Remote Desktop Connection - The identify of the the remote computer cannot be verified.

When you try to "remote desktop" to a RDS server without going through the RDCB (Connection Broker), you might get the following if your RDS server does not have a trusted certificate.  By the way, you might have to do a mstsc.exe /admin to initiate a connection..

 

This is because the certificate used by the RDP-Licenser is not a trusted certificate by a CA.  It could be a self-signed certificate.  To check the thumbprint of the cert which is being used for RDP session, follow this:

• Bring up Local Machine Certificate Store.  CertLM.msc (Windows Server 2012) or use MMC and Add the Certificate Snapin.
• Go to "Remote Desktop" store and you should see the certificate there. 
• Mark down the Thumbprint and check if it matches the thumbprint in the WMIC 
• In an elevated command prompt, do a "Wbemtest"
• Connect to Namespace "root\cimv2\terminalservices"
• Click on "Enum Classes", select "Recursive" and click OK
• Scroll down to Win32_TSGeneralSettings and double click it.
• Click on the "Instances" button on the right 
• Scroll down to "SSLCertificateSHA1Hash" and double click on it.
• You will be able to see the Thumbprint of the cert. See if that matches the one that you have marked down just now.

So, to use a trusted certificate by a CA.  You will have to import a cert into the Personal Store and change the thumbprint of WMI instance.

• If you are using an SSL cert from 3rd party CA, make sure you import into the personal store with a private key.  You will see a little pad lock on the icon of the cert.
• Once imported, find out what the thumbprint is for that cert.
• http://blogs.technet.com/b/askperf/archive/2014/05/28/listener-certificate-configurations-in-windows-server-2012-2012-r2.aspx
• Update the WMI with this
• wmic /namespace:\\root\CIMV2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="<<your_cert_thumbprint>>"
• If you get an error like this, most likely you cert does not have a private key.
• Check to make sure there is no other ASCII characters which are not suppose to be there.
• You will get an "Update Successful" message if everything goes well.

Hope this help...

Customizing Start Menu Layout and Right Click Context Menu on Start Button - Windows Serve 2012 R2

When you have an RDS farm and you want to control the look and feel of the user's desktop, here are some of the stuff I've found with countless hours of testing and verification.  I wish Microsoft has some guidelines around this area to make admin's life easier.

A lot of stuff can be done via the group policy users configurations.  Remember to enable Loop back policy processing if you are linking the policy to your RDS servers.

Taskbar Context Menu
If you want to disable user's ability to right click on the task bar (context menu) and access some of the settings and configuration.  You need to set the follow the group policy.

User Configuration | Policies | Administrative Templates | Windows Components | Start Menu and Taskbar | Remove access to the context menu for the taskbar  : Set to Enable


Start Menu Context Menu.
Also refer to as Win-X command. When you right click on the start button on the lower left corner, you see a a context menu access to commands and tools.  You won't want your normal users to see all these even though they might not have permission to run it.  Still..  removing it from users ability to see if is better in a sense.

The context menu is located from this location:
c:\users\%username%\appdata\local\microsoft\windows\winx

You will see 3 groups of menu.  You can delete and make modification to these groups to control what users can see.

I would suggest to do this prior to the user's logging on the first time.  On your RDSH servers (Hosts)

• Go to the default user profile in c:\users\default
• Navigate to Appdata\Local\Microsoft\windows\WinX
• Remove Group 3 as it is mostly Admin Tools which you do not want your users to see 
• Remove Task Manager, Run and Search from Group 2
• Leave Group 1 "Desktop" alone

When user logon for the first time, the default context menu will be copied to the user's profile under the 'local' folder as mentioned above.  The end result will be like this:

For existing users, you might want to create a batch file and delete the groups when they logon through startup script:

del /Q c:\users\%username%\appdata\local\microsoft\windows\winx\group3

Reference:  http://vhorizon.co.uk/removing-windows-server-2012-start-context-menu/

If you are using User Profile Disks (UPD) and selected to "Store only the following folders on the user profile disk", even if you selected all of the folders, I find that the "Local" (%appdata%\local) folder only gets created locally from the "default" profile when you logon to the RDSH servers. Hence, the user will get those winx groups as defined in the default profile.

Start Menu (Metro UI)

Great news if you are using Windows Server 2012 R2 RDS.  I have to praise the Microsoft RDS team for making our life so much easier if you want to customize what users see and limit the 

• Login to the RDSH server and customize exactly what you want to see in the Metro Modern UI start screen. 
• Use Powershell to export-startlayout -path \\dc1\layouts\startlayout.xml -as XML
• In the group policy settings User Configuration | Policies | Administrative Templates | Windows Components | Start Menu and Taskbar | Start screen layout, specify "\\dc1\layout\startlayout.xml"
• Users will get the same layout when they start the Modern UI.

However, if you are using user profile disk, ensure that the AppData\Local\Microsoft\Windows folder is added to the UPD.  Reference: http://microsoftplatform.blogspot.ca/2013/09/using-user-profile-disks-upd-in.html.  Otherwise, you will see a blank Modern UI screen even thought they seem like working.  The first time after the group policy is applied, it works.  Subsequent logon will display blank UI.

I tried to get the working after reading Freek's post and it didn't work.  I guess it doesn't apply to Windows Server 2012 R2.

http://microsoftplatform.blogspot.com.au/2012/11/predefining-and-customizing-modern-ui.html