Parallels Remote Application Server 19, hands on: Flexibility, security and usability are all improved

Remote and hybrid work isn’t going away, and even organizations who were never interested in VDI (Virtual Desktop Infrastruacture) now need to offer remote access to applications and Windows desktops, and cloud services are an attractive way to do that. 

It still supports the full range of hypervisors you’re likely to have on local, hosted or cloud infrastructure (Hyper-V, vSphere, Nutanix and Scale Computing), but the latest version of Parallels RAS adds support for AWS EC2 to its existing Azure Virtual Desktop integration, with autoscaling as well as cost control options that are even more important for cloud services that bill by usage. 

This functionality is presented in a friendly graphical interface with wizards, dropdowns and checkboxes to guide you through common tasks whether you’re using local or cloud infrastructure, making the more powerful features accessible to even less experienced admins who may not be confident working in cloud portals or relying on the command line. Whether you’ve got one virtual desktop environment or a hybrid setup that mixes on-premises, hosting and one or more cloud providers, you can manage it all from the same interface. 

That includes security features like certificates and MSA. You can now request a free LetsEncrypt SSL certificate to secure connections to virtual desktops directly from the Parallels interface rather than generating a self-signed certificate and have it automatically renewed as necessary. That means you don’t have to remember to get a new certificate every 90 days or have users locked out if you forget. Parallels RAS already supports multi-factor authentication (MFA) with standard TOTP Authenticator apps like Microsoft Authenticator and Google Authenticator: now you can use multiple MFA providers or migrate from one to another, so you don’t need to stand up a separate RAS environment if one team wants to use a different MFA vendor.  

One of the main reasons for offering virtual desktops in the first place is to give staff access to applications that only work on Windows, and it’s just as important to avoid getting locked into ‘golden images’ that are hard to update on virtual desktops as it is with physical machines, so Parallels RAS 19 adds support for MSIX App Attach (the replacement for App-V). Package an application as a VHD, VHDX or the more compact MSIX CIM format (there are tools that will convert MSI installers to MSIX packages that Parallels can import), assign it to a session host and use tags for versioning and you can deploy and update applications without needing to make any changes to the RAS template. Mark a package as Pre-production while you’re testing the latest version of the app, then switch the tag to Production and users will automatically get that new version when they next open the app, without needing to log off and back on again to get the update. 

Sometimes you do want users to log off, of course. With cloud desktops you pay by the hour or even the minute, and while it’s good practice to allow flexible working you also need to control costs. For teams with core working hours, you can schedule automatic shutdown for specific pools of servers, including a message explaining to users when the shutdown will happen and why. You can set individual or groups of session hosts to shut down in the evening, start back up in the morning ready for your users and stay off over the weekend to save money. 

You can also restrict logon hours so that one person logging in for five minutes of work before bed doesn’t spin up a pool of servers that stay on all night (this is particularly useful if you have users in countries like Germany where there are strict limits on what hours staff are expected to work). We like the graphical view that makes it clear when user can and can’t log on, but the interface for setting that is a little fiddly: you can select a whole day or a specific hour to block by clicking, or click and drag to select multiple hours or days, but we spent a lot of time clicking individual day and hour blocks before discovering those shortcuts. 

With any of these restrictions you need to warn users when resources will be available and when they will lose access. Setting log-on hours doesn’t actually log users off unless their session is idle, so if they’re finishing up some urgent work they can snooze the notifications or extend their session and carry on working. You will also have to upgrade all your users to the latest Parallels Client if you set log-on hour restrictions as earlier clients won’t be able to connect at all. 

Having this as a separate option from the scheduled power management makes sense because you can restrict hours for specific groups of users if you have different shifts of workers or staff in different time zones sharing the same infrastructure. 

The interface for picking users and groups to apply log-on hour restrictions is rather like creating a rule in Outlook, and this shows up other places such as controlling MFA requirements, who has access to published resources, and what connection policies are applied. You can make rules to allow or deny access and filter who they apply to by user, group, gateway, MAC address, device name, OS and other criteria, and set the details of connection policies by ticking checkboxes from a tree of options that’s easy to navigate. This is the kind of thing that’s often managed by complex configuration files, so again, this makes it easier for less experienced admins to take over managing remote access — which can be a big help if you’re now supporting a lot more remote users with the same IT headcount. 

One big advantage of Azure Virtual Desktop and Windows 365 is that they automatically use peer-to-peer communication for Teams video to avoid latency issues (and reduce load on the cloud servers). If you want similar benefits with other desktop hosting options you can use URL redirection in RAS 19 to make sure Teams launches locally: you might want to use that for other high-bandwidth sites or where latency is critical and configuring that as a session setting will avoid having to give users complicated instructions for workarounds. 

There are some other new redirection features like picking which cameras on a Mac get redirected to the virtual desktop and using folder rather than drive redirection on iOS and Android so users can copy files between their mobile device and the remote computer. It’s also nice to see a native ARM64 Parallels client for the new thin-and-light Windows on Arm devices. And users will be very glad of one new feature: email address connection discovery. Instead of digging through their messages to find the setup instructions and creating an RDP connection by typing in what’s usually a complex server name, if you set up the details in your DNS TXT record, they can just type in their email address when they open the Parallels client and be connected to the right session host automatically.  

Both users and admins will welcome the improvements in this update, which adds support for the latest versions of Windows Server (dropping Windows Server 2008 and adding Server 2022) and other platforms — while dropping support for Internet Explorer for obvious security reasons.

Alternatives to consider

Virtual desktop infrastructure (VDI) has assumed renewed importance during the coronavirus pandemic, and there are multiple vendors who provide tools and services to deliver it. Two of the leading providers are Citrix and Vmware (NB: Citrix DaaS — desktop as a service — was formerly known as Citrix Virtual Apps and Desktops).

RECENT AND RELATED CONTENT

Parallels Remote Application Server 18: More tools for admins, better experiences for users