Azure RDS HTML5 Web Client Unable to Access Gateway

azurerds

We have a RDS (Remote Desktop Services) deployment, and recently went through the process of installing the HTML5 web client as per the directions at:

https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-web-client-admin

Our deployment is hosted on domain A, which has an active directory instance. There is also domain B with its own active directory instance, there is a two way trust between the two.

The problem we are having is that the traditional RD Web Access works fine for all users, but when users from domain B log on to the HTML 5 web client and try to open an app they get a message "We couldn't connect to the gateway because of an error". At the same time the browser console shows the following error:

Connection(ERR): The connection generated an internal exception with disconnect code=GatewayProtocolError(52), extended code=, reason=Gateway tunnel authorization failed with error code=2147965403

During troubleshooting we’ve tried:

  • Verified that required ports are opened.
  • Disabling all firewalls between gateways, brokers, and session hosts – same error.
  • Re-applied the publicly trusted cert to the HTML5 client (via Import-RDWebClientBrokerCert) – same error
  • Verified that the proper cert was bound to the HTML5 client – same error.
  • Enabled NTLM by setting the GPO: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network Security: Restrict NTLM: NTLM Authentication in this domain. To “Disable” (within same domain as RDP) – same error.
  • Ran regsvr32 wksprtps.dll (dll was already registered, but tried it anyway)
  • Verified that the required KB4025334 from July of last year was installed or not necessary (OS was up to date)

Any ideas on other areas we can look at?

Best Answer

Had the issue today and without seeing a solution online, I thought it appropriate that I post what I did to resolve.

The issue for me was on the rds gateway. IN the RD Gateway Manager, the Resource Authorization Polies needed to be updated. While we had a policy that enabled Domain Users, it was restricted to Domain Computers. This worked well when using mstsc however with the web client the IP address of the client is passed and was not valid.

Changing the Network Resource to "Allow users to connect to any network resource" resolved the issue.

We found the issue in the TerminalServices - Gateway event logs

Related Topic