Author: Carl Stalhood

VMware Horizon 7 – Virtual Desktop Pools

Last Modified: Mar 8, 2022 @ 8:04 am

56 Comments

This article details Horizon pool configuration for Virtual Desktops. RDS Farms and pools are detailed in a separate article at https://www.carlstalhood.com/vmware-horizon-7-rds-farmspools/.

Navigation

This post applies to all VMware Horizon 7 versions including 7.13 (ESB) and 7.10.3 (ESB).

Change Log

Non-Persistent – Instant Clone vs Composer

In general, use Instant Clone, if possible. Here are some advantages of Instant Clone over Composer:

  • No Composer server needed.
  • Faster provisioning and recompose, and lower IOPS during these operations.
  • If multiple datastores, rebalance is automatic.
    • With Composer, rebalance is a manual operation.
  • Composer features like Disposable Disks and disk space reclamation are not needed with Instant Clones.

Requirements for Instant Clones:

  • Horizon Enterprise licenses
    • All editions of Horizon 7.13 includes Instant Clone licensing. Since Composer was removed from Horizon 8, start migrating to Instant Clones.
  • ESXi 6 Update 1 or newer
  • Virtual Machine hardware version 11 or newer
  • View Storage Accelerator must be enabled

Notes on Instant Clones:

  • Horizon 7.9 and newer support delaying desktop refresh (not recommended), just like you can with Composer.
  • Horizon 7.3 and newer support dedicated desktop pools.
  • Horizon 7.1 and newer support Linked Clones for RDS Pools.
  • The master VM snapshot is copied to every LUN containing instant clones. Composer does the same.
  • Instant Clone pools create “Parent” machines on each ESXi host for each datastore. These “parent” machines are powered on and consume CPU/Memory/Disk resources. If you have six hosts and three datastores containing instant clones, then Horizon creates 18 parent virtual machines.
    • For lower density pools, Horizon 7.13 supports Smart Provisioning, which eliminates the need for “Parent” machines when there are less than 12 single-pool VMs per host. See the Smart Provisioning YouTube video for an overview.
    • Prior to Horizon 7.13, Instant Clone pools always create Parent machines no matter the size of the Instant Clone pool.
    • Composer does not need parent virtual machines.
  • Persistent disks are not supported with Instant Clones
    • An alternative is VMware App Volumes Writable Volumes
  • Persona is not supported with Instant Clones.
  • See Instant-Clone Desktop Pools at VMware Docs.
  • Also see VMware Technical White Paper VMware Horizon 7 Instant-Clone Desktops and RDSH Servers

Infrastructure Prep

  • Each desktop pool points to one vSphere cluster.
  • Ensure vSwitch has sufficient ports for the new virtual desktops.
    • Instant clones require static port binding with the elastic port allocation. Do not change the port binding to ephemeral.
  • Ensure the VLAN has enough DHCP addresses for the desktop pool.
  • KMS Licensing is required – MAK licensing is not supported
  • The virtual desktop pools will use the same hardware specs (e.g. vCPUs, memory size, network label, GPU) specified on the master virtual desktop. Adjust accordingly.
  • The master image should be in the same vSphere cluster where the linked clone virtual desktops will be created.
  • If Instant Clone:
    • ESXi must be version 6 update 1 or newer
    • Master VM must be version hardware version 11 or newer
    • In Horizon Administrator, add Instant Clone Domain Accounts
    • In Horizon Administrator, enable View Storage Accelerator on your vCenter connection.
    • If you upgrade vCenter to 6.7, then you must upgrade your ESXi hosts to 6.7 at the same time. Afterwards, take a new snapshot of the master image and perform a push operation. See Upgrade Instant-Clone Desktop Pools at VMware Docs.

Disk space

  • One or more LUNs (datastores) for storage of the virtual desktops.
  • By default, Replicas are copied to each LUN that contains virtual desktops.
    • It’s possible to place the Replica and the linked clones on separate LUNs. If you use a dedicated Replica LUN, then there is only one copy of the Replica no matter how many LUNs are used for storing virtual desktops.
    • Note: NFS VAAI requires the Replica to be copied to each virtual desktop LUN.
  • .vswp files – Plan for disk space for memory swap and graphics memory overhead. If the master virtual desktop has 4 GB of RAM configured and if none of its memory is reserved then each linked clone will have a 4 GB .vswp file.
    • To reduce the size of the .vswp files, edit each virtual desktop and reserve its memory. Whatever memory is reserved will be subtracted from the .vswp file size.
  • Linked clone Delta disks – Delta disks start small whenever the virtual desktop boots and grow until the virtual desktop is refreshed. To keep delta disks small, refresh the virtual desktops immediately after the user logs off. Otherwise, the delta disk could potentially grow to the same size as the C: drive.
  • If Composer:
    • Persistent disks can be used to store the user’s profile (but not user-installed applications). To enable Persistent disks, the pool must be Dedicated Assignment. You can place the persistent disks on a LUN that is separate from the linked clones LUN. How do you back up the persistent disks? A better option is to use VMware User Environment Manager instead of Persistent disks.
    • Disposable disks. In Dedicated Assignment pools, you have the option of creating Disposable Disks. These disks are always stored with the virtual desktop (you can’t choose a dedicated disposable disk LUN). If you’re planning to frequently refresh the desktops, there’s no point in using Disposable disks.

Floating (Non-Persistent) Automatic Linked Clone Desktop Pool

Master Image Preparation

Do the following on the master image that the virtual desktops will link to:

  1. Video Memory – if Instant Clones, shut down the master, Edit Settings (hardware) in vSphere client, expand Video card, and set video memory. More video memory means more client monitors. The maximum number and maximum resolution of client monitors depends on the ESXi version, the Horizon version, and the Windows version with newest versions providing the greatest number of client monitors. For example, Horizon 7.9 supports six monitors in Windows 10 version 1803 and later.
  2. DHCP – Make sure the master VM is configured for DHCP.
  3. Join domain – Join the master VM to the domain.
  4. Computer Group Policy – Make sure the Master VM is in the same OU as the Linked Clones so the Master VM will get the computer-level GPO settings. Run gpupdate on the master after moving the VM to the correct OU. New Instant Clones do not immediately refresh group policy so the group policy settings must already be applied to the master VM. See VMware 2150495 Computer-based Global Policy Objects (GPOs) that require a reboot to take effect are not applied on instant clones.
  5. KMS Licensing is required.
  6. Provisioning Agent – When installing Horizon Agent, select the imaging component you intend to use. You can install Instant Clone, or Composer, but not both.
    • All editions of Horizon 7.13 includes Instant Clone licensing. Since Composer was removed from Horizon 8, start migrating to Instant Clones.
  7. If Instant Clone, Persona must be disabled.
  8. Snapshot – Shut down the master image and take a new snapshot.

Floating Pool – Horizon Console

In Horizon 7.5 and newer, you can use the new Horizon Console (https://ConnectionServerFQDN/newadmin) to create an Instant Clone pool.

In Horizon 7.8 and newer, you can use the new Horizon Console (https://ConnectionServerFQDN/newadmin) to create a Composer pool, including Persistent Disks.

If prefer to use Horizon Administrator, then skip ahead to Floating Pool – Horizon Administrator.

  1. Login to Horizon Console (https://ConnectionServerFQDN/newadmin)
  2. On the left, under Inventory, click Desktops.
  3. In Horizon Console 7.10 and newer, on the right, if you select an existing pool, you can click Duplicate to copy the settings to a new pool.
  4. On the right, click Add.
  5. In the Type page, select Automated desktop pool.
  6. In the vCenter Server page, select Instant Clone, select a vCenter server, and click Next.
  7. In the User Assignment page, select Floating, and click Next.
  8. In the Storage Optimization page, if you want to use storage tiering, check the box for Select separate datastores for replica and OS disk. Click Next.
  9. In the Desktop Pool Identification page, do the following:
    1. Give the pool a unique ID, which is not shown to the users. Horizon creates a vCenter VM folder with the same name as the Pool ID.
    2. Enter a Display name, which is shown to the users.
    3.  If you intend to use Identity Manager, then leave Access group set to /. Otherwise, if you intend to delegate administration of this pool, then select an Access group that the delegated administrators have been assigned to.
  10. Click Next.
  11. In the Provisioning Settings page, do the following:
    1. in Virtual Machine Naming, enter a Naming Pattern. You can use {n:fixed=3} to specify the location for incremented numerals in the machine names. Make sure the naming pattern does not conflict with any existing machines.
    2. In Desktop Pool Sizing, enter the maximum number of desktops to create. Ensure that the DHCP scope has enough addresses for the Max number of desktops specified here.
    3. Select Provision all machines up-front to create all of the machines now.
    4. Or select Provision machines on demand, which tells Horizon to create the machines (up to the maximum) as users connect.
    5. If you’re not creating all machines up-front, then specify the Number of spare (powered on) machines. As users connect, Horizon creates more machines to try to keep this number of spare machines running and waiting for a new connection.
  12. Click Next.
  13. In the vCenter Settings page, most of these are self-explanatory. Click Browse next to each option, and make your selection.
  14. If the Parent VM (aka Master VM) is not showing up in the list, then check the box next to Show all parent VMs and click the … next to the VM to see the issue.
  15. Instant Clones monitors/resolution – If Instant Clones, the number of monitors configured on the Master Image (snapshot) is displayed. If not correct, delete the snapshot, edit the master VM’s Hardware Settings, expand video card, make your desired changes, and take another snapshot.
  16. Scroll down for more settings.
  17. Datastores – select one or more datastores on which the virtual desktops will be placed.
    • If you selected to put Replica on a different datastore, then you’ll have another Browse button for Replica disk datastores.
  18. When selecting Networks, you can use the Network from the parent image, or uncheck the box and select a different network.
  19. Click Next when done.
  20. In the Desktop Pool Settings page:
    1. You can select a Category Folder where the published icon will be placed on the client’s Start Menu and/or Desktop. This applies to Horizon Client 4.6 and newer. See Create Shortcuts for a Desktop Pool at VMware Docs.

      1. Change the selection to Select a category folder from the folder list.
      2. You can type in a new category, or select an existing one.
      3. Newer versions of Horizon have an option to put the icon on desktop or Start Menu.
      4. Then click Submit.
    2. In the Desktop Pool Settings page, Horizon 7.9 and newer let you select a Session Type, which means you can optionally publish applications from virtual desktops.
    3. Change the selection for Automatically logoff after disconnect to After, and specify a disconnect timer.

      • Note: In Horizon 7.10 or newer, you can also use Group Policy to configure this. The GPO overrides the pool setting. Install the Horizon 7.10 GPO Templates if you haven’t already. Edit a GPO that applies to the Horizon Agents. Find the Disconnect Session Time Limit (VDI) setting at VMware View Agent Configuration > Agent Configuration.
      • Horizon 7.10 also has an Idle Time Until Disconnect (VDI) for virtual desktops. RDSH idle timer is configured using Microsoft RDSH GPO settings, not Horizon GPO settings.
    4. You can allow users to restart their machines.
    5. If you choose Dedicated assignment instead of Floating assignment, there’s an option for Refresh OS disk after logoff. Leaving it set to Always is strongly recommended. The other options cause the delta disk to grow, and will cause data loss surprise for the users when you later push a new image. Instant Clones floating assignment pools always refresh on logoff.
    6. Reclaim VM disk space is also an option for Dedicated assignment pools. Floating assignment pools always refresh on logoff so there’s no need to reclaim disk space.
  21. Click Next.
  22. In the Remote Display Settings page:
    1. In 3D Renderer, there’s an option for NVIDIA GRID VGPU if you have GPUs installed.
    2. Check the box next to HTML Access.
    3. There’s an Allow Session Collaboration checkbox, which adds a VMware Horizon Collaboration icon in the system tray of the remote desktop, which lets you invite users to collaborate.  See Session Collaboration for details.
  23. Click Next.
  24. In the Guest Customization page,
    1. Next to AD container, click Browse, and select the OU where virtual desktop computer objects will be placed. You can type (paste) into the AD container field.
    2. Consider checking the box next to Allow reuse of pre-existing computer accounts.
  25. Click Next.
  26. In the Ready to Complete page, you may entitle users now, or leave it unchecked and to it later. Click Submit.

If you opted to add entitlements now:

  1. In the Add Entitlements window, click Add.
  2. Find a group that will have permission to log into these desktops, and click OK.
  3. Then click OK.

To check the status of the virtual desktops:

  1. Go to Inventory > Desktops.
  2. You might have to click the refresh icon on the top right to see the new pool.
  3. Click the link for the pool name.
  4. On the Summary page, if you scroll down, the vCenter Server section has a State field where you can see the status of the pool creation process.  It takes several minutes to publish the master image snapshot. After the snapshot is copied to the Replica, vSphere creates a digest file for View Storage Accelerator, which takes a few more minutes.
  5. Horizon Console 7.11 and newer has a Pending Image progress bar that doesn’t update automatically. To refresh it, scroll up and click the refresh icon.

  6. You can watch the progress in vSphere Client’s Recent Tasks list.


  7. Eventually the pool’s tabs named Machines and Machines (InstantClone Details) will show the new machines.

If you wish to automate the creation of the pool, Aresh Sarkari at Automating Desktop Pool creation using PowerCLI – VMware Horizon 7.x explains New-HVPool -spec 'C:\temp\DesktopPool\LinkedClone.json' and the contents of the JSON file.

Floating Pool – Horizon Administrator

  1. In View Administrator, on the left, expand Catalog, and click Desktop Pools.
  2. On the right, you can clone an existing pool. This action copies many of the settings from the existing pool into the new pool.
  3. Or just click Add.
  4. In the Type page, select Automated Desktop Pool, and click Next.
  5. In the User Assignment page, select Floating, and click Next.
  6. In the vCenter Server page, select either Instant clones, or View Composer linked clones.
    • All editions of Horizon 7.13 includes Instant Clone licensing. Since Composer was removed from Horizon 8, start migrating to Instant Clones.
  7. Select the vCenter server, and click Next.

  8. Pool name – In the Desktop Pool Identification page, enter a name for the pool. Horizon creates a vCenter VM folder with the same name as the Pool ID.
  9. Display name is the name of the icon displayed in Horizon Client.
  10. Access Group – Assign the pool to an Access group to restrict delegated administration. Note: If you intend to integrate with VMware Identity Manager (aka Workspace ONE), then make sure you select the root (/) Access group. Other Access Groups won’t work. Click Next.
  11. In the Pool Settings page, do the following:
    1. Horizon 7.3 lets you select a Category Folder where the published icon will be placed on the client’s Start Menu. This applies to Horizon Client 4.6 and newer. See Create Shortcuts for a Desktop Pool at VMware Docs.
    2. Horizon 7.5 adds an option to put the shortcut on the endpoint’s Desktop.
    3. Change the selection for Automatically logoff after disconnect to After, and specify a disconnect timer.
    4. If View Composer, change the selection for Delete or refresh desktop on logoff to Refresh Immediately. Instant Clones always refresh after logoff.
    5. Horizon 7.1 and newer allows users to restart machines gracefully, instead of a reset.
    6. Scroll down.
    7. In the Remote Display Protocol section, select a Default display protocol. New in Horizon 7 is VMware Blast.
    8. In Horizon 7.3.1 and newer, if you set the Default display protocol to PCoIP, then HTML5 Blast won’t work unless Allow users to choose protocol is set to Yes. See VMware Communities Upgraded from 7.0.1 to 7.3.1, getting “You cannot access your applications or desktops”… error.
    9. Composer and Instant Clone have different options for 3D Renderer. Horizon 7.1 adds an option for NVIDIA GRID VGPU when creating Instant Clones.

      • Monitors/Resolution – If Composer, increase the number of monitors and resolution. This causes more video memory to be allocated to the VMs. If Instant Clone, these settings are configured on the Master VM’s settings in vSphere Client.
    10. Check the box next to HTML Access.
    11. Horizon 7.4 adds the Allow Session Collaboration checkbox, which adds a VMware Horizon Collaboration icon in the system tray of the remote desktop, which lets you invite users to collaborate. See Session Collaboration for details.
    12. Click Next.
  12. In the Provisioning Settings page, enter a naming pattern. You can use {n:fixed=3} to specify the location for the incremented numerals. Make sure the naming pattern does not conflict with any existing machines. Note: Instant Clones does not support manual machine names.
  13. Enter the maximum number of desktops to create. You can create all of them now or wait to create them as users connect. When a user connects to one of these desktops, Horizon immediately creates another desktop (up to the maximum) and powers it on.
    1. In Horizon 6.2 and newer, the maximum number of desktops per pool is 2,000. Ensure that the DHCP scope has enough addresses for the Max number of desktops specified here.
  14. Enter the number of spare (idle, unassigned, unused) desktops you want powered on. Horizon maintains this number up to the maximum number of desktops.
  15. Click Next.

  16. If Horizon Composer, in the Disposable File Redirection page, select Do not redirect disposable files, and click Next. Since we’re refreshing the desktops on logoff, there’s no need for a separate disposable disk.
  17. In the Storage Optimization page, if you want to use storage tiering, check the box for Select separate datastores for replica and OS disk. Click Next.
  18. In the vCenter Settings page, most of these are self-explanatory. Click Browse next to each option, and make your selection.
  19. Horizon 7.1 adds the ability to select multiple Networks for the Instant Clones.
  20. If the Parent VM is not showing up in the list then check the box next to Show all parent VMs and click the … next to the VM to see the issue.
  21. Instant Clones monitors/resolution – If Instant Clones, the number of monitors configured on the Master Image (snapshot) is displayed. If not correct, delete the snapshot, edit the master VM’s Hardware Settings, expand video card, make your desired changes, and take another snapshot.
  22. Datastores – select one or more datastores on which the virtual desktops will be placed.
  23. If Composer – select your Storage Overcommit preference. Since you are refreshing desktops on every logoff, they should stay small, so Unbounded is probably acceptable. VMware recommends no more than 140 virtual desktops per VAAI-enabled LUN. If the LUN is not VAAI enabled, 64 is the maximum. If Instant Clone, Unbounded is the only option. Click OK when done.

  24. For Select Replica Disk Datastores, select one datastore for the replica, and then click OK.
  25. Then click Next.
  26. If Instant Clone, View Storage Accelerator and Transparent Page Sharing are enabled by default and can’t be disabled. Storage reclamation doesn’t make sense for Instant Clone.
  27. If Composer, in the Advanced Storage Options page, be aware of the following:
    • View Storage Accelerator creates digest files, which consumes disk space. Creation of the digest files requires IOPS. Make sure to set the blackout times so that this digest creation does not happen during peak hours.
    • Reclaim VM disk space is not useful for non-persistent desktops.
  28. If you scroll down, there’s a new Transparent Page Sharing Scope. The default is no sharing. Use one of the other options to enable sharing. Click Next.
  29. In the Guest Customization page, next to AD container, click Browse, and select the OU where virtual desktop computer objects will be placed. Horizon 7.3 lets you type (paste) into the AD container field.
  30. Consider checking the box next to Allow reuse of pre-existing computer accounts. Click Next.

  31. In the Ready to Complete page, you may entitle users now or later. Click Finish.
  32. To check the status of the virtual desktops, go to Catalog > Desktop Pools.
  33. Double-click the pool name.
  34. If you scroll down, the vCenter Server section has a State field.
  35. vSphere Client shows recent tasks.
  36. On the Inventory tab, click Machines (View Composer or InstantClone Details). There’s a refresh button.
  37. You can also view the status of the desktops by looking at the Dashboard.
  38. Your VMs should eventually have a status of Available.
  39. If you encounter issues with View Composer, see VMware 2087379 VMware Horizon View Composer help center
  40. If Instant Clone, the Master VM and the snapshot used by the Instant Clones must not be deleted.

Entitle Virtual Desktops

Horizon Console

This section uses the new Horizon Console to add a entitle a Desktop Pool. If you prefer to use Horizon Administrator, then skip to the next section.

To make a pool accessible by a user, it must be entitled.

  1. In Horizon Console (https://ConnectionServerFQDN/newadmin), go to Inventory > Desktops.
  2. Click the link for a pool name.
  3. On the Summary tab, click the Entitlements drop-down, and then click Add entitlement. Or you can go to pool’s Entitlements tab and add from there.
  4. In the Add Entitlements window, click Add.
  5. Find a group that will have permission to log into these desktops, and click OK.
  6. Then click OK.

Horizon Administrator

To make a pool accessible by a user, it must be entitled.

  1. Go to Catalog > Desktop Pools.
  2. Double-click the pool name.
  3. On the Summary tab, click Entitlements, and then Add entitlement.
  4. In the Add Entitlements window, click Add.
  5. Find a group that will have permission to log into these desktops, and click OK.
  6. Then click OK.
  7. For a Persistent pool, go to the Inventory tab to see the desktops. Select a desktop and under More Commands click Assign User.
  8. Find the user and click OK. Repeat to assign users to additional desktops.

Add Machine to Pool

Horizon Console

This section uses Horizon Console to add a machine to an Instant Clone Pool. If you prefer to use Horizon Administrator, then skip to the next section.

  1. In Horizon Console (https://ConnectionServerFQDN/newadmin), on the left, expand Inventory, and click Desktops.
  2. On the right, highlight an existing Desktop Pool, and click Edit.
  3. Switch to the Provisioning Settings tab, scroll down, and change the Max number of machines. Then click OK.
  4. With Instant Clones, this won’t take very long.
  5. If you open the pool, the tabs named Machines and Machines (InstantClone Details) show the new machines.

Horizon Administrator

  1. On the left, expand Catalog, and click Desktop Pools.
  2. On the right, highlight an existing Automated Desktop Pool, and click Edit.
  3. Switch to the Provisioning Settings tab, and change the Max number of machines. Then click OK.
  4. With Instant Clones, this won’t take very long.
  5. With Composer, it might take a few minutes for the machine to boot a couple times while running QuickPrep.
  6. The pool now has new machines.

Update a Pool

Master Image Preparation

  1. Power on the master/parent virtual desktop.
  2. After making your changes, shut down the master virtual desktop.
  3. Right-click the virtual machine and take snapshot. You must create a new snapshot.
  4. You’ll need to periodically delete the older snapshots. Right-click the master VM, and click Manage Snapshots.
  5. Delete one or more of the snapshots.

Horizon Console

This section uses Horizon Console. If you prefer Horizon Administrator, then skip to the next section.

  1. In Horizon Console, go to Inventory > Desktops.
  2. Click the link for a pool name.
  3. For Instant Clones, on the Summary tab, click Maintain, and then click Schedule.
  4. In the Image page, select the new snapshot. Notice the snapshot’s monitor/resolution settings. Click Next.
  5. In the Scheduling page, decide when to apply this new image. If you select Force users to log off, notice you can customize the logoff message in Global Settings. Click Next.
  6. In the Ready to Complete page, click Finish.
  7. The pool’s Summary tab, near the bottom, indicates that the image is being pushed.

  8. You can click the tab named Machines (InstantClone Details) to check on the status of the push task. Notice the Pending Image.
  9. The snapshot is copied to each datastore.
  10. The snapshot is attached to a Replica, powered on, then powered off. Digest is then computed.
  11. Then the Replica is attached to a parent, and the parent is powered on. This all takes a bit of time. But the existing Instant Clones remain accessible until the Replica preparation is complete.
  12. Once Replicas are prepared, each machine is rebooted once.
  13. Eventually the Pending Image field will be cleared and the desktops are available again.

Horizon Administrator

  1. In View Administrator, go to Inventory > Pools.
  2. Double-click a pool name.
  3. For Instant Clones, on the Summary tab, click Push Image, and then click Schedule.
  4. Or if Composer, click View Composer, and then click Recompose.
  5. In the Image page, select the new snapshot. Notice the snapshot’s monitor/resolution settings. Click Next.
  6. In the Scheduling page, decide when to apply this new image, and then click Next.
  7. In the Ready to Complete page, click Finish.
  8. On the Inventory tab, you can click Machines (InstantClone Details) or Desktops (View Composer Details) to check on the status of the push/recompose task. Notice the Pending Image.
  9. For both provisioning methods, the snapshot is copied to each datastore.
  10. For Instant Clone, the snapshot is attached to a Replica, powered on, then powered off. Digest is then computed. Then the Replica is attached to a parent, and the parent is powered on. This takes a bit of time. But the Instant Clones remain accessible until the Replica preparation is complete.
  11. Once Replicas are prepared, for Instant Clones, each machine is rebooted once. While with Composer, each virtual machine is rebooted three times, which can be painful. Composer consumes considerable IOPS and time during Recompose operation. To speed up Recompose, switch to Instant Clones.
  12. Eventually the Pending Image field will be cleared and the desktops are available again.

Host Maintenance – Instant Clones

In Horizon 7.1 and newer, ESXi hosts running Instant Clones can be placed into maintenance mode without any special instructions.

Instant-Clone Maintenance Utilities at VMware Docs:

  • IcUnprotect.cmd – use this utility to unprotect folders and VMs, delete VMs, and detect VMs whose master image or snapshot is deleted.
  • IcMaint.cmd – This command deletes the master images, which are the parent VMs in vCenter Server, from the ESXi host, so that the host can be put into maintenance mode. In Horizon 7.0.3, this utility is the only method to prepare a Instant Clone ESXi host for maintenance mode. Also see VMware 2144808 Entering and exiting maintenance mode for an ESXi host that has Horizon instant clones.
  • IcCleanup.cmd – use this utility to unprotect and delete some or all of the internal VMs created by instant clones. This command is available in Horizon 7.10 and newer.

Related Pages

VMware Horizon 7.13.3 – Master Virtual Desktop

Last Modified: Mar 22, 2023 @ 6:00 am

154 Comments

Navigation

Use this post to build a virtual desktop that will be used as the parent image or source image for additional virtual desktops. There’s a separate article for RDS Session Host.

This post applies to all VMware Horizon 7 versions including 7.13.3 (ESB).

💡 = Recently Updated

Change Log

Virtual Hardware

Lieven D’hoore has a desktop VM build checklist at VMware Horizon View – Windows 10 Golden Image Creation

  1. The virtual desktop pools will use the same hardware specs (e.g. vCPUs, memory size, network label) specified on the master virtual desktop. Adjust accordingly.
  2. For New Hard disk, consider setting Thin provision.
  3. Make sure the virtual desktop is using a SCSI controller.
  4. The master virtual desktop should be configured with a VMXNET 3 network adapter.
  5. When building the master virtual desktop, you will probably boot from an ISO.
  6. Before using View Administrator to create a pool, ensure the CD/DVD drive points to Client Device and is not Connected. The important part is to make sure ISO file is not configured.
  7. There’s no need for the Floppy drive so remove it.
  8. If you have any Serial ports, remove them.
  9. In Device Manager, after installing VMware Tools, make sure the video driver is VMware SVGA 3D.
  10. If not, you can use the driver at C:\Program Files\Common Files\VMware\Drivers\video_wddm.

Windows

VMware TechZone Creating an Optimized Windows Image for a VMware Horizon Virtual Desktop

Preparation

Windows 7 VMXNET 3 Networking Hotfix

For Windows 7 machines:

  1. Ensure the vSphere network port group allows a sufficient number of connected virtual machines.
  2. Make sure Windows 7 Service Pack 1 is installed.
  3. The recommended hotfix for fixing VMXNET 3 is the 3125574 Convenience Rollup.

    1. Run windows6.1-kb3125574-v4-x64.msi.
  4. Or, the minimum hotfix is 2550978 http://support.microsoft.com/kb/2550978.

    1. Run Windows6-1-KB2550978.msu.
  5. Click Yes when asked to install the hotfix.
  6. Click Restart Now.
  7. After installing either hotfix, follow http://support.microsoft.com/kb/315539 to delete ghost NICs.

From Microsoft KB article http://support.microsoft.com/kb/235257: For desktop VMs using VMXnet3 NICs, you can significantly improve the peak video playback performance of your View desktop by simply setting the following registry setting to the value recommended by Microsoft:

  • HKLM\System\CurrentControlSet\Services\Afd\Parameters\FastSendDatagramThreshold to 1500

Windows 7 Black Screen Hotfix

For Windows 7 machines, request and install Microsoft hotfix 2578159: The logon process stops responding in Windows. More info at VMware 2073945 Reconnecting to the VDI desktop with PCoIP displays a black screen.

Windows 7 SHA2 Hotfix

For Windows 7 machines, install Microsoft Security Advisory 3033929, Availability of SHA-2 Code Signing Support for Windows 7 and Windows Server 2008 R2.

Windows 7 Hotfix for AppVolumes

For Windows 7 machines, install the Microsoft hotfix for mountmgr.sys.  More info at VMware 2126775 Logging in to a virtual machine fails or is slow at the Welcome Screen when using VMware AppVolumes,

Power Options

  1. Run Power Options. In Windows 8 and newer, right-click the Start Menu to access Power Options.
  2. Click the arrow to show more plans, and select High performance.
  3. Next to High performance, click Change plan settings.
  4. Change the selection for Turn off the display to Never, and click Save changes.

System Settings

  1. Domain Join. For linked clones, join the machine to the domain. For Instant Clones, see VMware 2150495 Computer-based Global Policy Objects (GPOs) that require reboot are not applied on instant clones.
  2. In System control panel applet (right-click the Start Menu > System), click Remote settings.
  3. Enable Remote Desktop.
  4. Activate Windows with a KMS license if not already activated. Note: only KMS is supported with View Composer.

Windows Profiles v3/v4 Hotfix

Roaming user profiles are tied to the operating system version so profiles on Windows 8.1-based, Windows 10-based, or Windows Server 2012 R2-based computers are incompatible with roaming user profiles in earlier versions of Windows.

Profiles are compatible only between the following client and server operating system pairs:

  • v6 = Windows 10 1607 and newer, Windows Server 2016, Windows Server 2019
  • v5 = Windows 10 1511 and older
  • v4 = Windows 8.1 and Windows Server 2012 R2
  • v3 = Windows 8 and Windows Server 2012
  • v2 = Windows 7 and Windows Server 2008 R2

If Windows 8, install hotfix http://support.microsoft.com/kb/2887239.

If Windows 8.1, ensure update rollup 2887595 is installed. http://support.microsoft.com/kb/2890783

After you apply this update, you must create a registry key before you restart the computer.

  1. Run regedit.
  2. Locate and then tap or click the following registry subkey:
    HKEY_LOCAL_MACHINE\System\CurrentControlset\Services\ProfSvc\Parameters
  3. On the Edit menu, point to New, and then tap or click DWORD Value.
  4. Type UseProfilePathExtensionVersion.
  5. Press and hold or right-click UseProfilePathExtensionVersion, and then tap or click Modify.
  6. In the Value data box, type 1, and then tap or click OK.
  7. Exit Registry Editor.

After you configure the UseProfilePathExtensionVersion registry entry, you have to restart the computer. Then, Windows 8.1 creates a user profile and appends the suffix “.v4” to the profile folder name to differentiate it from version 2 of the profile in Windows 7 and version 3 of the profile in Windows 8. Then, Windows 8.1-based computers that have update rollup 2887595 installed and the UseProfilePathExtensionVersion registry entry configured use version 4 of the profile.

Windows 8 creates a new copy of the user profile and appends the suffix “.v3” in the profile folder name to differentiate it from the original version 2 profile for Windows 7. After that, Windows 8-based computers that have this hotfix installed and the UseProfilePathExtensionVersion registry entry configured use the version 3 profile for users.

Install Applications

Install applications locally if you want them to be available on all virtual desktops created based on this master virtual desktop.

Or you can use a Layering product (e.g. VMware App Volumes, Unidesk) or App Streaming (e.g. ThinApp, Microsoft App-V).

Antivirus

VMware Tech Paper Antivirus Considerations for VMware Horizon 7 contains exclusions for Horizon View, App Volumes, User Environment Manager, ThinApp, etc.

Microsoft’s virus scanning recommendations (e.g. exclude group policy files) – http://support.microsoft.com/kb/822158.

Carbon Black

Interoperability of VMware Carbon Black and Horizon (79180)

Symantec

Symantec links:

Trend Micro

Trend Micro Slow login on Citrix environment after installing OfficeScan (OSCE): The following registries can be used to troubleshoot the issue. These registries will allow a delay on the startup procedure of OSCE until the system has launched successfully. This avoids deadlock situations during login.

Citrix CTX136680 – Slow Server Performance After Trend Micro Installation. Citrix session hosts experience slow response and performance more noticeable while users try to log in to the servers. At some point the performance of the servers is affected, resulting in issues with users logging on and requiring the server to be restarted. This issue is more noticeable on mid to large session host infrastructures.

Trend Micro has provided a registry fix for this type of issue. Create the following registry on all the affected servers. Add new DWORD Value as:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TmFilterParameters] “DisableCtProcCheck”=dword:00000001

Trend Micro Links:

Sophos

Sophos Endpoint Security and Control: Best Practice for running Sophos on virtual systems: we’ve amassed the following practical information about how you can optimize our software to work with this technology.

Sophos Endpoint Security and Control: Installation and configuration considerations for Sophos Anti-Virus on a Remote Desktop Services server: It maybe desirable to disable the Sophos AutoUpdate shield icon

Sophos Endpoint Security and Control: How to include current version of Sophos in a disk image for cloned virtual machines: This procedure will make sure that the produced target/cloned computers:

  • Get their distinct identity with Enterprise Console, under which they can be subsequently managed.
  • Have the desired version of Sophos Anti-Virus already installed and configured on the created image.

Palo Alto Traps

  • Install Traps Agent for Windows:
    • Virtual desktop infrastructure (VDI) installation—Intended for non-persistent endpoints that replicate (also referred to as spawn) from a golden image which has Traps installed.
    • Temporary session—Intended for either physical or virtual endpoints (such as a Remote Desktop Server) that repeatedly revert to a snapshot (or image) on which Traps is not installed.

Windows Defender Antivirus

Configuring Microsoft Defender Antivirus for non-persistent VDI machines – Microsoft Blog

Deployment guide for Windows Defender Antivirus in a virtual desktop infrastructure (VDI) environment – Microsoft Docs

Onboarding and servicing non-persistent VDI machines with Microsoft Defender ATP

Cylance

CTX232722 Unable to launch application with Cylance Memory Protection Enabled. Cylance must be run in compatibility mode in order to the VDA and Cylance to run on the same machine. See the article for detailed instructions.

Horizon Agent

Horizon Agent Installation/Upgrade

Install Horizon Agent on the master virtual desktop. Upgrades are performed in-place.

  1. See VMware 2149393 Supported versions of Windows 10 on Horizon Agent.
    1. Windows 10 version 1903 is supported by Horizon Agent 7.8 and newer.
    2. Windows 10 version 1809 is supported by Horizon Agents 7.5.1 and newer.
  2. VMware Tools – Only install Horizon Agent after you install VMware Tools.
    1. If you need to update VMware Tools, uninstall Horizon Agent, upgrade VMware Tools, and then reinstall Horizon Agent.
    2. See VMware Product Interoperability Matrices for supported versions of VMware Tools with different versions of Horizon Agent.
    3. If VMware Tools 11.x, VMware recommends running the following: (source = VMware 78434 Performance issues for Horizon 7 when using VMware VMTools 11.x) 
      C:\Program Files\VMware\VMware Tools\VMwareToolboxCmd.exe" config set appinfo disabled true
  3. Check the video driver to make sure it is VMware SVGA 3D.
  4. Download Horizon 7.13.3 Agent.
  5. Run the downloaded VMware-Horizon-Agent-x86_64-7.13.3.exe.
  6. If you want the URL Content Redirection feature, then you must run the Agent installer with the the following switches: /v URL_FILTERING_ENABLED=1
  7. In the Welcome to the Installation Wizard for VMware Horizon Agent page, click Next.
  8. In the License Agreement page, select I accept the terms, and click Next.
  9. In the Network protocol configuration page, select IPv4, and click Next.
  10. In the Custom Setup page, there are several features not enabled by default. Feel free to enable them.
    1. If you want USB Redirection, then enable that feature.
    2. Horizon 7.2 and newer have VMware Virtualization Pack for Skype for Business. See Configure Skype for Business at VMware Docs for details.
    3. You can install Instant Clone Agent, or View Composer Agent, but not both.

    4. According to Instant-Clone Desktop Pools at VMware Docs, Persona is not supported with Instant Clones.

    5. If you want Scanner Redirection, then enable that feature. Note: Scanner Redirection will impact host density.
    6. Horizon 7.3 through Horizon 7.9 have HTML5 Multimedia Redirection. In Horizon 7.10 and newer, HTML5 Browser Redirection seems to be installed automatically. To enable and configure these features, see HTML5 Redirection in Horizon Group Policy.
    7. Horizon 7.6 and newer have an option for Geolocation Redirection. The feature requires a plugin for Internet Explorer 11 and Horizon Client 4.9. No other browsers are supported. See Configuring Geolocation Redirection at VMware Docs.
    8. Horizon 7.5 and newer have Horizon Performance Tracker, which adds a program to the Agent that can show the user performance of the remote session. You can publish the Tracker.

    9. Horizon 7.7 and newer have a VMware Integrated Printing or VMware Advanced Printing option, which replaces the older ThinPrint technology. VMware Integrated Printing requires Horizon Client 4.10 or newer.
    10. If you enable VMware Integrated Printing, then you must disable Virtual Printing, which is higher in the list.

  11. Click Next when done making selections.
  12. In the Ready to Install the Program page, click Install.
  13. In the Installer Completed page, click Finish.
  14. Click Yes when asked to restart.
  15. Horizon Agent 7.13 and newer let you Modify the features that were selected during installation. In older versions, you must uninstall Horizon Agent and reinstall it.
    • If you click Modify from Apps & features (or Programs and Features), it will tell you to open an elevated command prompt and run the command shown in the window.
    • You can’t change from Manual to Instant Clone or back again using this method.
  16. If you want to know what features were selected during installation, look in HKLM\Software\VMware, Inc.\Installer\Features_HorizonAgent. Or look in the installation log files as detailed at Paul Grevink View Agent, what is installed?

  17. For Horizon Persona (not with Instant Clones), enable the Microsoft Software Shadow Copy Provider service. See Windows 10 with Persona management not syncing at VMware Communities.
  18. If Windows 10 version 1709 with View Composer, you might have to delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Security. See VMware 51518 Production Support for VMware Horizon 7.4, 7.3.2, and 7.2 with Win 10 1709 Semi-Annual Channel (SAC) Guest OS
  19. To verify installation of the URL Content Redirection feature, check for the presence of C:\Program Files\VMware\VMware View\Agent\bin\UrlRedirection.
  20. There’s also a new IE add-on.
  21. URL Content Redirection is configured using group policy.

Install/Upgrade Dynamic Environment Manager (DEM) Agent

Dynamic Environment Manager (DEM) is the new name for User Environment Manager (UEM).

If you are licensed for Dynamic Environment Manager (Horizon Enterprise Edition), install the Dynamic Environment Manager (DEM) Enterprise Agent.

  • DEM Enterprise has the same or more features that has always been included in Horizon Enterprise. DEM Standard is a reduced-feature version for Horizon 8 Standard Edition.
  • Note: UEM 9.1 and newer can also work without Active Directory (Group Policy); see VMware 2148324 Configuring advanced UEM settings in NoAD mode for details.

DEM 2006 and newer Agents (FlexEngines) require additional configuration to enable DEM Computer Settings. You can either configure registry settings on each DEM Agent machine, or in DEM Agent 2103 and newer you can use an installer command-line switch. Both are detailed at Perform Installation with Computer Environment Settings Support at VMware Docs.

  • Group Policy Preferences can push these registry keys to the Horizon Agent machines. Or you can manually modify the registry in your master images. The minimum registry values are Enabled and ConfigFilePath as detailed at Perform Installation with Computer Environment Settings Support at VMware Docs. For the list of additional registry values, see FlexEngine Configuration for Computer Environment Settings at VMware Docs.
  • Command line install looks something like below. The command line installer switch sets the same ConfigFilePath and Enabled registry values as shown above. 
    msiexec /i "\fs01\bin\VMware\DEM\VMware-DEM-Enterprise-2212-10.8-GA\VMware Dynamic Environment Manager Enterprise 2106 10.3 x64.msi" /qn COMPENVCONFIGFILEPATH=\\fs01\DEMConfig\general

To install DEM Agent:

  1. Windows 10 Compatibility – See VMware 57386 VMware Dynamic Environment Manager and Windows 10 Versions Support Matrix
  2. Make sure Prevent access to registry editing tools is not enabled in any GPO since this setting prevents the FlexEngine from operating properly.
  3. Based on your entitlement, download either DEM 2212 (10.8) Enterprise Edition, or DEM 2212 (10.8) Standard Edition. For ESB Horizon, download the DEM version included with your ESB version of Horizon.

  4. Run the extracted VMware Dynamic Environment Manager Enterprise 2212 10.8 x64.msi.
  5. In the Welcome to the VMware Dynamic Environment Manager Enterprise Setup Wizard page, click Next.
  6. In the End-User License Agreement page, check the box next to I accept the terms, and click Next.
  7. In the Destination Folder page, click Next.
  8. The Choose Setup Type page appears. By default, the installer only installs the engine. You can click Custom or Complete to also install the Management Console. The Management Console is typically installed on an administrator workstation, not on a master image.

  9. In the Choose License File page, if installing on a Horizon Agent, then no license file is needed. Click Next.
  10. In the Ready to install VMware Dynamic Environment Manager Enterprise page, click Install.
  11. In the Completed the VMware Dynamic Environment Manager Enterprise Setup Wizard page, click Finish.
  12. If you have PCoIP Zero Clients that map USB devices (e.g. USB drives), then you might have to set the following registry value. (Source = VMware 2151440 Smart card SSO fails when you use User Environment Manager with a zero client)
    • HKLM\Software\VMware, Inc.\VMware VDM\Agent\USB
      • UemFlags (DWORD) = 1

Unity Touch

With the Unity Touch feature, tablet and smart phone users can quickly navigate to a Horizon View desktop application or file from a Unity Touch sidebar. Although end users can specify which favorite applications appear in the sidebar, for added convenience, administrators can configure a default list of favorite applications.

In the Unity Touch sidebar, the favorite applications and favorite files that users specify are stored in the user’s profile. For non-persistent pools, enable Roaming Profiles.

To set the default list of favorite applications:

  1. Navigate to HKLM\Software\Wow6432Node\VMware, Inc.\VMware Unity
  2. Create a string value called FavAppList.
  3. Specify the default favorite applications using format: path-to-app-1|path-to-app-2|path-to-app-3|…. For example:
Programs/Accessories/Accessibility/Speech Recognition.lnk|Programs/VMware/VMware vSphere Client.lnk|Programs/Microsoft Office/Microsoft Office 2010 Tools/Microsoft Office 2010 Language Preferences.lnk

Unity Touch can be disabled by setting HKEY_LOCAL_MACHINE\Software\VMware,Inc.\VMware Unity\enabled to 0.

For more information, see Configure Favorite Applications Displayed by Unity Touch at VMware Docs.

Composer – Rearm

By default, when View Composer creates linked clones and runs QuikPrep, one of the tasks is to rearm licensing. You can prevent rearm by setting the following registry key:

  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\vmware-viewcomposer-ga
    • SkipLicenseActivation  (DWORD) = 0x1

Dynamic PCoIP Policies

If you wish to change PCoIP Policies (e.g. clipboard redirection, client printers, etc.) based on how the user connects, see VMware Blog Post VMware Horizon View Secret Weapon. The article describes configuring VMware Horizon View Script Host service to run a script to change PCoIP configuration based on the Connection Server that the user connected through. Full script is included in the article.

Microsoft FSLogix

Why FSLogix?

Microsoft FSLogix has two major features:

  • Profile Container is an alternative to VMware DEM Personalization.
  • App Masking is an alternative to VMware App Volumes.

DEM has three categories of features: Personalization, User Settings, and Computer Settings. FSLogix Profile Container only replaces the Personalization feature set. You typically do FSLogix Profile Container for profiles and use DEM for User Settings and Computer Settings. Here are some advantages of DEM Profile Container over DEM Personalization:

  • FSLogix Profile Container saves the entire profile but DEM Personalization requires you to specify each setting location that you want to save. FSLogix is “set and forget” while DEM Personalization requires tweaking for each application.
  • At logon, DEM Personalization must download and unzip each application’s profile settings, which takes time. FSLogix simply mounts the user’s profile disk, which is faster than DEM Personalization.
  • FSLogix Profile Container has special support for roaming caches and search indexes produced by Microsoft Office products (e.g. Outlook .ost file).
  • FSLogix is owned, developed and supported by Microsoft.

Here are some FSLogix Challenges as compared to DEM Personalization:

  • FSLogix Profile disk consumes significant disk space. The default maximum size for a FSLogix profile disk is 30 GB per user.
  • High Availability for FSLogix Profile disks file share is challenging. The file server High Availability capability must be able to handle .vhdx files that are always open. DFS Replication is not an acceptable HA solution. One option is Microsoft Scale Out File Server (SOFS) cluster. Another option is Nutanix Files.

VMware App Volumes has some drawbacks, including the following:

  • Completely separate infrastructure that must be built, maintained, and troubleshooted.
  • Introduces delays during logon as AppStacks are mounted.
  • AppStacks can sometimes conflict with the base image or other AppStacks.

An alternative approach is to install all apps on the base image and use FSLogix App Masking to hide unauthorized apps from unauthorized users. No delays during logon.

Microsoft FSLogix is free for all Microsoft RDS CALs, Microsoft Virtual Desktop Access per-user CALs, and all Microsoft Enterprise E3/E5 per-user licenses. Notice that per-device licenses are excluded. See Licensing Requirements at Microsoft Docs.

FSLogix Installation

Do the following to install Microsoft FSLogix on the Horizon Agent machine:

  1. Go to https://docs.microsoft.com/en-us/fslogix/install-ht and click the download link.
  2. Extract the downloaded .zip file.
  3. In the FSLogix \x64\Release folder, run FSLogixAppsSetup.exe.
  4. Check the box next to I agree to the license terms and conditions and click Install.
  5. In the Setup Successful page, click Restart.
  6. Make sure the Windows Search service is set to Automatic and Running.
  7. If Office is already installed, then repair the Office installation after installing and starting the Windows Search Service.

FSLogix is configured through Group Policy or by editing registry values on each FSLogix Agent machine.

VMware OS Optimization Tool

  1. See VMware Windows Operating System Optimization Tool Guide for details on this tool.
  2. Download the VMware OS Optimization Tool VMware fling.
  3. Run the extracted VMwareOSOptimizationTool.exe.
  4. On the Optimize tab, choose a template.
  5. Then click Analyze on the bottom of the window.
  6. On the Optimize tab, review the optimizations, and make changes as desired. Then on the bottom left, click Optimize.
  7. The History tab lets you rollback the optimizations.
  8. The Finalize tab contains tasks that should be run every time you seal your master image.

Additional Optimizations

Additional Windows 10 Optimizations

Additional Windows 7 Optimizations

Microsoft has compiled a list of links to various optimization guides.

It’s a common practice to optimize a Windows 7 virtual machine (VM) template (or image) specifically for VDI use. Usually such customizations include the following.

  • Minimize the footprint, e.g. disable some features and services that are not required when the OS is used in “stateless” or “non-persistent” fashion. This is especially true for disk-intensive workloads since disk I/O is a common bottleneck for VDI deployment. (Especially if there are multiple VMs with the same I/O patterns that are timely aligned).
  • Lock down user interface (e.g. optimize for specific task workers).

With that said the certain practices are quite debatable and vary between actual real-world deployments. Exact choices whether to disable this or that particular component depend on customer requirements and VDI usage patterns. E.g. in personalized virtual desktop scenario there’s much less things to disable since the machine is not completely “stateless”. Some customers rely heavily on particular UI functions and other can relatively easily trade them off for the sake of performance or standardization (thus enhance supportability and potentially security). This is one of the primary reasons why Microsoft doesn’t publish any “VDI Tuning” guide officially.

Though there are a number of such papers and even tools published either by the community or third parties. This Wiki page is aimed to serve as a consolidated and comprehensive list of such resources.

Daniel Ruiz XenDesktop Windows 7 Optimization and GPO’s Settings

Microsoft Whitepaper Performance Optimization Guidelines for Windows 7 Desktop Virtualization

Snapshot

  1. Make sure the master virtual desktop is configured for DHCP.
  2. If connected to the console, run ipconfig /release.
  3. Run antivirus sealing tasks:
  4. Base Image Script Framework (BIS-F) automates many image sealing tasks. The script is configurable using Group Policy.
  5. Shutdown the master virtual desktop.
  6. Edit the Settings of the master virtual machine and disconnect the CD-ROM. Make sure no ISO is configured in the virtual machine.
  7. Take a snapshot of the master virtual desktop. View Composer requires a snapshot.

Related Pages

VMware Horizon 7.13.3 Security Server

Last Modified: Mar 22, 2023 @ 5:48 am

87 Comments

Navigation

This post applies to all VMware Horizon 7 versions, including 7.13.3.

💡 = Recently Updated

Change Log

Preparation

The newer Horizon Console does not support Security Servers. The older Flash-based Horizon Administrator won’t work for much longer, so take it as a clue that you should deploy Unified Access Gateways (UAG) to replace your Security Servers. Horizon 8 also does not support Security Servers.

Security Servers are intended to be deployed in the DMZ.

Horizon Security Server is installed on Windows. If you prefer a Linux appliance, see VMware Unified Access Gateway. Note: Some of the newer Blast Extreme functionality only works in Unified Access Gateway. See Configure the Blast Secure Gateway at VMware Docs.

Security Considerations for Horizon View 5.2 – http://www.vmware.com/resources/techresources/10371

Firewall Ports

If there is only one Security Server in the DMZ, create a NAT’d public IP to the Security Server. Create a public DNS entry that resolves to this IP address.

If your load balancer (e.g. NetScaler ADC, F5) is able to provide persistence across multiple port numbers, then you only need one public IP. For example, in NetScaler, this is called Persistency Groups.

If your load balancer doesn’t support persistence across multiple port numbers, then create three public IPs:

  • Public IP NAT’d to the load balancer IP. Create a public DNS entry that resolves to this IP address. This is the DNS name that users will enter into their Horizon Clients.
  • Public IP NAT’d to each of the Security Servers. Each Security Server must be exposed directly to the Internet. Create public DNS names that resolve to these public IPs. When installing Security Server, specify these public DNS names and not the load balanced DNS name.

Firewall Rules for View Connection Server at VMware Docs.

Open these ports from any device on the Internet to all Security Server and Load Balancer public IPs:

  • TCP 80
  • TCP and UDP 443
  • TCP and UDP 4172. UDP 4172 must be opened in both directions.
  • TCP and UDP 8443 (for Blast)

Open these ports from the Security Servers to internal:

  • If IPSec is enabled in View Administrator (Global Settings > Security > Edit), open ISAKMP Protocol (UDP 500) and ESP. Or if there is NAT between the Security Server and the Connection Server, open NAT-T ISAKMP (UDP 4500). Configuring a Back-End Firewall to Support IPsec at VMware Docs.
  • TCP 8009 (AJP13) to the paired internal Horizon Connection Server.
  • TCP 4001 (JMS) to the paired internal Horizon Connection Server.
  • TCP and UDP 4172 (PCoIP) to all internal Horizon Agents. UDP 4172 must be opened in both directions.
  • TCP 32111 (USB Redirection) to all internal Horizon Agents.
  • TCP and UDP 22443 (HTML Blast) to all internal Horizon Agents.
  • TCP 9427 (MMR) to all internal Horizon Agents.
  • TCP 4002 for Enhanced Messaged Security – Change the JMS Message Security Mode to Enhanced at VMware Docs

Pairing Password

The newer Horizon Console does not support Security Servers. The older Flash-based Horizon Administrator won’t work for much longer, so take it as a clue that you should deploy Unified Access Gateways to replace your Security Servers.

  1. VMware Code Script to manage Horizon 7.x Security Servers via the View-API without needing the FLEX based Administrator Console
  2. In Horizon Administrator, on the left, expand View Configuration, and click Servers.
  3. On the right, switch to the Connection Servers tab.
  4. Select the Horizon Connection Server to which the Security Server will be paired. Then click More Commands, and click Specify Security Server Pairing Password.
  5. Enter a temporary password, and click OK.

Install – Security Server

  1. Ensure the Horizon Security Server has 10 GB of RAM and 4 vCPU.
  2. Windows Server 2019 is supported for the Horizon Security Server 7.8 and newer.
  3. Login to the Horizon Security Server.
  4. Download Horizon 7.13.3 Horizon Connection Server.
  5. If you are upgrading an existing Security Server, then you must prepare it for upgrade:

    1. In Horizon Administrator (Flash/Flex console), on the left, expand View Configuration, and click Servers.
    2. On the right, switch to the tab named Security Servers.
    3. Highlight the Security Server, then click the menu named More Commands and click Prepare for Upgrade or Reinstallation.
    4. Click OK to remove the IPSec rules.
  6. On the Security Server, run the downloaded VMware-Horizon-Connection-Server-x86_64-7.13.3.exe.
  7. In the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server page, click Next.
  8. In the License Agreement page, select I accept the terms, and click Next.
  9. In the Destination Folder page, click Next.
  10. In the Installation Options page, select Horizon 7 Security Server, and click Next.
  11. In the Paired Horizon 7 Connection Server page, enter the name of the internal Horizon Connection Server that this Security Server will be paired with. If using a hostname, it must be resolvable (edit the local HOSTS file) to the correct IP. Also, the correct firewall ports are required. Click Next.
  12. In the Paired Horizon 7 Connection Server Password page, enter the pairing password specified earlier, and click Next.
  13. In the Horizon 7 Security Server Configuration page, edit the URLs as appropriate. These URLs must be externally accessible. The top URL is a FQDN, while the middle URL is an IP address. These can be changed later. Click Next.
  14. In the Firewall Configuration page, click Next.
  15. In the Ready to Install the Program page, click Install.
  16. In the Installer Completed page, click Finish.

SSL

Security Server Certificate

  1. Run certlm.msc (Windows 2012+). Or run mmc, add the Certificates snap-in and point it to Computer > Local Machine.
  2. Request a new certificate with a common name that matches the public FQDN of the Security Server, or import a wildcard certificate.
  3. Note: the private key must be exportable. If using the Computer template, click Details, and then click Properties.
  4. On the Private Key tab, click Key options to expand it, and check the box next to Mark private key as exportable.
  5. In the list of certificates, look for the one that is self-signed. The Issuer will be the local computer name instead of a Certificate Authority. Right-click it, and click Properties.
  6. On the General tab, clear the Friendly name field, and click OK.
  7. Right-click your Certificate Authority-signed certificate, and try to export it.
  8. On the Export Private Key page, make sure Yes, export the private key is selectable. If the option to export the private key is grayed out, then this certificate will not work. Click Cancel.
  9. Right-click your Certificate Authority-signed certificate, and click Properties.
  10. On the General tab, in the Friendly name field, enter the text vdm, and click OK. Note: only one certificate can have vdm as the Friendly name.
  11. Then restart the VMware Horizon 7 Security Server service.

Load Balancing

See Carl Stalhood – Horizon View Load Balancing

Enable PCoIP Secure Gateway

  1. In View Administrator, on the left, expand View Configuration, and click Servers.
  2. On the right, switch to the Connection Servers tab.
  3. Right-click the Connection Server that is paired with the Security Server, and click Edit. Note: you can’t configure this directly on the Horizon Security Server, and instead must configure it on the paired Horizon Connection Server.
  4. On the General tab, check the box next to Use PCoIP Secure Gateway for PCoIP connections to machine. Also, make sure HTTP(S) Secure Tunnel and Blast Secure Gateway are enabled. Click OK.

Related Pages

VMware Horizon 7.13.3 Configuration

Last Modified: Mar 22, 2023 @ 5:46 am

73 Comments

Navigation

This post applies to all VMware Horizon 7 versions including 7.13.3.

💡 = Recently Updated

Change Log

Preparation

Horizon Service Account

  1. Create an account in Active Directory that Horizon View will use to login to vCenter. This account can also be used by Composer and Instant Clones to create computer accounts in Active Directory.
  2. Make sure the password does not expire.
  3. Domain User is sufficient. Permissions will be delegated where needed.

vCenter Role for View Composer

This role has all permissions needed for both full clones and linked clones. See Privileges Required for the vCenter Server User and View Composer and Instant Clone Privileges Required for the vCenter Server User at VMware Docs.

See the Product Interoperability Matrix for supported vCenter versions.

Create vSphere Role:

  1. In vSphere Web Client, go to Administration.
  2. In the Roles node, click the plus icon to add a Role.
  3. If you are using vTPM, then on the left, click Cryptographic operations. On the right, enable Clone, Decrypt, Direct Access, Encrypt, and Manage KMS. Scroll down on the right to see more Cryptographic operations permissions.

    1. While still in Cryptographic operations, scroll down and enable Migrate and Register host.
  4. On the left, click Datastore. On the right, enable Allocate space, Browse datastore, and Low level file operations.
  5. On the left, click Folder. On the right, enable Create folder, and Delete folder.
  6. On the left, click Global. On the right, enable Act as vCenter Server, Disable Methods, and Enable Methods, and then scroll down on the right to see more Global permissions.

    1. While still in Global, enable, Manage custom attributes, Set custom attribute, and System tag.
  7. On the left, click Host. On the right, in the Configuration section, enable Advanced Settings. Then scroll down on the right to see more Host settings.

    1. While still in Host, scroll down to the Inventory section and click Modify cluster.
  8. On the left, click Network. On the right, enable All Network Privileges.
  9. For Virtual SAN, enable Profile-driven storage and everything under it. VMware 2094412 When attempting to deploy linked clones using VMware Virtual SAN (VSAN) you receive the error: Unable to connect to PBM sub system PB may be down
  10. On the left, click Resource. On the right, enable Assign virtual machine to resource pool, and Migrate powered off virtual machine.
  11. On the left, click Storage views. On the right, enable View.
  12. On the left, click Virtual Machine. On the right, click Change Configuration to enable all Configuration permissions. Scroll down on the right to see more Virtual machine permissions.

    1. While still in Virtual Machine, scroll down and click Edit Inventory to enable all Inventory permissions.
    2. While still in Virtual Machine, scroll down to the Interaction section, enable Connect devices, and then click See more privileges.
    3. While still in Virtual Machine, scroll down and enable Perform wipe or shrink operations,  Power Off, Power On, Reset, and Suspend.
    4. While still in Virtual Machine, scroll down to the Provisioning section and enable Allow disk access, Clone template, and Clone virtual machine. Then click See more privileges.
    5. While still in Virtual Machine, scroll down and enable Customize guest, Deploy template, and Read customization specifications.
    6. While still in Virtual Machine, scroll down and click Snapshot Management to enable all Snapshot permissions.
  13. Click Next.
  14. Name it Horizon or similar. Then click Finish

Assign role to service account:

  1. Create an account in Active Directory that Horizon View will use to login to vCenter.
  2. In vSphere Web Client, in Hosts and Clusters view, browse to the vCenter object. Permissions must be assigned at the vCenter level. It won’t work at any lower level.
  3. On the right, select the tab named Permissions.
  4. Click the plus icon to add a permission.
  5. In the Add Permission dialog box, do the following:
    1. Change the User domain.
    2. Search for the service account.
    3. Change the Role to the one you created in the previous section.
    4. Check the box next to Propagate to children.
  6. Click OK.
  7. The service account is now listed on the Permissions tab.
  8. From VMware Docs Configure a vCenter Server User for Horizon 7 and View Composer: If you install Horizon Composer on the same machine as Windows vCenter Server, you must make the Horizon service account a local system administrator on the Windows vCenter Server machine.
    • If you install Horizon Composer on a different machine than Windows vCenter Server, you do not have to make the Horizon service account a local administrator on the Windows vCenter Server machine. However, the Horizon service account must be a local administrator on the Horizon Composer standalone machine.
  9. On the Horizon Composer server, right-click the Start button, and click Computer Management.
  10. Go to System Tools > Local Users and Groups > Groups. Double-click Administrators. Add the Horizon service account, and click OK.

Active Directory Delegation for Instant Clones and Composer

Horizon Composer and Instant Clones create computer objects in Active Directory. Horizon is configured with an Active Directory service account that must be granted permission to create computer objects. See Create a User Account for Instant-Clone Operations at VMware Docs.

  1. Create an OU in Active Directory where the Horizon Agent computer objects will be stored.
  2. In Active Directory Users & Computers, right-click the Horizon Agents OU, and click Delegate Control.
  3. In the Welcome to the Delegation of Control Wizard page, click Next.
  4. In the Users or Groups page, add the Active Directory service account for Instant Clones and/or Horizon Composer. Then click Next.
  5. In the Tasks to Delegate page, select Create a custom task to delegate, and click Next.
  6. In the Active Directory Object Type page, do the following:
    1. Change the radio button to select Only the following objects in the folder.
    2. Check the boxes next to Create select objects in this folder and Delete selected objects in this folder.
  7. Click Next.
  8. In the Permissions page, check the boxes next to Read All Properties, Write All Properties, and Reset Password. Then Next.
  9. In the Completing the Delegation of Control Wizard page, click Finish.
  10. If you are viewing Advanced Features in Active Directory Users & Computers, if you view the properties of the OU, on the Security tab, click Advanced, find your service account, you should see permissions similar to the following.

Events SQL Database

A new empty SQL database is needed for storage of View Events.

  1. Only SQL Server authentication is supported, so make sure it’s enabled on your SQL Server > Properties > Security page.
  2. In SQL Server Management Studio, create a new database.
  3. Name it VMwareHorizonEvents or similar. Switch to the Options tab.
  4. Select your desired Recovery model, and click OK.
  5. Under Security > Logins, add a SQL login if one does not exist already. Windows authentication is not supported.
  6. Right-click a SQL login, and click Properties.
  7. On the User Mapping page, check the Map box next to the VMwareHorizonEvents database.
  8. On the bottom, add the user to the db_owner database role. Click OK when done.

Horizon Consoles

On the desktop of the Horizon Connection Server is an icon to launch Horizon 7 Administrator Console.

Horizon 7.5 and newer have two administrator consoles:

  • Horizon Console (HTML5)
  • Horizon Administrator (Flex) – Flash-based

In Horizon versions 7.5 through 7.10, Horizon Console was not yet feature complete so most administrators continue to use the Flash-based Horizon Administrator. In these versions, you can access Horizon Console by navigating to https://viewConnectionServer/newadmin (add /newadmin to the end of your Connection Server FQDN). Or click the Horizon Console link at the top right of the Horizon Administrator console.

In Horizon 7.10 and newer, Horizon Console is feature complete and is now the primary administrator interface. The Flash-based Horizon Administrator is now deprecated.

In Horizon 7.11 and later:

  • When you connect to Horizon Administrator (/admin at the end of the Connection Server URL), you are prompted to choose between Horizon Console and Horizon Administrator. In prior versions of Horizon, going to /admin always opens the Flash-based administrator console.
  • If you navigate to /newadmin, it will redirect you to /admin where you can choose between the two consoles.
  • You can go directly to the Flash-based administrator console by navigating to /flexadmin.

Horizon Console 7.11 and newer’s Dashboard can show you the CPU/Memory of the Connection Servers:

  1. On the top left, expand Monitor and click Dashboard.
  2. On the right, in the top-left block named System Health, click VIEW.
  3. With Components selected on the left, the first tab on the right is Connection Servers. It shows you a list of Connection Servers in the pod and each server’s CPU and Memory Consumption.

Licensing

As of Horizon 7.9, Horizon Licensing can be configured in either the new HTML5-based Horizon Console or the classic Flash-based Horizon Administrator.

  1. Open Horizon Console or Horizon Administrator.
  2. Login using a Horizon administrator account.

  3. In Horizon Console on the left, expand Settings and click Product Licensing and Usage.

    1. Or in Horizon Administrator, on the left, under View Configuration, click Product Licensing and Usage.
  4. In the right pane, on the top left, click Edit License.

  5. In the Edit License window, enter your license serial number, and click OK.
  6. Licensing information is displayed:
    • License expiration is shown.
    • Application Remoting (published applications) requires Horizon Advanced Edition.
    • Skype Optimization requires Horizon Advanced Edition.
    • In Horizon 7.13, Instant Clones are available in all editions of Horizon. Prior to 7.13, Instant Clones requires Horizon Enterprise Edition.
    • Session Collaboration requires Horizon Enterprise Edition.
    • Help Desk tool requires Horizon Enterprise Edition.

Horizon Administrators

To configure Horizon Administrators:

  1. In Horizon Console 7.8 or newer, on the left, expand Settings, and click Administrators.

    • Or in Horizon Administrator, on the left, expand View Configuration, and click Administrators.
  2. On the right, near the top, click Add User or Group.

  3. In the Select administrators or groups page, click Add.

  4. Enter the name of a group that you want to grant Horizon Administrator permissions to, and click Find.
  5. After the group is found, check the box next to the group (or highlight the group), and then click OK.

  6. Continue adding groups, or just click Next.
    Note: This wizard only lets you select one role; so, only add groups that will have the same role assigned. You can run the wizard multiple times.
  7. In the Select a role page, select the role (e.g. Administrators). Newer versions of Horizon include a built-in Help Desk Administrators role, which grants access to the Help Desk tool. Then click Next.

  8. Select an access group to which the permission will be applied and then click Finish.
    • Access Groups let you designate permissions to specific pools instead of to all pools.
    • Note: If you intend to integrate Horizon with VMware Identity Manager (aka VMware Access), then only pools in the Root Access group will sync with Identity Manager. Other Access Groups won’t work.

Help Desk Website

Horizon 7.2 and newer have a new web-based Help Desk tool built into Horizon Connection Server.

  • In Horizon Console (Horizon 7.5 and newer), simply enter a user name in the search box.
  • VMware also has an alternative Horizon Helpdesk Utility Fling
  • For Horizon 7.2 through 7.4, go to https://HorizonFQDN/helpdesk (e.g. https://view.corp.com/helpdesk).

The Desktops and Applications tabs let you see what the user it entitled to. You can even export these lists.

On the Sessions tab, click a session to see more details.

On the Details tab, scroll down to find action buttons like Remote Assistance. These buttons are kind of hidden.

Keep scrolling down and you’ll see Logon Segments.

The Processes tab lets you end processes in the user’s session.

Notes on the Help Desk feature:

  • Enterprise Licensing – Help Desk tool requires Horizon Enterprise edition license, or Horizon Apps Advanced edition license. Horizon Standard Edition licenses do not include this tool. In Horizon 7.3 and newer, the Product Licensing page indicates if Help Desk is licensed or not.

  • In Horizon 7.2, only Full Horizon Administrators can login to the Help Desk web page.
  • Horizon 7.3 and newer have built-in Help Desk Administrators roles that can log into the Help Desk tool.

    • Add Help Desk users to the Administrators and Groups tab, and assign them one of the Help Desk roles.

  • 15 minutes of History – There’s only 15 minutes of collected metric data. Use vRealize Operations for Horizon for longer historical monitoring.
  • See Rob Beekmans Helpdesk functionality added to VMware Horizon 7.2.
  • According to Pascal van de Bor Horizon 7.2: With a little helpdesk from my friends, checkOrigin needs to be disabled to prevent the “Authentication failed, invalid domain, username or password. Please try again” error.

See Troubleshooting Users in Horizon Help Desk Tool at VMware Docs.

vCenter Connection, and optional Horizon Composer

Horizon must connect to vCenter for several reasons:

  • Power manage the virtual machines
  • Create new virtual machines using Instant Clones or Horizon Composer
  • Update virtual machines using Instant Clones or Horizon Composer

See the Product Interoperability Matrix for supported vCenter versions.

If you are adding multiple vCenter servers to Horizon, make sure each vCenter Server has a Unique ID. In vSphere Web Client, go to the vCenter Server > Manage > Settings > General > Edit > Runtime Settings, and confirm that the ID is unique for each vCenter server.

  1. In Horizon Console 7.8 or newer, on the left, expand Settings, and click Servers.

    • Or in Horizon Administrator, on the left, expand View Configuration, and click Servers.
  2. In the right pane, in the vCenter Servers tab, click Add.

  3. In the VC Information page, do the following:
    1. In the Server address field, enter the FQDN of the vCenter server.
    2. In the User Name field, enter the previously created Active Directory account (domainname\username) that Horizon will use to login to vCenter.
    3. Also enter the service account’s password.
  4. Click Next.

  5. If you see a message regarding invalid certificate, click View Certificate. Then click Accept.


  6. In the View Composer page, if you are using Horizon Composer, then do the following:
    1. Select Standalone View Composer Server.
    2. Enter the FQDN of the Composer Server, and the credentials of an account to access the Horizon Composer server. The service account must be a local administrator on the Horizon Composer Server.
  7. Click Next.

  8. If you see an invalid certificate, click View Certificate. Then click Accept.


  9. If you are using Horizon Composer, then in the View Composer Domains page, do the following:
    1. Click Add.

    2. Enter the Full domain name of where the virtual desktop computer objects will be created.
    3. Enter the Active Directory service account credentials that has permission to create computer objects, and click Submit.

  10. Then click Next.
  11. In the Storage page, do the following:
    1. Reclaim VM disk space requires IOPS during its operation. This feature is not needed for Instant Clones.
    2. Check the box to Enable Horizon Storage Accelerator, and increase the host cache size to 2048. Notes:
      • Horizon Storage Accelerator is required for Instant Clones.
      • Horizon Storage Accelerator causes digest files to be created, thus increasing disk space requirements and increasing how long it takes to Recompose a pool.
  12. Click Next.

  13. In the Ready to Complete page, click Submit.

Instant Clone Domain Accounts

If you plan to use Instant-Clone to create non-persistent virtual desktops, then add an administrator account that can join machines to the domain.

  1. In Horizon Console 7.9 or newer, on the left, expand Settings and click Instant Clone Domain Accounts.

    • Or in Horizon Administrator, on the left, expand View Configuration, and click Instant Clone Domain Accounts.
  2. On the right, click Add.

  3. Select the domain.
  4. Enter credentials of a service account that can join machines to the domain. Click OK.

Disable Check Origin

If you connect to Horizon Connection Server using any DNS name (e.g. load balancing DNS name) that doesn’t match the server’s DNS name, then it might not work unless you disable Origin Check as detailed at VMware 2144768 Accessing the Horizon View Administrator page displays a blank error window in Horizon 7.

Restrict Remote Access

The Users and Groups node has a new Remote Access tab. You can configure this in either the Horizon Console or in Horizon Administrator.

If you add groups or users to this tab, only these groups and users can login through Unified Access Gateway (UAG) or Security Server.

Users not in the list can’t login through Unified Access Gateway (UAG) or Security Server.

Disable Secure Tunnel

By default, internal Horizon Clients connect to Horizon Agents by tunneling (proxying) Blast or PCoIP through a Horizon Connection Server. It would be more efficient if the internal Horizon Clients connect directly to the Horizon Agents instead of going through a Connection Server.

  • If the tunnels are enabled, and if you reboot the Connection Server, then user connections will drop.
  • If the tunnels are disabled, then rebooting the Connection Server will not affect existing connections.

To disable the tunnels in either Horizon Console or Horizon Administrator:

  1. In Horizon Console, on the left, expand Settings, and click Servers.

    • Or in Horizon Administrator, on the left, expand View Configuration, and click Servers.
  2. On the right, switch to the Connection Servers tab.

  3. Click the Connection Server to highlight it, and click Edit.

  4. On the General tab, uncheck the boxes next to HTTP(S) Secure Tunnel and the two Gateways. Click OK.
  5. Note: if you are using HTML5 Blast internally, then disabling the Blast Secure Gateway will cause HTML5 Blast connections to go directly to the Horizon Agent, and the Agent certificate is probably not trusted. Newer versions of Horizon have an option to use Blast Secure Gateway only for HTML Access.

Event Database and Syslog

  1. In Horizon Console 7.9 or newer, on the left, expand Settings and click Event Configuration.

    • Or in Horizon Administrator, expand View Configuration, and click Event Configuration.
  2. On the right, under Event Database, click Edit.

  3. In the Edit Event Database dialog box, do the following:
    1. Enter the name of the SQL server.
    2. Select Microsoft SQL Server as the Database type.
    3. Enter the name of the database.
    4. Enter the SQL account credentials (no Windows authentication).
    5. Optionally, enter VE_ (or similar) for the Table prefix. This allows you to use the same Events database for multiple View installations.
  4. Click OK.

  5. On the right, in the Event Settings section, you can click Edit to change the age of events shown in Horizon Console or Horizon Administrator.

  6. To add a Syslog server, look on the right side of the page.

  7. There are configuration options for logging to a file (Events to File System).

  8. You can go to Monitor > Events to view the events in the database.

Event Database SQL Index

VMware Knowledgebase article – The Event database performance in VMware View 6.0.x is extremely slow (2094580): Symptoms:

  • The Event database performance in VMware View 6.0.x is extremely slow when browsing within View
  • High CPU usage on the SQL server, hosting the Event database
  • The larger the Event database becomes, the slower the queries run.

To resolve this issue, create an index. Run this command on your SQL Event database:

CREATE INDEX IX_eventid ON dbo.VDIevent_data (eventid)

Substitute VDIevent_data for the table name using your Event database prefix.

Event Queries

VMware Fling – Horizon View Event Notifier: collects and sends the alerts via email (SMTP) to users that are specified during the configuration process. It allows aggregation of alerts across multiple Horizon View Pods and for near real-time alerting of Horizon View alerts that are otherwise very difficult to be notified on.

Chris Halstead – VMware Horizon View Events Database Export Utility: this utility allows administrators to easily apply very detailed filtering to the data and export it to .csv. You can filter on time range,  event severity, event source, session type (Application or Desktop), Usernames and Event Types.  The application allows for extremely granular export of data.   The exported columns can also be customized and the application will export data from both the live and the historical tables in the View Events Database.

VMware Knowledgebase article – Creating SQL views to retrieve the top 50 maximum number of concurrent desktop sessions over a period: This article provides steps to create database views to retrieve the maximum number of concurrent desktop sessions over a period from the event_historical table.

To retrieve the top 50 maximum number of concurrent desktop sessions over a period time from the event_historical table, run this query:

select Count, Time from(select top 50 DOB.<prefix>_data_historical.IntValue as 'Count', DOB.<prefix>_historical.Time as 'Time' from DOB.<prefix>_historical.DOB.<prefix>_data_historical where DOB.<prefix>_historical.EventID = DOB.<prefix>_data_historical.EventID and DOB.<prefix>_data_historical.Name = 'UserCount' and DOB.<prefix>_historical.EventType='BROKER_DAILY_MAX_DESKTOP order by DOB.<prefix>_historical.Time DESC) A Order by Time

Where <prefix> is the prefix for the event table. You can find the prefix that you must use by examining other view definitions, such as user_events.

Global Settings

  1. In Horizon Console 7.9 or newer, on the left, expand Settings and click Global Settings. Or in Horizon Administrator, on the left, under View Configuration, click Global Settings.

  2. On the right, under Global Settings, in the General Settings tab (or General section), click Edit.

  3. Set the Connection Server Session Timeout (7.13 only) or View Administrator session timeout, which applies to both administrators and help desk. 4320 minutes (72 hours) is the maximum.


  4. Forcibly disconnect users is an active session timeout. It is not an idle timeout in that it doesn’t care if the user is working or not. The default is 10 hours so consider increasing it. Note: this timer does not log the user out of Windows. Instead it merely disconnects the user, and requires the user to logon to Horizon Connection Server again.

  5. Under Client-dependent settings you can set an idle timeout. This is a disconnect, not logoff.

  6. To configure an idle timeout for desktop sessions:
  7. Enable automatic status updates enables automatic updating of the table displayed in the top-left corner of Horizon Administrator.

  8. In Horizon 7.8 and newer, the Send domain list option in Horizon Console and Horizon Administrator is unchecked by default, which means users must enter a domain name instead of picking one from a list. Check this box to restore functionality from Horizon 7.7 and earlier. See VMware Blog Post Changes in Logon for VMware Horizon. Note: This setting is configurable in Horizon Console 7.10 and newer.

  9. Make other changes as desired. Click OK when done.

Horizon 7.8 and newer disable “Log On as Current User” by default. To enable this client feature:

  1. In Horizon Console 7.10 or newer, on the left, expand Settings, and click Servers.

    • Or in Horizon Administrator, on the left, expand View Configuration and click Servers.
  2. On the right, switch to the Connection Servers tab.

  3. Highlight a Connection Server and click Edit.

  4. Switch to the Authentication tab.

  5. Scroll down. Check the box next to Accept logon as current user. Click OK.

Horizon 7.11 and newer can restrict connections to a minimum version of Horizon Client. 💡

  1. In Horizon Console 7.11 or newer, on the left, expand Settings, and click Global Settings.
  2. On the right, switch to the tab named Client Restriction Settings.
  3. Click Edit.
  4. For each client type, enter a minimum version number. Click OK when done.
  5. The client version is enforced when you try to launch an icon.

Global Policies

By default, Multimedia Redirection is disabled. You can enable it in Global Policies.

  1. In Horizon Console 7.8 or newer, go to Settings > Global Policies. Or in Horizon Administrator, go to Policies > Global Policies.

  2. On the right, click Edit Policies.

  3. Set Multimedia redirection to Allow, and click OK. Notice that Multimedia redirection is not encrypted.

Backups

Connection Server LDAP Backup and Composer Database Backups can be configured in Horizon Administrator, or in Horizon Console.

  1. in Horizon Console 7.8 or newer, on the left, expand Settings and click Servers. Or in Horizon Administrator, on the left, expand View Configuration, and click Servers.

  2. On the right, switch to the Connection Servers tab.

  3. Select a Horizon Connection Server, and click Backup Now. Backups can be found in C:\ProgramData\VMware\VDM\backups.

  4. To change automatic backup settings, Edit the Horizon Connection Server, and switch to the Backup tab.

  5. you can schedule automatic backups. This also backs up the View Composer database but not the vCenter database. See VMware 1008046 Performing an end-to-end backup and restore for VMware View Manager.

Tips

VMware Blog Post Top 10 Tips for a Successful Horizon VDI

Related Pages

VMware Horizon 7.13.3 Connection Server

Last Modified: Mar 22, 2023 @ 5:43 am

239 Comments

Navigation

This post applies to all VMware Horizon 7 versions including 7.13.3 (ESB).

💡 = Recently Updated

Change Log

Upgrade

If you are performing a new install, skip to Install Horizon 7 Standard Connection Server.

Notes regarding upgrades:

  • Upgrade all Connection Servers during the same maintenance window.
    • Downgrades are not permitted.
      • You can snapshot your Connection Servers before beginning the upgrade. To revert, shut down all Connection Servers, then revert to snapshots.
    • For Cloud Pod Architecture, you don’t have to upgrade every pod at once. But upgrade all of them as soon as possible.
    • Horizon Agents cannot be upgraded until the Connection Servers are upgraded.
    • All Connection Servers in the pod must be online before starting the upgrade.
    • Upgrade Horizon Composer before upgrading the Connection Servers.
    • It’s an in-place upgrade. Just run the Connection Server installer and click Next a couple times.
      • If upgrading from version 7.7 or older to version 7.8 or newer, then be aware of authentication changes.
    • For Security Servers, in Horizon Administrator, go to paired Connection Server, More Commands > Prepare for Upgrade or Reinstallation.
  • Upgrade the Horizon Group Policy template (.admx) files.
  • Upgrade the Horizon Agents.
    • It’s an in-place upgrade.
    • There’s no hurry. Upgrade the Horizon Agents when time permits.
  • Upgrade the Horizon Clients.
    • Horizon Clients can be upgraded anytime before the rest of the infrastructure is upgraded.

Install Horizon 7 Standard Connection Server

The first Horizon Connection Server must be a Standard Server. Subsequent Horizon Connection Servers are Replicas. Once Horizon Connection Server is installed, there is no difference between them.

A production Horizon Connection Server should have 10 GB of RAM and 4 vCPU.

  • In Horizon 7.2 and newer, each Horizon Connection Server can handle 4,000 connections.
  • In Horizon 7.1 and newer, each Horizon Connection Server can handle 2,000 connections.

Horizon 7.13.3 is the last release of Horizon 7 and will be supported until May 2023. VMware recommends upgrading all Horizon 7 implementations to Horizon 8.

To install the first Horizon Connection Server:

  1. Ensure the Horizon Connection Server has 10 GB of RAM and 4 vCPU. Source = Hardware Requirements for View Connection Server at VMware Docs.
  2. Windows Server 2019 is supported with Horizon Connection Server 7.8 and newer.
  3. Windows Server 2016 is supported with Horizon Connection Server 7.1 and newer.
  4. Horizon Composer cannot be installed on the Horizon Connection Server, and vice versa.
  5. The older Horizon Administrator (/flexadmin) is a Flash-based console. After December 2020, Chrome will no longer support Flash.
    • Horizon Console (/newadmin) is HTML5 and does not need Flash.
  6. Download Horizon 7.13.3 View Connection Server.
  7. If Horizon Toolbox is installed, uninstall it.
  8. Run the downloaded VMware-Horizon-Connection-Server-x86_64-7.13.3.exe.
  9. In the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server page, click Next.
  10. If you are upgrading from version 7.7 or older to version 7.8 or newer, then acknowledge the authentication changes warning by clicking OK.
  11. In the License Agreement page, select I accept the terms, and click Next.
  12. In the Destination Folder page, click Next.
  13. In the Installation Options page, select Horizon 7 Standard Server, and click Next.
  14. In the Data Recovery page, enter a password, and click Next.
  15. In the Firewall Configuration page, click Next.
  16. In the Initial Horizon 7 Administrators page, enter an AD group containing your Horizon administrators, and click Next.
  17. In the User Experience Improvement Program page, uncheck the box, and click Next.
  18. In the Ready to Install the Program page, click Install.
  19. In the Installer Completed page, uncheck the box next to Show the readme file, and click Finish.
  20. If you upgraded to Horizon 7.8 or newer and want to re-enable Logon as current user:
    1. In Horizon Console 7.10 or newer, on the left, expand Settings and click Servers. Or in Horizon Administrator, on the left, go to View Configuration > Servers.

    2. On the right, switch to the tab named Connection Servers.
    3. Highlight the server you just upgraded and click Edit.

    4. Switch to the tab named Authentication.

    5. Scroll down, check the box next to Accept logon as current user and then click OK.

  21. If you upgraded to Horizon 7.8 or newer and want to re-enable sending the domain list to Horizon Client:
    1. In Horizon Console 7.10 or newer, on the left, expand Settings and click Global Settings. Or in Horizon Administrator, on the left, go to View Configuration > Global Settings.
    2. On the right, in the General section, click the Edit button.

    3. Near the bottom, check the box next to Send domain list. You might want to uncheck Hide domain list in client user interface. Then click OK.

Install Horizon 7 Replica Connection Server

Additional internal Horizon Connection Servers are installed as Replicas. After installation, there is no difference between a Replica server and a Standard server.

A production Horizon Connection Server should have 10 GB of RAM and 4 vCPU.

  • In Horizon 7.2 and newer, each Horizon Connection Server can handle 4,000 connections.
  • In Horizon 7.1 and newer, each Horizon Connection Server can handle 2,000 connections.

To install Horizon Connection Server Replica:

  1. Ensure the Horizon Connection Server has 10 GB of RAM and 4 vCPU.
  2. Windows Server 2019 is supported with Horizon Connection Server 7.8 and newer.
  3. Windows Server 2016 is supported with Horizon Connection Server 7.1 and newer.
  4. Download Horizon 7.13.3 View Connection Server.
  5. Run the downloaded VMware-Horizon-Connection-Server-x86_64-7.13.3.exe.
  6. In the Welcome to the Installation Wizard for VMware Horizon 7 Connection Server page, click Next.
  7. In the License Agreement page, select I accept the terms, and click Next.
  8. In the Destination Folder page, click Next.
  9. In the Installation Options page, select Horizon 7 Replica Server, and click Next.
  10. In the Source Server page, enter the name of another Horizon Connection Server in the group. Then click Next.
  11. In the Firewall Configuration page, click Next.
  12. In the Ready to Install the Program page, click Install.
  13. In the Installer Completed page, click Finish.
  14. Load balance your multiple Horizon Connection Servers.

Horizon Connection Server Certificate

  1. Run certlm.msc (Windows 2012+). Or run mmc, add the Certificates snap-in, and point it to Computer > Local Machine.
  2. Request a new certificate with a common name that matches the FQDN of the Connection Server, or import a wildcard certificate.
  3. Note: the private key must be exportable. If using the Computer template, click Details, and then click Properties.
  4. On the Private Key tab, click Key options to expand it, and check the box next to Mark private key as exportable.
  5. In the list of certificates, look for the one that is self-signed. The Issuer will be the local computer name instead of a Certificate Authority. Right-click it, and click Properties.
  6. On the General tab, clear the Friendly name field, and click OK.
  7. Right-click your Certificate Authority-signed certificate, and try to export it.
  8. On the Export Private Key page, make sure Yes, export the private key is selectable. If the option to export the private key is grayed out, then this certificate will not work. Click Cancel.
  9. Right-click your Certificate Authority-signed certificate, and click Properties.
  10. On the General tab, in the Friendly name field, enter the text vdm, and click OK. Note: only one certificate can have vdm as the Friendly name.
  11. Then restart the VMware Horizon View Connection Server service. It will take several seconds before you can connect to Horizon View Administrator.

Horizon Portal – Client Installation Link

If you point your browser to the Horizon Connection Server (without /admin in the path), the Install VMware Horizon Client link redirects to the VMware.com site for downloading of Horizon Clients. You can change it so that the Horizon Clients can be downloaded directly from the Horizon Connection Server.

  1. On the Horizon Connection Server, go to C:\Program Files\VMware\VMware View\Server\broker\webapps.
  2. Create a new folder called downloads.
  3. Copy the downloaded Horizon Client 5.2 for Windows to the new C:\Program Files\VMware\VMware View\Server\broker\webapps\downloads folder.
  4. Run Notepad as administrator.
  5. Open the file C:\ProgramData\VMware\VDM\portal\portal-links-html-access.properties file with a text editor (as Administrator).
  6. Go back to the downloads folder, and copy the Horizon Client filename.
  7. In Notepad, modify link.win32 and link.win64 by specifying the relative path to the Horizon Client executable under /downloads. Note: In Horizon Client 4.3 and newer, there’s only one Horizon client for both 32-bit and 64-bit. The following example shows a link for the Horizon win64 client. 
    link.win64=/downloads/VMware-Horizon-Client-5.2.0-14570289.exe
  8. Then Save the file.
  9. Restart the VMware Horizon View Web Component service, or restart the entire Connection Server.
  10. It will take a few seconds for the ws_TomcatService process to start so be patient. If you get a 503 error, then the service is not done starting.
  11. Now when you click the link to download the client, it will grab the file directly from the Horizon Connection Server.
  12. Repeat these steps on each Connection Server.

Portal Branding

Chris Tucker at Horizon View 7.X – Branding the Logon page details how to brand the Horizon 7.1 and newer portal page.

LDAP Edits

Horizon Console Timeout

The HTML5 Horizon Console (https://MyConnectionServer/newadmin) has a default timeout of 10 minutes. Changing the Horizon Administrator timeout will not affect the Horizon Console timeout. You can use adsiedit.msc to increase the Horizon Console timeout.

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit, and click Connect to.
  3. Change the first selection to Select or type a Distinguished Name, and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server, and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Scroll down, click to highlight pae-APISessionTimeout, and click Edit.
  7. Enter a value in minutes. Click OK.

Mobile Client – Save Password

If desired, you can configure Horizon Connection Server to allow mobile clients (iOS, Android) to save user passwords.

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit, and click Connect to.
  3. Change the first selection to Select or type a Distinguished Name, and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server, and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Scroll down, click to highlight pae-ClientCredentialCacheTimeout, and click Edit.
  7. Enter a value in minutes. 0 = no saving of credentials. -1 = no timeout. Click OK.

Biometric Authentication – iOS Touch ID, iOS Face ID, Fingerprints, Windows Hello

Biometric authentication, including Touch ID, Face ID, Fingerprints, and Windows Hello, is disabled by default. To enable: (source = vDelboy – How to Enable Touch ID in VMware Horizon 6.2 and Configure Biometric Authentication at VMware Docs)

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit and click Connect to…
  3. Change the first selection to Select or type a Distinguished Name and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Find the attribute pae-ClientConfig and double-click it.
  7. Enter the line BioMetricsTimeout=-1, and click Add. Click OK. The change takes effect immediately.

Disallow Non-empty Pool Deletion

Configure View to Disallow the Deletion of a Desktop Pool That Contains Desktop Machines at VMware Docs.

  1. On the Horizon Connection Server, run ADSI Edit.
  2. Right-click ADSI Edit and click Connect to…
  3. Change the first selection to Select or type a Distinguished Name and enter dc=vdi,dc=vmware,dc=int.
  4. Change the second selection to Select or type a domain or server and enter localhost. Click OK.
  5. Navigate to Properties > Global. On the right, double-click CN=Common.
  6. Find the attribute pae-NameValuePair, and double-click it.
  7. Enter the line cs-disableNonEmptyPoolDelete=1, and click Add. Click OK. The change takes effect immediately.

Load Balancing

See Carl Stalhood’s Horizon Load Balancing using NetScaler 12.1.

Remote Desktop Licensing

If you plan to build RDS Hosts, then install Remote Desktop Licensing somewhere. You can install it on your Horizon Connection Servers by following the procedure at https://www.carlstalhood.com/delivery-controller-7-15-ltsr-and-licensing/#rdlicensing.

Antivirus

VMware Tech Paper Antivirus Considerations for VMware Horizon 7: exclusions for Horizon View, App Volumes, User Environment Manager, ThinApp

Help Desk Tool Timing Profiler

Horizon 7.2 and newer include a web-based Help Desk Tool. Run the following command to enable the timing profiler on each Connection Server instance to view logon segments.

vdmadmin -I -timingProfiler -enable

Logon Monitoring

The VMware Logon Monitor Fling is built into Horizon 7.1 and newer.

The logon logs are stored at C:\programdata\VMware\VMware Logon Monitor\Logs on each Horizon Agent. The Fling website has a PDF that explains how to also store them on a file share.

Inside each session log file are logon time statistics. 

VMware Horizon 7.13.3 Composer

Last Modified: Mar 22, 2023 @ 5:46 am

93 Comments

Navigation

This post applies to all VMware Horizon 7 versions including 7.13.3 (ESB).

Change Log

Planning

If you’re doing Instant Clones, then you don’t need Horizon Composer. Composer is only needed for the older method of creating Linked Clones. However, Instant Clones requires Horizon Enterprise Edition, so maybe Composer is your only option.

  • Instant Clones in Standard Edition – In Horizon 7.13, all editions of Horizon, including Standard Edition, include licensing for Instant Clones. Horizon 8 removes Composer, so start migrating to Instant Clones today.

vCenter Server planning:

  • A single vCenter Server can handle 10,000 VMs. However, this is a single point of failure. VMware recommends separate vCenter servers for each 2,000 or 4,000 VMs. More vCenter Servers means more concurrent vCenter operations, especially if your pools are configured for Refresh on Logoff.
    • Horizon 7.2 and newer supports 4,000 VMs per vCenter Server.
    • Horizon 7.1 and older supports 2,000 VMs per vCenter Server.
  • Each ESXi cluster is managed by one vCenter Server.
  • Don’t use existing vCenter servers. Build separate vCenter servers for the vSphere clusters that host Agent VMs. Horizon licenses include vCenter licenses, so there’s no excuse to not use separate vCenter servers.

Horizon View Composer server planning:

A remote SQL Server is needed for databases:

  • vCenter database
  • Horizon Composer database
  • Horizon Events database
  • Supported SQL versions are listed on the Solution/Database Interoperability tab at VMware Product Interoperability Matrices.

SQL Server Preparation

Only SQL Authentication is supported.

  1. Open the properties of the SQL Server.
  2. On the Security page, make sure SQL Server authentication is enabled.
  3. Create a new SQL database for View Composer.
  4. Call it VMwareHorizonComposer or similar. Then switch to the Options page.
  5. Select your desired Recovery model, and click OK.
  6. View Composer only supports SQL authentication on remote SQL servers. Expand Security, right-click Logins, and click New Login to create a new SQL login.
  7. Name the new account.
  8. Select SQL Server authentication.
  9. Enter a password for the new account.
  10. Uncheck the box next to Enforce password policy.
  11. Then switch to the User Mapping page.
  12. On the User Mapping page, in the upper half, check the Map box for VMwareHorizonComposer.
  13. On the bottom, check the box for the db_owner role, and click OK.

SQL Native Client

  1. Download SQL Native Client (sqlncli.msi).
  2. On the Horizon View Composer server, run sqlncli.msi.
  3. In the Welcome to the Installation Wizard for SQL Server 2012 Native Client page, click Next.
  4. In the License Agreement page, select I accept, and click Next.
  5. In the Feature Selection page, click Next.
  6. In the Ready to Install the Program page, click Install.
  7. In the Completing the SQL Server 2012 Native Client installation page, click Finish.

ODBC

  1. On the Horizon View Composer server, run ODBC Data Sources (64-bit) from the Start Menu.
  2. On the System DSN tab, click Add.
  3. Select SQL Server Native Client, and click Finish.
  4. Enter the name HorizonComposer for the DSN, and enter the SQL server name. Click Next.
  5. Change the selection to With SQL Server authentication, and enter the credentials of the new ViewComposer SQL account. Then click Next.
  6. Check the box next to Change the default database, and select the VMwareHorizonComposer database. Then click Next.
  7. Click Finish.
  8. Click OK twice.

Install/Upgrade Composer

  1. Upgrade can be performed in-place.
  2. Windows Server 2019 is supported with Horizon Composer 7.8 and newer.
  3. Don’t install on Horizon Connection Server: Horizon Composer cannot be installed on the Horizon Connection Server. Composer and Connection Server must be separate machines.
  4. Extra Memory for vCenter: If you install Horizon Composer on a Windows vCenter server, VMware recommends adding 8 GB of RAM to the server. See VMware 2105261 Intermittent provisioning issues and generic errors when Composer and vCenter Server are co-installed
    1. vCenter Service Account: if you install Horizon Composer on a Windows vCenter server, login as the same account that was used to install vCenter. See VMware 2017773 Installing or upgrading View Composer fails with error: The wizard was interrupted before VMware View Composer could be completely installed
  5. Internet access for CRL checking: If the Horizon Composer server does not have Internet access, see VMware 2081888 Installing Horizon View Composer fails with the error: Error 1920 Service VMware Horizon View Composer (svid) failed to start
  6. Certificate: If you install a certificate now, Composer installer will prompt you to select it during installation. Or, you can replace the certificate later.
  7. Download: Horizon 7.13.3 (ESB) Composer.
  8. Install: Run the downloaded VMware-viewcomposer-7.13.3.exe.
  9. In the Welcome to the Installation Wizard for VMware Horizon 7 Composer page, click Next.
  10. In the License Agreement page, select I accept the terms, and click Next.
  11. In the Destination Folder page, click Next.
  12. In the Database Information page, enter the name of the ODBC DSN.
  13. Enter the SQL account credentials (no Windows accounts), and click Next. For remote SQL databases, only SQL accounts will work. The SQL account must be db_owner of the database.
  14. The VMware Horizon 7 Composer Port Settings page appears. If you already installed a valid certificate on the Composer server, select Use an existing SSL certificate, and select the certificate. Click Next.
  15. In the Ready to Install the Program page, click Install.
  16. In the Installer Completed page, click Finish.
  17. Click Yes when asked to restart the computer.
  18. If you encounter installation issues, see VMware 2087379 VMware Horizon View Composer help center

After Upgrade, Accept Untrusted Certificate

If you upgraded Composer, then go to Horizon Console or Horizon Administrator and verify the certificate. Ideally, Composer should be using a Trusted Certificate. Or you might have to Accept an untrusted certificate.

In Horizon Console 7.10 or newer: (scroll down for Horizon Administrator instructions)

  1. On the left, expand Monitor and click Dashboard.
  2. On the right, in the top left box labelled System Health, click View.
  3. With Components selected on the left, on the right, switch to the tab named View Composer Servers.
  4. Click the link for Untrusted Certificate.
  5. Scroll down and Accept the certificate.

Or in Horizon Administrator:

  1. On the top left, click Dashboard.
  2. On the right, expand View Composer Servers and click the red Composer server.
  3. Next to Untrusted certificate, click Verify.
  4. Click the button labelled View Certificate.
  5. At the bottom, click the button labelled Accept.

Administrator Permissions

If Horizon View Composer is installed on a standalone server (not on vCenter), Horizon Connection Server will need a service account with administrator permissions on the Horizon View Composer server. Add your Horizon View Composer Service Account to the local Administrators group.

Composer Certificate

  1. Open the MMC Certificates snap-in (certlm.msc).
  2. Make sure your Composer certificate private key is exportable. Try exporting the certificate, and make sure Yes, export the private key is a selectable option.

  3. Stop the VMware Horizon 7 Composer service.
  4. In the certificates console, double-click your Composer certificate. On the Details tab, note the Thumbprint.
  5. Run Command Prompt as Administrator
  6. Change the directory to C:\Program Files (x86)\VMware\VMware View Composer.
  7. Run sviconfig -operation=replacecertificate -delete=false.
  8. Select the certificate that matches the thumbprint you noted earlier.
  9. Then restart the VMware Horizon 7 Composer service.

SQL Database Maintenance

SQL password: The password for the SQL account is stored in C:\Program Files (x86)\VMware\VMware View Composer\SviWebService.exe.config. To change the password, run SviConfig ‑operation=SaveConfiguration as detailed at VMware 1022526 The View Composer service fails to start after the Composer DSN password is changed.

Database Move: To move the database to a new SQL server, you must uninstall Composer and reinstall it. See VMware 2081899 VMware Horizon View Composer fails to work properly after migrating the Composer database to a new SQL server

Related Pages

Citrix SCOM Management Pack – NetScaler (1.17.93)

Last Modified: Nov 6, 2020 @ 7:12 am

40 Comments

Navigation

💡 = Recently Updated

Requirements

  • NetScaler Platinum Edition
  • NetScaler 9.3 or newer
  • System Center Operations Manager 2012 or newer

Citrix Blog Post SCOM NetScaler Management Pack Resource Consumption & Performance Overview:

  • For 14,000 NetScaler objects, extra 3 GB of RAM is needed on the SCOM monitoring agent. CPU is minimal.
  • For more than 14,000 NetScaler objects, the Agent started dropping data due to workflows.
  • Performance overview at Citrix Docs

NetScaler Pack

Full documentation at http://docs.citrix.com/en-us/scom-management-packs/netscaler/1-17.html.

Install Citrix NetScaler Pack

  1. On the System Center Operations Manager server, go to the downloaded Citrix SCOM Management Pack for NetScaler, and run Citrix_SCOM_Management_Pack_for_NetScaler.1.17.93exe.
  2. In the Welcome to the setup wizard for Citrix SCOM Management Pack for NetScaler page, click Next.
  3. In the View Relevant Product Configuration page, click Next.
  4. If you see a page indicating that an older version is already installed, click Next.
  5. In the License Agreement page, check the box next to I accept the terms, and click Next.
  6. In the Choose Destination Location page, click Next.
  7. In the Configure Post-Install Actions page, check the box next to Automatically import the Management Pack, and click Install.
  8. In the Completed the setup page, click Next.
  9. In the All post-install actions were successfully completed page, click Finish.

MP Agent Installation Account

Configure the MP Agent Installation Account as detailed for the XAXD Pack.

NetScaler Monitoring Account

On the NetScaler appliances, run the following commands to add a local account, and bind it to a restrictive cmdPolicy. Replace the password with a secure password. If you leave the password off the command, then NetScaler will prompt you.

add system cmdPolicy polNetScalerMonitoring ALLOW (^show\s+system\s+\S+)|(^show\s+system\s+\S+\s+.*)|(^show\s+configstatus)|(^show\s+configstatus\s+.*)|(^shell\s+nsconmsg\s+-K\s+\S+\s+.*)

add system user usrNetScalerMonitoring MyPassword

bind system user usrNetScalerMonitoring read-only 1

bind system user usrNetScalerMonitoring polNetScalerMonitoring 1

show system user usrNetScalerMonitoring

SCOM Device Discovery

  1. System Center Operations Manager uses SNMP to communicate with NetScaler. If Windows Firewall is enabled on the SCOM server, enable some Inbound and Outbound rules.
  2. Inbound Rule: Operations Manager Ping Response.
  3. Inbound Rule: Operations Manager SNMP Response.
  4. Inbound Rule: Operations Manager SNMP Trap Listener.
  5. Outbound Rule: Operations Manager Ping Request.
  6. Outbound Rule: Operations Manager SNMP Request.
  7. Make sure the NetScaler is configured with an SNMP community string with ALL permission at System > SNMP > Community.
  8. If you have SNMP Managers configured, then make sure SCOM is in the list.
  9. In SCOM Console, go to the Administration workspace, right-click, and click Discovery Wizard.
  10. Select Network devices, and click Next.
  11. In the General Properties page, give the discovery rule a name. Select a SCOM server, and resource pool to run the discovery rule. Then click Next.
  12. In the Discovery Method page, select Explicit discovery, and click Next.
  13. In the Default Accounts page, if you are using SNMPv2 (instead of SNMPv3) to connect to NetScaler, then you can add the community string now. Click Create Account.
  14. In the Introduction page, click Next.
  15. In the General Properties page, give the community string a display name, and click Next.
  16. In the Credentials page, enter the community string, and click Create.
  17. Then click Next.
  18. In the Devices page, click Add.
  19. Enter the hostname of the device.
  20. Select the SNMP version.
  21. If SNMPv2, select the community string. If SNMPv3, you can add the user account now.
  22. Click OK when done.
  23. Add more devices. Then click Next.
  24. In the Schedule Discovery page, select how often you want this rule to run, and click Next.
  25. In the Summary page, click Create.
  26. Click Yes to distribute the accounts.
  27. In the Completion page, click Close. The rule will run now.
  28. You  can also go to Administration > Network Management > Discovery Rules, and run the rule manually.
  29. And Network Devices Pending Management will show you discovery issues.
  30. The NetScaler appliance needs to be discovered and listed in the Network Devices node.
  31. You can use a SNMP Tester tool on the SCOM server to verify SNMP communication with NetScaler.  💡
  32. Also see CTX219765 Monitoring NetScaler with SCOM Management Packs – Understanding Discovery.  💡

Install Citrix NetScaler Agent

The Citrix SCOM Agent for NetScaler must be installed on the same SCOM server that is running the device discovery rule.

  1. If upgrading, uninstall the older Agent for NetScaler.
  2. On the SCOM servers that are running the SNMP Discovery Rule, go to \\scom01\CitrixMPShare\NetScaler MP, and run MPNSAgent.exe.
  3. In the Welcome to the setup wizard for Citrix SCOM Management Pack Agent for NetScaler page, click Next.
  4. If you see a page indicating that an older version is already installed, click Next.
  5. In the License Agreement page, check the box next to I accept the terms, and click Next.
  6. In the Destination Folder page, click Next.
  7. In the  Destination Data Folder page, click Install.
  8. In the Completed the setup wizard page, click Finish.

NetScaler Monitoring RunAs Account

  1. In SCOM console, go to Administration workspace, right-click, and click Create Run As Account.
  2. In the Introduction page, click Next.
  3. In the General Properties page, change the account type to Basic Authentication.
  4. Give the account a display name and click Next.
  5. In the Credentials page, enter the credentials of the local monitoring account on the NetScalers, and click Next.
  6. In the Distribution Security page, best practice is to select More secure. But you’ll need to manually specify every agent that should receive these credentials. Click Create.
  7. In the Completion page, click Close.
  8. In the Administration workspace, go to Run As > Profiles.
  9. Double-click Citrix NetScaler Appliance Action Account.
  10. In the Introduction page, click Next.
  11. In the General Properties page, click Next.
  12. In the Run As Accounts page, click Add.
  13. Select the previously created NetScaler monitoring account.
  14. Change the selection to A selected class, group, or object. Then click Select > Object.
  15. Search for the NetScaler appliances these credentials apply to, click Add, and then click OK.
  16. Then click OK.
  17. Click Save.
  18. In the Completion page, if the Run As account is configured for Secure Distribution then click the link to specify Agents to receive the credentials.

Use Management Pack

In the Monitoring workspace, under Citrix NetScaler, your appliance should eventually show up. These views should give you an inventory of the NetScaler configuration, current health status, etc.

Related Pages

Citrix SCOM Management Packs – XenApp/XenDesktop (2017_10_27)

Last Modified: Nov 7, 2020 @ 6:34 am

69 Comments

Navigation

Change Log

Requirements

  • XenApp/XenDesktop Platinum Edition with current Subscription Advantage
  • XenApp/XenDesktop version 6.0 or newer
  • Citrix Licensing Server 11.13.1 or newer
  • System Center Operations Manager 2012 or newer

Citrix provided an overview of the SCOM Management Packs during a breakout session at Synergy 2016.

Licensing Pack

See Citrix Docs for Full Documentation of the Licensing Pack.

  1. Download the Citrix SCOM Management Pack Bundle and extract it.
  2. Extract the Citrix_SCOM_Management_Pack_for_LicenseServer.zip file.
  3. In SCOM Console, go to Administration, right-click Management Packs, and click Import Management Packs.
  4. Click Add, and click add from disk.
  5. Browse to the extracted License Server Management Pack, and select all three files. Click Open.
  6. Click Install.
  7. Click Close when done.
  8. Go to Administration > Device Management > Agent Managed.
  9. Double-click your license server.
  10. On the Security tab, check the box next to Allow this agent to act as a proxy, and click OK.
  11. If you go to Monitoring > Citrix License Server > License Server State, you’ll eventually see your license server.

XenApp/XenDesktop Pack

See Citrix Docs for Full Documentation of the XenApp/XenDesktop Pack.

Links:

To upgrade:

  • Install the updated SCOM Pack on the SCOM Server.
  • Run the Install MPXAXD Agent task, and override the UpgradeAgent parameter to true.
  • In-place upgrade the Machine Agent.
  • Import updated SLA Dashboard Management Pack.

Install/Upgrade Citrix XenAppXenDesktop Pack

To install or upgrade:

  1. To upgrade, simply run the installer again as detailed in the next step.
  2. Download the Citrix SCOM Management Pack Bundle.
  3. On the System Center Operations Manager server, run Citrix_SCOM_Management_Pack_for_XenAppXenDesktop.exe.
  4. In the Welcome to the setup wizard for Citrix SCOM Management Pack for XenApp and XenDesktop page, click Next.
  5. In the View Relevant Product Configuration page, click Next.
  6. If upgrading, the installer will detect the older version. Click Next to begin the upgrade. For new installs, skip to the next step.
  7. In the License Agreement page, check the box next to I accept the terms, and click Next.
  8. In the Destination Folder page, click Next.
  9. In the Configure Post-Install Actions page, check the box next to Automatically import the Management Pack. Feel free to uncheck Enable the product to send anonymous usage statistics to Citrix. Click Install.
  10. In the Completed the setup for Citrix SCOM Management Pack for XenApp and XenDesktop page, click Next.
  11. In the All post-install actions were successfully executed page, click Finish.

Citrix XAXD Pack Action Account

  1. Create a new account. This account must be an administrator on all monitored Citrix machines: Controllers, VDAs, etc.
  2. In Citrix Studio, add the action account with Read-only permissions.



  3. In SCOM console, go to Administration workspace, right-click, and click Create Run As Account.
  4. In the Introduction page, click Next.
  5. In the General Properties page, change the account type to Windows.
  6. Give the account a display name and click Next.
  7. In the Credentials page, enter the previously created action account credentials and click Next.
  8. In the Distribution Security page, best practice is to select More secure. But you’ll need to manually specify every agent that should receive these credentials. Click Create.
  9. In the Completion page, click Close.
  10. In the Administration workspace, go to Run As > Profiles.
  11. Double-click Citrix XenApp/XenDesktop Monitoring Account.
  12. In the Introduction page, click Next.
  13. In the General Properties page, click Next.
  14. In the Run As Accounts page, click Add.
  15. Select the previously created action account, and click OK.
  16. Click Save.
  17. In the Completion page, if the Run As account is configured for Secure Distribution, then click the link to specify Agents to receive the credentials.

MP Agent Installation Account

Several of the Management Packs require an additional agent to be installed on top of the SCOM agent. Create an Active Directory account that will be used by the agent installer to connect to the file share on the System Center Operations Manager server. This configuration is used by several of Citrix’s Management Packs.

  1. In Active Directory, create a new regular account for Management Pack Agent installation.
  2. On the System Center Operations Manager server, open Computer Management.
  3. Edit the CitrixMPShareUsers local group.
  4. Add the MP Agent Installation Account. Also add the Citrix Admins group. Click OK.
  5. In SCOM Console, go to the Administration workspace, right-click, and click Create Run As Account.
  6. In the Introduction page, click Next.
  7. In the General Properties page, change the account type to Windows.
  8. Give the account a display name and click Next.
  9. In the Credentials page, enter the previously created Agent Installation account credentials, and click Next.
  10. In the Distribution Security page, best practice is to select More secure. But you’ll need to manually specify every agent that should receive these credentials. Click Create.
  11. In the Completion page, click Close.
  12. In the Administration workspace, go to Run As > Profiles.
  13. Double-click Citrix Management Pack Network Share Account.
  14. In the Introduction page, click Next.
  15. In the General Properties page, click Next.
  16. In the Run As Accounts page, click Add.
  17. Select the previously created Management Pack Agent installation account, and click OK.
  18. Click Save.

SCOM Proxy Agent

All Microsoft SCOM Agents running Citrix Agents must be marked as a Proxy Agent.

  1. In the SCOM Console, go to the Administration workspace, expand Device Management, and click Agent Managed.
  2. Double-click your SCOM Agent.
  3. On the Security tab, check the box next to Allow this agent to act as a proxy, and click OK.

Director URL

  1. On the SCOM server, run XenApp and XenDesktop MP Configuration.
  2. In Management Pack 3.12 and newer, the first time you launch the tool, you’ll be taken to the Configuration encryption tab. Click Set, and enter a permanent password. Note: the password will later be entered in clear text when running a SCOM Task to install or upgrade the agent.

  3. For environments with more than 100 Delivery Groups, 600 Server OS machines, and 1,500 applications, see Configuring SCOM Administrator at Citrix Docs to configure the SCOM Connector by specifying a SCOM Administrator on the SCOM Administrator tab.
  4. On the Director URL tab, click Add.
  5. Enter the XenDesktop Site name (farm name).
  6. Enter the Director URL for the farm, and click OK twice.

Push Citrix XAXD Agent

To push the XAXD Agent:

  1. In the SCOM Console, go to Monitoring workspace, expand Citrix Library, and click XenApp/XenDesktop Delivery Controller Computers.
  2. Select a Delivery Controller.
  3. On the bottom right, in the XAXD Delivery Controller Computer Role Tasks pane, click Check Installation Prerequisites.
  4. Click Run.
  5. Review the report, and then click Close.
  6. Now click the Install Citrix MPXAXD Agent task.
  7. If desired, you can override the Task Parameters. See the documentation for details.
  8. In 3.12 and newer, you must override the Encryption Password parameter, and specify the password you entered in the Configuration Tool.
  9. If upgrading, set UpgradeAgent to true. Then click Run.
  10. When done, review the task output, and then click Close.
  11. If you see an Error about the service logon account…

    1. Then go to the Delivery Controller, open Services, and reconfigure Citrix MPXAXD Agent service to run as a local administrator that has read-only permissions in Citrix Studio.
  12. The agent will eventually report as Healthy.
  13. You can verify configuration by running the Check Requirements and Configuration task. You might have to also run the Update Configuration task.

  14. If you scroll down, you’ll see the agent version.
  15. Citrix CTX224736 Citrix SCOM Management Pack for XenApp and XenDesktop 7.x – Disabling monitoring of VDA Services in large environments: In large environments, with 500+ Server OS machines, disable monitoring of VDA services on Server OS machines.
  16. Citrix CTX225735 Citrix SCOM MP Agents – Support Information Logging: The information in the SCOM MP Agent log files might be insufficient to troubleshoot certain issues. You can set additional product logging by modifying the log level registry key.
    • HKEY_LOCAL_MACHINE\SOFTWARE\Comtrade\<SCOM MP Agent>
      • LogLevel (REG_SZ) = ERROR, WARN, INFO, or DEBUG
    • The log files are located at %ProgramData%\Citrix\SCOM MP Agent\logs
    • Logging configuration for some agents is located in the mp_config.ini file.
  17. Citrix CTX230082 Citrix SCOM Management Pack for XenApp and XenDesktop – Monitoring failure on connections live for more than 24 hours. If any Session A in the monitored environment last longer than 24 hours, any new sessions that start after the 24-hour retention period but before Session A ends will not be monitored properly.  💡
    • HKEY_LOCAL_MACHINE\SOFTWARE\ComTrade\XenDesktop MP Agent
      • ConnectionEventsMaxAgeInHours (DWORD) = number of hours you expect the longest connections in the monitored environment to last

Install Citrix Machine Proxy Agent

To monitor the performance of the VDAs, install the Citrix Machine Agent on any Windows Server 2012 or newer machine (Windows Server 2008 R2 is not supported). This Agent will use PSRemoting to connect to a Delivery Controller to enumerate the VDAs in the farm. The Agent will then use WinRM to pull performance data and session data from the VDAs.

  1. Enable PSRemoting on the Delivery Controllers.
  2. On the VDAs, run winrm quickconfig.
  3. The Machine Agent uses an account to connect to Delivery Controller and VDAs. You can use the same Action Account created earlier for the Management Pack. This account must be a read-only administrator in XenDesktop and it must have administrator permissions to all Controllers and VDAs.

  4. To verify WinRM, run Command Prompt as the action account.

  5. Run winrm identify -r:http://myvda.corp.local:5985 -auth:Kerberos. It should connect.
  6. Go to any Windows Server 2012 or newer machine that you want to run the VDA Machine Agent on. The Machine Agent uses WinRM to connect to the VDAs. One option is to install it on one of the Delivery Controllers.
  7. Connect to \\scom01\CitrixMPShare.
  8. Copy XenDesktop Machine MP to the local machine.
  9. Run Support.exe /checkprereq to verify prerequisites.

  10. Then run MPXAXDMachineAgent.exe.
  11. In the Welcome to the setup wizard for Citrix SCOM Management Pack Machine Agent for XenApp and XenDesktop page, click Next.
  12. The installer will detect the previously installed version. Click Next.
  13. In the End User License Agreement page, check the box next to I accept the terms, and click Next.
  14. In the Destination Folder page, click Next.
  15. In the Destination Data Folder page, click Next.
  16. In the Agent Service Account page, enter the service account (action account) credentials, and click Next.
  17. In the Delivery Controllers page, enter the hostnames of the Delivery Controllers you want this agent to monitor, and click Install.
  18. In the Completed the setup wizard for Citrix SCOM Management Pack Machine Agent for XenApp and XenDesktop page, click Finish.
  19. In SCOM console, go to Monitoring > Citrix Library > XenApp/XenDesktop Machine Monitoring.
  20. Select a Proxy computer.
  21. On the bottom right, run the Update Configuration task.
  22. Then run the Check Requirements task.

If the Machine Agent Proxy Computer is monitoring a large environment, then see the following. Environments with more than 100 Delivery Groups, 600 Server OS machines, and 1,500 applications are considered large.

New Reports

3.14 adds new Application – Usage report as described in Citrix Blog Post What’s New with the Citrix SCOM Management Packs – Nov 2017.

3.9 adds two new Reports as described in Citrix Blog Post Monitor Site Infrastructure & Delivery Group Availability with Citrix SCOM Management Pack for XenApp and XenDesktop:

  • Site – Infrastructure Availability report – availability of a Site infrastructure over time. Availability is determined by health (availability) of most important Citrix services on the Delivery controller computers, and availability of configured hosting connections.
  • Delivery Group – Availability – availability of desktops provided with the selected Delivery Group

3.8 adds two new Reports as described in Citrix Blog Post Analyzing Application/Desktop Usage with Citrix SCOM Management Pack for XenApp and XenDesktop.

  • Application – User Activity report – see for a selected application which users have been using it and when. For each specific usage you also get usage duration, IP address of the client computer, and machine name on which the application was running.

  • Delivery Group – Desktop User Activity report – shows which users have been using desktop and when for each selected Delivery Group. It is almost identical to the “Application – User Activity” report, except that the delivery group is selected instead of application and you get desktop usages in the specific delivery group instead of application usages.

Customize Management Pack

Citrix Blog Post Increasing the Application Discovery Limit in Citrix SCOM Management Pack: That limit is around 1,500 applications. Now, you can discover more than 1,500 applications using the following method. We have tested the discovery of up to 4,500 applications in our lab environment.

The existing management pack has five discoveries for applications. Each discovery can discover approximately 300 applications. We have created a custom management pack that includes an additional 10 discoveries to be able to discover a total of 4,500 applications. See the Blog Post for the download link.

SLA Dashboards

The XAXD Pack has an extra Management Pack that adds SLA Targets and dashboards.

  1. In SCOM Console, go to Administration workspace, right-click Management Packs and click Import Management Packs.
  2. Click Add and then click Add from disk.
  3. Connecting to the online catalog is not required.
  4. Browse to C:\Program Files\Citrix\XenDesktop MP (orC:\Program Files\Comtrade\XenDesktop MP) and select the Citrix.XenApp.And.XenDesktop.SLADashboards Management Pack. Click Open.
  5. Click Install.
  6. Click Close when done.
  7. Go to the Monitoring workspace, expand Citrix XenApp and XenDesktop, expand Dashboards, and click Delivery Group SLA Dashboard.
  8. On the right, click the gear icon, and click Configure.
  9. In the General Properties page, click Next.
  10. In the Scope page, click Add.
  11. Select the Desktop OS  Delivery Group Health and Server OS Delivery group Health SLAs and click Add. Then click OK.
  12. Click Finish.
  13. On the left, click the Site SLA Dashboard.
  14. On the right, look for the lower gear icon and click Configure. You might have to click the Site SLAs pane first.
  15. In the General Properties page, click Next.
  16. In the Scope page, click Add.
  17. Select Site Health and click Add. Then click OK.
  18. Click Finish.
  19. If you go to Authoring > Service Level Tracking, you can create more SLAs. See the documentation for details.
  20. The XAXD pack also adds a bunch of reports.

StoreFront Pack

Full documentation at http://docs.citrix.com/en-us/scom-management-packs/storefront/1-12.html.

Install Citrix StoreFront Pack

  1. Download the Citrix SCOM Management Pack Bundle.
  2. On the System Center Operations Manager server, run Citrix_SCOM_Management_Pack_for_StoreFront.exe.
  3. In the Welcome to the setup wizard for Citrix SCOM Management Pack for StoreFront page, click Next.
  4. In the View Relevant Product Configuration page, click Next.
  5. The installer could detect an older version. Click Next.
  6. In the License Agreement page, check the box next to I accept the terms and click Next.
  7. In the Destination Folder page, click Next.
  8. In the Configure Post-Install Actions page, check the box next to Automatically import the Management Pack, and click Install.
  9. In the Completed the setup for the Citrix SCOM Management Pack for StoreFront page, click Next.
  10. In the All post-install actions were successfully executed page, click Finish.

MP Agent Installation Account

Configure the MP Agent Installation Account as detailed earlier for the XAXD Pack.

SCOM Proxy Agent

All Microsoft SCOM Agents running Citrix Agents must be marked as a Proxy Agent.

  1. In the SCOM Console, go to the Administration workspace, expand Device Management and click Agent Managed.
  2. Double-click your SCOM Agent.
  3. On the Security tab, check the box next to Allow this agent to act as a proxy, and click OK.

Probe Account

The StoreFront Management Pack logs into StoreFront using an account. StoreFront must be configured with Explicit Authentication.

  1. On the SCOM server, run StoreFront MP Configuration.
  2. In Management Pack 1.11 and newer, the first time you launch the tool, you’ll be taken to the Encryption Password tab. Click Set, and enter a permanent password. Note: the password will later be entered in clear text run running a SCOM Task to install or upgrade the agent.

  3. On the StoreFront availability tab, click Add.
  4. Enter credentials that can log into StoreFront. Make sure the userPrincipalName suffix or domain name matches one of the allowed domains configured on StoreFront (Source = CTX222920 Error: “StoreFront Store Service Probe Failed” While Using Citrix SCOM Management Pack for StoreFront). Click OK twice.
  5. Click OK.

Push Citrix StoreFront Agent

  1. If the StoreFront Server is Windows 2008 R2, install Microsoft hotfix 2847346 Svchost.exe running NSI service leaks memory and non-paged pool memory leak Tag NSpc. Also see Citrix CTX225624 Citrix SCOM MP for Storefront causes high memory utilization on Windows Server 2008 R2.
  2. In the SCOM Console, go to Monitoring workspace, expand Citrix Library, and click StoreFront Computers.
  3. Select a StoreFront server.
  4. On the bottom right, in the StoreFron Server Computer Role Tasks pane, click Check Installation Prerequisites.
  5. Click Run.
  6. Review the report, and then click Close.
  7. Now click the Install Citrix MPSF Agent task.
  8. If desired, you can override the Task Parameters. See the documentation for details.
  9. In 1.11 and newer, you must override the Encryption Password parameter, and specify the password you entered in the Configuration Tool.
  10. If upgrading, override UpgradeAgent, and set it to true.
  11. Then click Run.
  12. When done, review the report, and then click Close.
  13. The agent will eventually report as Healthy.
  14. You can verify configuration and version by running the Check Requirements and Configuration task. You might have to also run the Update Configuration task.

Provisioning Services Pack

Full Documentation is at http://docs.citrix.com/en-us/scom-management-packs/provisioning-services/1-19.html.

Install Citrix Provisioning Services Pack

  1. Download the Citrix SCOM Management Pack Bundle.
  2. On the System Center Operations Manager server, run Citrix_SCOM_Management_Pack_for_ProvisioningServices.exe.
  3. In the Welcome to the InstallShield wizard for Citrix SCOM Management Pack for Provisioning Services page, click Next.
  4. In the View Relevant Product Configuration page, click Next.
  5. If an older version is detected, click Next to upgrade it.
  6. In the License Agreement page, check the box next to I accept the terms, and click Next.
  7. In the Destination Folder page, click Next.
  8. In the Configure Post-Install Actions page, check the box next to Automatically import the Management Pack, and click Install.
  9. In the Completed the setup for Citrix SCOM Management Pack for Provisioning Services page, click Next.
  10. In the All post-install actions were successfully executed page, click Finish.

MP Agent Installation Account

Configure the MP Agent Installation Account as detailed earlier for the XAXD Pack.

SCOM Proxy Agent

All Microsoft SCOM Agents running Citrix Agents must be marked as a Proxy Agent.

  1. In the SCOM Console, go to the Administration workspace, expand Device Management, and click Agent Managed.
  2. Double-click your SCOM Agent.
  3. On the Security tab, check the box next to Allow this agent to act as a proxy and click OK.
  4. If you have many Provisioning Services servers, you can run Provisioning Services MP Configuration from the Start Menu, and enable Proxy using this tool.
  5. In Management Pack 1.17 and newer, the first time you launch the tool, you’ll be taken to the Configuration encryption tab. Click Set, and enter a permanent password. Note: the password will later be entered in clear text run running a SCOM Task to install or upgrade the agent.

  6. Then you can configure the Proxy tab.

Farm Account

The Provisioning Services Management Pack needs to log into the Provisioning Services farm.

  1. Create a service account and make it a full Provisioning Services farm administrator.
  2. On the SCOM server, run Provisioning Services MP Configuration.
  3. In Management Pack 1.17 and newer, the first time you launch the tool, you’ll be taken to the Configuration encryption tab. Click Set, and enter a permanent password. Note: the password will later be entered in clear text run running a SCOM Task to install or upgrade the agent.

  4. On the Provisioning Services tab, click Add.
  5. Enter a farm name. You’ll need this farm name later.
  6. Enter credentials for a full farm administrator, and click OK.
  7. Click OK.

Push Citrix Provisioning Services Agent

  1. In the SCOM Console, go to Monitoring workspace, expand Citrix Library, and click Provisioning Services Computers.
  2. Select a Provisioning Services server.
  3. On the bottom right, in the Tasks pane, click Check Installation Prerequisites.
  4. Click Run.
  5. Review the report, and click Close.
  6. Now click the Install Citrix MPPVS Agent task.
  7. If desired, you can override the Task Parameters. For example, UpgradeAgent can be overridden to true. See the documentation for details.
  8. In 1.18 and newer, you must override the Encryption Password parameter, and specify the password you entered in the Configuration Tool.
  9. Then click Run.
  10. When done, review the report, and click Close.
  11. Run the Set Farm Name on Citrix MPPVS Agent task.
  12. Override the Task Parameter.
  13. Specify the farm name. This should match the farm account created earlier. Then click Override.
  14. Click Run.
  15. Review the task output, and click Close.
  16. The agent will eventually report as Healthy.
  17. You can verify configuration by running the Check Requirements and Configuration task. You might have to also run the Update Configuration task.

  18. From John Haggerty in the comments: If you see: “Connection to PVS Soap Server Failed”, and if C:\ProgramData\Citrix\Provisioning Services MP Agent\mppvs_agt.log says “Security Support Provider Interface (SSPI) authentication failed”, then configure Kerberos Authentication for Citrix MPPVS Agent service. To enable Kerberos authentication, perform the following steps:
    1. Set “Log On” account for “Citrix MPVPS Agent” service to the account you are using for MPPVS.
    2. In command prompt, go to “%Program Files%\Citrix\Provisioning Services MP Agent” and execute PVSMonitorSvc.exe /setconnection runninguser
    3. Restart “Citrix MPVPS Agent” service and after a minute run check requirements tool to check if agent is ok now.
    4. NOTE: Issue will be resolved in next discovery cycle (by default 5 minutes).

Related Pages

NetScaler Gateway 11 – SSL VPN

Last Modified: Nov 7, 2020 @ 6:35 am

117 Comments

Navigation

💡 = Recently Updated

Overview

NetScaler Gateway supports five different connection methods:

  • ICA Proxy to XenApp/XenDesktop – client is built into Citrix Receiver
  • SSL VPN – requires NetScaler Gateway plug-in
  • Clientless – browser only, no VPN client, uses rewrite
  • Secure Browse – from MDX-wrapped mobile applications (XenMobile), uses rewrite
  • RDP Proxy – only RDP client is needed

If Endpoint Analysis is configured, then an Endpoint Analysis plug-in is downloaded to the Windows or Mac client.

Users use SSL to connect to NetScaler Gateway Virtual Servers.

  • NetScaler Gateway prompts the user for authentication.
  • Once the user is authenticated, NetScaler Gateway uses Session Policies to determine what happens next.

You can configure NetScaler Gateway Session Policies to only use one of the connection methods. Or NetScaler Gateway can be configured to let users choose between ICA Proxy, Clientless, and SSL VPN connection methods. Here’s a sample Client Choices screen using the X1 theme:

Enable SSL VPN in a Session Policy as detailed later. Then configure additional NetScaler Gateway objects including the following:

  • DNS Servers and Suffix – enable DNS resolution across the VPN tunnel
  • NetScaler Gateway Universal Licenses – all VPN users must be licensed.
  • Intranet IP addresses – give IP addresses to VPN clients. If no client IP, then VPN clients use NetScaler SNIP to communicate with internal resources. Requires routing changes on internal network.
  • Intranet Applications – if split tunnel is enabled, configure this object to dictate what traffic goes across the tunnel and which traffic stays local.
  • Authorization Policies – if default authorization is DENY, use Authorization Policies to dictate what resources can be accessed across the NetScaler Gateway connection. These Authorization Policies apply to all NetScaler Gateway connections, not just VPN.
  • Bookmarks – displayed on the built-in NetScaler Gateway portal page. Users click bookmarks to access resources across the VPN tunnel or clientless access (rewrite).
  • Endpoint Analysis Scans – block endpoints that fail security requirements. Configured in Session Policies or Preauthentication Policies.
  • Traffic Policies – Single Sign-on to internal web applications
  • AAA Groups – bind Session Policies, Authorization Policies, Intranet Applications, Intranet IPs, Bookmarks, and Traffic Policies to one or more Active Directory groups. Allows different Active Directory groups to have different NetScaler Gateway configurations.

Prerequisites

Except for ICA Proxy, all NetScaler Gateway connection methods require a NetScaler Gateway Universal License for each concurrent session. Go to System > Licenses and make sure NetScaler Gateway User licenses are installed.

Also make sure the maximum AAA users equals the number of licenses. Go to NetScaler Gateway > Global Settings > Change authentication AAA settings.

DNS usually needs to function across the VPN tunnel. Go to Traffic Management > DNS > Name Servers to add DNS servers.

Create Session Profile

You can create multiple Session Policy/Profiles, each with different settings. Then you can bind these Session Policies to different AAA groups or different NetScaler Gateway Virtual Servers. You can also bind Endpoint Analysis expressions to a Session Policy so that the Session Policy only applies to machines that pass the Endpoint Analysis scan.

If multiple Session Policies apply to a particular connection, then the settings in the policies are merged. For conflicting settings, the Session Policy with the highest priority (lowest priority number) wins. Session Policies bound to AAA groups only override Session Policies bound to NetScaler Gateway Virtual Servers if the AAA group bind point has a lower priority number. In other words, priority numbers are evaluated globally no matter where the Session Policy is bound. You can run the command nsconmsg –d current –g pol_hits to see which Session Policies are applying to a particular connection.

Do the following to enable SSL VPN. First create the Session Profile. Then create a Session Policy.

  1. On the left, expand NetScaler Gateway, expand Policies, and click Session.
  2. On the right, switch to the Session Profiles tab and click Add.
  3. Name the profile VPN or similar.
  4. In Session Profiles, every line has an Override Global checkbox to the right of it. If you check this box next to a particular field, then the field in this session profile will override settings configured globally or in a lower priority session policy.
  5. Switch to the Network Configuration tab and check the box next to Advanced Settings.
  6. You will find a setting that lets you select a DNS Virtual Server. Or if you don’t select anything then the tunnel will use the DNS servers configured under Traffic Management > DNS > Name Servers.
  7. Configure the behavior when there are more VPN clients than available IPs in the address pool. This only applies if you are configuring Intranet IPs.
  8. There are also a couple timeouts lower on the page.
  9. Switch to the Client Experience tab. This tab contains most of the NetScaler Gateway VPN settings.
  10. Override Plug-in Type and set it to Windows/Mac OS X.
  11. Whenever NetScaler firmware is upgraded, all users will be prompted to upgrade their VPN clients. You can use the Upgrade drop-downs to disable the automatic upgrade.
  12. By default, if Receiver and NetScaler Gateway Plug-in are installed on the same machine, then the icons are merged. To see the NetScaler Gateway Plug-in Settings, you right-click Receiver, open Advanced Preferences and then click NetScaler Gateway Settings.

  13. You can configure the Session Policy/Profile to prevent NetScaler Gateway Plug-in from merging with Receiver. On the Client Experience tab, scroll down and check the box next to Advanced Settings.
  14. Check the box next to Show VPN Plugin-in icon with Receiver. This causes the two icons to be displayed separately thus making it easier to access the NetScaler Gateway Plug-in settings.

  15. On the Client Experience tab, override Split Tunnel and make your choice. Setting it to Off will force all traffic to use the tunnel. Setting it to On will require you to create Intranet Applications so the NetScaler Gateway Plug-in will know which traffic goes through the tunnel and which traffic goes directly out the client NIC (e.g. to the Internet).
  16. On the Client Experience tab, there are timers that can be configured. Global Settings contains default timers so you might want to override the defaults and increase the timeouts. See Configuring Time-Out Settings at Citrix Docs for details.
    1. Client Idle Time-out is a NetScaler Gateway Plug-in timer that disconnects the session if there is no user activity (mouse, keyboard) on the client machine.
    2. Session Time-out disconnects the session if there is no network activity for this duration.
    3. In addition to these two timers on the Client Experience tab, on the Network Configuration tab, under Advanced Settings, there’s a Forced Timeout setting.
  17. By default, once the VPN tunnel is established, a 3-page interface appears containing bookmarks, file shares, and StoreFront. An example of the three-page interface in the X1 theme is shown below.
  18. On the Client Experience tab, the Home Page field lets you override the 3-page interface and instead display a different webpage (e.g. Intranet or StoreFront). This homepage is displayed after the VPN tunnel is established (or immediately if connecting using Clientless Access).
  19. On the Client Experience tab, there are more settings that control the behavior of the NetScaler Gateway plug-in. Hover your mouse over the question marks to see what they do.
  20. Additional VPN settings can be found by clicking Advanced Settings near the bottom of the Client Experience tab.
  21. Under Client Experience > Advanced Settings, on the General tab, there are settings to run a login script at login, enable/disable Split DNS, and enable Local LAN Access. Use the question marks to see what they do. Reliable DNS occurs when Split DNS is set to Remote.
  22. Under Client Experience > Advanced Settings, on the General tab, is a checkbox for Client Choices. This lets the user decide if they want VPN, Clientless, or ICA Proxy (StoreFront). Without Client Choices, the VPN will launch automatically
  23. On the main Client Experience tab, if you enabled Client Choices, you can set Clientless Access to Allow to add Clientless to the list of available connection methods.
  24. An example of Client Choices is shown below:
  25. The Client Experience > Advanced Settings section has additional tabs for controlling the NetScaler Gateway Plug-in. A commonly configured tab is Proxy so you can enable a proxy server for VPN users.
  26. Back in the main Session Profile, switch to the Security tab.
  27. Set the default authorization to Allow or Deny. If Deny (recommended), you will need to create authorization policies to allow traffic across the tunnel. You can later create different authorization policies for different groups of users.
  28. On the Published Applications tab, set ICA Proxy to Off. This ensures VPN is used instead of ICA Proxy.
  29. Configure the Web Interface Address to embed StoreFront into the 3-pane default portal page. Note: additional iFrame configuration is required on the StoreFront side as detailed below.
  30. From Michael Krasnove: if you configured the Session Policy to direct users to StoreFront, then placing the following code in c:\inetpub\wwwroot\Citrix\StoreWeb\custom\script.js will cause StoreFront to end the VPN tunnel when the user logs off of StoreFront. 
    var LOGOFF_REDIRECT_URL = 'https://YourGatewayFQDN.com/cgi/logout';
 
// Prevent the default "logoff" screen from being displayed
CTXS.Controllers.LogoffController.prototype._handleLogoffResult = $.noop;
 
CTXS.Extensions.afterWebLogoffComplete = function () {
 window.location.href = LOGOFF_REDIRECT_URL;
};
  31. Click Create when you’re done creating the Session Profile.

Create Session Policy

  1. In the right pane, switch to the Session Policies tab and click Add.
  2. Give the policy a descriptive name.
  3. Change the Action to the VPN Profile you just created.
  4. Add a policy expression. You can enter ns_true, which applies to all connections.
  5. Or you can add Endpoint Analysis scans. If the Endpoint Analysis scan succeeds, then the session policy is applied. If the Endpoint Analysis scan fails, then this session policy is skipped and the next one is evaluated. This is how you can allow VPN if EPA scan succeeds but all failed EPA scans will get a different session policy that only has ICA Proxy enabled.
  6. To add an Endpoint Analysis scan, use one of the Editor links on the right.
  7. Configure OPSWAT scans in the OPSWAT EPA Editor.
  8. Configure Client Security Expressions in the Expression Editor.
  9. You can combine multiple Endpoint Analysis scan expressions using Booleans (&&, ||, !). Click Create when done.

Bind Session Policy

Most of the NetScaler Gateway objects can be bound to NetScaler Gateway Virtual Server, AAA Group, or both. This section details Session Policies, but the other NetScaler Gateway objects (e.g. Authorization Policies) can be bound using similar instructions.

  1. Bind the new session policy to a NetScaler Gateway Virtual Server or a AAA group. If you bind it only to a AAA group, then only members of that Active Directory group will evaluate the expression.
  2. To bind to a NetScaler Gateway Virtual Server, edit a NetScaler Gateway Virtual Server (or create a new one), scroll down to the Policies section and click the Plus icon.
  3. In the Choose Type page, select Session, Request and click Continue.
  4. Select one or more session policies. This is where you specify a priority.
  5. To bind to a AAA Group, go to NetScaler Gateway > User Administration > AAA Groups.
  6. Add a group with the same name (case sensitive) as the Active Directory group name. This assumes your LDAP policies/server are configured for group extraction.
  7. Edit the AAA Group.
  8. On the right, in the Advanced Settings column, add the Policies section.
  9. Click the plus icon to bind one or more Session Policies.
  10. If you want these Session Policies to override the Session Policies bound to the NetScaler Gateway Virtual Server then make sure the Session Policies bound to the AAA Group have lower priority numbers.

NetScaler Gateway Plug-in Installation

Here is what the user sees when launching the VPN session for the first time.


And then the 3-pane interface is displayed.

Only administrators can install the NetScaler Gateway Plug-in. You can download the Gateway plug-in from the NetScaler at /var/netscaler/gui/vpns/scripts/vista and push it to corporate-managed machines. Or you can download VPN clients from Citrix.com. The VPN client version must match the NetScaler firmware version.

Authorization Policies

If your Session Profile has Security tab > Default Authorization set to Deny (recommended), then create Authorization Policies to allow access across the tunnel.

  1. On the left, under NetScaler Gateway, expand Policies and click Authorization.
  2. On the right, click Add.
  3. Name the Authorization Policy.
  4. Select Allow or Deny.
  5. NetScaler Gateway requires you to Switch to Classic Syntax. The other syntax option is for AAA.
  6. Enter an expression. Use the Expression Editor link to build an expression. You can specify destination IP subnets, destination port numbers, etc.
  7. Click Create when done.
  8. Authorization Policies are usually bound to AAA groups. This allows different groups to have different access across the tunnel.
  9. On the right, in the Advanced Settings column, add the Authorization Policies section.
  10. Then click where it says No Authorization Policy to bind policies.

Intranet Applications

If you enabled Split Tunnel, then you’ll need to create Intranet Applications to specify which traffic goes through the tunnel.

  1. On the left, under NetScaler Gateway, expand Resources and click Intranet Applications.
  2. On the right, click Add.
  3. Enter a name for the Internal subnet.
  4. Change the Interception Mode to TRANSPARENT.
  5. Enter an IP subnet. Only packets destined for this network go across the tunnel.
  6. Then click Create.
  7. Create additional Intranet applications for each internal subnet.
  8. Intranet Applications are usually bound to the Gateway Virtual Server but you can also bind them to AAA Groups.
  9. On the right, in the Advanced Settings column, add the Intranet Applications section.
  10. On the left, click No Intranet Application to bind Intranet Applications.

DNS Suffix

Specify a DNS Suffix for Split DNS to function with single label DNS names.

  1. On the left, under NetScaler Gateway, expand Resources and click DNS Suffix.
  2. On the right, click Add.
  3. Enter the DNS Suffix and click Create. You can add multiple suffixes.

Bookmarks

Bookmarks are the links that are displayed in the 3-pane interface. They can point to file shares or websites.

  1. Under NetScaler Gateway, expand Resources, and click Bookmarks.
  2. On the right, click Add.
  3. Give the bookmark a name and display text.
  4. Enter a website or file share. For file shares you can use %username%.
  5. The other fields are for Single Sign-on through Unified Gateway. Click Create.
  6. Bookmarks (aka Published Applications > Url) are usually bound to AAA groups so different groups can have different bookmarks. But it’s also possible to bind Bookmarks to NetScaler Gateway Virtual Servers.
  7. If NetScaler Gateway Virtual Server, add the Published Applications section to bind Bookmarks.
  8. For AAA Group, it’s the Bookmarks section.
  9. On the left, find the Published Applications section and click No Url to bind Bookmarks.

VPN Client IP Pools (Intranet IPs)

By default, NetScaler Gateway VPN clients use NetScaler SNIP as their source IP when communicating with internal resources. To support IP Phones or endpoint management, you must instead assign IP addresses to VPN clients.

Any IP pool you add to NetScaler must be reachable from the internal network. Configure a static route on the upstream router. The reply traffic should be routed through a NetScaler SNIP. Or the NetScaler can participate in OSPF.

When a client is assigned a client IP, this IP address persists across multiple sessions until the appliance reboots or until the appliance runs out of IPs in the pool.

  1. Edit a NetScaler Gateway Virtual Server or a AAA group.
  2. On the right, in the Advanced Settings section, click the plus icon next to Intranet IP Addresses.
  3. On the left, click where it says No Intranet IP.
  4. Enter a subnet and netmask. Click Bind.
  5. To see the Client IP address, on the client side, right-click the NetScaler Gateway Plug-in and click Configure NetScaler Gateway.
  6. Switch to the Profile tab to see the Client IP address.
  7. To see the client IP on the NetScaler, go to NetScaler Gateway and on the right is Active user sessions.
  8. Select one of the views and click Continue.
  9. The right column contains the Intranet IP.

StoreFront in Gateway Portal

  1. If you want to enable StoreFront to integrate with NetScaler Gateway’s default portal, edit the file C:\Inetpub\wwwroot\Citrix\StoreWeb\web.config.
  2. On the bottom, there are three sections containing frame options. Change all three of them from deny to allow.
  3. Also change frame-ancestors from none to self.
  4. In NetScaler, go to NetScaler Gateway > Global Settings and click Configure Domains for Clientless Access.
  5. Change the selection to Allow Domains, enter your StoreFront FQDN and click the plus icon.
  6. Click OK.
  7. In a Session Policy/Profile, on the Client Experience tab, make sure Single Sign-on to Web Applications is enabled.
  8. On the Published Applications tab, configure the Web Interface Address to point to the StoreFront Receiver for Web page.
  9. Configure the Single Sign-on domain to match what’s configured in StoreFront.
  10. The Applications page of the 3-page portal should automatically show the StoreFront published icons.

Quarantine Group

NetScaler Gateway can be configured so that if Endpoint Analysis scans fail, then the user is placed into a Quarantine Group. You can bind session policies, authorization policies, etc. to this quarantine group. Policies bound to other AAA groups are ignored.

  1. Go to NetScaler Gateway > User Administration > AAA Groups.
  2. Add a new local group for your Quarantined Users. This group is local and does not need to exist in Active Directory.
  3. Create a new Session Profile.
  4. On the Security tab, check the box next to Advanced Settings.
  5. Check the box to the right of Client Security Check String.
  6. Use the Editor links to add an Endpoint Analysis expression.
  7. Just below the Client Security Check String, select the previously created Quarantine Group.
  8. Click Create when done.
  9. Create a Session Policy and select the Session Profile you just created.
  10. Enter ns_true as the expression. Then click Create.
  11. Edit your Gateway Virtual Server and bind the new session policy.
  12. Bind session policies, authorization policies, etc. to your quarantine group. These policies typically limit access to the internal network so users can remediate. Or it might simply display a webpage telling users how to become compliant.
  13. To troubleshoot Quarantine policies, use the command nsconmsg –d current –g pol_hits.
  14. Another option is to use the session policy bound to the Quarantine Group for SmartAccess configuration.
  15. Gateway Insight (Insight Center 11.0 build 65 and newer) shows users that failed EPA scans and their quarantine status.

Related Pages

AppDisks

Last Modified: Nov 7, 2020 @ 6:34 am

82 Comments

Navigation

Planning

AppDisks are available in all editions of XenApp/XenDesktop 7.8 and newer. AppDNA is only available in Platinum Edition.

AppDisks can be created on vSphere (5.1 and newer) and XenServer only. No support for Hyper-V.

Delivery Groups used with AppDisks can contain machines from Pooled Random Machine Catalogs containing Server OS or Desktop OS machines. You cannot use AppDisks with machines from other catalog types, such as pooled static or dedicated (assigned).

In Provisioning Services environments, AppDisks are stored on hypervisor storage, not Provisioning Services storage. Also, additional data might be written to the write cache.

AppDisk must be on the same hosting resource as the linked clones it is attached to. If you have multiple hosting resources, then you’ll need to import the AppDisk to each hosting resource containing linked clones that you want to attach the AppDisk to.

According to the AppDisk FAQ, Citrix has tested up to 16 AppDisks attached to a single virtual machine. To minimize the number of AppDisks, you should combine multiple applications into a single AppDisk.

AppDisks are stored on a datastore with a GUID in the folder name, thus it’s difficult to know what’s in the .vmdk file. Use PowerShell commands (Get-AppLibAppDisk) to determine the AppDisk-to-.vmdk mapping. If you intend to backup and recover these files, periodically run the PowerShell commands and export to a file so you can know which disk is which. Or, when you import the AppDisk, Studio will tell you which applications are installed in the AppDisk and you can then rename the imported AppDisk.

Links:

vCenter Preparation

Citrix has instructions for creating a XenDesktop role in vCenter. AppDisks requires an additional permission: Virtual Machine > Configuration > Modify device Settings.

For AppDisks, the read only role must be applied to the vCenter level. See Mark New at discussions.citrix.com for details.  ?

AppDNA Preparation

  1. If you intend to use AppDNA to analyze your AppDisks, build a separate AppDNA server.
  2. In Studio, go to Configuration, right-click AppDNA, and click Create AppDNA connection before creating an AppDisk.
  3. The dialog box has an example for the Connection address. It should be in http://appdnaserver:8199/appdna format.
  4. Enter the AppDNA SQL server name and database name. Click Save.

Create AppDisk

  1. Antivirus will slow down the AppDisk creation process. Add CtxPvD.exe and CtxPvDSvc.exe to the exclusion list of your antivirus program. More details in Known Issues.
  2. According to CTX211853 AppDisk Creation Task Stuck At “Creating…” In Studio, Shadow Copy and Microsoft Software Shadow Copy Service Provider services must be enabled on the machines.
  3. You need a Machine Creation Services or Provisioning Services catalog of type Random. Make sure at least one machine in the catalog is not assigned to any Delivery Group.


  4. For Provisioning Services, the machine must boot from a Maintenance (Private Image) version. After the AppDisk is created, the Maintenance version can be discarded.
  5. In Studio, right-click AppDisks and click Create AppDisk.
  6. In the Getting started with AppDisks page, click Next.
  7. In the Create AppDisk page, select a size for the disk. These are thin provisioned so size probably doesn’t matter. Just make sure it’s big enough to hold the application.
  8. Note: If PvS, if the AppDisk is bigger than the cache disk, then PvS might try to put the cache on the AppDisk and will fail to server. See Formatted drive still goes to Server for cache with PVS 7.9 at Citrix Discussions.  💡
  9. Click Next.
  10. In the Preparation Machine page, select an MCS or PVS random catalog that has an available machine not assigned to a Delivery Group. Click Next.
  11. In the Summary page, give the AppDisk a name. Include the datastore or hosting resource name since you need different AppDisks for each hosting resource. Click Finish.
  12. The new AppDisk is prepped. This takes a while.
  13. If you look in your hypervisor storage, you’ll see a new folder named AppDisk-VirtualID. It’s not obvious which AppDisk this .vmdk file belongs to. You can run a PowerShell command like get-applibappdisk | ? virtualdiskid -eq 0cac15d0-55db-4931-848e-de6ee79dddf8 to determine the AppDisk name.
  14. Once prep is done, Studio says Ready to install applications. If you look on the bottom it will show you which machine was used for AppDisk preparation.
  15. You can also right-click the AppDisk, click Install Applications, and it will tell you which machine should be used for application installation.

  16. Access the console of the prep machine and install the application(s).
  17. When done, go back to Studio, right-click the AppDisk, and click Seal AppDisk.
  18. Click Yes to seal it. This will cause the prep machine to reboot.
  19. Preparation will take some time. If it seems stuck, you might have to login to the prep machine so it continues the process.

  20. Windows Defender might interfere with the sealing process. In that case, turn off Defender’s Real-time protection.
  21. If you added AppDNA to Studio, then it will ask AppDNA to analyze the AppDisk.
  22. When done you can View report.
  23. Once the AppDisk is created and sealed, you can click the Applications tab in the bottom half of the window to see what the AppDisk contains.

Import AppDisk

AppDisks can only be attached to machines on the same hosting resource the AppDisk is located on. You can easily copy/import the AppDisk to multiple hosting resources (datastores).

Also, if you added AppDNA after creating AppDisks, then you can only analyze them by re-importing them.

To import an AppDisk:

  1. You will need an available prep machine in a MCS or PvS Random Catalog that is not assigned to any Delivery Group. The Catalog must be on the same Hosting Resource where the imported AppDisk will be placed.


  2. When you look at a datastore containing AppDisks, it’s not obvious which .vmdk goes with which AppDisk. Run the PowerShell command Get-AppLibAppDisk <AppDiskName> to see the VirtualDiskId.
  3. In vSphere Web Client, edit a non-linked clone virtual machine. Any non-MCS/PVS machine should work. This import machine is different than the linked clone machine that Studio will use to prepare the AppDisk.
  4. Make sure the import machine is currently powered off. If the machine is powered on, then vSphere might complain about the disk being currently in use.
  5. Add an Existing Hard Disk (AppDisk).

  6. When browsing the datastore with the existing AppDisk, select the folder name that matches the VirtualDiskId and then select the disk that’s in the folder.
  7. In Studio, right-click AppDisks and click Create AppDisk.
  8. In the Create AppDisk page, select Import existing AppDisk.
  9. Select a Hosting Resource where you want to copy the AppDisk to. Studio always copies the AppDisk, even if to the same datastore as the source.
  10. In the Import Disk page, browse to the virtual machine and click the arrow to expand it.
  11. Then select the attached AppDisk and click Next.
  12. In the Preparation machine page, select a random linked clone catalog with a machine that hasn’t been added to any Delivery Group and click Next.
  13. In the Summary page, give the AppDisk a name. Include the hosting resource (datastore) name. Click Finish.
  14. The AppDisk will be copied to the new datastore and analyzed if AppDNA is configured.
  15. You can then assign the imported AppDisk to Delivery Groups.
  16. Once the AppDisk is imported, click the Applications tab in the bottom half of the Windows to see what’s in the AppDisk.
  17. You can rename the AppDisk by right-clicking it and clicking Properties.

Assign to Delivery Group

AppDisks are assigned to Delivery Groups, not Catalogs.

  1. If you want to assign an AppDisk to an existing Delivery Group, right-click the Delivery Group and click Manage AppDisks.
  2. Or you can create a new Delivery Group.
  3. On the AppDisks page, click Add.
  4. Select one or more AppDisks and click OK. Notice that you can only select AppDisks on the same hosting resource as the Catalog.
  5. You can prioritize the AppDisks by using the arrow buttons on the right. Or click Auto Order to let AppDNA do it for you.
  6. If you are changing AppDisks assigned to an existing Delivery Group, choose a Rollout Strategy (reboot schedule). This is identical to Machine Creation Services Rollout Strategy. Then finish the wizard.
  7. If you chose Auto Order when assigning the AppDisks then AppDNA will need to do some analysis.
  8. If you highlight a Delivery Group, the AppDisks tab on the bottom shows the currently assigned AppDisks.

Update AppDisk

  1. In Studio, right-click an AppDisk and click Create New Version.
  2. Give the new version a name.
  3. Select a linked clone machine that is not currently in a Delivery Group.
  4. Click Create new version. This copies the AppDisk and links it to the prep virtual machine.
  5. Proceed through the normal Create AppDisk process. This includes installing applications and sealing the AppDisk.
  6. Then assign the new AppDisk to a Delivery Group. This process will include removing the old AppDisk and assigning the new AppDisk.