Where to put Session Host

Hello,

Just wanted to find out the consensus on where you would put your session host DMZ with specific rules to get to file share and resources OR on the Internal LAN? RD WEB and Gateway are in the DMZ

I am only thinking about where there might be a weak password(Complexity is on but asdFGH123 would pass :that )) that allows a hacker into the network

Any thoughts?

Thanks

Robbie

P.S> can I put TMG in front of RD WEB to use as single sign on?