in this video I create an application group publish applications and review
managing access to Windows virtual desktop
hello my name is Travis and this
is Ciraltos in this video I show you how to create a remote applications
group publish applications and set access in Windows virtual desktop before
that please take a second to subscribe and don't forget to hit the bell icon to
get alerts when new content is published back to it let's start by reviewing some
of the basics of application groups there can be two types of application
groups desktop and remote app remote app is for well publishing remote
applications a desktop app group is for a full desktop experience there can be
multiple remote app groups in a host pool and only one desktop app group in a
host pool users can be assigned to remote app groups or a remote desktop
app group in a host pool but not both and the last bullet point here is
important as of today uses our assigned to an app group individually this is
kind of a pain to manage and Microsoft is aware of that a new portal experience
for managing Windows virtual desktop was demonstrated at ignite this year one of
the features was group based management for Windows virtual desktop app groups
until then I created a script that will sync an ad group with a remote app group
I'll show you that later here's a visual for assigning users to app groups you can
see in this slide the user is assigned to the desktop application group here
the user is assigned to multiple remote app groups the user can't be assigned to
both a desktop and remote app group for the user to have access to both a remote
app and remote desktop that requires two hosts pools let's move on to what the
demos are gonna cover I'm gonna start with an existing host pool if you want
to follow along and need to set one up see my previous video that walks through
onboarding and setting up a host pool I'm gonna start by creating an app group
from there I'm gonna add a couple apps I'm gonna add a user to the app group
manually and then I'm gonna sync an ad group with the app group using that
script I was talking about let's get started
the first thing I need to do is login and I'll just add this command and run
it I have to log in with an account that has rights to this Remote Desktop tenant
it also cannot be a guest account Here I am logged in next I'm gonna view the
existing application groups and I'll do that with the get-RDSappgroup command
and here it is notice the resource type in this application group is set to
desktop and remember as I said before you can only have one resource type of
desktop within a hosts pool but you can have multiple remote app resource types
a user can be assigned to the desktop resource type or multiple remote app
resource types but not both you can also delete this group and recreate it with a
different name if you wanted to you don't need to have this group it's just
the default one that's set up when you deploy a host pool next I'm going to add
a remote app group and that uses the new RDS app group command and that will be
assigned to my host pool now if I run that get RDS app group command again I
have two application groups and you can see one is a remote app for the resource
type the one we just created and the other one is desktop the next thing I'm
going to do is add a couple applications to that app group so the first thing I'm
going to do is run a command to get all of the Start menu applications and you
can see that returns quite a bit so let's say I just wanted to find Excel I
could filter that out through PowerShell this command will filter down to app
groups with friendly names like Excel there it is so that's the application
you can see it has a friendly name alias name file path icon path but the way I'm
gonna add it all I need is that alias name I use the new-RDSremoteapp
command targeting my host pool and app group the app alias is Excel I'm gonna
run that command again this time targeting in word and I just happen to
know that that is word for the app alias oh I forgot to change the name
let's go back and do that and there it is let me clear this out next
I'm gonna make sure that those applications are actually in the remote
app group that I just set up this command just gets the RDS remote apps
for that tenant host and application group there you can see I have two of
them ms excel and ms word next let's take a look at who has access to each of
these two application groups I have let's first take a look at the desktop
application group that was set up on deployment and you can see I have a test
user 3 assigned to that app group now let's do the same for the app group we
just set up and nothing nobody's been assigned
that's alright let's assign a couple users the first user I'm going to add is
my account so let's see if that works there goes let's see if that user is now
part of that application group we'll get the RDS app group users for
the app group named apps there it is so now my user is part of that group let's
try to add that test 3 user to this application group here it is I get an
error that that specified user principal name is already assigned to a desktop
application group in this host pool as I said before you can add a user to the
desktop app or a remote app but not both so let's review are the permissions we
have set up now so in apps we have let's see here
so my Travis account and for the desktop application group that test user 3 let's
give it a try to see if this works first I'm gonna log in with the Travis account
and you can see both Excel and Word are available let's try the
three account okay there it is so now I have access to the desktop on host pool
two I'm not going to go into any of these I'm just showing that they are
showing up and available also you can see I'm using a server OS with IE that
doesn't support some of the features but again this is just to show that those
users have access so now we created a new app group and we added some apps you
can create multiple you just go through the same process of creating an app
group and assigning applications but you do need to add users to each app group
in order for it to be available to them that is a problem as I said before with
Windows virtual desktop right now it's per user there's no group based
management yet but I did come up with a script that I'm gonna run that will
synchronize an ad group to a remote desktop pool and this script is
available on my github page I'll have a link below you can take a look at it if
we go over to ad users and computers if we look at desktop the only user I have
in desktop oops there we go is my Travis account but here in desktop test user 3 is
added and if I go back and look at this HP for host pool two apps that has
three of my test users in there but over here the apps group has my Travis
account so we're gonna straighten that out this script starts by taking the ad
group name this is the ad group that it's going to sync to in this case is
the HP two desktop and then the tenant name the host pool name and the
application group name so if I run that it looks like I missed a step let's try
this whoops okay let's try it again so I got an error
but that's to be expected because it was trying to add my Travis account to the
desktop application group but you can see later here at the bottom it did find
that test 3 user 3 was not found in the ad group so it removed it from the
desktop group let's take a look at the permissions that we have again so we can
see what that script did so desktop application group has nobody in there
because it did remove that user 3 and the app group just has my Travis user
account so let's run that script again this time instead of the desktop ad
group we're gonna use the host pool two apps group and sync that with the
application group and you can see that right now just has Travis so what did it
do it found that the three test accounts that were part of the ad group and not
part of the application group apps it did add them and then the last line it
said that it didn't see the Travis account in the ad group hp-2 apps so it
removed it so let's look at where our permissions are now so the desktop group
still has nothing but the app group is now synchronized to the AD group let's
go back and check that out so apps members there were the three and
here are the three users now that the Travis account has been removed from
this I'm gonna run that script again targeting the desktop group see that's
for the apps there it is so the ad group is HP to desktop and it's targeting the
desktop application group go back here the only member in there is my account
okay there it is it says it didn't find it in the application group and it's
going to add it to the app group desktop application group let's review those
permissions again now in Windows virtual desktop so the desktop application group
has my account in it and still the application group apps has the three
test users so now that is in synchronization so one problem you would
have with this script is if you have the same user in both groups it's gonna
float between the two because it'll get deleted and then remove add it to the
other and then delete it from that and add it to the other so you don't want to
do that it is a little bit wonky I think it's better than adding in hand typing a
list of users but it still could use a little bit of help I don't plan on
developing it any further because Microsoft has a solution on its way
that's supposed to be out I think in previews sometime
first quarter 2020 so that's it for the demo we created a new remote app
application group we added a couple applications to that group and then we
set permissions couple different ways on the remote app group and the desktop
application group that's it for the demo don't forget to subscribe and click the
bell icon to be alerted when there's new content thanks for watching