RDP ShortPath for WVD - NielsKok.Tech Azure Virtual Desktop (2024)

November 24, 2021January 10, 2021 by Niels Kok

This is my take on RDP Shortpath for WVD. In this blogpost I will discuss the pro’s and cons of using this feature. Furthermore, I will talk about the configuration needed and the architecture involved. You can find the configuration below. I will first talk about the architecture and the pro’s and cons. I will then show how I configured this in my test environment.

Architecture

Firstly, the architecture. This is architecture overview from the Microsoft Docs:

The architecture overview shows that it is now possible to connect to your WVD hostpools directly. You can do this is in a number of ways:

• Public IP assignment to your sessionhost (not recommended)
• Via Site to Site VPN
• Via Point to Site VPN
• Express Route

In addition, when the “ShortPath” is not available the Remote Desktop client automatically switches back to the public endpoint connection. This is the connection information for a normal connection:

You can see that the same gateway is used when connected via ShortPath and connected via the “normal” connection.

Pro’s & Cons

The pro’s of the solution are:

• You are now able to fully control the connection to your WVD Sessionhost. Furthermore, you can apply QoS (Quality of Service) to the whole route to your sessionhosts.
• There is more bandwidth available between the clients and the sessionhosts. This results in faster transfer times when copying files from and to the sessionhosts.
• UDP is a protocol with less overhead, as a result, this could lead a much smoother experience for the end users.

The con’s of the solution are:

• All the traffic now routes via the S2S VPN, Express Route or P2S VPN. This could lead to much higher costs. For example: You have Microsoft Teams offloading configured. Which offloads the rendering tasks for Microsoft Teams to the local clients. This takes about 1 Mbit/s of a bandwidth, this does not seem to be much… but if 500 users are doing this at the same time you could be looking at an upgrade for networking solution. This does not even take other applications in to account.
• The Remote Desktop application decides whether Shortpath is being used or not. You can not control this. The application detects the best route and applies it if it thinks it is better.
• RDP ShortPath is only available in the Remote Desktop Client.

Configuration

I have configured RDP ShortPath for WVD like this in my own testing environment:

The green connection represents the ShortPath connection and the red connection represents the normal connection via the public endpoint for WVD from Microsoft.

1. Configure 2 registry keys. These enable UDP to be used for the Remote Desktop connection.
2. After that you configure the Windows Defender Firewall on the session host to allow the 3390 UDP connection.

This is the script to configure the registry keys:

$WinstationsKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations' New-ItemProperty -Path $WinstationsKey -Name 'fUseUdpPortRedirector' -ErrorAction:SilentlyContinue -PropertyType:dword -Value 1 -Force New-ItemProperty -Path $WinstationsKey -Name 'UdpPortNumber' -ErrorAction:SilentlyContinue -PropertyType:dword -Value 3390 -Force

And this is the script Microsoft made available to configure the Windows Defender Firewall:

New-NetFirewallRule -DisplayName 'Remote Desktop - Shortpath (UDP-In)' -Action Allow -Description 'Inbound rule for the Remote Desktop service to allow RDP traffic. [UDP 3390]' -Group '@FirewallAPI.dll,-28752' -Name 'RemoteDesktop-UserMode-In-Shortpath-UDP' -PolicyStore PersistentStore -Profile Domain, Private -Service TermService -Protocol udp -LocalPort 3390 -Program '%SystemRoot%\system32\svchost.exe' -Enabled:True

You can also configure this via Group Policy within Active Directory. I personally would put configuration like this in the WVD image so you don’t get a lot of overhead on the configuration. This is fairly easy to integrate in to your image creation process.

References