Introduction

Remote Desktop Services (RDS) on Windows Server 2019 enables secure, centralized delivery of desktops and apps to remote users. This step-by-step guide covers GUI and PowerShell install, activation, licensing mode, CALs, verification, and security hardening—so IT teams can deploy RDS the right way with genuine licensing.

Need genuine Windows Server licenses or RDS CALs? Browse Indigo Software’s Server category for trusted options

Who this is for

  • System administrators and MSPs deploying RDS on Windows Server 2019
  • Organizations migrating from Windows Server 2016 or planning upgrades to 2022 or 2025
  • Teams standardizing on best practices for licensing and security

Prerequisites and system requirements

  • Windows Server 2019 installed and updated: If you still need it, follow our Windows Server 2019 installation and activation guide
  • Local or domain Administrator privileges
  • Static IP, DNS configured, and server reachable by FQDN
  • Internet access for activation (or plan for Web/phone activation)
  • Valid RDS CALs (Per User or Per Device) that match Windows Server 2019
  • Capacity planning: CPU/RAM/storage sized for expected session count
  • Optional but recommended:
  1. SSL/TLS certificate for RD Web/Gateway, preferably from a public CA
  2. A dedicated RD License Server role
  3. If starting fresh, see our Windows Server 2022 guide

Common ports

  • TCP 3389: RDP (do not expose directly to the internet; prefer RD Gateway)
  • TCP 443: RD Web Access and RD Gateway over HTTPS

Step 1: Add Remote Desktop Services roles (GUI)

  1. Open Server Manager > Manage > Add Roles and Features.
  2. Select Role-based or feature-based installation.
  3. Choose the target server.
  4. Under Server Roles, select Remote Desktop Services.
  5. Add the services you need:
    • RD Session Host (RDSH)
    • RD Licensing
    • RD Web Access (recommended)
    • RD Connection Broker (required for Standard Deployment/multi-server)
  6. Complete the wizard and reboot if prompted.

PowerShell quick install (single-server lab/POC)
Run in an elevated PowerShell window:

PowerShellInstall-WindowsFeature RDS-RD-Server,RDS-Licensing,RDS-Web-Access `
  -IncludeManagementTools -Restart

For a standard multi-server deployment, also add:

PowerShellInstall-WindowsFeature RDS-Connection-Broker -IncludeManagementTools

Step 2: Choose deployment type and create a collection

  • Quick Start: Good for one-box testing or labs.
  • Standard Deployment: Best for production. Distributes roles (Broker/Web/Session Host) and supports scale-out.

In Server Manager > Remote Desktop Services:

  1. Select Quick Start or Standard Deployment.
  2. For Standard, add servers for RD Connection Broker, RD Web Access, and RD Session Host.
  3. Create a new session collection (e.g., “Prod-Desktop”):
    • Publish Full Desktop or specific RemoteApps.
    • Assign user groups (e.g., Domain Users or a specific AD group).

Step 3: Activate the RD Licensing server

GUI

  1. Open RD Licensing Manager (licmgr.exe).
  2. Right-click the server > Activate Server.
  3. Choose Automatic, Web, or Telephone activation method.
  4. Complete the wizard.

PowerShell (after Connection Broker is installed)

PowerShellImport-Module RemoteDesktop
Get-RDLicenseConfiguration
# Example: Set per-user licensing and specify license server FQDN
Set-RDLicenseConfiguration -LicenseServer "rd-lic01.contoso.com" -Mode PerUser

Step 4: Install RDS CALs

  1. In RD Licensing Manager, right-click the licensing server > Install Licenses.
  2. Select your program type (Retail, Open/Volume Licensing, etc.).
  3. Enter your License Key Pack ID and complete the wizard.
  4. Confirm CALs appear under the server in licmgr.

Need CALs? Explore Windows Server and RDS options.

Step 5: Configure licensing mode and license server

Method A: Server Manager

  • Server Manager > Remote Desktop Services > Collections
  • Actions > Edit Deployment Properties > RD Licensing
  • Set Licensing mode (Per User or Per Device) and specify the license server

Method B: Group Policy (recommended for domain-joined RDSH)

  • Open Group Policy Management and edit a GPO linked to the RDSH OU:
    • Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing
      • Use the specified Remote Desktop licensing servers = Enabled (enter FQDN)
      • Set the Remote Desktop licensing mode = Enabled (Per User or Per Device)
  • Run gpupdate /force on RDSH and verify with RD Licensing Diagnoser.

Step 6: Test and verify

  • From a client, run mstsc and connect to the server FQDN or collection.
  • Log on with a test user (non-admin).
  • Confirm full desktop or RemoteApp launch, printing, clipboard, and profile.
  • In Server Manager > RDS, check health of Session Host, Broker, and Licensing.
  • If you’re still building your base OS stack, see our Windows Server 2016 guide for older estates

Security hardening checklist

  • Avoid exposing TCP 3389 to the internet; use RD Gateway over HTTPS 443.
  • Enforce Network Level Authentication (NLA) on Session Hosts.
  • Use TLS 1.2+, modern cipher suites, and a trusted certificate for Web/Gateway.
  • Restrict RDP access to known IPs/VPN; place RDS behind a firewall.
  • Implement MFA (e.g., NPS Extension for Azure MFA on RD Gateway).
  • Limit local admin membership; enable Just Enough Administration (JEA) where possible.
  • Configure session limits and idle timeouts.
  • Monitor logs: Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices*

Troubleshooting tips

  • The remote session was disconnected because there are no Remote Desktop License Servers available
    • Verify RD Licensing server activation and installed CALs.
    • Confirm licensing mode matches CAL type (Per User vs Per Device).
    • Check GPO settings and run gpresult /h report.html on the RDSH.
  • RD Licensing mode not configured
    • Set via Server Manager or the GPO paths above; restart Remote Desktop Services.
  • Firewall or network issues
    • Allow TCP 3389 internally and TCP 443 for Web/Gateway.
    • Validate name resolution and the SSL certificate chain.
  • CredSSP or encryption errors
    • Update clients and server; ensure TLS 1.2 is enabled and older protocols are disabled.
  • Reference: Microsoft’s RDS troubleshooting guide

Video tutorial
Prefer a walkthrough? Watch this quick setup video:

Related Indigo Software guides

Install and activate Windows Server 2019

Install and activate Windows Server 2022

Activate RDS on Windows Server 2025 (forward planning)

Deploy Microsoft Exchange Server 2019

Install SQL Server 2019

Install SQL Server 2022

Install Microsoft Project Professional 2024

Install Microsoft Visio Professional 2019

Note: If you support older environments, see:

Windows Server 2016 guide

SQL Server 2016

SQL Server 2017

Microsoft Project Professional 2016

Microsoft Visio Professional 2016

Office Home & Business 2019

Office Home & Business 2021

Office Professional Plus 2016

Mac Office 2016

Microsoft Project Professional 2019

Why Indigo Software

Indigo Software helps organizations deploy Microsoft infrastructure with clear, verified steps and genuine licensing. If you need help sizing CALs or choosing deployment topology, reach out—our team is here to help

FAQ

Do I need new CALs for Windows Server 2019 if I have 2016 CALs?

Yes. RDS CALs are version-specific. Use 2019 CALs for Windows Server 2019.

Which licensing mode should I choose: Per User or Per Device?

Per User for employees using multiple devices; Per Device for shared kiosks/labs.

Can I deploy RDS on a single server?

Yes for small/POC. For production, use Standard Deployment with separate roles for reliability and scale.

How do I scale for many users?

Add Session Hosts, keep CPU/RAM headroom, consider GPU for graphics workloads, and spread roles across servers.

Where can I buy genuine RDS CALs and Windows Server?

Indigo Software’s Server category