rdp short path is a brand new feature in windows virtual desktop that lets you get to
your vms faster let me explain so here we have a map of the us capital this is washington d.c
and over here we've got the u.s capitol building and if you wanted to get from the capitol building
to the white house you could go this way and go all the way around and take this roundabout way
consider that reverse connect it is very efficient it's far more efficient than
going to bangalore and then going to the white house but rdp short path is even more direct
in getting you to your destination so if you want to learn more about rdp's short
path and how it can help you and wbd then join us because we're starting right now
i'm Dean Cefola and this is the azure academy so to see how rdp short path fits in let's look at
the new diagram that's in the wbd docs and talk through reverse connect for a second over on
the left when we go to our client that client will subscribe to wvd and they'll log in the
web access role will give them all of the icons for the things that they're allowed to click on
that's their remote apps and desktops but even though they have those icons they don't have
access they have to click on one of those icons and authenticate in order to be able to get
in through the wvd service to get to those applications so reverse connect starting at port
tcp 443 routes over the public internet through the wbd gateway service which communicates with
the broker the broker will figure out which systems in your environment are available
for your user connection and then you will get an outbound connection from the session host
through the gateway back to your client this is the reverse connect model now in rdp short path
almost everything is the same instead of having to go back through the gateway and then get your
session host to communicate reverse back to you instead your client gets to go directly
to the session host when you use reverse connect you're going out through the cloud through the
public internet to do all that connectivity back to your environment with rdp short path you don't
have to go over the public internet this can be done privately on your own network which gives
us some other benefits and options for example your express route can now take your wvd traffic
so can your point to site or site to site vpns and you can also choose to do this over a public
ip address sitting on top of your session host although generally i don't like to use
that because it's one more thing to manage and if you don't secure that public ip address correctly
you could end up with more than you bargained for now this can be done in a few different
ways which we'll talk about in a minute and we can do this because there's a change in protocol
reverse connect functions over tcp 443 pretty much an internet standard for how a lot of things work
however there are some drawbacks for one thing the efficiency is not as great as udp but to
sum it up basically tcp is much heavier as a protocol there's more handshakes there's more
packets error checking resending all that stuff udp ends up being a much more efficient protocol
for sending data like voice over ip or connection to your wvd server the way wbd already works is
there are certificates that are on your session host that are validated through the wbd client
when you go to connect and rdp short path is very similar there are tls connections that are made
between your client and your session host and that's secured using that same certificate and
that certificate gets on the session host when it is built and set up but this does give you a place
where you can choose if you want to to have your own managed certificates from your own authority
but something to consider if you are going to use short path is bandwidth which means if you
have a large bandwidth requirement the pipe that you're using for rdp short path has to be able to
carry that load and up until now we haven't had a very good way of quantifying all that information
for you but in the wbd docs there is now a new page for bandwidth considerations there's a pretty
detailed walkthrough of what you can expect when you look at particular types of data or workloads
in your sessions for example you can go from a 0.3 kilobits per second data stream when you're just
sitting there idle looking at your desktop or your application down to a three megabit connection if
you're streaming full screen 4k video with an h.264 encoder but this also means that you can
do quality of service and do traffic shaping and i'll show you how to get started with that in just
a minute for now let's set up rdp short path if you want to master the azure cloud you can start
right now by clicking the subscribe button and the notification bell so you don't miss anything so
there's several ways that you could get this set up and i'm going to show you how to do this for a
test machine right now by editing the registry directly so here in the windows registry we're
going to go into hkey local machine and then go into system current control set control and then
we're going to scroll all the way down until we get to terminal server and inside terminal server
we'll go to win stations and then right click over here and we're going to add a new d word
and this d word is going to be f use udp port redirector and we're going to set that value to 1
and then we're going to add another d word and this is going to be udp port number and we're
gonna set that to three three nine zero and that's it that's how you get it set up and tested and you
should do a reboot before you actually try this but that's just for setting up a single machine
now we're gonna flip over to my domain controller and i've got powershell open here with a little
bit of code that i pulled right out of the azure docs and this code is going to set up for us a new
group policy but we're going to set up for rdp short path so at the top i've got two variables
one that's going to pull in my domain name and the other is the name of the new gpo i want to create
rdp short path and then we'll create that gpo and then add these two things to it which are the same
registry entries that we just did so here is my gpo and let's go into the policies and look
at the registry and there are our settings so now that's how you can implement it for a single test
machine and also through a gpo now there are some other things we want in our gpo since we're here
let's go down to windows settings security settings and then we're going to go to windows
defender firewall for advanced security to our inbound rules so in our rule type we'll select
a custom rule hit next and then on our next screen here we want to select the second option a program
path and we're going to put in exactly percent system root percents slash system 32 svchost.exe
and hit next and on our next screen for our protocol type udp set our specific port for 3390
and then hit next and here on the scope page we're going to set it for all ip addresses
and hit next our action will be allowed next our profile will be for all three profile types give
your rule a name and then hit finish now i forgot one thing if we go back into the rule up top here
right click on that and go to properties and then at the top go to the program and services tab
and then click the settings button for your service we want to specifically set this
to remote desktop services for terminal server all right that way we'll get the rule to apply against
the right service so just hit ok ok and close all that stuff and then let's pop over to azure and
we want to make sure that if we have a network security group or firewall rule in place that
we want to edit that to allow our udp so here's my network security group and i'll go to the inbound
security rules and click add so our scope and our scope port will be just leaving those alone as
any our destination we're going to leave as any and then we'll set our destination port for 3390
select our protocol as udp set it to be allowed give it a appropriate priority and then name the
rule so that we know what in the world this thing is and then put in a description that matches your
stuff so i'll hit add on that and now that we have our rule it's time to do a test so let me open
my wbd client and it'll be easiest to show this if i just go into my full desktop so we'll double
click on that put in our credentials so we authenticate now at the very top of the screen
you see we have that connection bar i want you to click on the graph there that's what tells us
what our connection speed and type and all that information is doing and when you do hit the
show details and there you can see we've got our udp set up and i've got a 15 millisecond latency
not too bad going over a point to site vpn let me show you a few other ways you can tell that you've
got udp working right here's the windows event viewer and you can find the path to this exact log
in the docs and i've sorted everything here by the event id the one that we want is one three one and
you can see the description there says connected by udp but what about from the azure side can we
see that we've done a udp connection from there so back in azure i'll go to my log analytics space
where i've got all my monitoring stuff set up and if you missed that we've got all that covered in
another video in our wvd series go check out that playlist so if i go into the logs section in log
analytics i'm going to run a query against wbd connections and then we scroll down here to find
the udp use equals one that means this session was connected by udp and that's our rdp short
path and one last thing that we'll cover today is quality of service so i'll go back to my rdp short
path group policy under our computer configuration we'll go to windows settings and then policy based
qos and we'll create a new policy i'll call this rdp short path we'll set our dscp to 46
and then we're gonna hit next leave the specified outbound throttle alone and for our applications
again we'll put the svc host.exe and hit next we'll leave it from any ip source or destination
hit next set our protocol to udp the port to 3390 you get the idea and then hit finish and there is
our qos policy so just to recap you can see it was real simple to set up rdp short path which
you could do just testing by going to the registry yourself or implementing it through group policy
just be sure to remember that any firewalls or network security groups that you have make
allowances for udp port 3390 and just be sure that you've got enough bandwidth in your network pipe
if you're sending this data over your express route or vpn so if you thought that this was
pretty cool or learned something new hit that thumbs up comment share like subscribe all that
stuff and you want to be sure to check out our latest video right over there as well as this guy
down here that is our wvd playlist in case you missed anything in the world of wvd and let me
know if i missed something by giving me a comment so i can make that as another video that you
want to learn about thanks for joining us today and we will catch you next time happy learning