Event ID 2002 — RD Gateway Server Configuration

Applies To: Windows Server 2008 R2

For remote clients to successfully connect to internal network resources (computers) through a Remote Desktop Gateway (RD Gateway) server, the RD Gateway server must be configured correctly. The RD Gateway server must be configured to use an appropriate Secure Sockets Layer (SSL)-compatible X.509 certificate, and authorization policy settings must be configured correctly. Remote Desktop connection authorization policies (RD CAPs) specify who can connect to the RD Gateway server. Remote Desktop resource authorization policies (RD RAPs) specify the internal network resources that clients can connect to through an RD Gateway server.

Event Details

Resolve

Check whether settings are associated with local security groups on another RD Gateway server

To resolve this issue, ensure that the settings that you are attempting to import to an RD Gateway server are not associated with local security groups on the RD Gateway server from which you exported the settings. If the settings are not associated with local security groups on the RD Gateway server from which you have exported the settings, try exporting and then importing the file that contains these settings again.

If you export policies from one RD Gateway server that contain references to local security groups (user or computer groups in Local Users and Computers) on that server, you cannot import these settings to another RD Gateway server, because the local security groups might not exist on the RD Gateway server to which you are attempting to import the settings. For example, if you export settings from RD Gateway Server 1, and then try to import these settings to RD Gateway Server 2 and these settings are associated with local security groups on RD Gateway Server 1, the attempt to import the settings will not succeed.

To perform these procedures, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

Check whether RD Gateway server policy settings are associated with local user or computer groups on another RD Gateway server

To check whether RD Gateway server policy settings are associated with local user or computer groups on another RD Gateway server:

1. On the RD Gateway server from which you are trying to export policy and configuration settings, open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.
2. In the Remote Desktop Gateway Manager console tree, select the node that represents the local RD Gateway server, which is named for the computer on which the RD Gateway server is running.
3. In the console tree, expand Policies, and then click Connection Authorization Policies.
4. In the results pane, in the list of Remote Desktop connection authorization policies (RD CAPs), for each RD CAP, check for local security groups. To do this, check the following, on the Requirements tab:
   • Check whether a local user group appears under User group membership (required). If so, the policy and configuration settings cannot be imported to another RD Gateway server.
   • Check whether a local computer group appears under Client Computer group membership (optional). If so, the policy and configuration settings cannot be imported to another RD Gateway server.
5. In the console tree, expand Policies, and then click Resource Authorization Policies.
6. In the results pane, in the list of Remote Desktop resource authorization policies (RD RAPs), for each RD RAP, check for local security groups. To do this, check for the following:
   • On the User Groups tab, check whether a local user group appears under User Groups. If so, the policy and configuration settings cannot be imported to another RD Gateway server.
   • On the Computer Group tab, check whether a local computer group appears. If so, the policy and configuration settings cannot be imported to another RD Gateway server.
7. If no user groups associated with the RD CAPs or RD RAPs are local user or computer groups, try exporting the settings from this RD Gateway server, and importing them to another RD Gateway server again. In such a case, it is possible that the .xml file that contains the policy settings and that you exported from the other RD Gateway server was corrupted. Exporting, and then importing the file that contains these settings again can help resolve the problem.

Export settings from the local RD Gateway server and then import them to another RD Gateway server

Important:  Importing policy settings to an RD Gateway server will cause any existing policy settings on that server to be overwritten. If you want to save the existing policy settings on that RD Gateway server, we recommend that you create a backup copy of those settings before attempting to import new policy settings to the server.

To export settings from the local RD Gateway server and then import them to another RD Gateway server:

1. Open Remote Desktop Gateway Manager. To open Remote Desktop Gateway Manager, click Start, point to Administrative Tools, point to Remote Desktop Services, and then click Remote Desktop Gateway Manager.
2. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, which is named for the computer on which the RD Gateway server is running, and then click Export policy and configuration settings.
3. Specify a name and location for the file, and then click OK.
4. A message will appear to indicate that the settings have been successfully exported to the location that you have specified.
5. Click OK.
6. Close Remote Desktop Gateway Manager.
7. On the target Remote Desktop Gateway server (the Remote Desktop Gateway server on which you want to import the settings), open Remote Desktop Gateway Manager.
8. In the Remote Desktop Gateway Manager console tree, right-click the local RD Gateway server, and then click Import policy and configuration settings.
9. In the Import Policy and Server Configuration Settings dialog box, specify the file that you want to import, and then click OK.
10. A message will appear stating that importing the file will cause existing policy and configuration settings for the RD Gateway server to be overwritten. To proceed, click Yes, and then proceed to step 11. To cancel the procedure, click No.
11. After the settings have been imported, another message will appear to indicate that the settings have been succesfully imported to the local RD Gateway server from the location that you have specified.
12. Click OK.

Verify

To verify that the RD Gateway server is configured correctly, examine Event Viewer logs and search for the following event messages. These event messages indicate that the Remote Desktop Gateway service is running, and that clients are successfully connecting to internal network resources through the RD Gateway server.

To perform this procedure, you do not need to have membership in the local Administrators group. Therefore, as a security best practice, consider performing this task as a user without administrative credentials.

To verify that the RD Gateway server is configured correctly:

1. On the RD Gateway server, click Start, point to Administrative Tools, and then click Event Viewer.
2. In the Event Viewer console tree, navigate to Application and Services Logs\Microsoft\Windows\TerminalServices-Gateway, and then search for the following events:
   • Event ID 101, Source TerminalServices-Gateway: This event indicates that the Remote Desktop Gateway service is running.
   • Event ID 200, Source TerminalServices-Gateway: This event indicates that the client is connected to the RD Gateway server.
   • Event ID 302, Source TerminalServices-Gateway: This event indicates that the client is connected to an internal network resource through the RD Gateway server.

Related Management Information

RD Gateway Server Configuration

Remote Desktop Services