I have a Server 2012 RD farm which is used exclusively for sessions - not remote apps. It's working well except for some login concerns. One in particular is a warning that remote clients get when logging in:
This remote connection could harm your local or remote computer. Make sure that you trust the publisher before you connect.
Here's a screen shot on Windows 7:
The clients are not owned by us so we don't have them domain-joined. However, we do have our root certificates installed into them, and all the involved certs chain up to those. As such, we do not get certificate warnings/errors, but we still do get the above warning.
My concern with this is that the users are not that security conscious and some are not highly technical. As such, if the user has to routinely dismiss this dialog, he/she might get immune to security dialogs in general when connecting to our server, and this could be disastrous if one happens to be warning about an attacker's invalid cert!
Is there a way to get rid of this dialog? If it requires a bit of config on the client that is ok as long as it doesn't leave the user vulnerable to other sites. I also definitely do not want certificate errors / untrusted certificate warnings to be suppressed - only the above dialog.
We do not need (or even want) clients to be able to pull in local disks, USB devices, etc., and in fact already have that turned off.
I also note that the dialog claims our web site "wants to run a RemoteApp program," even though we are not publishing remote apps and only want to allow session logins. I assume this has something to do with how RD Web works internally. I wouldn't even bother with RD Web except that it makes the logins a lot more intuitive and easily permits the selection of particular server Collections by the users.
Any ideas?
Turns out it was one of those simple little things overlooked.
When you first open the RD Web site, you get a log-in page that looks something like this:
It so turns out that if the "Security" option is set to "This is a public or shared computer," that a certain check-box gets omitted from the dialog shown in the question. That check-box is.... drum-roll please:
So, when you log in, choose "This is a private computer," and then you will see the above check-box. Check it and, sure enough, the prompt doesn't appear again. (Although it does seem to re-appear if certain settings are changed on the Collection, until checked again.)
(Two annoying RD problems gone, one to go...)