It turns out that much of the configuration data for RDSH is stored in the Win32_TSGeneralSetting class in WMI in the root\cimv2\TerminalServices namespace. The configured certificate for a given connection is referenced by the Thumbprint value of that certificate on a property called SSLCertificateSHA1Hash.
UPDATE: Here's a generalized Powershell solution that grabs and sets the thumbprint of the first SSL cert in the computer's personal store. If your system has multiple certs, you should add a -Filter option to the gci command to make sure you reference the correct cert. I've left my original answer intact below this for reference.
# get a reference to the config instance
$tsgs = gwmi -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'"
# grab the thumbprint of the first SSL cert in the computer store
$thumb = (gci -path cert:/LocalMachine/My | select -first 1).Thumbprint
# set the new thumbprint value
swmi -path $tsgs.__path -argument @{SSLCertificateSHA1Hash="$thumb"}
In order to get the thumbprint value
- Open the properties dialog for your certificate and select the Details tab
- Scroll down to the Thumbprint field and copy the space delimited hex string into something like Notepad
- Remove all the spaces from the string. You'll also want to watch out for and remove a non-ascii character that sometimes gets copied just before the first character in the string. It's not visible in Notepad.
- This is the value you need to set in WMI. It should look something like this: 1ea1fd5b25b8c327be2c4e4852263efdb4d16af4.
Now that you have the thumbprint value, here's a one-liner you can use to set the value using wmic:
wmic /namespace:\\root\cimv2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="THUMBPRINT"
Or if PowerShell is your thing, you can use this instead:
$path = (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -Filter "TerminalName='RDP-tcp'").__path
Set-WmiInstance -Path $path -argument @{SSLCertificateSHA1Hash="THUMBPRINT"}
Note: the certificate must be in the 'Personal' Certificate Store for the Computer account.
Session-based
Session-based refers to Microsoft’s implementation of session virtualisation, isolation which is what was previously called Terminal Services.
- Each user runs on a server operating system (OS) desktop that is semi-isolated from the other user.
- Each session shares the same OS kernel.
- A RDS server is normally a locked down secured environment because configuration changes can affect all users.
Virtual machine-based
Virtual machine-based refers to full x86 hardware virtualisation where:
- Each virtual machine runs separate virtualised hardware that is then interpreted and mapped to physical hardware. This runs on one or more Hyper-V servers.
- Each client connects to a separate operating system environment running a client OS like Windows 8.
- Client Oss are normally secured the same as a regular Management Operating Environment (MOE) base changes don’t affect other users because they run in a separate OS instance.
The different between Pooled and Personal for Virtual machine-based is that:
- Pooled shares VMs between users. When a user logs off that VM is available for another person to use or can be rebuilt. This is good for regular users that use a lot of the same applications. http://technet.microsoft.com/en-us/library/dd883265(v=ws.10).aspx
- A Personal VM is only used for one user. This is good for power users that require specific applications that might be manually installed. http://technet.microsoft.com/en-us/library/dd883277(v=ws.10).aspx
This link and it’s sub-links give some examples: http://technet.microsoft.com/en-us/library/hh831447.aspx
Also see:
Hope that helps.
Best Answer
The difference is how the options for installing RDS is presented to you and how they are actually going to be installed.