Remote Desktop (RDS) Server Hosting

RDS server hosting lets staff use ERP, accounting and office applications without installing them on their own computers, by connecting over Remote Desktop to a Windows server in the cloud. Applications and data run in one central place, and employees reach the same desktop whether they are in the office, at home or in a branch. MAV Cloud builds this setup on its VMware-based Cloud Server platform and plans access security, backup, monitoring and Windows Server management in the same quote.

This page covers the scope of the service, Microsoft’s RDS roles, licensing, security and migration. The vCPU and RAM calculation by user count lives in a separate tool.

What is an RDS server, and what is it used for?

RDS (Remote Desktop Services) is the role-based infrastructure in Windows Server that lets several users open separate sessions on the same server and work in a full desktop or in individual applications (see RDS in our glossary). The application runs on the server, and only the screen output reaches the user’s device. Microsoft describes it as a model in which applications are installed and patched once on central hosts while data stays in the datacenter (Microsoft Learn: Remote Desktop Services overview).

Companies asking for terminal server hosting most often use it for:

• ERP and accounting clients: desktop applications that need to sit close to their database run without the lag of a long-distance connection.
• Office applications: email, documents and spreadsheets are handled on a shared, managed desktop.
• Line-of-business applications: legacy or specialised Windows software that is awkward to install on many computers is published from one server.
• Remote branches and field teams: everyone connects to the same system without a separate server in each branch.

Full desktop or RemoteApp?

RDS offers two publishing options. With a full desktop, the user connects to a prepared Windows desktop on the server and does all their work there. With RemoteApp, only selected applications are published, and each one opens on the user’s own computer like a locally installed program.

If only the ERP or accounting program needs to be used remotely, RemoteApp usually gives a simpler experience. If the aim is to run all daily work centrally, a full desktop is the better fit.

Session Host, RD Gateway and the licensing server: the core roles

A remote desktop deployment is not a single role. The Microsoft roles most often used in small and mid-sized setups are:

Role	Purpose
RD Session Host	The server that runs user sessions and RemoteApp programs.
RD Connection Broker	Distributes connections across several Session Hosts and reconnects users to existing sessions.
RD Web Access	Lists the desktops and applications a user is authorised to use in a web portal.
RD Gateway	Carries RDP traffic inside HTTPS (TCP 443), giving access without opening the internal RDP port to the internet.
RD Licensing	Issues and tracks Remote Desktop Services client access licenses (RDS CALs).

In a small deployment, several of these roles can run on the same virtual server; as users grow, more Session Hosts are added behind the Connection Broker.

RDS CAL licensing: per user and per device

Each user or device that connects to a Session Host running Windows Server needs an RDS CAL. Microsoft defines two types: a per user CAL is assigned to a user in Active Directory and lets that person connect from any number of devices, while a per device CAL is assigned to a physical device and suits teams that share the same computers across shifts (Microsoft Learn: RDS CALs).

The CAL version must be compatible with the Windows Server version being accessed; older CALs cannot be used to connect to a newer Windows Server. The licensing model and version are chosen before deployment based on user and device counts and are planned at the quote stage.

Security: port 3389 stays closed to the internet

Leaving the RDP port (3389) directly open to the internet makes a server one of the most common targets for password-guessing attacks. Remote desktop access is therefore built through an intermediate layer: RD Gateway over HTTPS, or a VPN tunnel. Only connections that pass through that layer reach the server.

• Multi-factor authentication (MFA): a stolen password alone is not enough to sign in.
• Patch management: Windows and application updates are applied on a regular schedule.
• Least privilege: users only reach the applications and folders they need.
• Logging and monitoring: failed sign-ins and unusual connections are tracked.

Where an access model that re-verifies identity and device on every connection is required, a Zero Trust network security approach can be planned instead of, or alongside, this layer.

User profiles, printing and peripherals

On a multi-user server, profile management directly affects sign-in time and disk growth. User profiles are kept separate from the server with methods such as FSLogix profile containers or user profile disks, so that with several Session Hosts a user sees the same settings whichever server they land on.

Printers and peripherals need to be discussed before deployment. Local printer redirection works in most scenarios, but branch network printers, label printers, barcode scanners and e-signature devices are tested one by one for drivers and connectivity.

Sizing and the entry configuration

The vCPU and RAM required depend on the number of concurrent users and how heavy the applications are. The RDS server sizing calculator estimates this by user profile, and usage data from the current server on busy days is added to the calculation.

On the cloud server side, the entry configuration is 4 vCPU, 8 GB RAM and 100 GB SSD, and its monthly price starts from approximately 60–100 USD depending on the customer and the services selected. RDS deployments may need a larger configuration or more than one server, depending on user count. The final price, including licensing, backup and management lines, is set in the quote.

The server runs on the same infrastructure as our cloud server rental service, on VMware in the Equinix Istanbul data center. Allocated vCPU and RAM are isolated, the disk sits on central storage, and high availability means that if a physical host fails the virtual server can be restarted on another host in the cluster. The reserved-resource model is explained on our VDS server page.

Management, backup and monitoring

Routine care of an RDS server covers Windows updates, certificate renewals, user and group management and tracking session issues. If there is no in-house team for this, these tasks can be handed to the MAV Cloud team through Windows Server management.

High availability protects against hardware failure, but it does not bring back a deleted folder or data encrypted by ransomware. Regular backup of server and user data to a different environment is planned under our cloud backup service.

Migrating from an office server

Applications, databases and shared folders on the on-premises server are inventoried first. The target configuration is defined, applications are tested for correct behaviour in multi-user sessions, a downtime window is planned and rollback steps are prepared.

Erler Otomotiv’s on-premises systems and Lets Club’s systems were each moved to the cloud over a weekend, so working days were not affected.

SLA and certifications

MAV Cloud’s service level agreement sets a monthly 99.9% availability target for the cloud server service, with first-response targets of 15 minutes for critical, 1 hour for high, 4 hours for medium and 1 business day for low priority.

MAV Cloud is certified to ISO/IEC 27001, ISO/IEC 27701, ISO 22301, ISO/IEC 20000 and ISO 9001. Information security, personal data management, business continuity and service management processes are audited against these standards.

Frequently Asked Questions

Are RDS licenses included in the quote?

RDS CAL requirements are planned at the quote stage based on user or device count. The licensing model and the channel through which licenses are provided are set out as a separate line in the quote.

How many users can one server handle?

That depends on how heavy the applications are and how many users work at the same time. A first estimate comes from the RDS server sizing calculator, and the final decision uses current usage data.

Do users connect to the server directly over the internet?

No. The RDP port is not exposed to the internet. Connections go through RD Gateway or a VPN and are protected with multi-factor authentication.

Will branch printers work?

Local printer redirection works in most scenarios. Network printers, label printers and specialised peripherals are tested one by one before the move.

Where is the data kept?

Servers run in the Equinix Istanbul data center on VMware infrastructure. Data stays in Turkey.

If the user and application list is not clear yet, the free assessment is a good place to start. If the requirements are already known, the quote form is the fastest route.