Configure AD on WIn2016 with RemoteApp

The goal for this project: Be able to deliver RemoteApps as .RDP and/or ZIP from a Windows 2016 Server. In Win 2008 R2, this is possible using "workgroup" (single stand-alone server) and it is pretty easy. In all later editions, including target Win20016, you more or less must have the computer as member in a domain - the install program will not let you install it without it. I have 2 x Windows 2016 Standard vm's (with public static IP) that you will have access to through a fast proxmox-html5-viewer. One is going to be the domain controller (I know the forrest name, which is a non-existent sub-domain of a real domain) and one is going to be the RemoteApp server that has a few Windows-programs installed. Please note that while you only will work with two servers, the "design" of Active Directory should be prepared to handle many more completely independent "children"-servers and all these children-servers should have local administrator access (inside their "children") using the built-in, default Administrator-username. Plan the AD for this. Your tasks: 1. Plan and determine best AD-layout. You should give me the best options for having a low-maintenance setup. Please remember that I don't have to much use for a domain-controller beside getting past the installer and it is really only to be able to set up apps and users on the children. Each of the children-servers (domain members) are different small organizations and they mostly have their own users that is only used on that single server. 2. Setup your plan above and document all tasks you do so I can reproduce it. It should be in writing with step-by-step instructions (please don't notepad). I will test on a fresh install before money is released and project is done. 3. Make sure the two computers works and that users can get their RDP-files (not only webaccess). That means installing all required components to easly customize and publish RDP-files in a signed public portal. - As little components as possible: If I don't need a gw-server, don't add it. - Should be using a signed certificate in the RemoteApp connection/RDP. So - a key ready to use RemoteApp-server without error-msgs and an easy way to get one-click extract RDP to users desktop. I have made an attempt on this myself, but my time is limited and I faced issues on how to get apps appear into the portal when logging in (since the children-server requires a Group from AD to be the logged-in user). So I choose to rather learn from the expert, that is you! Hopefully, this will take shorter time than trying to debug my mistakes. If you think this is for you: Let me know what you plan on doing and maybe we can work! I expect you know Windows by heart and don't have to Google/Youtube everything like me (because then I could just do it myself and use a lot of time). Using Powershell commands or scripted setup to save from mistakes is a big, big plus! Delivery: - Documented step-by-step (what do I type where) in Word or similar. - Working setup on those two machines - with at least two example apps like WordPad (with redistributeable RDP-to-desktop or ZIP). PS: If you think a portal on the AD/DC for all users are more effective to distribute RDP/ZIP or other methods that is secure, I want to hear those ideas as well.