topic Re: MUH2 Terminal Server Identity Agents on regular computers and laptops + ID Collector in General Topics

MUH2 Terminal Server Identity Agents on regular computers and laptops + ID Collector

Dr_Steve_Brule — Mon, 06 Feb 2023 20:00:56 GMT

Can the MUH2 client be applied to all clients in an AD environment regardless if they're a terminal server or not?

Customer has several Windows 10 Enterprise multi-hosts (per sk177024) mixed in with their regular desktops and laptops within their departments and they would like to more granular identity-based enforcement on those machines. Since these are mixed in everywhere among different AD groups/departments, they would like to push out the MUH2 client to all endpoints regardless of where they reside. Is there any harm on running the MUH2 agent on regular desktop/laptops? Customer is also using ID collectors to complement the agents.

Re: MUH2 Terminal Server Identity Agents on regular computers and laptops + ID Collector

Wolfgang — Mon, 06 Feb 2023 20:12:22 GMT

@Dr_Steve_Brule Yes, Windows10 Enterprise multisession is supported Terminal Server Identity Agent v2 (MUH2) supported in Windows 10 Enterprise multi-session

Some limitation with MUH2 agent …. as an example 1000 agents per PDP gateway, see Terminal Server Agent v2 (MUH2) - FAQ

Re: MUH2 Terminal Server Identity Agents on regular computers and laptops + ID Collector

Dr_Steve_Brule — Tue, 07 Feb 2023 14:39:17 GMT

Thanks @Wolfgang . But any harm on installing the agent on regular desktops that aren't multi-user hosts?

Re: MUH2 Terminal Server Identity Agents on regular computers and laptops + ID Collector

Wolfgang — Tue, 07 Feb 2023 14:52:14 GMT

MUH2 agents are only for multi-user hosts. For hosts without multi-user you have to use the normal identity agent or no agent.

With identity collector you can get the identities without installing an agent on normal desktop clients.

Re: MUH2 Terminal Server Identity Agents on regular computers and laptops + ID Collector

PhoneBoy — Tue, 07 Feb 2023 16:16:48 GMT

You should only install agents on systems that actually need it.
At a high level, this includes:

Multi-user hosts
Roaming users (specifically roaming within a site, like with WiFi, where the user IP might change)

There are some scalability issues that will need to be accounted for on the gateway the agents are connected to.
I believe an R81.10 gateway can handle up to 50 MUHv2 agents connected to it.
R81.20 should be able to handle far more.