Category: Omnissa Horizon

Navigation

As of version 9.9, User Environment Manager (UEM) was renamed to Dynamic Environment Manager (DEM).

This post applies to all Dynamic Environment Manager (aka User Environment Manager) versions including DEM 2312 (10.12) ESB, DEM 2212 (10.8) ESB, DEM 2111 ESB (10.4), and DEM 9.9 (ESB).

• Change Log
• Upgrade
• Installation Prerequisites
• Local Profile
• DEM Console Installation
• Configure Dynamic Environment Manager
  • DEM Licensing
  • Horizon Smart Policies
  • Application Blocking
  • Privilege Elevation
  • Computer Settings
• Personalization and DEM Templates
• Additional DEM Configuration
• DEM Application Profiler
• DEM Support Tool

💡 = Recently Updated

Change Log

• 2024 Jul 28 – updated install instructions for DEM 2406 (aka 10.13)
• 2023 Oct 28 – Horizon Smart Policies – DEM 2309 adds FIDO2 and Storage Drive
• 2023 Apr 1 – Search button in DEM Console 2303
• 2022 Apr 11 – added Licensing section for 2203 and newer.
• 2021 June 18 – added info from Omnissa 83679 Dynamic Environment Manage(DEM) User File Type Association(FTA) Delay in Applying after Login.

Upgrade

If you are performing a new installation, skip to the Installation Prerequisites section.

When upgrading an existing installation of DEM or UEM, upgrade the FlexEngine on the Horizon Agents first.

The newest FlexEngine can still interpret the INI files from older DEM console. After your clients (FlexEngine) have been upgraded, you can upgrade the management console, which allow for new options, like elevated privileges and others, which (when enabled) can now be correctly interpreted by the upgraded clients (FlexEngine). After that update the ADMX files.

DEM 2203 and newer move FlexEngine licensing to the configuration share and DEM console. If you are upgrading existing FlexEngines, then the previous license will continue functioning. New FlexEngines need the new licensing configuration method.

Installation Prerequisites

Before performing the procedures detailed on this page, make sure you’ve created the DEM File Shares, imported the DEM GPO ADMX templates, created the GPOs for Horizon, and configured the Horizon GPOs for Dynamic Environment Manager.

Omnissa Tech Zone Antivirus Considerations in a Horizon Environment: exclusions for Horizon, App Volumes, User Environment Manager, ThinApp

Omnissa Workspace Tech Zone has an excellent Quick-Start Tutorial for Dynamic Environment Manager. It’s around 130 printed pages.

Local Profile

At user logon, DEM restores profile archives on top of a Windows profile, which is typically a local profile.

If your Horizon Agent machines are single-user, non-persistent that reboot at logoff, then local profiles are deleted at logoff.

If your Horizon Agent machines are multi-user machines (e.g. RDSH) that don’t reboot every day, then you might need a process to delete local profiles when the user logs off. Here are some options:

• Schedule a delprof2.exe script that runs daily.
• A more advanced option is to add users to the local Guests group, which causes their profile to be deleted at logoff.

DEM Console Installation

In Horizon 2006 (aka 8.0), DEM is available in all editions of Horizon. There are two editions of DEM, each with different downloads and different DEM capabilities.

• Horizon 8 (2006+) Enterprise Edition and Horizon 7.13 Enterprise Edition are entitled to DEM Enterprise Edition, which has all features.
• Horizon 8 (2006+) Standard Edition and Horizon 8 Advanced Edition are entitled to DEM Standard Edition, which is limited primarily to Personalization features. If you are using FSLogix Profile Containers, then you don’t need DEM Standard Edition.

DEM 2406 (10.13) is the latest release. DEM 2312 (10.12) is an Extended Support Branch (ESB). DEM 2312 (10.12) is an Extended Support Branch (ESB).

1. Based on your entitlement, download either DEM 2406 (10.13) Enterprise Edition or DEM 2406 (10.13) Standard Edition. For ESB Horizon, download the DEM version included with your ESB version of Horizon.
   
   
2. If upgrading, don’t upgrade the DEM Console until all of your DEM Agents have been upgraded.
3. On your administrator machine, run the downloaded VMware Dynamic Environment Manager 2406 10.13 x64.msi.
   
4. In the Welcome to the VMware Dynamic Environment Manager Enterprise Setup Wizard page, check the box next to I accept and click Next.
   
5. In the Destination Folder page, click Next.
   
6. In the Choose Setup Type page, click Custom.
   
7. In the Custom Setup page, change the selections so that only the console is selected and then click Next.
   
8. In the Ready to install VMware Dynamic Environment Manager Enterprise page, click Install.
   
9. In the Completed the VMware Dynamic Environment Manager Enterprise Setup Wizard page, click Finish.
   

Configure Dynamic Environment Manager

Here is a summary of the major Dynamic Environment Manager functionality:

• Personalization (aka import/export user settings) – saves application and Windows settings to a file share. This is the roaming profiles functionality of Dynamic Environment Manager. You configure folders and registry keys that need to be saved. The import/export can happen at logon/logoff or during application launch/exit.
  • Pre-configure application settings – configures files and registry keys for specific applications so users don’t have to do it themselves. Some examples: disable splash screen, default folder save location, database server name, etc.
  • Self–support tool – users can use this tool to restore their application settings.
  • DEM Standard Edition supports all Personalization features.
• User Environment – configures Windows settings like drive mappings, Explorer settings, printer mappings, etc. This is similar to group policy but offers significantly more options for conditional filtering. Dynamic Environment Manager can configure any registry setting defined in an ADMX file.
  • DEM Standard Edition only has a limited set of User Environment settings (e.g., drive mappings). Most User Environment features require DEM Enterprise Edition.
  • Most settings in DEM are only for users, not computers. DEM 2006 (aka 10.0) and newer support ADMX templates for Computer Settings. In older DEM, use Group Policy to configure Computer Settings.
  • Best practice is to not mix Dynamic Environment Manager and user group policy. Pick one tool. If the same setting is configured in both locations then group policy will win.
  • UEM 9.6 and newer support Windows Server 2019 as an Operating System condition.
• Horizon Smart Policies – Use Horizon Conditions (e.g., client IP) to control device mappings (e.g., client printing) and PCoIP/Blast Bandwidth Profile.
• Privilege Elevation (UEM 9.2 and newer) – allow apps to run as administrator even though user is not an administrator. Installers can also be elevated.

Links:

• Dynamic Environment Manager (DEM) documentation can be found at Omnissa Docs.
• VMware has posted several User Environment Manager videos at YouTube.
• Fabian Lenz Let’s troubleshoot User Environment Manager (#UEM) 9.X: How to avoid errors during the installation

Initial Configuration (Easy Start)

To perform an initial configuration of Dynamic Environment Manager, do the following:

1. Launch the DEM Management Console from the Start Menu.
   
2. Enter the path to the DEMConfig share and click OK.
   
3. DEM Console 2306 and newer might ask you to join Omnissa Customer Experience Improvement Program (CEIP).
   
4. In the ribbon, click Configure. These Settings checkboxes define what is displayed in the management console. Leave it set to the defaults and click OK.
   
5. In the Personalization ribbon, on the far right, click Easy Start.
   
6. Select your version of Office and click OK. Office 2019 and Office 2016 are essentially the same.
   
7. Click OK when prompted that configuration items have been successfully installed.
   
8. Review the pre-configured settings to make sure they are acceptable. For example, on the ribbon named User Environment, under Shortcuts, Dynamic Environment Manager might create a Wordpad shortcut that says (created by VMware UEM). You can either Disable this item or delete it.
   
   • Bulk convert existing shortcuts to Dynamic Environment Manager – Ivan de Mes
9. Go to the ribbon name User Environment. On the left, expand Windows Settings and click Policy Settings. On the right, if there is a setting to Remove Common Program Groups, then click Edit.
   
   1. Consider adding a condition so it doesn’t apply to administrators.
      

DEM Licensing

DEM 2203 and newer moved FlexEngine Agent licensing to the DEM Configuration Share and DEM Console.

1. Download the Production License File from the same place you downloaded DEM:  DEM 2312 (10.12) Enterprise Edition, or DEM 2312 (10.12) Standard Edition.
   
2. In the DEM console, click the top-left star icon and then click License.
   
3. Click Manage.
   
4. Choose License File and then select the downloaded VMware-DEM-10.13.0-GA.lic file.
   
5. Click OK.
   

DEM Console places the license info in the DEM Configuration Share file under \general\FlexRepository\AgentConfiguration.

Common Configurations

1. DEM 2303 (10.9) and newer have a Search button to help you find configuration files.
   
2. To roam the Start Menu in Windows 10 1703 and newer:
   1. Go to the ribbon named Personalization, click a folder, and click Create Config File.
      
   2. Select Use a Windows Common Setting and click Next.
      
   3. Select Windows 10 Start Menu – Windows 10 Version 1703 and higher. This option is only available in newer versions of DEM. It should work with Windows Server 2019, but it doesn’t apply to Windows Server 2016, which is actually version 1607.
      
   4. Enter a file name. DEM will create a .zip file for each user with this name. Click Finish when done.
      
3. You can run Triggered Tasks when a session is reconnected, workstation is unlocked, or on a schedule (DEM 2306 and newer). This is useful for re-evaluating Smart Policies, as detailed below.
   
   • DEM 2111 and newer have a Trigger named App Volumes logon-time apps delivered. This was renamed from the older All AppStacks Attached trigger. It was renamed because App Volumes 2111 supports on-demand apps.
     
     
   • DEM 2306 (10.10) and newer have a Schedule trigger.
     
     
   • You can pick one of the predefined Actions or choose Run custom command to run a script. Some scripts might need an additional configuration under Privilege Elevation.
     
4. UEM 9.3 and newer have a setting to store Outlook OST file on App Volumes writable volumes. Go to the ribbon named User Environment. Right-click App Volumes and create a setting. Check the box next to Store Offline Outlook Data File (.ost) on writable volume. Configure other fields as desired. Note: this setting only applies to new Outlook profiles. More info in the YouTube video VMware User Environment Manager Outlook OST on App Volumes User Writable Volume Feature Walkthrough.
   

Links:

• Nigel Hickey Leveraging VMware UEM to reduce Microsoft GPO usage: Configure ADMX settings in UEM.
  

Horizon Smart Policies

Horizon Smart Policies let you control (e.g. disable) Horizon functionality for external users or other conditions.

1. In UEM 9.0 and newer, go to User Environment > Horizon Smart Policies, and create a policy.
   
2. DEM 9.11 has an expanded list of settings configurable using Horizon Smart Policies.
   
3. DEM 2309 (10.11) and newer can control FIDO2 and Storage drive.
   
4. DEM 2306 (10.10) and newer can control Browser Content Redirection.
   
5. UEM 9.8 and newer have many Horizon Smart Policy Settings, including Drag and drop. See VMware User Environment Management 9.8 Feature Walk-Through at YouTube.
   
6. On the Conditions tab, you can use any of the available conditions, including the Horizon Client Property conditions.
   
   • To detect external users, select Horizon Client Property > Client Location = External. UAG and Security Server set the session’s location to External.
     
7. You can also enter a Horizon Client Property condition that corresponds to the ViewClient_ registry keys. In the Property field, type in a property name (remove ViewClient_ from the property name). See VMware Blog Post Enhancing Your VMware Horizon 7 Implementation with Smart Policies.
   
   
8. There’s Endpoint Platform as a policy condition. Create a Policy, go to the Conditions tab, and select the Endpoint Platform condition.
   
9. Some of the conditions have Matches Regex. For example, Endpoint name and Horizon Client Property > Pool name.
   
   
10. To reapply Horizon Policies when users reconnect to an existing session, go to User Environment > Triggered Tasks, and click Create. Or you can edit one of the existing Triggered Tasks settings.
    
    1. Change the Trigger to Session Reconnected.
    2. Change the Action to User Environment refresh. Select Horizon Smart Policies and click Save.
       

Application Blocking

1. UEM 9.0 adds an Application Blocking feature. To enable it, go to User Environment > Application Blocking, and click the Global Configuration button.
   
2. Check the box to Enable Application Blocking. Specify Conditions where, if true, then App Blocking is enabled. These are the same conditions available in other policies and settings. Click OK.
   
3. Then you can create an Application Blocking setting to designate the folders that users can run executables from, or what file hashes are allowed.
   
4. You can add folders that allow or block apps. Any executable in these paths will be allowed or blocked. By default, executables in Windows and Program Files (including x86) are allowed.
   
5. UEM 9.1 and newer allows File Hashes in addition to File Paths. Set the Type to Hash-based, click Add, browse to an executable, UEM will compute the hash, and add it to the list.
   
6. UEM 9.2 and newer supports Publisher-based allow. Set the Type to Publisher-based, click Add, browse to an executable, UEM will read the certificate, and add it to the list. Note: A challenge with hash-bashed and publisher-based rules is that the policy might have to be updated whenever the app is updated.
   

Privilege Elevation

1. UEM 9.2 adds a Privilege Elevation feature, which allows executables to run as administrator even if users are not administrators. To enable it, go to User Environment > Privilege Elevation, and click the Global Configuration button.
   
2. Check the box to Enable Privilege Elevation. Specify Conditions where, if true, then Privilege Elevation is enabled. These are the same conditions available in other policies and settings.
3. If you allow installers to be elevated, elevate the installer’s child processes too, check the box. This checkbox only applies to installers. Child processes of elevated applications is enabled when creating a Privilege Elevation configuration setting.
4. When an application is elevated, the user can be asked to allow it. This prompt is intended to inform the user that the application has more permissions than it should, and thus be careful with this application. Click OK.
   
5. Then you can create a Privilege Elevation setting to designate the applications that should be elevated. The applications can be specified by a path, a hash, or a publisher certificate. These are essentially the same options as Application Blocking.
   
6. Path-based user-installed application lets you elevate installers. The other three options elevate applications, but not installers.
7. The child processes checkbox applies to applications.
   
8. UEM 9.4 adds Argument-based elevated application, which lets you elevate specific scripts and/or Control Panel applets. For details, see the YouTube video VMware User Environment Manager 9.4 Argument Based Privilege Elevation Feature Walk-through.
   
9. DEM Group Policy settings can be enabled to log both Application Blocking and Privilege Elevation to Event Viewer

Computer Settings

DEM Enterprise Edition 2006 and newer can deploy computer-based ADMX settings.

• Domain Computers must have Read permission to the DEM Config file share.

DEM 2006 and newer Agents (FlexEngines) must be configured to enable computer settings. You can either configure registry settings on each DEM Agent machine, or in DEM Agent 2103 and newer you can use an installer command-line switch. Both are detailed at Perform Installation with Computer Environment Settings Support at Omnissa Docs.

• Group Policy Preferences can push these registry keys to the Horizon Agent machines. Or you can manually modify the registry in your master images. If you use group policy, then make sure the group policy applies to your master image. The minimum registry values are Enabled and ConfigFilePath as detailed at Perform Installation with Computer Environment Settings Support at Omnissa Docs. For the list of additional registry values, see FlexEngine Configuration for Computer Environment Settings at Omnissa Docs.
  
• Command line install looks something like below. The command line installer switch sets the same ConfigFilePath and Enabled registry values as shown above.

  msiexec /i "\\fs01\bin\VMware\DEM\VMware-DEM-Enterprise-2406-10.13-GA\VMware Dynamic Environment Manager Enterprise 2406 10.13 x64.msi" /qn COMPENVCONFIGFILEPATH=\\fs01\DEMConfig\general

  

Do the following to enable Computer Environment settings in the DEM Console:

1. In the DEM Management Console, at the right side of any ribbon, click Configure.
   
2. At the bottom of the General tab, check the box next to Computer Environment.
   
3. A new Computer Environment ribbon is added. DEM 2009 and newer have Startup Tasks and Shutdown Tasks.
   
4. With ADMX-based Settings highlighted on the left, click Manage Templates in the ribbon.
   
5. At the bottom of the window, click Add Folder.
   
6. If you have PolicyDefinitions in your SYSVOL, then browse to that. Or you can point it to C:\Windows\PolicyDefinitions. Click OK.
   
7. Click OK after import is successful. DEM copied the .admx files into the DEM Config share. You can run this again any time to update templates.
   
8. With ADMX-based Settings selected on the left, click Create in the ribbon.
   
9. At the bottom, click Select Categories.
   
10. Select a category where your setting is located and click OK.
    
11. At the top of the window click Edit Policies.
    
12. Only the settings for your chosen categories are shown. Configure these settings the same way you would configure them in group policy. Then close the window.
    
13. DEM shows the configured settings.
    
14. On the Conditions tab, you can add conditions. Obviously the user-based conditions will not be available for computer-based settings.
    

Personalization and DEM Templates

Omnissa has provided a list of Personalization Templates to simplify your configuration.

1. To save user settings at logoff and restore at logon, you must specify the settings to save.  Easy Start created a bunch of configurations on the Personalization ribbon. Note: DEM 9.11 adds a Search box to this ribbon.
   
2. You can see what settings these save. On the tab named Import / Export, on the top right, click Manage, and then click Expand.
   
   1. Click Yes to expand it.
      
      
   2. After reviewing the config, click a different Personalization setting, and then click No to not save your changes.
      
3. To save more profile settings at logoff, on the ribbon named Personalization, select a folder (or create a new folder), and then click Create Config File.
   
4. A wizard appears. You can use one of the built-in Windows Common Setting or Application Templates. Or you can create your own.
   
   
   
   • DEM 9.10 and newer have a Windows Common Setting named Default applications – File type associations and protocols. For details, see Ivan de Mes at Managing File Type Associations (FTA) natively using Dynamic Environment Manager.
     
     • Also enable the GPO setting Do not show the ‘new application installed’ notification at Computer Configuration > Policies > Administrative Templates > Windows Components > File Explorer.
       
     • To avoid a delay in applying FTAs after login, Omnissa 83679 recommends setting HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Serialize\StartupDelayInMSec (DWORD) = 0.
       
   • UEM 9.4 and newer have a Windows Common Setting for Windows 10 Start Menu – Windows 10 1703 and higher
     
5. Download a template and import it.
   1. In the DEM Console, on the Personalization tab, click the Configure button to locate your DEM Configuration file share.
      
      
   2. Extract the downloaded templates to the General\Applications folder in the DEM Config Share.
      
      
   3. The downloaded template should then show up in the Personalization tab under the Applications folder. If you don’t see it, click the Refresh Tree icon.
      
6. DirectFlex – to speed up logins, enable DirectFlex whenever possible. Instead of restoring the files during logon and thus delaying the login, DirectFlex restores the settings on-demand when the user launches the application. DirectFlex can be enabled on most application configurations. However, Windows settings (e.g. Start Menu) should be loaded during login rather than on-demand after login.
   

Additional DEM Configuration

• VMware Blog Post VMware User Environment Manager, Part 2: Complementing Mandatory Profiles with VMware User Environment Manager details the following:
  • Personalization Settings (what settings are roamed)
  • Predefined App Settings
  • User Environment Settings (shortcuts, drive mappings, and so on)
• Active Directory Attribute References – DEM 2009 and newer support Active Directory Attribute References like %{AD$extensionAttribute8}%\%username%\Archives.
• ViewClient Property References – DEM 2009 and newer support ViewClient Property References in the %{ViewClient_propertyName}% format.
• File Type Associations – Ivan de Mes Export/Import File Type Associations (FTA) successfully using UEM uses GetUserFTA.exe and SetUserFTA.exe to backup and save file type associations at logoff and logon.
  
• Start Menu – Customize Windows 10 Start Menu Layout via UEM and App Volumes.
  
• Predefined settings – Fabian Lenz has a series of articles on Predefined settings in UEM:
  • Predefined settings (Basic concepts) explains the four types of Predefined Settings.
    
  • Predefined settings – Deep how-to (Internet Explorer) explains how to use Application Profiler, or a regular user DEM profile archive, to create Predefined Settings.
    
  • Predefined settings – Dynamic Placeholder explains how to use environment variables in Predefined Settings.
    
• ThinApp – To integrate ThinApp with UEM, configure DEM to save the application’s setting (e.g. AppData, HKCU registry key). You can use Application Profiler to identify these settings locations. Then configure ThinApp with Merged Isolation Mode for those locations. Also enable DirectFlex.
  
• Run Once – Omnissa 2146336 Run Once option behave differently in combination with a Local User Profile: The Run Once option for DEM configurations, such as shortcuts, has no effect when a Local User Profile is used. As a result, the UEM configuration runs at each login. To work around, set the RunOnceSpecial attribute in DEM XML configuration files.

User Environment Manager 8.7 and newer has a UEMResult feature that lets you see what settings were applied to the user. The .xml file is only updated at logoff. To enable for a particular user, go to the user’s Logs folder and create a folder named UEMResult. At logoff, DEM will put an .xml file in this folder. More information at Omnissa Docs.

From Omnissa 2113514 Enabling debug logging for a single user in VMware Dynamic Environment Manager: To configure FlexEngine to log at debug level for a single user, create an empty FlexDebug.txt file in the same folder as the standard log file for this user. This triggers FlexEngine to switch to debug logging for this particular user.

DEM Application Profiler

This tool cannot be installed on a machine that has FlexEngine (aka DEM Agent) installed:

1. .NET Framework 3.5 is required.
2. In the Dynamic Environment Manager files, in the Optional Components folder, run VMware DEM Application Profiler 10.6 x64.msi. DEM 2406 (10.13) includes version 10.6 of the Profiler.
   
3. In the Welcome to the VMware DEM Application Profiler Setup Wizard page, click Next.
   
4. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
   
5. In the Custom Setup page, click Next.
   
6. In the Ready to install VMware DEM Application Profiler page, click Install.
   
7. In the Completed the VMware DEM Application Profiler Setup Wizard page, click Finish.
   

You may now use the tool to determine where applications store their settings and export a default application configuration that can be pushed out using Dynamic Environment Manager.

• See Omnissa Docs for details.
• vDelboy VMware User Environment Manager Application Profiler has an overview of the process.
• VMware Blog Profiling Applications with VMware User Environment Manager details how to use Application Profiler to determine where Chrome settings are stored and upload that configuration to Dynamic Environment Manager.

DEM Support Tool

vDelboy – VMware UEM Helpdesk Support Tool

Do the following to configure the environment for the support tool:

1. In the Dynamic Environment Manager Console, click the star icon on the top left, and click Configure Helpdesk Support Tool.
   
2. Click Add.
   
3. In the Profile archive path field, enter the user folder share (the same one configured in Dynamic Environment Manager GPO). At the end of the path, enter \[UserFolder]\Archives.
4. Check the other two boxes. The paths should be filled in automatically. Make sure they match what you configured in the Dynamic Environment Manager group policy object. Click OK.
   
5. Click Save.
   
6. Omnissa recommends creating a new GPO for the Support Tool. This GPO should apply only to the support personnel.
   
   
7. On the Scope tab, change the filtering so it applies to DEM Support and DEM Admins. If this GPO applies to machines with group policy loopback processing enabled, then also add Domain Computers.
   
8. Edit the GPO.
   
9. Go to User Configuration | Policies | Administrative Templates | VMware DEM | Helpdesk Support Tool.
10. Double-click the setting DEM configuration share.
    
11. Enable the setting, and enter the path to the DEMConfig share. Click OK.
    
12. Consider enabling the remaining GPO settings. Read the Explain text or refer to the documentation.
    

Do the following to install the support tool.

1. .NET Framework 3.5 is required.
2. Some support tool functions require the FlexEngine (aka DEM Agent) to be installed on the help desk machine.
3. In the extracted Dynamic Environment Manager files is an Optional Components folder. From inside that folder run VMware DEM Helpdesk Support Tool 2111 10.4 x64.msi. This tool was not updated for the DEM 2406 (10.13) release.
   
4. In the Welcome to the VMware DEM Helpdesk Support Tool Setup Wizard page, click Next.
   
5. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
   
6. In the Destination Folder page, click Next.
   
7. In the Ready to install VMware DEM Helpdesk Support Tool page, click Install.
   
8. In the Completed the VMware DEM Helpdesk Support Tool Setup Wizard page, click Finish.
   

Once the Helpdesk Support Tool is installed, you can launch it from the Start Menu, search for users, and then perform operations on the archives.

Related Pages

• Back to Omnissa Horizon 8

Navigation

This article applies to all versions of Horizon Client for Windows, including versions 2312.1 and 5.5.6.

• Change Log
• Horizon Client Versions
• Windows 10 / Windows 11 Support
• Install – Horizon Client Manual
  • Install – Horizon Client Silent
  • Keylogger Blocking
• Launch Horizon Client
  • Shortcuts and Favorites
  • Support information
• Certificate Validation
• Client Device Redirection
  • Client Drive Redirection
  • Serial Port Redirection
  • Scanner Redirection
    • Scanner Redirection Caveats
  • Client Printers
  • File Type Association
• Session Collaboration
• Performance Tracker
• HTML Blast
• Thin Clients
• Repurposed PCs
• Horizon Client GPO – Security Settings

💡 = Recently Updated

Change Log

• 2024 Aug 6 – Folders in Horizon Client 2406
• 2024 Jul 29 – Install Horizon Client – updated for Horizon Client 2406
• 2023 Oct 28 – Keylogger Blocking
• 2023 July 8 – Certificate Validation – Horizon 2306 (8.10) and newer with Horizon Client 2306 (8.10) and newer can enforce certificate checking on the client.
• 2023 Apr 1 – Install Horizon Client – updated for Horizon Client 2303 – see Horizon Group Policy for new features

Horizon Client Versions

Starting August 2020, the client versioning changed to a YYMM format. Horizon Client 2406 is the latest release.

• Horizon 8.x no longer supports Horizon Client 5.x and older.
• Features, like ThinPrint, were removed from Horizon Client 2006 and newer, so don’t use the 2xxx (8.x) clients with Horizon 7.13 and older.
• Microsoft Teams optimization features depend on Horizon Client version and Horizon Agent version. See Omnissa Knowledgebase Article 86475 MS Teams Optimization Feature Compatibility Matrix for Horizon 7 and Horizon 8 Recent Releases.
• Windows 21H2 and Windows 11 are supported with Horizon Client 2111 and newer.
• Horizon Client 2006 and newer no longer support Windows 7, Windows 8.1, or Windows 10 1809.

Connection Server can be configured to prevent older clients from connecting. Find it in the Global Settings node in Horizon Console.

Windows 10 / Windows 11 Support

• Windows 10 22H2 and Windows 11 22H2 are supported with Horizon Client 2209 (8.7) and newer.
• Windows 10 21H2 and Windows 11 are supported with Horizon Client 2111 (8.4) and newer.
• Windows 10 21H1 is supported with Horizon Client 2103 (8.2) and newer.
• Windows 10 20H2 is supported with Horizon Client 2012 (8.1) and newer.
• Windows 10 2004 is supported with Horizon Client 2006 (8.0) and newer
• Windows 10 1909 is supported with Horizon Client 5.3 and newer
• Windows 10 1803 is supported with Horizon Client 4.8 and newer

Manual Installation of Horizon Client

The Horizon Clients can be downloaded from https://customerconnect.omnissa.com/downloads/info/slug/desktop_end_user_computing/vmware_horizon_clients/horizon_8.

1. Logon to the client machine as an administrator. Administrative rights are required for the Horizon Client installation. You can also push the client silently as described in the next section.
2. Open a browser and enter the name of your Horizon Connection Server in the address bar (e.g. https://view.corp.local). Use https://.
3. Click the Install VMware Horizon Client link. If the Horizon Clients are installed on the Connection Server, the client will download immediately. Or you’ll be taken to omnissa.com to download the client.
   
4. If you are redirected to the Clients download page (https://customerconnect.omnissa.com/downloads/info/slug/desktop_end_user_computing/vmware_horizon_clients/horizon_8), then find the VMware Horizon Client for Windows, and click Go to Downloads.
   
   
5. Then click Download Now.
   
6. On the client machine, run the downloaded VMware-Horizon-Client-2406-8.13.exe.
   
   • If you want to use the URL Content Redirection feature in Horizon 7 and newer, run the installer with the following switch: /v URL_FILTERING_ENABLED=1.
   • If you want the UNC Path Redirection feature in 2209 (8.7) and newer, then you run the Client installer with the following switches: /v ENABLE_UNC_REDIRECTION=1. You can combine the two switches.
     
7. Click Agree & Install. Or you can click Customize Installation. Horizon Client 2203 and newer has an option to Enable Keylogger Blocking, but only in Custom installation. Or Horizon Client 2309 and later let you enable Keylogger Blocking in the Settings interface.
   
   1. If you selected Customize Installation, you can enter a Default connection server, install Teams Optimization, etc.
   2. Horizon Client 2203 and newer has an option to Enable Keylogger Blocking.
   3. Click Agree & Install when done.
      
8. In the Success page, click Finish.
   
9. Click Restart Now when prompted to restart.
   
10. Note: Horizon Client 2106 and newer have an updated user interface.

Verify URL Redirection

1. To verify that URL Content Redirection is installed, verify the presence of the file C:\Program Files\VMware\VMware Horizon View Client\vmware-url-protocol-launch-helper.exe.
   
2. There’s also an IE add-on.
   
3. URL Content Redirection is configured using group policy.

Software Updates

1. In the Horizon Client, click the hamburger icon on the top right, and click Software Updates. It will be green if there is an update available. Note: Horizon Client 5.5 will not offer an upgrade to Horizon Client 2006 or newer.
   
2. There is an option to Show pop-up message when there is an update.
   
3. The Horizon GPO Templates for Horizon Client have GPO settings to control the pop-up message. The settings are Update message pop-up and Allow user to skip Horizon Client update.
   

Install – Horizon Client Silent

Installing Horizon Client From the Command Line at Omnissa Docs has instructions on how to install the Horizon Client silently. Common methods for installing the client silently include: SCCM and Active Directory Group Policy Computer Startup Script.

Keylogger Blocking

Horizon Client 2309 and newer let you enable Keylogger Blocking if you did not select it during installation.

1. In Horizon Client, before you open a server, click the Settings button.
   
2. On the Security page, set Keylogger Blocking to On. Then restart the Horizon Client.
   

Launch Horizon Client

To launch a View Desktop or application manually:

1. From the Start Menu run VMware Horizon Client.
   
   1. Horizon Client 4.7 and newer has a GPO setting to prevent the Client from being launched multiple times.
   2. Install the Horizon GPO templates if you haven’t already.
   3. Create or edit a GPO that is linked to an OU containing the Horizon Client machines. These are the end-user PCs, not the virtual desktops.
   4. The Block multiple Horizon Client instances per Windows session setting is at Computer Configuration | Policies | Administrative Templates | VMware Horizon Client Configuration.
      
      
2. To change SSL certificate verification:
   • In Horizon Clients version 2106 and newer, click the Settings button on the top right. Switch to the SSL Configuration page. Then make a selection. This is also configurable using Group Policy as detailed at Certificate Validation below.
     
     
     
   • In Horizon Clients older than version 2106, open the Options (hamburger) menu, and click Configure SSL. This is also configurable using Group Policy as detailed at Certificate Validation below.
     
     
3. If there is no server in the list, then use the New Server button on the top left or click Add Server on the top right.
   
   
4. Enter the load balanced FQDN for the Connection Server and click Connect.
   
   
5. You can click the Options menu to Hide the selector after launching an item.
   
   
6. If you want to perform pass-through authentication, click the hamburger icon, and select Log in as current user. This option is only available if selected during installation, the client machine was rebooted, and is not prohibited using group policy. Also, the Connection Server must allow Log on as current user.
   
   
7. Horizon 7.2 and newer have Recursive Unlock, which is enabled by default. See Using the Log In as Current User Feature Available with Windows-Based Horizon Client at Omnissa Docs.
8. If you have apps published to an Unauthenticated User, click the hamburger icon, and select Unauthenticated access or Log in anonymously using Unauthenticated Access.
   
   
9. Before connecting to the server, click Settings and then switch to the VMware Blast page. Or click the hamburger icon and then click Configure VMware Blast.
   
   
10. In Horizon Client 4.8 and newer, network condition is determined automatically and no longer configurable in the client.
    1. If your Horizon Client is older than 4.8, then adjust the network condition and click OK. This affects TCP vs UDP for Blast connectivity. Excellent = TCP only. Typical = UDP if the ports are open. Poor = UDP plus packet duplication, which is best for 20% packet loss networks. More info in Omnissa Tech Zone VMware Blast Extreme Display Protocol in Horizon.
       
11. You can optionally enable Allow High Color Accuracy.
    
    
12. In Horizon Client 2106 and Horizon Agent 2106 and newer, High Efficiency Video Decoding (HEVC) is enabled by default.
    
13. Horizon Client 5.2 and newer have an option to Allow Blast connections to use operating system proxy settings, which is deselected by default. You can configure a client-side group policy to enable proxy. Or users can manually enable it.
    
14. Double-click the server.
    
    
15. If the certificate is not trusted, click Show Certificate, and then click Continue. To disable this prompt, see Certificate Validation below.
    
    
16. Enter your username and password, and then click Login.
    
    
    • Horizon 7.8 and newer no longer send the domain list by default but you can enable it in Horizon Console. Or, instruct users to login using their userPrincipalNames.
      
      
17. If you see too many domains in the Domain list:
    1. You can filter them by running the vdmadmin -N command. See Configuring Domain Filters Using the ‑N Option at Omnissa Docs.
    2. Horizon 7.1 and newer have an option to Hide domain list in client user interface. If you enable this in Global Settings, then users must enter UPN, or Domain\Username. This is the same place you can configure Horizon to send the Domain List to the client.
       
       
18. If any of your published applications or desktops are configured with a Category Folder, click Yes when asked for shortcuts to appear in your Start Menu or desktop.
    
    
    
    • Horizon Client 5.1 and newer have an interesting command line switch -installShortcutsThenQuit that connects to a Connection Server, creates the shortcuts on Start Menu and Desktop, and then quits. Here is sample syntax:

      vmware-view.exe -serverURL serverurl -loginAsCurrentUser true -installShortcutsThenQuit

19. If any of your published application icons have Pre-launch enabled, then a session will be started on one of the Horizon Agents that hosts the icon. All it does is create a session; the icon that Pre-launch was enabled on is not launched until the user double-clicks the icon. When the user launches any icon published from the Horizon Agent, it will launch quickly.
    
    • After the user closes the Horizon Client, the Pre-launch session remains disconnected for the duration specified in the RDS Farm.
      
20. Horizon Client 2406 and newer let users organize icons into folders.
    
    • The Folders feature can be in disabled in Horizon Console 2406 and newer at Settings > Global Settings. It’s enabled by default.
      
21. If you have a bunch of icons, click one of the icons and then start typing in the name of the icon and it will highlight.
    
22. If the pool settings allow it, you can right-click an icon and then select a protocol. VMware Blast is the recommended protocol.
    
    
    
    1. When editing a pool, you can force users to use a particular protocol by setting Allow Users to Choose Protocol = No.
       
    2. In Horizon Console, at Monitor > Sessions, if you scroll to the right, you can see which Protocol the clients are using.
       
23. You can synchronize num lock and cap lock status.
    1. Right-click a desktop icon and click Settings.
       
       
    2. The left side of the screen shows all published desktops. On the right, enable the option to Automatically synchronize the keypad, scroll, and cap lock keys.
       
       
    3. You can also automatically enable this setting by configuring a client-side group policy setting.
       
24. Either double-click an icon, or right-click an icon, and click Launch.
    
    
25. When connecting, you might be prompted to access your local files.
    
    
    • You can change your file sharing options by clicking the Settings button (or gear icon) and switching to the Data Sharing (or Sharing page.
      
      
26. If you are connected to a remote desktop, you can use the menu at the top of the screen, click the three dots, and then click Settings.. An interesting option is Autoconnect to this Desktop. This setting is stored on the Horizon Connection Server in LDAP and there doesn’t appear to be any way to automate enabling it.
    
    
    
27. In Horizon Client 4.4 and newer, administrators can enable a Desktop Pool Setting that allows users to Restart the remote desktop gracefully.
    
    
28. Horizon can show the client’s battery status in the remote desktop. The user will have to click the up arrow in the system tray to see the battery icon. The battery icon is shown in both single-user Virtual Desktops and multi-user RDS Desktops.
    
29. There are client-side group policy settings to define a hotkey combination for grabbing and releasing input focus.
    
30. The Horizon Client also has a taskbar jump list showing recently launched applications and desktops.
    
31. Some of the menu items in Horizon Client can be hidden by configuring Group Policy using the Horizon GPO Templates.
    
    

Shortcuts and Favorites

In the Horizon Client, once you are connected to a server, you can right-click an icon and click Create Shortcut to Desktop or Add to Start Menu.

In the Horizon Client, each desktop/app icon has a star icon you can click, or right-click an icon and Mark as Favorite. Favorites are stored in the LDAP database on the Horizon Connection Server.

1. On the top right of the Horizon Client, you can switch to the Favorite view so that only icons selected as Favorites are displayed.
   
   
2. Or switch back to the All View by deselecting the Favorite button.
   
   

Support information

1. In Horizon Client 2106 and newer, in the menu is About VMware Horizon Client.
   
   1. Or on the Question Mark menu is Support Information.
      
2. Users can click this to find the client name, client operating system, Horizon Client version, the Horizon Connection Server name, and entitled desktops.
   
   

Certificate Validation

When you connect to a Horizon Connection Server, and if the certificate is not trusted or valid, then the user is prompted to accept the certificate. You can disable this prompt for any client machine that can be controlled using group policy.

1. Copy the Horizon .admx files to PolicyDefinitions if you haven’t already.
2. Create a GPO that is linked to an OU containing the Horizon Client machines. These are the end-user PCs, not the virtual desktops.
3. Edit the GPO.
4. Go to Computer Configuration | Policies | Administrative Templates | VMware Horizon Client Configuration | Scripting Definitions.
5. On the right, double-click Server URL.
   
6. Set the URL to your Horizon View URL and click OK.
   
7. On the left, click Security Settings. On the right, open the setting Certificate verification mode.
   
8. Enable the setting and make your choice. No Security will disable the certificate prompt. Then click OK.
   

Horizon 2306 (8.10) and newer with Horizon Client 2306 (8.10) and newer can enforce certificate checking on the client.

1. Go to Settings > Global Settings > Client Desired Configuration and click Edit.
   
2. Make your choices and click OK.
   

Device Redirection

Client Drive Redirection

1. When you connect to a Horizon Agent that has Client Drive Redirection enabled, you are prompted to allow file redirection.
   
   
2. By default, only the user’s local profile is redirected.
   
3. You can redirect more folders or drives by opening Settings, or click the Options menu, and click Share Folders.
   
   
4. In the Drive & Folder Sharing tab (or Sharing tab), on the Global Sharing sub-tab, add drives or folders.
   
   
   • Horizon Client 2206 and newer with Horizon Agent 2206 and newer have an Exclusive Sharing tab that lets you share a client drive exclusively with the remote desktop for faster file transfer performance. The Storage Drive Redirection feature is installed by default on Horizon Agent 2206 and newer.
     
5. The folders or drives you added are now visible within Explorer in the Horizon Desktop.
   
6. Client Drive Redirection also works in published applications.
   
7. Horizon Agent 7.7 and newer with Horizon Client 4.10 and newer let you drag files from the local machine into the remote machine. This is drag only. You can’t copy/paste. If you drag the file onto a remote application, then then application opens the file.
   
   1. This feature can be disabled and/or controlled in a GPO that applies to the Horizon Agent. Make sure the Horizon 7.7 or newer GPO templates are installed. In the Computer half of the GPO, go to Administrative Templates > VMware Blast and edit the setting Configure drag and drop direction.
      
   2. The Configure drag and drop direction setting is also configurable for PCoIP under the Computer-half node named PCoIP Session Variables > Overridable Administrative Defaults.
      
8. The client drive redirection prompt configuration is stored in %appdata%\VMware\VMware Horizon View Client\prefs.txt. You can edit this file to disable the prompt.
   
   
9. Horizon has some GPO settings for Client Drive Redirection that let you control drive letters for client drives in the remote session. Install the Horizon GPO Templates if you haven’t already. Edit a GPO that applies to the Horizon Agents. Then find the settings under VMware View Agent Configuration > VMware Horizon Client Drive Redirection.
   

Serial Port Redirection

1. If you connect to a Horizon Agent that has Serial Port Redirection enabled, then a new icon will appear in the system tray.
   
2. Right-click the icon to map the remote COM port to the local COM port.
   

Scanner Redirection

From VMware Blogs Scanner Redirection in Horizon with View: we have added scanner redirection to Horizon with View for use with both VDI desktops and Remote Desktop Session Host (RDSH) applications and desktops. The new scanner redirection functionality in View works by capturing the entire image at the client with the scanning device, compressing the image, and sending that compressed image to the guest in the data center, where the image is presented by a “virtual scanner device” to the application that requested the image capture. The scanner redirection functionality supports both TWAIN and WIA scanning modes and allows images to be captured from both scanners and other imaging devices (such as webcams).

The scanner redirection functionality requires the Horizon Agent version 6.0.2 or later, and the Windows Horizon Client 3.2 or later.

When you install the Horizon Agent component, be sure to select the scanner redirection feature if you want to use it; it is disabled by default. If you are installing the feature onto a server-based OS (Windows Server 2008 R2 or Windows Server 2012 R2) for either VDI desktops or RDSH desktops or applications, then be sure that the Desktop Experience feature (a Microsoft operating system feature) is installed on the server OS first. (This is a prerequisite for installing scanners in a server-based OS.)

After a user makes a connection from a compatible Windows Horizon Client to the new Horizon Agent, a new tool-tray application icon appears. The user clicks the icon to reveal the compatible image acquisition devices available for scanning.

The default mode of operation is, however, that “it should just work,” and the seamless hosted application should be able to acquire an image without needing manual intervention. The user may need to adjust the preferences if more than one imaging device is connected to the client machine, and the user wants to select a specific scanner, or if the user wants to adjust the scan resolution, and so on.

Scanner Redirection Preferences, available by clicking Preferences from the tool-tray icon, allows further configuration of the scanning process, for example, adjusting the default compression applied to the scanning. This can greatly reduce the bandwidth needed to transmit the image (the compression is applied on the client side before the image is transmitted to the guest), but, of course, the more an image is compressed, the lower the image quality. In addition, in the Scanner Redirection Preferences, options are available to adjust the default image capture device (for example, automatic mode, last-used, or an absolute specified device).

These preferences can also be adjusted by way of Group Policy options in the guest OS. A new GPO file (available in the Horizon with View GPO Bundle) allows this configuration. See Configuring Scanner Redirection in Setting Up Desktop and Application Pools in View for more information

Scanner Redirection Caveats

From VMware Communities:

• Scanner redirection does not create a device on your virtual desktop that matches the name of the actual scanner.  It creates a generic scanner in Device Manager called VMWare Virtual WIA Scanner (or VMWare Virtual TWAIN Scanner I am assuming).  For us this stinks because the image capture software our client uses (Vertex by Jack Henry), has a prepopulated list of scanners you can select.  So if we plug in a Canon-CR50 and select Canon CR50/80 in the application, it does not recognize that this scanner is attached to the virtual desktop.
  1. There is a tick box option in the scanner preferences dialog box titled “Use vendor defined names for TWAIN scanners”. This should solve the issue you mention, and we added it specifically to cover the problematic use case you mention.
  2. This only applies to TWAIN scans, WIA can’t use the vendor name.
• You must install a TWAIN or WIA driver on your thin client.  If you can’t find a TWAIN or WIA driver, you are out of luck.  For teller check image scanners, we have found no TWAIN or WIA drivers for the TellerScan TS-230, TS-240, or the Canon CR-55.  We have found a TWAIN driver for the Canon CR-50 (from the Canon Europe site no less), but issue #1 above means we are out of luck.

Client Printers

Horizon 7.7 and newer with Horizon Client 4.10 and newer have a new VMware Integrated Printing (aka VMware Advanced Printing) feature that replaces the older ThinPrint technology. ThinPrint is no longer available in Horizon Agent 2006 and newer.

When printing from an application, if you highlight a printer and click Preferences, the VMware Horizon icon on the Layout tab shows you that this printer is using VMware Integrated Printing.

If you open the client printer Properties as an administrator, on the Advanced tab, you will see the VMware Universal EMF Driver.

If older ThinPrint:

• Inside the virtual desktop, if you go to Devices and Printers, it will look a little weird. To see all of the client printers, right-click on a TP printer and use the expandable menus.
  
• But when you print from an application, all printers appear normally.
  

File Type Association

Some published applications might have file types associated with them. When you double-click a file with the configured extension, you might be prompted to open the file using the remote application.

In Horizon Client, if you right-click an icon and click Settings:

• On the Applications page (or Sharing page), you can disable this functionality.
  
  

It’s also configurable in the client-side registry at HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware VDM\Client by creating a String value at named AllowFileRedirection and setting it to false. See VMware Communities for more information.

Session Collaboration

Horizon 7.4 and newer have an Allow Session Collaboration checkbox in Pool Settings and RDS Farm Settings.

This setting enables a VMware Horizon Collaboration icon in the system tray of the remote desktop, which lets you invite users to collaborate.

The invite is a URL that you can run (or click) on the collaborator’s machine that has Horizon Client 4.7 or newer installed.

To give control to the collaborator, double-click the green icon to open the Session Collaboration window. Or open the icon in the system tray.

Performance Tracker

Horizon Agent 7.5 and newer have an optional component called Performance Tracker.

When installing Horizon Agent, the last option is Horizon Performance Tracker. It is deselected by default.

After it’s installed in an RDS farm, you can publish the Performance Tracker as an Application Pool

Or connect to a Desktop and launch it from the Desktop icon.

It can display protocol performance information in graphical or tabular form. The overview UI also shows the name of the Horizon Agent machine.

There’s also a Floating Bar option.

Performance Tracker can be configured to launch automatically:

1. Install the Horizon GPO templates if you haven’t already.
2. Edit a GPO that applies to the Horizon Agents. These are Computer settings.
   
3. Go to Computer Configuration | Policies | Administrative Templates | VMware Horizon Performance Tracker.
4. On the right, you’ll see two options for auto starting the Performance Tracker.
   
5. Both settings let you Show or Hide the overview UI.
   
6. If Hide is selected, then users can open the Tracker from the systray icon.
   

HTML Blast

From the Horizon Connection Server webpage, you can click the VMware Horizon View HTML Access link to launch a desktop or application inside your browser. While Internet Explorer 9 is supported, some functionality, like clipboard and audio, is only available in Internet Explorer 10 and newer, Chrome and Firefox.

In Horizon 6.2 and later, you can launch applications as well as desktops from HTML Blast.

If you click the star icon then you can Mark the icon as a Favorite. Favorites are stored in the LDAP database on the Horizon Connection Server.

Applications and desktops are launched within the browser window. You can click the vertical lines on the left to switch to a different application or desktop.

You can open the Copy & Paste panel to copy between the local machine and the remote machine.

Thin Clients

Omnissa EUC Technology Partner Hub – Thin Client Device and Model Information. It shows thin client models and the version of Horizon that is supported with the model.

Repurposed PCs

From Chris Halstead VMware Horizon View AutoConnection Utility: I decided to write an app in .NET that is essentially a wrapper for the View Client.  It creates the command line variables based on what the user configures in the GUI and automatically connects to the specified desktop or application pool.  All of the user configured information is stored in the registry under the current user hive.

The application silently and automatically connects into either a desktop or application pool each time a user logs in by placing it in the startup folder.

Once you have tested your connection, you are ready to enable AutoConnection.  You enable AutoConnection by checking the “Enable AutoConnection” box.   A common use case would be to place the .exe in the Windows startup folder so that every time a user logs in it will automatically connect to the Virtual Desktop.

This will run the application with the GUI hidden and will automatically connect to the specified pool.   The application will minimize to the system tray and a balloon will indicate the connection process is occurring.

Horizon Client Group Policy – Security Settings

The Horizon GPO Bundle includes policy templates for the Horizon Client. See https://www.carlstalhood.com/horizon-group-policy-and-profiles/#viewtemplates to install the ADMX files.

Here are some security GPO settings recommended (VMware Horizon with View Security Hardening Overview) by VMware:

Navigation

Use this post to build a Windows Server Remote Desktop Session Host that will be used as the source image for additional cloned Remote Desktop Session Hosts. Or you can build each Remote Desktop Session Host manually using the steps detailed in this post.

• Hardware
  • NIC Hotplug – Disable
  • VMware Tools
• Windows
  • Disable Internet Explorer Enhanced Security Config
  • User Account Control and SmartScreen
  • Windows Update
  • Windows Server 2008 R2 Hotfixes
  • File Sharing
  • Windows Firewall – Remote Management
  • Local Administrators Group
• Remote Desktop Session Host
  • Role and Features – Windows Server 2012
  • Windows Roles – Windows Server 2008 R2
  • Remote Desktop Licensing Configuration
  • C: Drive Permissions
• Installs
  • VMware Horizon 6 Agent 6.2.2
  • User Environment Manager Engine
• Horizon Agent Load Balancing Script
• Antivirus
• Install Applications
• VMware OS Optimization Tool
• Seal and Snapshot
• Full Clone Post-Cloning Tasks

Hardware

• The session host pools will use the same hardware specs (e.g. vCPUs, memory size, network label) specified on the master session host. Adjust accordingly.
• For 2012 R2, set the vCPUs to 8. For 2008 R2, set the vCPUs to 4. Two is the minimum. See VMware whitepaper for more information.
• Typical memory for an 8 vCPU session host is 24 – 48 GB (e.g. 32 GB).
• For New Hard disk, consider setting Thin provision. And increase the size so it can store the locally cached profiles (C:\Users).
  
• The session host should be configured with a VMXNET 3 network adapter.
  
• When building the master session host, you will probably boot from an ISO. When you are ready to create the pool (RDS farm), ensure the CD/DVD drive points to Client Device and is not Connected. The important part is to make sure ISO file is not configured.
  
• There’s no need for the Floppy drive so remove it.
  
• If you have any Serial ports, remove them.

NIC Hotplug – Disable

1. Users could use the systray icon to Eject the Ethernet Controller. Obviously this is bad.
   
2. To disable this functionality, power off the virtual machine.
3. Once powered off, right-click the virtual machine and click Edit Settings.
   
4. On the VM Options tab, expand Advanced and then click Edit Configuration.
   
5. Click Add Row.
6. On the left, enter devices.hotplug. On the right, enter false.
7. Then click OK a couple times to close the windows.
   
8. The VM can then be powered on.

VMware Tools

VMware Tools includes the Shared Folders feature, which prevents roaming profiles from being deleted properly. When installing VMware Tools, make sure you deselect Shared Folders so it is not installed.

After installing VMware Tools, open Registry Editor and go to HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order. Look in the ProviderOrder value on the right and ensure that vmhgfs is not listed. If it is, remove it.

Windows

Disable Internet Explorer Enhanced Security Config

1. In Server Manager, switch to the Local Server page.
2. On the far right, click the link for On next to IE Enhanced Security Configuration.
   
3. Click Off for both Administrators and Users. Click OK.
   

User Account Control and SmartScreen

This section is optional.

1. Right-click the flag icon by the clock and click Open Action Center. Or launch it from the Start Menu.
   
2. On the left click Change User Account Control settings.
   
3. To disable UAC, move the slider down to Never Notify and click OK. Or you can leave it enabled if your security standards require it.
   
4. Back in Action Center, on the left, click Change Windows SmartScreen settings.
   
5. Make your selection regarding SmartScreen and click OK.
   

Windows Update

Whenever you deploy a virtual machine from a template and SysPrep is executed during the cloning process, all Windows Update settings are reset. You must reconfigure Windows Update on every new virtual machine (or use group policy).

1. In Server Manager, click Local Server on the left. Then on the right click the link for Last checked for updates.
2. On the left, click Change settings.
   
3. Check the box next to Give me updates for other Microsoft products when I update Windows and click OK.
   
4. Windows Update will automatically start checking for updates.
5. Install any updates it recommends.

Windows Server 2008 R2 Hotfixes

If this is a Windows Server 2008 R2 session host, at a minimum, request and install the Windows hotfixes listed at Citrix CTX129229 Recommended Hotfixes for XenApp 6.x on Windows Server 2008 R2. Scroll down to the Microsoft Hotfixes section.

Microsoft 2483177 You cannot play back an H.264 video file or an AAC audio file on a computer that is running Windows Server 2008 R2 with the Desktop Experience feature enabled. From the hotfix description: the Desktop Experience feature in Windows Server 2008 R2 does not include decoders for the H.264 and AAC formats.

The following file is available for download from the Microsoft Download Center:

Download the Desktop Experience Decoder Update for Windows Server 2008 R2 package now.

File Sharing

By default on Windows 2012, if Windows Firewall is enabled, then all file shares are blocked. You can’t even connect to C$ from a different machine. To facilitate remote management, consider enabling file sharing.

1. To enable sharing, by the clock, right-click the network icon and click Open Network and Sharing Center.
   
2. On the left, click Change advanced sharing settings.
   
3. Select Turn on file and printer sharing.
4. Select Tun on network discovery.
   

Windows Firewall – Remote Management

By default, Windows Server 2012 blocks remote management tools. For example, you can’t use Event Viewer on server 1 to access the event logs on server 2.

1. Run Windows Firewall with Advanced Security.
2. On the left, click Inbound Rules.
3. On the right, right-click COM+ Network Access (DCOM-In) and click Enable Rule.
   
4. Highlight all three Remove Event Log rules, right-click, and click Enable Rule.
   

Local Administrators Group

If the Horizon Administrators and members of the Domain Admins group are the same people, then there is nothing to change. Otherwise, add your Horizon Admins group to the local Administrators group.

1. In Server Manager, open the Tools menu and click Computer Management. Or launch it by right-clicking the Start Button.
2. Add the Horizon Admins group to the local Administrators group.
   

Remote Desktop Session Host

Role and Features – Windows Server 2012

If this session host is Windows Server 2008 R2 then skip to the next section.

1. In Server Manager, open the Manage menu and click Add Roles and Features.
   
2. Click Next until you get to the Server Roles page.
3. Check the box next to Remote Desktop Services and click Next.
   
4. Check the box next to Group Policy Management and scroll down.
   
5. Expand User Interfaces and Infrastructure and check the box next to Desktop Experience. This adds a bunch of features like Themes, Windows Media Player, Flash, etc.
   
6. Check the box next to Telnet Client and scroll up.
7. Expand Remote Server Administration Tools > Role Administration Tools > AD Delivery Services and AD LDS Tools > AD DS Tools. Check the box next to Active Directory Administrative Center.
8. To verify Remote Desktop Services licensing, expand Remote Desktop Services Tools and check the box next to Remote Desktop Licensing Diagnoser Tool. Click Next when done.
   
9. In the Select role services page, check the box next to Remote Desktop Session Host and click Next.
   
10. If desired, click the Restart box, then click Install. Restart is required.
    

Windows Roles – Windows Server 2008 R2

If this session host is running Windows 2008 R2 then the instructions are slightly different.

1. In Server Manager, right-click Roles and click Add Roles.
   
2. In the Before You Begin page, click Next.
3. In the Select Server Roles page, check the box next to Remote Desktop Services and click Next.
   
4. In the Introduction to Remote Desktop Services page, click Next.
5. In the Select Role Services page, check the box next to Remote Desktop Session Host and click Next.
   
6. In the Uninstall and Reinstall Applications for Compatibility page, click Next.
7. In the Specify Authentication Method for Remote Desktop Session Host page, select Do not require Network Level Authentication and click Next.
   
8. In the Specify Licensing Mode page, select Per User and click Next.
   
9. In the Select User Groups Allowed Access to this RD Session Host Server page, click Add. Browse for Authenticated Users (on the local machine) and click Next.
   
10. In the Configure Client Experience page, check the boxes for Audio and video playback and Desktop composition. This causes Desktop Experience to be installed. Click Next.
    
11. In the Confirm Installation Selections page, click Install.
12. In the Installation Results page, click Close.
13. Click Yes when you are prompted to restart now.
14. Login to the server. Then click Close.

Remote Desktop Licensing Configuration

The only way to configure Remote Desktop Licensing in Windows Server 2012 is using group policy (local or domain). This also works for Windows Server 2008 R2.

1. For local group policy, run gpedit.msc.
   
2. Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing.
   
3. Double-click Use the specified Remote Desktop license servers. Change it to Enabled and enter the names of the RD Licensing Servers. Click OK.
   
4. Double-click Set the Remote Desktop licensing mode. Change it to Enabled and select Per User. Click OK.
   
5. In Server Manager, open the Tools menu, expand Terminal Services and click RD Licensing Diagnoser.
6. The Diagnoser should find the license server and indicate the licensing mode. It’s OK if there are no licenses installed on the Remote Desktop License Server.
   

C: Drive Permissions

The default permissions allow users to store files on the C: drive in places other than their profile.

1. Open the Properties dialog box for C:\.
2. On the Security tab, click Advanced.
   
3. Highlight the line containing Users and Create Folders and click Remove.
   
4. Highlight the line containing Users and Special and click Remove. Click OK
   
   
5. Click Yes to confirm the permissions change.
6. If you see any of these Error Applying Security windows, click Continue.
   
7. Click OK to close the C: drive properties.

Installs

VMware Horizon 6 Agent 6.2.2

View Agent for RDS Hosted Apps Desktops is missing a few features:

• No Generic USB Redirection. USB Flash Drives and hard drives are supported.
• No Real-Time Audio Video
• No serial port redirection
• No Persona. Instead use VMware User Environment Manager (Horizon Enterprise) or Microsoft’s roaming profiles

To install View Agent on Remote Desktop Services, do the following:

1. Go to the downloaded Horizon 6 Agent x64 6.2.2 and run VMware-viewagent-x86_64-6.2.2.exe.
   
2. In the Welcome to the Installation Wizard for VMware Horizon 6 Agent page, click Next.
   
3. In the License Agreement page, select I accept the terms and click Next.
   
4. If you see a message about Desktop OS Configuration then you need to cancel the installer and install the Remote Desktop Session Host role.
   
5. In the Network protocol configuration page, select IPv4 and click Next.
   
6. In the Custom Setup page, enable Scanner Redirection if desired. Same for USB Redirection.
7. Client Drive Redirection is a new feature in Horizon 6 Agent 6.1. The description indicates that the file transfers are not encrypted.
8. VMware Horizon View Composer Agent is a new feature of Horizon 6 Agent 6.2. If you are building a pool of Remote Desktop Session Hosts then install this feature. Note: if you are not building linked clones then don’t select this option or else you won’t be able to select the machine in a Manual RDS Farm in View Administrator.
9. Click Next when done making selections.
   
10. Click OK to acknowledge the USB redirection message.
11. If you see the Register with Horizon 6 Connection Server page, enter the name of a Horizon 6 Connection Server and click Next. You only see this page if not installing the View Composer Agent.
    
12. In the Ready to Install the Program page, click Install.
    
13. In the Installer Completed page, click Finish.
    
14. Click Yes to restart the server.
    

User Environment Manager Engine

If you are licensed for User Environment Manager (Horizon Enterprise Edition), install the User Environment Manager Engine.

1. Make sure Prevent access to registry editing tools is not enabled in any GPO. This setting prevents the FlexEngine from operating properly.
2. In Server Manager, open the Manage menu and click Add Roles and Features.
3. In the Features page, select .NET Framework 3.5 and click Next.
   
4. In the Confirmation page, click Specify an alternate source path.
   
5. Mount or extract the Windows Server 2012 R2 ISO.
6. Enter the path to the sources folder on the Windows Server 2012 R2 ISO and click OK. Then click Install.
   
7. Go to the extracted User Environment Manager 9.0 files and run VMware User Environment Manager 9.0 x64.msi.
   
8. In the Welcome to the VMware User Environment Manager Setup Wizard page, click Next.
   
9. In the End-User License Agreement page, check the box next to I accept the terms and click Next.
   
10. In the Destination Folder page, click Next.
    
11. The Choose Setup Type page appears. By default, the installer only installs the engine. You can click Custom or Complete to also install the console.
    
    
12. In the Choose License File page, if installing on a View Agent then no license file is needed. Click Next.
    
13. Otherwise, Browse to the license file and then click Next.
    
14. In the Ready to install VMware User Environment Manager page, click Install.
    
15. In the Completed the VMware User Environment Manager Setup Wizard page, click Finish.
    

Horizon Agent Load Balancing Script

If you have multiple identical Remote Desktop Services Hosts in a single RDS Farm, by default, VMware Horizon uses a least connections Load Balancing algorithm. You can change this to performance-based Load Balancing by configuring scripts on each RDS Host. See Configuring Load Balancing for RDS Hosts at pubs.vmware.com.

There are only three levels of load: HIGH, MED, and LOW. Within a load level, Horizon selects an RDS server at random.

Do the following to configure the Load Balancing script:

1. The script must be placed at C:\Program Files\VMware\VMware View\Agent\scripts on every RDS Host. VMware provided a couple sample scripts that you can use. One script only looks at CPU and the other script only looks at Memory. If you write your own script, make sure it exists in this folder on every RDS Host in the RDS Farm.
   
2. Open Services and configure the VMware Horizon View Script Host service to run automatically.
   
   
3. Then start the service.
   
4. In regedit, go to HKLM\Software\VMware, Inc.\VMware VDM\ScriptEvents\RdshLoad.
5. Create a new String Value. It doesn’t matter what you name it but the script name is recommended.
6. Modify the String Value and enter cscript.exe “PathToScript”. For example: cscript.exe "C:\Program Files\VMware\VMware View\Agent\scripts\cpuutilisation.vbs"
   
7. After setting the registry value, restart the VMware Horizon View Agent service.
   
8. After you later add this RDS Host to a farm, in View Administrator, click the Dashboard view.
9. Expand RDS Farms, expand the farm and click the RDS Host.
   
10. Make sure the Server load is reported.
    

Antivirus

Install antivirus using your normal procedure. Instructions vary for each Antivirus product.

Microsoft’s virus scanning recommendations (e.g. exclude group policy files) – http://support.microsoft.com/kb/822158.

Symantec

Symantec has a document at http://www.symantec.com/business/support/index?page=content&id=TECH91070 detailing best practices when deploying Symantec Endpoint Protection to session hosts.

Best practices for virtualization with Symantec Endpoint Protection 12.1, 12.1 RU1, and 12.1 RU1 MP1  – http://www.symantec.com/docs/TECH173650

Install Applications

Install applications that will be executed on these machines.

VMware OS Optimization Tool

1. Download the VMware OS Optimization Tool VMware fling.
   
2. Run the downloaded VMwareOSOptimizationTool_1050.msi.
   
3. On the Analyze tab, on the bottom left, click Analyze.
   
4. Check both boxes and click Continue to Analyze.
   
5. Review the optimizations and make changes as desired. Then on the bottom left click Optimize.
   
6. Click the FAILED links for more information.
   
7. The History tab lets you rollback the optimizations.
   
8. The Templates tab lets you edit the optimizations. You can create your own template or edit an existing template.
   

Citrix has published a document with several registry modifications that are supposed to improve server performance. You can access it at http://support.citrix.com/article/CTX131577.

Another list of optimizations can be found at http://www.citrixtools.net/Resources/Articles/articleType/ArticleView/articleId/5610/Windows-2008-R2-Remote-Desktop-and-XenApp-6-Tuning-Tips-Update.aspx.

Seal and Snapshot

1. Go to the properties of the C: drive and run Disk Cleanup.
   
2. On the Tools tab, click Optimize to defrag the drive.
   
3. Run slmgr.vbs /dlv and make sure it is licensed with KMS and has at least one rearm remaining.
4. Run Delprof2 to clean up local profiles. Get it from http://helgeklein.com/download/.
5. Make sure the master session host is configured for DHCP.
   
6. Session hosts commonly have DHCP reservations.
   
   
7. Run antivirus sealing tasks:
   1. Symantec: Run a full scan and then run the Virtual Image Exception tool – http://www.symantec.com/business/support/index?page=content&id=TECH173650
   2. Symantec: run the ClientSideClonePrepTool –http://www.symantec.com/business/support/index?page=content&id=HOWTO54706
8. Shutdown the master session host.
   
9. Edit the Settings of the master virtual machine and disconnect the CD-ROM. Make sure no ISO is configured in the virtual machine.
   
10. Take a snapshot of the master session host. View Composer requires a snapshot.
    
    
11. Use can now use Horizon View Administrator to create RDS Farms.

Full Clone Post-Cloning Tasks

If you used vCenter to clone the machine instead of using Horizon 6 Composer, then after the machine is cloned, do the following on the cloned machine:

1. Static IP – Configure a static IP address (or DHCP reservation).
2. Windows Update – Run Windows Update. SysPrep always disables Windows Update so you must run it at least once to re-enable it.
3. Join domain – Join the machine to the domain if SysPrep didn’t do it for you.
4. Active Directory OU – Move the Active Directory computer object to the correct OU.
5. Horizon 6 Agent – uninstall the Horizon 6 Agent and reinstall it so it registers with a Horizon 6 Connection Server.
6. Antivirus – Re-configure antivirus. Instructions vary based for each product. Go to the antivirus vendor’s website and search for a cloning procedure.
7. Firewall rules – Add the new machine to any firewall rules (PCoIP, Blast) between the Horizon 6 Security Server and Horizon 6 Agents.
8. View Administrator – In View Administrator, add the new machine to a Remote Desktop Services farm.

Navigation

• RDS Farms Overview
• RDS Farms – Linked Clones
  • Customization Specification
  • Create an Automatic Farm
  • Add RDS Host to Automatic Farm
  • Update an Automatic Farm
• RDS Farms – Manual
  • Add RDS Host to Manual Farm
• Published Desktop
• Published Applications
  • Anti-affinity

Overview

Before following this procedure, build a master RDS Session Host.

This post details VMware Horizon configuration for Remote Desktop Session Host Horizon View Agents. Virtual Desktops are detailed elsewhere.

Before you can publish applications or desktops, you must create an RDS Farm. An RDS Farm is a collection of identical (cloned) Remote Desktop Session Hosts. Applications must be installed identically on every machine in the farm. If you have different applications on different Remote Desktop Session Hosts then these are different RDS Farms.

Horizon 6 supports up to 200 RDS farms, each with up to 200 RDS hosts.

Once the RDS Farms are created, you publish resources from them by either creating a Desktop Pool or an Application Pool or both. When creating a Desktop Pool or Application Pool, all members of the RDS Farm are selected. It is not possible to select a subset of Farm members.

RDS Farms – Linked Clones

You can use View Composer to create RDS linked clones. Here are some missing features and other notes:

• No QuickPrep. Uses SysPrep with Customization Specifications instead. SysPrep is slower than QuickPrep. SysPrep is also performed during Recompose operations.
• No View Storage Accelerator.
• No Rebalance.
• No Refresh. The machines are persistent until you Recompose the farm.
  • The delta disks continue to grow until you Recompose the farm.
  • You can enable Space Reclamation to shrink the delta disks as files are deleted.
• DHCP is required.

Customization Specification

If you want to use View Composer then SysPrep requires a Customization Specification in vCenter. QuickPrep is not supported with RDS farms.

1. In vCenter, from the Home page, click Customization Specification Manager.
   
2. Click the icon to create a new Customization Specification.
   
3. In the Specify Properties page, give the spec a name and click Next.
   
4. In the Set Registration Information page, enter your normal settings and click Next.
   
5. In the Set Computer Name page, select Use the virtual machine name and click Next.
   
6. In the Enter Windows License page, select Per seat and click Next.
   
7. In the Set Administrator Password page, enter the local administrator password and click Next.
   
8. In the Time Zone page, select the time zone and click Next.
   
9. In the Run Once page, click Next.
   
10. In the Configure Network page, leave it set to Use standard network settings. Horizon 6 requires the VMs to be configured for DHCP. Click Next.
    
11. In the Set Workgroup or Domain page, enter credentials that can join the machines to the domain and click Next.
    
12. In the Set Operating System Options page, leave the box checked and click Next.
    
13. In the Ready to complete page, click Finish.
    

Create an Automatic Farm

To create a farm of linked clones, do the following:

1. Make sure your RDS View Agents have the VMware Horizon View Composer Agent feature installed.
   
2. In View Administrator, on the left, expand Resources and click Farms.
   
3. On the right, click Add.
   
4. In the Type page, select Automated Farm and click Next.
   
5. In the vCenter Server page, select the vCenter Server and View Composer and click Next.
   
6. In the Identification and Settings page, enter a name for the Farm. A folder with the same name will be created in vCenter.
7. Allow users to choose protocol should be set to No.
8. For Empty session timeout, set it to 1 minute. For When timeout occurs, set it to Log off. You usually want the session to end when users close all of their applications.
9. For Log off disconnected sessions, specify a disconnect timer. This is in addition to the idle timer configured in View Configuration > Global Settings.
10. Check the box next to Allow HTML Access and click Next.
    
11. In the Provisioning Settings page, enter a naming pattern. Make sure the name includes {n:fixed=3} or something like that.
12. Enter the number of machines to create and click Next.
    
13. In the Storage Optimization page, click Next.
    
14. In the vCenter Settings page, click Browse next to each option and make a selection.
    
15. When selecting a datastore, set the Storage Overcommit to Unbounded. Click OK and then click Next.
    
16. In the Advanced Storage Options page, decide if you want space reclamation or not. Space reclamation does reduce disk space but increases IOPS while the operation is occurring. If space reclamation is enabled, also configure a Blackout window so the increased IOPS does not affect production usage. Scroll down.
    
17. If you scroll down you’ll see an option for Transparent Page Sharing. By default it is disabled. You can enable it by setting it to Global. This should reduce some memory consumption. Click Next.
    
18. In the Guest Customization page, select an OU.
19. Select a customization specification and click Next.
    
20. In the Ready to Complete page, click Finish.
    
21. On the RDS Hosts tab you can see the progress of the farm creation operation.
    
22. Since RDS Farms use SysPrep, it will take some time before they become available.
    
23. Once the RDS Hosts are created, you publish resources from them by either creating a Desktop Pool or an Application Pool or both.

Add RDS Host to Automatic Farm

1. On the left, expand Resources and click Farms.
2. On the right, highlight an existing Farm and click Edit.
   
3. Switch to the Provisioning Settings tab and change the Max number of machines. Then click OK.
   
4. Since this is based on SysPrep, it will take a while to add the virtual machine. The new VMs reboot several times during the provisioning and customization process.
5. The farm now has new RDS host(s).
   

Update an Automatic Farm

1. Power on the master session host.
   
2. After making your changes, shut down the master session host.
   
3. Right-click the virtual machine and take snapshot. You must create a new snapshot.
   
4. Name the snapshot and click OK.
   
5. You’ll need to periodically delete the older snapshots. Right-click the master VM and click Manage Snapshots.
   
6. Delete one or more of the snapshots.
   
7. In View Administrator, go to Resources > Farms.
   
8. Double-click a farm name.
   
9. Before beginning the Recompose operation, edit the Farm and on the Provisioning Settings tab consider specifying a minimum number of ready machines during View Composer maintenance operations. If you leave this set to 0 then all machines will be in maintenance mode and nobody can connect until Recompose is complete.
   
10. On the Summary tab, click Recompose.
    
11. In the Image page, select the new snapshot and click Next.
    
12. In the Scheduling page, decide when to apply this new image and then click Next.
    
13. In the Ready to Complete page, click Finish.
    
14. On the RDS Hosts tab, you can check on the status of the recompose task. Since RDS Farms use SysPrep, this will take a while.
    

RDS Farms – Manual

To create a manual RDS Farm, do the following:

1. Make sure the View Composer Agent is not installed on your RDS servers and make sure you saw the screen to register the Agent with a Horizon 6 Connection Server.
   
2. In View Administrator, expand View Configuration and click Registered Machines. Make sure your manually built RDS Host is registered and listed on the RDS Hosts tab.
   
   
3. In View Administrator, on the left, expand Resources and click Farms.
   
4. On the right, click Add.
   
5. In the Identification and Settings page, enter a name for the Farm.
6. For Empty session timeout, set it to 1 minute. For When timeout occurs, set it to Log off. You usually want the session to end when users close all of their applications.
7. For Log off disconnect sessions, specify a disconnect timer. This is in addition to the idle timer configured in View Configuration > Global Settings.
8. Check the box next to Allow HTML Access and click Next.
   
9. In the Select RDS Hosts, select one or more identical Remote Desktop Session Hosts. Click Next.
   
10. In the Ready to Complete page, click Finish.
    

Add RDS Host to Manual Farm

1. On the left, expand Resources and click Farms.
2. On the right, double-click an existing Farm.
   
3. On the right, switch to the RDS Hosts tab and click Add.
   
4. Select the new RDS host and click OK.
   
5. The farm now has a new RDS host.
   

Published Desktop

To publish a desktop from an RDS farm, do the following:

1. In View Administrator, on the left, expand Catalog and click Desktop Pools.
   
2. On the right, click Add.
   
3. In the Type page, select RDS Desktop Pool and click Next.
   
4. In the Desktop Pool Identification page, enter an ID and name. They can be different. Click Next.
   
5. In the Desktop Pool Settings page, click Next.
   
6. In the Select an RDS farm page, select a farm and click Next.
   
7. In the Ready to Complete page, check the box next to Entitle users after this wizard finishes and click Finish.
   
8. In the Entitlements window, click Add.
   
9. Browse to an Active Directory group and click OK.
10. Then click Close.
    
11. If you go to Resources > Farms, double-click your farm and switch to the RDS Pools tab, you can see which Desktop Pool is associated with this farm.
    

Published Applications

1. In View Administrator, on the left, expand Catalog and click Application Pools.
   
2. On the right, click Add.
   
3. The purpose of this wizard is to publish applications from an RDS Farm and entitle them. The entitlements will apply to all of the applications you select on this page. If you want different entitlements for different applications, run this wizard multiple times and select different applications. Once the applications are published, you can change their entitlements individually. Click Next after selecting one or more applications.
   
4. Or you can add an application manually by changing the radio button to Add application pool manually. Notice that Explorer is not one of the listed applications so that one will need to be done manually.
   
5. Notice the Entitle users box is checked by default. All of the applications in this list will receive the same entitlements. Click Finish.
   
6. Then click Add to select a group that can see these icons. Click OK when done.
   
7. You can run the wizard again to publish more applications with different entitlements.
8. If you double-click one of the application pools, on the Entitlements page you can change the entitlements.
   
9. If you go to Resources > Farms, double-click your farm, and switch to the RDS Pools tab, you can see which Application Pools (published applications) are associated with this farm. Notice you can’t really do anything from here.
   

Anti-affinity

You can configure Horizon to restrict the number of instances of an application running on a particular RDS host. Here are some limitations:

• If the user already has a session then anti-affinity is ignored.
• If the application is launched from within an RDS Desktop then anti-affinity is ignored.
• Not recommended for Horizon Mobile clients.

See Configure an Anti-Affinity Rule for an Application Pool at pubs.vmware.com.

Do the following to configure Anti-Affinity:

1. On the left, expand Catalog and click Application Pools.
2. On the right, edit an existing app/pool.
   
3. In the Anti-Affinity Patterns field, enter process names to match. Wildcards are supported. Each match is counted.
4. In the Anti-Affinity Count field, enter the maximum number of matches that can run on a single RDS Host.