All Products
Search

This Product

    Bastionhost:Deploy Windows Server as an application server

    Document Center

    Bastionhost:Deploy Windows Server as an application server

    Last Updated:Mar 31, 2026

    Bastionhost's application O&M feature requires a Windows Server configured with RemoteApp. This guide walks you through deploying Windows Server 2019 as an application server — setting up an Active Directory (AD) domain, installing Remote Desktop Services (RDS), and configuring the required policies.

    Before you begin

    Supported Windows Server version

    RemoteApp requires Windows Server 2016, 2019, or 2022. Windows Server 2000 and 2003 are not supported. This guide uses Windows Server 2019.

    Physical or virtual machine

    The server can be a physical machine or a virtual machine.

    RDS licensing

    Application O&M depends on RDS, which includes a 120-day free trial. After the trial ends, the application O&M feature stops working. To continue using RDS beyond the trial period, purchase Client Access Licenses (CALs) from Microsoft and activate a license server on the application server.

    Choose a CAL type based on your team's usage pattern:

    CAL typePurchase basisBest for
    Per Device CALs (recommended)Maximum number of concurrent O&M connections — each O&M connection requires a CALTeams where concurrent users are fewer than total O&M personnel
    Per User CALsTotal number of O&M personnel — each person requires a CALTeams where all personnel connect simultaneously
    Warning

    After the 120-day RDS trial ends, the application O&M feature stops working. Purchase CALs on the official Microsoft website and activate them before the trial expires to avoid interruption.

    Recommended server configuration

    Size the application server based on the expected number of concurrent connections.

    Concurrent connectionsCPUMemorySystem disk
    1–104 cores8 GB200 GB
    11–204 cores16 GB200 GB
    21–508 cores16 GB300 GB
    51–1008 cores32 GB300 GB
    More than 10016 cores64 GB500 GB

    How RemoteApp works

    RemoteApp, introduced by Microsoft in Windows Server 2008, lets users run applications hosted on a remote server without installing an operating system or application locally. When Bastionhost performs O&M on applications, it logs on to the application server and starts the client on the server, making RemoteApp a required component.

    Deploy the application server

    The deployment consists of five steps:

    1. Create an AD domain

    2. Promote the server to a domain controller

    3. Install Remote Desktop Services

    4. Install RemoteApp

    5. Configure the application server

    Step 1/5: Create an AD domain

    1. Log on to the Windows Server 2019 machine. If you are using an Elastic Compute Service (ECS) instance, see Connect to an instance for available connection methods.

    2. Click the image..png icon, select Server Manager, and on the Dashboard page, click Add roles and features.

      image

    3. Follow the wizard, keeping default values unless your environment requires otherwise. Configure:

      • Installation Type: Select Role-based or feature-based installation. image

      • Server Roles: Select Active Directory Domain Services. image

      • Features: Select .NET Framework 3.5 Features and .NET Framework 4.7 Features. image

    4. After installation completes, restart the server.

      image

    Step 2/5: Promote the server to a domain controller

    1. On the Dashboard page, click Promote this server to a domain controller.

      image

    2. Follow the wizard, keeping default values unless your environment requires otherwise. Configure:

      • Deployment Configuration: Specify a root domain name, such as example.com. image

      • Domain Controller Options: Enter a Directory Services Restore Mode (DSRM) password. The password must contain letters, digits, and special characters. image

      • DNS Options: Ignore the prompt and click Next. image

    3. Restart the server. After the restart, confirm the server is joined to the domain.

      image

    Step 3/5: Install Remote Desktop Services

    1. Log on with a domain account or the administrator account.

      If the domain name is example.com, the domain account name is example. The password is the same as the administrator account password.

    2. Click the image..png icon, select Server Manager, and on the Dashboard page, click Add roles and features.

      image

    3. Follow the wizard, keeping default values unless your environment requires otherwise. Configure:

      • Server Roles: Select Remote Desktop Services. image

      • Role Services: Select Remote Desktop Session Host and Remote Desktop Licensing. image

      • Confirmation: Select Restart the destination server automatically if required. image

    Step 4/5: Install RemoteApp

    1. Log on with a domain account or the administrator account.

      If the domain name is example.com, the domain account name is example. The password is the same as the administrator account password.

    2. Click the image..png icon, select Server Manager, and on the Dashboard page, click Add roles and features.

      image

    3. Follow the wizard, keeping default values unless your environment requires otherwise. Configure:

      • Installation: Select Remote Desktop Services installation. image

      • Deployment Type: Select Quick Start. image

      • Deployment Scenario: Select Session-based desktop deployment. image

      • Server Selection: Select the server and click Next. image > Note: If a compatibility error appears, run Enable-PSRemoting in Windows PowerShell as administrator, then return to Server Selection and click Next. > > image

      • Confirmation: Select Restart the destination server automatically if required. image

    4. Wait for the installation to complete.

      image

    Step 5/5: Configure the application server

    This step covers six configuration tasks:

    1. Adjust Local Group Policy

    2. Block the IE address bar

    3. Disable Windows Defender Firewall

    4. Disable IE Enhanced Security Configuration

    5. Configure the RD Licensing mode

    6. Enable remote desktop connections

    Adjust Local Group Policy

    1. Open the Run dialog box and enter gpedit.msc.

      image

    2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host.

    3. Under Connections, set the following policies:

      PolicySetting
      Allow users to connect remotely by using Remote Desktop ServicesEnabled
      Limit number of connectionsEnabled — set RD Maximum Connections to 999999
      Restrict Remote Desktop Services users to a single Remote Desktop Services sessionDisabled
      Allow remote start of unlisted programsEnabled

      image

    4. Under Session Time Limits, set:

      • Set time limit for disconnected sessions: Enabled — set End a disconnected session to 1 minute.

      image

    Block the IE address bar

    1. Open the Run dialog box and enter gpedit.msc.

      image

    2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Internet Explorer.

    3. Set Enforce full-screen mode to Enabled.

    4. Open Internet Explorer to verify the address bar is hidden. If the address bar does not appear, the configuration is effective.

    Disable Windows Defender Firewall

    Navigate to Control Panel > System and Security > Windows Defender Firewall > Custom settings and turn off the firewall.

    image

    Disable IE Enhanced Security Configuration

    1. Click the image..png icon and select Server Manager.

    2. In the left-side navigation pane, click Local Server, then turn off IE Enhanced Security.

      image

    Configure the RD Licensing mode

    1. Click the image..png icon, select Server Manager, and navigate to Remote Desktop Services > Overview. Double-click RD Licensing.

      image

    2. Select the license server and click Next. Complete the remaining steps as prompted.

      image

    3. Return to the Remote Desktop Services page and choose Tasks > Edit Deployment Properties.

      image

    4. Set the licensing mode to Per Device, select the remote desktop license server, and click Apply.

      image

    Enable remote desktop connections

    1. Navigate to Control Panel > System and Security > System and click Allow remote access.

    2. On the Remote tab, select Allow connections to this computer and clear Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended).

    3. Click OK.