Unattended Desktop Flows on Windows Terminal Server (Remote Desktop Services)

[jochen_dot]

hi all, 

i am not able to find any good documentation if unattended desktop flows can run on windows server (e. g. windows server 2019 standard) if any other user is logged on that machine (not that user that is used in Power Automate to execute the flow).

On Run unattended desktop flows - Power Automate | Microsoft Learn i read that "Unattended desktop flows require an available machine with all users signed out."

On a windows server that acts as terminal server using using RDS (Remote Desktop Services) it is very unlikely that all users are signed off (that is the nature of a terminal server to provide a virtual desktop for centralized applications used by several users concurrently)..

Is an unattended desktop flow working if another user has a session on that windows server?

If not, how would an unattended desktop flow be able to work for this typical scenario?

thanks!

[OkanAT]

Hi,

If I recall correctly, you say that your VM won't have everyone logged off from the VM?

In that case, you can run your Robot in Attended :).

This will Run your robot 'Attended' (in the way that its still an Unattended running robot, but in an Attended environment).

Running it Attended should basically work for you. As someone is always logged in.

Good luck.

[jochen_dot]

i was asking for "Unattended".. "Attended" cannot work on locked sessions afaik.

and i meant "Unattended" for a user that is not logged in on that terminal server (you configure the user in your cloud flow that triggers the "unattended" flow) but what happens if other users are logged on that machine. the docu says that all users need to be logged off.

[OkanAT]

My bad,

if another user logs in on the VM that is running unattended. The flow fails with the error (user session logged in on the VM).

[OkanAT]

And to answer: How an unattended desktop will work in this scenario.

= It won't 🙂

[jochen_dot]

@OkanAT  thanks a lot for your answer.. it seems that "unattended" flows on Windows Servers that are used as terminal server (RDS) are not a good idea as terminal servers usually have a lot of concurrent users logged in (this is the nature of a terminal server).. 

would "power automate agent for virtual desktop" (Automate on virtual desktops - Power Automate | Microsoft Learn) help? The server im talking about is a physical windows server. thanks!

[OkanAT]

Hello,

Oh Yes! We are using Virtual Machines, but Physical Machines are great (Probably even quicker). I guess you mean something like a Laptop or Desktop? Yes it will help and work. 

I know big banks who use a Physical Machine to run their unattended robots.

Good luck.

[momlo · Accepted solution]

Hi @jochen_dot @OkanAT 

You CAN have unattended flow running simultaneously with other users working on the same Windows Server.

You must ensure the unattended flow uses another/dedicated Windows user/credentials, not an account used by someone else or other unattended flows.

### Examples:

#### Scenario 1 - Win 2019, no RDS, one unattended flow, one human session
- without RDS server will accept a maximum of 2 concurrent RDP sessions
- you can have one user logged in with, let's say "Developer Account" windows/domain account
- at the same time, you can execute one unattended flow using the "Unattended Service Account" windows/domain account
- no particular configuration is needed here; ensure your flow uses a desktop connection set up with a dedicated user account, different from the other user(real person) logging into the server, 
- if more unattended flows are scheduled to run at the same time, they will be queued in the machine queue

#### Scenario 2 - Win 2019, no RDS, two unattended flow
- If you want two unattended flows run on such a machine, you need two unattended add-ons, and then no 3rd session can be connected (as a Win will not accept 3rd connection), and the unattended flows need to be using DIFFERENT windows/domain accounts for their session.

- In this scenario, you might be required to install a gateway (I did not check the docs for some time, but I think it is still needed)

#### Scenario 3 - Win 2019, with RDS, multiple unattended flows and "human" sessions
- You can have a virtually unlimited number of unattended flows, but you need an RDS license for each session and enough resources.
- Ensure each unattended flow is executed using different windows/user accounts - like in scenario 1
- Ensure you have the required number of unattended addon-s; if you want five unattended flows at the same time - you need five add-ons
If you have three add-ons, three unattended flows will be able to run at the same time, and the rest will be queued
- in this scenario, you might be required to install a gateway (I did not check the docs for some time, but I think it is still needed)
- So, in this scenario, you can have any number of unattended flows and people logged in, but you need to have RDS licenses for each session, an unattended add-on for each unattended flow and each of the sessions needs to be using a dedicated domain/windows account

[jochen_dot]

thanks @OkanAT , it it not laptop or desktop but dedicated physical Windows Server 2019 (not virtualized) used as Terminal Server, i guess @momlo answered the question already in the meantime, 

thanks for your support

[jochen_dot]

thanks @OkanAT , 

it is not a Laptop or Desktop but a physical Windows Server 2019 (not virtualized) used as terminal server (having parallel user sessions) .. 

@momlo answered the question so far, thanks for your support

[jochen_dot]

thanks @momlo , that is really helpful ..

just wondering that the official power automate docs says "Unattended desktop flows require an available machine with all users signed out.", see  Run unattended desktop flows - Power Automate | Microsoft Learn , would you have any explanation or is that a documentation issue?

thanks again

[momlo]

Have no idea why they phrased this that way; I think they meant that you should not be logged in as the same user as the one you used for unattended runs. And even that would not be entirely true because you can configure the machine to "reuse session", and it then takes over the existing session 🙂

MS documentation is often "out of context" and updated too early or too late compared to product releases. 

You don't need to log out users if you want to run an unattended/attended but if they are not using the same user account.

I do that every single day when building automation on my dev account and testing unattended flows as my "dev windows account" on the very same win server 🙂

Another story is whether you should mix general/user-purpose servers with automation - I would separate the two. Also, the scenario with one server and many unattended flows does not scale well as you need an extra account for every unattended bot - so manual work: create a user, make PAD connections using that user etc. - no fun.

What scales well are machine groups - where you have one user account dedicated to flows and then add more machines to the machine group whenever you need more concurrent PAD flows (and you buy more unattended add-ons to match the desired flow runs). But, of course, that can be automated too.

I don't usually ask, but you might mark the answer as a solution to help others to find it more accessible.

[OkanAT]

@momlo Thanks for the insights!

The phrase @jochen_dot gave and linked to the docs "Unattended desktop flows require an available machine with all users signed out.", Could this not be the case whenever a user is Logged in and an Unattended flow is ran? From experience I can say that our VM doesn't throw me out when I log in while an unattended flow is running, but when I'm logged in the VM can kick me out or won't run another Unattended flow. 

[momlo]

Hey @OkanAT 

Win10/11 (I described the server behaviour in the other post)
If you are logged in to the win10 machine with "Okan" and then you try to run unattended flow using the "SecretBot" account, that flow will not be able to run as Win 10 allows 1 user session.

If you are logged in to the win10 machine with "Okan", and then you try to run an unattended flow using the "Okan" account, that flow will not be able to run as it will throw an error that there is a connected session.

If you set "reuse session" in the machine settings. And you are logged in to the win10 machine with "Okan", and then you try to run an unattended flow using the "Okan" account, that flow will execute as it will take over/reuse session, it will not log out at the end of the work.

If you are not logged to win10 machine, and then you try to run unattended flow using the "SecretBot" account, that flow will execute. You will not be able to connect to the machine using “Okan” as Win10 accepts 1 session only. You will be able to login to this machine using “SecureBot” account as this will still be 1 session that you will take over, making the run “attended”.