Author: Carl Stalhood

Navigation

This post applies to all Omnissa Horizon versions 2006 (aka 8.0) and newer.

• Change Log
• Upgrade
• Install/Upgrade Connection Server
  • Install Replica Connection Server
• Horizon Connection Server Certificate
  • Horizon Console Certificate Management
  • Install Cert Manually
• Horizon Portal:
  • Client Installation Link
  • Portal Branding
• LDAP Edits
  • Mobile Client – Save Password
  • Biometric Authentication – iOS Touch ID, iSO Face ID, Fingerprints, Windows Hello
• Load Balancing
• Remote Desktop Licensing
• Antivirus
• Help Desk Tool – Timing Profiler
• Logon Monitoring

💡 = Recently Updated

Change Log

• 2025 Jan 29 – updated for Horizon 2412
• 2024 Nov 21 – Windows Server 2025 is not yet supported. 
• 2024 July 27 – updated entire article for Omnissa Horizon 2402 (8.13)
• 2023 Jan 20 – added Horizon Console Certificate Management in Horizon 2212.

Upgrade

If you are performing a new install, skip to Install Horizon Connection Server.

Notes regarding upgrades:

• For supported upgrade paths (which version can be upgraded to which other version), see Omnissa Interoperability Matrix.
• Horizon 2412 (8.14) and newer require newer Omnissa license keys.
• Horizon 7 license key does not work in Horizon 2006 (8.0) and newer. You’ll need to upgrade your license key to Horizon 8.
• Horizon 8.x no longer supports Horizon Clients 5.x and older.
• According to Omnissa 78445 Update sequence for Horizon 7, Horizon 8, and compatible Omnissa products, App Volumes Managers are upgraded before upgrading Connection Servers.
• Upgrade all Connection Servers during the same maintenance window.
  • Horizon Agents cannot be upgraded until the Connection Servers are upgraded.
  • Horizon 2006 (8.0) and newer do not support Security Servers. The replacement is Unified Access Gateway.
  • Composer was removed from Horizon 2012 (8.1) and newer. All editions of Horizon 2006 (8.0) and newer support Instant Clones. See Modernizing VDI for a New Horizon at Omnissa Tech Zone for migration instructions.
  • Downgrades are not permitted.
    • You can snapshot your Connection Servers before beginning the upgrade. To revert, shut down all Connection Servers, then revert to snapshots.
  • For Cloud Pod Architecture, you don’t have to upgrade every pod at once. But upgrade all of them as soon as possible.
  • All Connection Servers in the pod must be online before starting the upgrade.
  • It’s an in-place upgrade. Just run the Connection Server installer and click Next a couple times.
  • Once the first Connection Server is upgraded, Horizon 2006 (8.0) and newer lets you upgrade the remaining Connection Servers concurrently.
  • After upgrading all Connection Servers to Horizon 2012 (8.1) or newer, see Omnissa 80781 Knowledge DML scripts for data population of new columns in view Events Database to backfill the Events Database with column data to improve Events query performance.
• Upgrade the Horizon Group Policy template (.admx) files in sysvol.
• Upgrade the Horizon Agents.
  • Persona is no longer supported. The replacement is Omnissa Dynamic Environment Manager. Or Microsoft FSLogix. See Modernizing VDI for a New Horizon at Omnissa Tech Zone for migration instructions.
  • If App Volumes Agent is installed, then uninstall it before you upgrade the Horizon Agent. See Omnissa 2118048 Agent installation order for Horizon, Dynamic Environment Manager, and App Volumes.
    • Otherwise, Horizon Agent is an in-place upgrade. Just run the installer on your gold images and full clones.
  • There’s no hurry. Upgrade the Horizon Agents when time permits.
• DEM Console should not be upgraded until all DEM Agents are upgraded.
• Upgrade the Horizon Clients.
  • Horizon Clients can be upgraded any time before the rest of the infrastructure is upgraded.

Install/Upgrade Horizon Connection Server

The first Horizon Connection Server must be a Standard Server. Subsequent Horizon Connection Servers are Replicas. Once Horizon Connection Server is installed, there is no difference between Standard and Replica.

A production Horizon Connection Server should have 10 GB of RAM and 4 vCPU. Each Horizon Connection Server can handle 4,000 user connections.

Horizon 2412 (8.14) is the latest release.

• Horizon 2312.1 (8.12.1) is also an Extended Service Branch (ESB) release, which is supported for 3 years from the January 2024 release date.
• Horizon 2212.1 (8.8) is also an Extended Service Branch (ESB) release, which is supported for 3 years from the January 2023 release date.

To install the first Horizon Connection Server:

1. Ensure the Horizon Connection Server has 10 GB of RAM and 4 vCPU. Source = Hardware Requirements for Horizon Connection Server at Omnissa Docs.
2. Horizon 2111 (8.4) and newer support Windows Server 2022. Windows Server 2025 is not yet supported. 
3. Horizon 2006 (8.0) and newer support Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019. See 78652 Supported Operating Systems and MSFT Active Directory Domain Functional Levels for Omnissa Horizon 8.
4. Horizon 2312 and newer no longer support Windows Server 2012 R2.
5. Horizon 2006 (8.0) and newer no longer need Flash.
6. Instant Clones in Horizon 2303 and newer require vSphere 7 or newer. vSphere 6.7 and older will not work.
7. Download Horizon 2412 (8.14) Horizon Connection Server.
   
8. Run the downloaded Omnissa-Horizon-Connection-Server-x86_64-2412-8.14.0.exe.
   
9. In the Welcome to the Installation Wizard for Omnissa Horizon Connection Server page, click Next.
   
10. In the Destination Folder page, click Next.
    
11. In the Installation Options page, select Horizon Standard Server, and click Next.
    
12. In the Data Recovery page, enter a password, and click Next.
    
13. In the Firewall Configuration page, click Next.
    
14. In the Initial Horizon Administrators page, enter an AD group containing your Horizon administrators, and click Next.
    
15. In the User Experience Improvement Program page, uncheck the box, and click Next.
    
16. In the Operational Data Collection page, click Next.
    
17. In the Ready to Install the Program page, click Install.
    
18. In the Installer Completed page, uncheck the box next to Show the readme file, and click Finish.
    

Install Horizon Connection Server Replica

Additional Horizon Connection Servers are installed as Replicas. After installation, there is no difference between a Replica server and a Standard server.

A production Horizon Connection Server should have at least 10 GB of RAM and 4 vCPU.

To install Horizon Connection Server Replica:

1. Ensure the Horizon Connection Server has at least 10 GB of RAM and 4 vCPU. Source = Hardware Requirements for Horizon Connection Server at Omnissa Docs.
2. Horizon 2111 (8.4) and newer support Windows Server 2022. Windows Server 2025 is not yet supported. 
3. Horizon 2006 (8.0) and newer support Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019. See 78652 Supported Operating Systems and MSFT Active Directory Domain Functional Levels for Horizon 8.
4. Horizon 2312 and newer no longer support Windows Server 2012 R2.
5. Horizon 2006 (8.0) and newer no longer need Flash.
6. Download Horizon 2412 (8.14) Horizon Connection Server.
   
7. Run the downloaded Omnissa-Horizon-Connection-Server-x86_64-2412-8.14.0.exe.
   
8. In the Welcome to the Installation Wizard for Omnissa Horizon Connection Server page, click Next.
   
9. In the Destination Folder page, click Next.
   
10. In the Installation Options page, select Horizon Replica Server, and click Next.
    
11. In the Source Server page, enter the name of another Horizon Connection Server in the pod. Then click Next.
    
12. In the Firewall Configuration page, click Next.
13. In the Ready to Install the Program page, click Install.
14. In the Installer Completed page, click Finish.
15. Load balance your multiple Horizon Connection Servers.
16. Horizon Console > Settings > Servers > Connection Servers tab shows multiple servers in the pod.
    

Horizon Connection Server Certificate

Horizon Console Certificate Management

Horizon 2212 and newer have a Certificate Management section in the Horizon Console under Settings. Horizon 2312 and newer can manage cluster certificates in addition to machine certificates.

• The Administrators role in Horizon does not include the Certificate Management permission.

  1. Go to Settings > Administrators. On the right, switch to the tab named Role Privileges. Click Add.
     
  2. Name the role CertificateManagement or similar. Select the Manage Certificates privilege, which might be on page 2. Click OK.
     
  3. Switch to the tab named Administrators and Groups. Select your Horizon Admins group and click Add Permissions.
     
  4. Select your new CertificateManagement role and click Finish.
     
  5. If you log out, log back in, and then go to Settings > Certificate Management, the buttons should no longer be grayed out. You can either import an existing cert, or click Generate CSR to create a new cert. If you click Generate CSR, then there’s no way to use this interface to combine the signed certificate with the key, so it’s probably better to use some other method of creating a certificate and export it as a .pfx file.
     
  6. Click Import to upload a PFX file to the Connection Server that you are currently connected to. For Machine Identity, you’ll have to repeat this process on each Connection Server.
     
  7. In certlm.msc on the Connection Server, notice that it sets the vdm friendly name on the imported cert, but it doesn’t remove the vdm friendly name from the old cert. You’ll need to manually remove the vdm friendly name from the old cert.
     
  8. Then open services.msc and restart the Omnissa Horizon Secure Gateway service or VMware Horizon View Security Gateway Component service.
     
  9. Repeat this process on the other Connection Servers.

Install Cert Manually

Alternatively, install a certificate without using Horizon Console:

1. Run certlm.msc. Or run mmc, add the Certificates snap-in, and point it to Computer > Local Machine.
2. Request a new certificate with a common name that matches the FQDN of the Connection Server or import a wildcard certificate.
   
3. Note: the private key must be exportable. If using the Computer template, click Details, and then click Properties.
   
4. On the Private Key tab, click Key options to expand it, and check the box next to Mark private key as exportable.
   
5. In the list of certificates, look for the one that is self-signed. The Issuer will be the local computer name instead of a Certificate Authority. Right-click it, and click Properties.
   
6. On the General tab, clear the Friendly name field, and click OK.
   
7. Right-click your Certificate Authority-signed certificate, and try to export it.
   
8. On the Export Private Key page, make sure Yes, export the private key is selectable. If the option to export the private key is grayed out, then this certificate will not work. Click Cancel.
   
9. Right-click your Certificate Authority-signed certificate, and click Properties.
   
10. On the General tab, in the Friendly name field, enter the text vdm, and click OK. Note: only one certificate can have vdm as the Friendly name.
    
11. Then open services.msc and restart the Omnissa Horizon Secure Gateway service or VMware Horizon View Security Gateway Component service. It will take several minutes before you can connect to Horizon Administrator Console.
    
12. Horizon Console > Monitor > Dashboard > System Health > View > Components > Connection Servers should show the Machine Identity Certificate as Valid.
    
    

Horizon Portal – Client Installation Link

If you point your browser to the Horizon Connection Server (without /admin in the path), the Install Omnissa Horizon Client link redirects to the Omnissa.com site for downloading of Horizon Clients. You can change it so that the Horizon Clients can be downloaded directly from the Horizon Connection Server.

1. These instructions changed in Connection Server 2406.
2. On the Horizon Connection Server, go to C:\Program Files\Omnissa\Horizon\Server\broker\webapps\portal or C:\Program Files\VMware\VMware View\Server\broker\webapps\portal.
3. Create a new folder called downloads.
   
4. Copy the downloaded Horizon Client 2412 for Windows to the new C:\Program Files\Omnissa\Horizon\Server\broker\webapps\portal\downloads folder.
   
5. Run Notepad as administrator.
   
6. Open the file C:\ProgramData\Omnissa\Horizon\portal\portal-links-web-client.properties or   C:\ProgramData\VMware\VDM\portal\portal-links-html-access.properties file with a text editor (as Administrator).
   
7. Go back to the downloads folder and copy the Horizon Client filename.
   
8. In Notepad, modify link.win32 and link.win64 by specifying the relative path to the Horizon Client executable under /downloads. There’s only one Horizon client for both 32-bit and 64-bit. The following example shows a link for the Horizon win64 client.

   link.win64=/portal/downloads/Omnissa-Horizon-Client-2412-8.14.0-12437220870.exe

9. Then Save the file.
   
10. Restart the Omnissa Horizon Servlet Host service or the VMware Horizon View Web Component service or restart the entire Connection Server.
    
11. It will take a few seconds for the ws_TomcatService process to start, so be patient. If you get a 503 error, then the service is not done starting.
    
12. Now when you click the link to download the client, it will grab the file directly from the Horizon Connection Server.
    
13. Repeat these steps on each Connection Server.

Portal Branding

Paolo Valsecchi at VMware Horizon 8: customize the login page details how to brand the Horizon portal page.

LDAP Edits

Mobile Client – Save Password

If desired, you can configure Horizon Connection Server to allow mobile clients (iOS, Android) to save user passwords.

1. On the Horizon Connection Server, run ADSI Edit (adsiedit.msc).
   
2. Right-click ADSI Edit, and click Connect to.
   
3. Change the first selection to Select or type a Distinguished Name, and enter dc=vdi,dc=vmware,dc=int.
4. Change the second selection to Select or type a domain or server, and enter localhost. Click OK.
   
5. Navigate to Properties > Global. On the right, double-click CN=Common.
   
6. Scroll down, click to highlight pae-ClientCredentialCacheTimeout, and click Edit.
   
7. Enter a value in minutes. 0 = no saving of credentials. -1 = no timeout. Click OK.
   

Biometric Authentication – iOS Touch ID, iOS Face ID, Fingerprints, Windows Hello

Biometric authentication, including Touch ID, Face ID, and Fingerprints, is disabled by default. To enable: (source = Configure Biometric Authentication at Omnissa Docs)

1. On the Horizon Connection Server, run ADSI Edit (adsiedit.msc).
2. Right-click ADSI Edit and click Connect to…
3. Change the first selection to Select or type a Distinguished Name and enter dc=vdi,dc=vmware,dc=int.
4. Change the second selection to Select or type a domain or server and enter localhost. Click OK.
5. Navigate to Properties > Global. On the right, double-click CN=Common.
   
6. Find the attribute pae-ClientConfig and double-click it.
   
7. Enter the line BioMetricsTimeout=-1, and click Add. Click OK. The change takes effect immediately.
   

Load Balancing

See Carl Stalhood’s Horizon Load Balancing using Citrix NetScaler.

Remote Desktop Licensing

If you plan to build RDS Hosts, then install Remote Desktop Licensing somewhere. You can install it on your Horizon Connection Servers by following the procedure at https://www.carlstalhood.com/delivery-controller-2402-ltsr-and-licensing/#rdlicensing.

Antivirus

Omnissa Tech Zone Antivirus Considerations in a Horizon Environment: exclusions for Horizon View, App Volumes, User Environment Manager, ThinApp

Help Desk Tool Timing Profiler

Run the following command to enable the timing profiler on each Connection Server instance to view logon segments in the Help Desk tool. See Omnissa Docs for more info.

vdmadmin -I -timingProfiler -enable

Related Pages

• Back to Omnissa Horizon 8