itopia Cloud Automation Stack (CAS) supports provisioning and managing Cloud VDI deployments running Windows 10 Session Hosts. Cloud VDI running on Windows 10 has several important distinctions from Cloud VDI running on Remote Desktop Services (RDS), however both VDI types can be used within the same deployment. This article will provide an overview of Windows 10 support in itopia CAS.

For new deployments created in CAS, itopia CAS offers two distinct deployment types:

It is important to note that new deployments created with Windows 10 Only support cannot be converted to Remote Desktop Services and Windows 10 deployments at this time; thus, if you are unsure whether your deployment will require RDS support in the future, it is recommended to create the deployment with support for both RDS and Windows 10.

Existing CAS deployments are considered Cloud VDI using Remote Desktop Services and Windows 10; as such, Windows 10 Collection Pools can be created in most existing CAS deployments, provided that the additional requirements described below are fulfilled.

Deployments created with Remote Desktop Services (RDS) and Windows 10 support include RDS infrastructure such as the RD Broker, RD Web, and RD Licensing roles. This allows for the creation of multi-session Collection Pools using the RD Session Host role on Windows Server, in addition to single-session Collection Pools running Windows 10.

Deployments created with Windows 10 Only support do not include Remote Desktop Services (RDS) infrastructure such as the RD Broker, RD Web, or RD Licensing roles. As such, it is not possible to provision multi-session Collection Pools using the RD Session Host role on Windows Server.

Windows 10 Only deployments do include the Remote Desktop Gateway role, which is used to provide secure end-user connectivity to their Cloud VDI sessions using HTTPS. In a Windows 10 Only deployment, this role is installed on one or more servers in a standalone configuration, independent of RDS infrastructure.

Due to licensing restrictions from Microsoft, Google Cloud supports GCE VM instances running Windows 10 only when used with sole-tenant nodes (STNs). A sole-tenant node is a hypervisor host server that is reserved only for your GCP project, effectively providing your project with dedicated usage of the server. STNs can be beneficial for regulatory and compliance needs where shared workloads are not permitted, as well as for fixed budgeting purposes, as STNs are billed at a constant price regardless of the number of VMs running on the nodes. Additional information about sole-tenant nodes is available from Google.

STNs also facilitate the use of bring-your-own-license (BYOL) for Microsoft operating systems and certain applications. BYOL allows GCP customers to leverage their existing Microsoft licenses (with appropriate usage rights) for VMs running in Google Cloud. This licensing typically requires licensing of "all CPU processors and/or cores" on the physical server; STNs facilitate this requirement by providing a fixed number of CPUs on which the VMs can run, thus allowing the license to be applied to all of them.

Using the BYOL framework, Microsoft allows running properly licensed versions of Window 10 Enterprise in Google Cloud. Therefore, itopia CAS deployments that deliver Windows 10 desktops must meet the following requirements:

Windows 10 Session Hosts are provided as two new types of Collection Pools in itopia CAS:

These Collection Pool types are enabled once sole-tenant node (STN) support is configured in the CAS deployment. More information on sole-tenant nodes in itopia CAS is available in Support for Sole-Tenant Nodes.

In addition to the operating system, Windows 10 Collection Pools differ from RDS Collection Pools in several important ways:

itopia maintains a Windows 10 Enterprise OS image that can be deployed to Windows 10 Collection Pools on sole-tenant nodes. This image is considered a "vanilla" image and contains no customization or optimization for VDI environments; it only contains the drivers and components necessary to run on Google Cloud.

Administrators may prepare a custom image based on this vanilla image, or they may import their own Windows 10 Enterprise images that have been prepared in accordance with the bring your own license guidance provided by Google.

When using the itopia-provided image, it is important to note that OS licensing is not configured for the image; any VMs provisioned using this image must still be configured with the proper licensing using your organization's Windows 10 licenses. CAS allows you to configure the VMs with your licensing information in the sole-tenant node configuration settings, or you may use an alternate method such as a Group Policy Object (GPO) to configure your licensing.

When users wish to connect to their Windows 10 VMs, they will use the Cloud VDI Portal to view available Cloud VDI resources, including their Windows 10 VMs. When they select a resource, the portal will provide a customized RDP file that will open with the native RDP client on the user's local device.

itopia provides a custom RDP client that enables single sign-on (SSO) support for the Cloud VDI portal. If the end-user has the itopia RDP Client installed, they may enable SSO support in the Portal. This will use a different method to launch their Cloud VDI session and will securely send their Portal credentials to the itopia RDP client, which can then perform SSO into their desktop session without the need to log in to the Windows 10 VM.

If the itopia RDP Client is not used, itopia recommends Microsoft's first-party Remote Desktop client, available for Windows, MacOS, Android, and iOS/iPadOS. With these clients (or any RDP-compliant client), the Cloud VDI portal will download a RDP file to the user's local machine, which can be opened by their RDP client to connect to their Windows 10 VM. The user may be prompted to provide their credentials to log in to their VM, as the Portal credentials cannot be securely stored in the RDP file.

If a multi-factor authentication (MFA) solution is configured, the user will be presented with the Windows 10 login screen and the Custom Windows Credential Provider; when the user completes their MFA challenge, the Windows 10 desktop will appear.

When their session is complete, the user may log off or simply close the Remote Desktop window; CAS will automatically terminate the user's session after approximately a minute and, in a Pooled Collection, make the VM available for other users.