tls-1-2-support-microsoft-sql-server.md) to enable SQL Server communication to use TLS 1.2.
57+
58+
## Connection Broker role fails to install due to removed permissions to service accounts to "Logon as a service"
59+
60+
When you try to install the RD Connection Broker role, the installation fails with the following error:
61+
62+
> Unable to install RD Connection Broker role service on server XXXXX.XXXXXX.XXX – Failed.
63+
64+
This is commonly due to the fact the object "NT SERVICE\ALL SERVICES" has been removed from the "Logon as a service" security policy, or there is another policy denying the "Logon as a service" privilege to the according service account.
65+
66+
You may also see the following error event on the "System" event log:
67+
68+
> Log Name: System
69+
> Source: Service Control Manager
70+
> Date: mm/dd/yyyy hh:mm:ss pp
71+
> Event ID: 7041
72+
> Task Category: None
73+
> Level: Error
74+
> Keywords: Classic
75+
> User: N/A
76+
> Computer: MyServer.com
77+
> Description:
78+
> The MSSQL$MICROSOFT##WID service was unable to log on as NT SERVICE\MSSQL$MICROSOFT##WID with the currently configured password due to the following error:
79+
> Logon failure: the user has not been granted the requested logon type at this computer.
80+
>
81+
> Service: MSSQL$MICROSOFT##WID
82+
> Domain and account: NT SERVICE\MSSQL$MICROSOFT##WID
83+
>
84+
> This service account does not have the required user right "Log on as a service."
85+
>
86+
> User Action
87+
>
88+
> Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster.
89+
>
90+
> If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.
91+
92+
### Resolution
93+
94+
Add the "NT SERVICE\ALL SERVICES" group back to the "Log on as a service" security policy. Also confirm that this group, or another service account object (e.g. Network service), is not part of the "Deny logon as a service" security policy.
95+
96+
If it still fails after the above conditions are met, try adding the service account "NT SERVICE\MSSQL$MICROSOFT##WID" to the "Logon as a service" security policy.
97+
98+
## Issues related to WinRM
99+
100+
Server manager, RDMS UI (Remote Desktop Management Services User Interface) and RDS PowerShell cmdlets heavily rely on WinRM to operate.
101+
102+
If the issue is related to Server Manager or RDMS UI not operating properly, we might eventually be facing an WinRM related issue.
103+
104+
* A common reason is having a proxy set on the system's WinHTTP interface. This can be checked by running the following command on an elevated cmd prompt:
105+
106+
```console
107+
netsh winhttp show proxy
108+
```
109+
110+
If a proxy is configured, you can remove it by using the following command:
111+
112+
```console
113+
netsh wintthp reset proxy
114+
```
115+
116+
Alternatively, set exclusions using the following command (We recommend removing proxy first for testing purposes. Use the above steps to confirm the proxy is indeed the cause of the issue):
117+
118+
For example:
119+
120+
```console
121+
set proxy proxy-server="http=<proxy>;https=<sproxy>:88" bypass-list="\*.contoso.com"
122+
```
123+
124+
* We can also check if the system has any configured WinRM related GPOs, which can also be a good test to temporarily remove them for testing purposes:
125+
126+
**Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Remote Management (WinRM)**
127+
128+
* Finally, we can look in the event viewer for potential WinRM problematic events, under:
129+
130+
**Applications and Services Logs** > **Microsoft** > **Windows** > **Windows Remote Management** > **Operational**
131+
132+
## Failed to add RD Session Host to a session collection or to create a new collection
133+
134+
Adding a RD Session Host to a collection might fail. You might receive different error messages. Usually the error message starts with "Unable to add the RD session Host to the collection…" followed by a more descriptive sentence of the underlying reason.
135+
136+
This behavior can be caused by different reasons. Here are some possible causes:
137+
138+
* WinRM related reasons, as described in to previous sections in this article.
139+
* The RD Session Host has existing GPOs configured, especially RDS-related ones, which prevent the deployment from overriding the desired settings. To resolve this, temporarily remove the GPOs, add the RD Session Host to the deployment or collection, then reapply the desired GPOs.
140+
141+
The error message might vary. Commonly the error message can be "Unable to configure the RD Session Host Server \<ServerName\>. Invalid Operation."
142+
143+
> [!NOTE]
144+
> Common GPOS that might cause this behaviour, are the following listed below, although we recommend removing any RDS related GPO and test:
145+
>
146+
> * Require user authentication for remote connections by using Network Level Authentication
147+
> * Set client connection encryption level
148+
> * Use the specified Remote Desktop license servers
149+
>
150+
> Paths to the GPOs mentioned above:
151+
>
152+
> * **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Remote Desktop Services** > **Security**
153+
> * **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Remote Desktop Services** > **Remote Desktop Session Host** > **Licensing**
154+
155+
* If we receive the error message that contains "Some or all identity references could not be translated" while adding a RD Session Host to a collection, this typically indicates issues with resolving the SID(s) of groups that are part of the permission list of the Session Collection.
156+
157+
There can be various reasons for issues resolving the SID. It is advisable to contact Microsoft Support for a detailed analysis of the situation. To confirm this issue (or temporarily work around it), we can test by gradually removing groups of users from the Session Collection permission list until we identify the group(s) causing the behavior.
158+
159+
* The error message "Unable to connect to the server by using Windows Powershell Remoting" can be due to different reasons, but a possible cause is that the Environment Variables have been changed or are incorrectly configured.
160+
161+
To fix this, run the command *sysdm.cpl*, opening **System Properties** menu > **Advance** tab > **Environment Variables**
162+
163+
Under **System variables**, select **Path** > "Edit".
164+
165+
You may have several environment variables, this can vary according to each system, but make sure the following ones are present and correctly configured:
166+
167+
* *%SystemRoot%\\system32*
168+
* *%SystemRoot%*
169+
* *%SystemRoot%\\system32\\Wbem*
170+
* *%SYSTEMROOT%\\System32\\WindowsPowerShell\\v1.0\\*
171+
* *%SYSTEMROOT%\\System32\\OpenSSH\\*

‎support/windows-server/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2087,6 +2087,8 @@ items:
20872087
href: ./remote/terminal-server-startup-connection-application.md
20882088
- name: The connection settings stored in the Default.rdp file
20892089
href: ./remote/remote-desktop-protocol-settings.md
2090+
- name: Unable to install RDS deployment or add RDS roles
2091+
href: remote/unable-to-install-rds-deployment-or-add-rds-roles.md
20902092
- name: Updates for Remote Desktop Services
20912093
href: ./remote/remote-desktop-services-updates.md
20922094
- name: Application compatibility

0 commit comments

Comments
 (0)