Compatibility issue upgrading to Windows Server 2012 (Remote Desktop Roles need uninstalled?)

You're confusing remote desktop for administration with remote desktop services. Remote desktop for administration is for remotely managing a server via RDP. Remote Desktop Services is for remotely working from a server session as if the remote session were your workstation and running applications within that session via RDP. The conceptual aspects may be blurry but the licensing is certainly perfectly clear. In addition, remote desktop for administration is limited to 2 concurrent sessions and no additional licensing is required. Remote Desktop Services requires RDS CAL's and is limited to the number of RDS CAL's that you've purchased (this isn't a technical limitation, it's a licensing/legal limitation).

They may seem like the same thing and from a technical perspective they are (except for the concurrent session differences) but from a legal and licensing perspective they are two wholly independent things.

If you're running applications on the server while using remote desktop for administration you're most likely in violation of the EULA of both the server and the application.

This is very similar to what we do. We have a single TS Gateway that all our clients enter through. This has connection and resource policies that control which user groups can log on to which servers.

Each company has their own self-contained terminal server. Most companies can only log on to the one TS, but for one particularly large client, they have two. We don't do any clustering of them, just half the users connect to TS1 and the other half connect to TS2.

All the servers sit on the same network segment, and we have very strict ACLs to define who can go where on the network (i.e. nobody can really go anywhere). Our GPO for the RDS servers also greatly restricts where they can go on the server itself.

The biggest issue that we have with this setup is the automated deployment of servers for new clients. Most of the process can be automated (we use ESXi and vSphere, which has powershell integration. Same as Hyper-V does), but I haven't yet found out how to automate the modification of TS Gateway policies.

We also have one very large client who uses our hosted terminal servers. Because I didn't want to bother with managing all their password resets and new accounts myself, we gave them delegation rights over their own OU on the domain. When they started to out-grow that, for political reasons, we gave them their own domain under our forest. That's all worked pretty well so far as well, except you can't use the User must change their password on next logon as this is incompatible with TS Gateway. Same deal when their password expires, they can't log on and someone needs to reset their password manually.