VMware Horizon 7.3 Installation Manual

Download

Page 1

View Installation

Modiﬁed for Horizon 7 7.3.2 VMware Horizon 7 7.3

Page 2

View Installation

You can find the most up-to-date technical documentation on the VMware website at:

https://docs.vmware.com/

If you have comments about this documentation, submit your feedback to

docfeedback@vmware.com

VMware, Inc.

3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com

VMware, Inc. 2

Page 3

View Installation 6

System Requirements for Server Components 7

Horizon Connection Server Requirements 7

View Administrator Requirements 9

View Composer Requirements 10

System Requirements for Guest Operating Systems 13

Supported Operating Systems for Horizon Agent 13

Supported Operating Systems for Standalone Horizon Persona Management 14

Remote Display Protocol and Software Support 14

Installing Horizon 7 in an IPv6 Environment 21

Setting Up Horizon 7 in an IPv6 Environment 21

Supported vSphere, Database, and Active Directory Versions in an IPv6 Environment 22

Supported Operating Systems for Horizon 7 Servers in an IPv6 Environment 23

Supported Windows Operating Systems for Desktops and RDS Hosts in an IPv6 Environment 23

Supported Clients in an IPv6 Environment 23

Supported Remoting Protocols in an IPv6 Environment 24

Supported Authentication Types in an IPv6 Environment 24

Other Supported Features in an IPv6 Environment 24

Installing Horizon 7 in FIPS Mode 27

Overview of Setting Up Horizon 7 in FIPS Mode 27

System Requirements for FIPS Mode 28

Preparing Active Directory 29

Configuring Domains and Trust Relationships 30

Creating an OU for Remote Desktops 31

Creating OUs and Groups for Kiosk Mode Client Accounts 31

Creating Groups for Users 32

Creating a User Account for vCenter Server 32

Creating a User Account for a Standalone View Composer Server 32

Create a User Account for View Composer AD Operations 33

Create a User Account for Instant-Clone Operations 34

Configure the Restricted Groups Policy 34

Using Horizon 7 Group Policy Administrative Template Files 35

Prepare Active Directory for Smart Card Authentication 36

VMware, Inc.

Page 4

View Installation

Disable Weak Ciphers in SSL/TLS 39

Installing View Composer 41

Prepare a View Composer Database 41

Configuring an SSL Certificate for View Composer 50

Install the View Composer Service 50

Enable TLSv1.0 on vCenter and ESXi Connections from View Composer 53

Configuring Your Infrastructure for View Composer 54

Installing Horizon Connection Server 55

Installing the Horizon Connection Server Software 55

Installation Prerequisites for Horizon Connection Server 56

Install Horizon Connection Server with a New Configuration 57

Install a Replicated Instance of Horizon Connection Server 65

Configure a Security Server Pairing Password 72

Install a Security Server 73

Firewall Rules for Horizon Connection Server 81

Reinstall Horizon Connection Server with a Backup Configuration 83

Microsoft Windows Installer Command-Line Options 85

Uninstalling Horizon 7 Components Silently by Using MSI Command-Line Options 87

Configuring SSL Certificates for Horizon 7 Servers 89

Understanding SSL Certificates for Horizon 7 Servers 89

Overview of Tasks for Setting Up SSL Certificates 91

Obtaining a Signed SSL Certificate from a CA 92

Configure Horizon Connection Server, Security Server, or View Composer to Use a New SSL

Certificate 94

Configure Client Endpoints to Trust Root and Intermediate Certificates 100

Configuring Certificate Revocation Checking on Server Certificates 103

Configure the PCoIP Secure Gateway to Use a New SSL Certificate 104

Setting Horizon Administrator to Trust a vCenter Server or View Composer Certificate 109

Benefits of Using SSL Certificates Signed by a CA 109

Troubleshooting Certificate Issues on Horizon Connection Server and Security Server 110

Configuring Horizon 7 for the First Time 111

Configuring User Accounts for vCenter Server, View Composer, and Instant Clones 111

Configuring Horizon Connection Server for the First Time 116

Configuring Horizon Client Connections 129

Replacing Default Ports for Horizon 7 Services 138

Sizing Windows Server Settings to Support Your Deployment 144

VMware, Inc. 4

Page 5

View Installation

Configuring Event Reporting 147

Add a Database and Database User for Horizon 7 Events 147

Prepare an SQL Server Database for Event Reporting 148

Configure the Event Database 149

Configure Event Logging for Syslog Servers 150

VMware, Inc. 5

Page 6

View Installation

View Installation explains how to install the VMware Horizon® 7 server and client components.

Intended Audience

This information is intended for anyone who wants to install VMware Horizon 7. The information is written

for experienced Windows or Linux system administrators who are familiar with virtual machine technology

and datacenter operations.

VMware, Inc. 6

Page 7

System Requirements for Server

Components 1

Hosts that run Horizon 7 server components must meet specific hardware and software requirements.

This section includes the following topics:

Horizon Connection Server Requirements

View Administrator Requirements

View Composer Requirements

Horizon Connection Server Requirements

Horizon Connection Server acts as a broker for client connections by authenticating and then directing

incoming user requests to the appropriate remote desktops and applications. Horizon Connection Server

has specific hardware, operating system, installation, and supporting software requirements.

Hardware Requirements for Horizon Connection Server

You must install all Horizon Connection Server installation types, including standard, replica, security

server, and enrollment server installations, on a dedicated physical or virtual machine that meets

specific hardware requirements.

Supported Operating Systems for Horizon Connection Server

You must install Horizon Connection Server on a supported Windows Server operating system.

Virtualization Software Requirements for Horizon Connection Server

Horizon Connection Server requires certain versions of VMware virtualization software.

Network Requirements for Replicated Horizon Connection Server Instances

When installing replicated Horizon Connection Server instances, you must usually configure the

instances in the same physical location and connect them over a high-performance LAN. Otherwise,

latency issues could cause the View LDAP configurations on Horizon Connection Server instances

to become inconsistent. A user could be denied access when connecting to a Horizon Connection

Server instance with an out-of-date configuration.

VMware, Inc.

Page 8

View Installation

Hardware Requirements for Horizon Connection Server

You must install all Horizon Connection Server installation types, including standard, replica, security

server, and enrollment server installations, on a dedicated physical or virtual machine that meets specific

hardware requirements.

Table 1‑1. Horizon Connection Server Hardware Requirements

Hardware Component Required Recommended

Processor Pentium IV 2.0GHz processor or

higher

Network Adapter 100Mpbs NIC 1Gbps NICs

Memory

Windows Server 2008 R2 64-bit

Memory

Windows Server 2012 R2 64-bit

4GB RAM or higher At least 10GB RAM for deployments of 50 or more

4 CPUs

remote desktops

These requirements also apply to replica and security server Horizon Connection Server instances that

you install for high availability or external access.

Important The physical or virtual machine that hosts Horizon Connection Server must have an IP

address that does not change. In an IPv4 environment, configure a static IP address. In an IPv6

environment, machines automatically get IP addresses that do not change.

Supported Operating Systems for Horizon Connection Server

You must install Horizon Connection Server on a supported Windows Server operating system.

The following operating systems support all Horizon Connection Server installation types, including

standard, replica, and security server installations.

Table 1‑2. Operating System Support for Horizon Connection Server

Operating System Version Edition

Windows Server 2008 R2 SP1 64-bit Standard

Enterprise

Datacenter

Windows Server 2012 R2 64-bit Standard

Datacenter

Windows Server 2016 64-bit Standard

Datacenter

Note Windows Server 2008 R2 with no service pack is no longer supported.

VMware, Inc. 8

Page 9

View Installation

Virtualization Software Requirements for Horizon Connection Server

Horizon Connection Server requires certain versions of VMware virtualization software.

If you are using vSphere, you must use a supported version of vSphere ESX/ESXi hosts and vCenter

Server.

For details about which versions of Horizon are compatible with which versions of vCenter Server and

ESXi, see the VMware Product Interoperability Matrix at

http://www.vmware.com/resources/compatibility/sim/interop_matrix.php.

Network Requirements for Replicated Horizon Connection Server Instances

When installing replicated Horizon Connection Server instances, you must usually configure the instances

in the same physical location and connect them over a high-performance LAN. Otherwise, latency issues

could cause the View LDAP configurations on Horizon Connection Server instances to become

inconsistent. A user could be denied access when connecting to a Horizon Connection Server instance

with an out-of-date configuration.

Important To use a group of replicated Connection Server instances across a WAN, MAN (metropolitan

area network), or other non-LAN, in scenarios where a Horizon deployment needs to span datacenters,

you must use the Cloud Pod Architecture feature. You can link together 25 pods to provide a single large

desktop brokering and management environment for five geographically distant sites and provide

desktops and applications for up to 50,000 sessions. For more information, see the Administering Cloud

Pod Architecture in Horizon 7 document.

View Administrator Requirements

Administrators use View Administrator to configure View Connection Server, deploy and manage remote

desktops and applications, control user authentication, initiate and examine system events, and carry out

analytical activities. Client systems that run View Administrator must meet certain requirements.

View Administrator is a Web-based application that is installed when you install View Connection Server.

You can access and use View Administrator with the following Web browsers:

Internet Explorer 9 (not recommended)

Internet Explorer 10

Internet Explorer 11

Firefox (latest supported versions)

Chrome (latest supported versions)

Safari 6 and later releases

Microsoft Edge (Windows 10)

VMware, Inc. 9

Page 10

View Installation

To use View Administrator with your Web browser, you must install Adobe Flash Player 10.1 or later. Your

client system must have access to the Internet to allow Adobe Flash Player to be installed.

The computer on which you launch View Administrator must trust the root and intermediate certificates of

the server that hosts View Connection Server. The supported browsers already contain certificates for all

of the well-known certificate authorities (CAs). If your certificates come from a CA that is not well known,

you must follow the instructions in Configure Client Endpoints to Trust Root and Intermediate Certificates.

To display text properly, View Administrator requires Microsoft-specific fonts. If your Web browser runs on

a non-Windows operating system such as Linux, UNIX, or Mac, make sure that Microsoft-specific fonts

are installed on your computer.

Currently, the Microsoft Web site does not distribute Microsoft fonts, but you can download them from

independent Web sites.

View Composer Requirements

With View Composer, you can deploy multiple linked-clone desktops from a single centralized base

image. View Composer has specific installation and storage requirements.

Supported Operating Systems for View Composer

View Composer supports 64-bit operating systems with specific requirements and limitations. You

can install View Composer on the same physical or virtual machine as vCenter Server or on a

separate server.

Hardware Requirements for Standalone View Composer

If you install View Composer on a different physical or virtual machine from the one used for

vCenter Server, you must use a dedicated machine that meets specific hardware requirements.

Database Requirements for View Composer and the Events Database

View Composer requires an SQL database to store data. The View Composer database must reside

on, or be available to, the View Composer server host. You can optionally set up an Events

database to record information from View Connection Server about View events.

VMware, Inc. 10

Page 11

View Installation

Supported Operating Systems for View Composer

View Composer supports 64-bit operating systems with specific requirements and limitations. You can

install View Composer on the same physical or virtual machine as vCenter Server or on a separate

server.

Table 1‑3. Operating System Support for View Composer

Operating System Version Edition

Windows Server 2008 R2 SP1 64-bit Standard

Enterprise

Datacenter

Windows Server 2012 R2 64-bit Standard

Datacenter

Windows Server 2016 64-bit Standard

Datacenter

Note Windows Server 2008 R2 with no service pack is no longer supported.

If you plan to install View Composer on a different physical or virtual machine than vCenter Server, see

Hardware Requirements for Standalone View Composer.

Hardware Requirements for Standalone View Composer

If you install View Composer on a different physical or virtual machine from the one used for

vCenter Server, you must use a dedicated machine that meets specific hardware requirements.

A standalone View Composer installation works with vCenter Server installed on a separate Windows

Server machine or with the Linux-based vCenter Server appliance. VMware recommends having a one-

to-one mapping between each View Composer service and vCenter Server instance.

Table 1‑4. View Composer Hardware Requirements

Hardware Component Required Recommended

Processor 1.4 GHz or faster Intel 64 or AMD

64 processor with 2 CPUs

Networking One or more 10/100Mbps network

interface cards (NICs)

Memory 4GB RAM or higher 8GB RAM or higher for deployments of 50 or more

2GHz or faster and 4 CPUs

1Gbps NICs

remote desktops

Disk space 40GB 60GB

Important The physical or virtual machine that hosts View Composer must have an IP address that

does not change. In an IPv4 environment, configure a static IP address. In an IPv6 environment,

machines automatically get IP addresses that do not change.

VMware, Inc. 11

Page 12

View Installation

Database Requirements for View Composer and the Events Database

View Composer requires an SQL database to store data. The View Composer database must reside on,

or be available to, the View Composer server host. You can optionally set up an Events database to

record information from View Connection Server about View events.

If a database server instance already exists for vCenter Server, View Composer can use that existing

instance if it is a version listed in the VMware Product Interoperability Matrixes at

http://www.vmware.com/resources/compatibility/sim/interop_matrix.php. If a database server instance

does not already exist, you must install one.

View Composer supports a subset of the database servers that vCenter Server supports. If you are

already using vCenter Server with a database server that is not supported by View Composer, continue to

use that database server for vCenter Server and install a separate database server to use for View

Composer.

Important If you create the View Composer database on the same SQL Server instance as

vCenter Server, do not overwrite the vCenter Server database.

For the most up-to-date information about supported databases, see the VMware Product Interoperability

Matrixes at http://www.vmware.com/resources/compatibility/sim/interop_matrix.php. For

Solution/Database Interoperability, after you select the product and version, for the Add Database step,

to see a list of all supported databases, select Any and click Add.

VMware, Inc. 12

Page 13

System Requirements for Guest

Operating Systems 2

Systems running Horizon Agent or Standalone View Persona Management must meet certain hardware

and software requirements.

This section includes the following topics:

Supported Operating Systems for Horizon Agent

Supported Operating Systems for Standalone Horizon Persona Management

Remote Display Protocol and Software Support

Supported Operating Systems for Horizon Agent

The Horizon Agent component (called View Agent in previous releases) assists with session

management, single sign-on, device redirection, and other features. You must install Horizon Agent on all

virtual machines, physical systems, and RDS hosts.

The types and editions of the supported guest operating system depend on the Windows version. For

updates to the list of supported Windows 10 operating systems, see the VMware Knowledge Base (KB)

article http://kb.vmware.com/kb/2149393. For Windows operating systems other than Windows 10, see

the VMware Knowledge Base (KB) article http://kb.vmware.com/kb/2150295.

To see a list of specific remote experience features supported on Windows operating systems where

Horizon Agent is installed, see the VMware Knowledge Base (KB) article

http://kb.vmware.com/kb/2150305.

To use the Horizon Persona Management setup option with Horizon Agent, you must install Horizon

Agent on Windows 10, Windows 8, Windows 8.1, Windows 7, Windows Server 2012 R2, Windows Server

2008 R2, or Windows Server 2016 virtual machines. This option does not operate on physical computers

or RDS hosts.

You can install the standalone version of Horizon Persona Management on physical computers. See

Supported Operating Systems for Standalone Horizon Persona Management.

Note To use the VMware Blast display protocol, you must install Horizon Agent on a single-session

virtual machine or on an RDS host. The RDS host can be a physical machine or a virtual machine. The

VMware Blast display protocol does not operate on a single-user physical computer.

VMware, Inc.

Page 14

View Installation

For enhanced security, VMware recommends configuring cipher suites to remove known vulnerabilities.

For instructions on how to set up a domain policy on cipher suites for Windows machines that run View

Composer or Horizon Agent, see Disable Weak Ciphers in SSL/TLS.

Supported Operating Systems for Standalone Horizon Persona Management

The standalone Horizon Persona Management software provides persona management for standalone

physical computers and virtual machines that do not have Horizon Agent installed. When users log in,

their profiles are downloaded dynamically from a remote profile repository to their standalone systems.

Note To configure Persona Management for Horizon desktops, install Horizon Agent with the Persona

Management setup option. The standalone Persona Management software is intended for non-Horizon

systems only.

To see a list of operating systems supported for the standalone Horizon Persona Management software,

see the VMware Knowledge Base (KB) article http://kb.vmware.com/kb/2150295.

The standalone Persona Management software is not supported on Microsoft Remote Desktop Services.

Remote Display Protocol and Software Support

Remote display protocols and software provide access to remote desktops and applications. The remote

display protocol used depends on the type of client device, whether you are connecting to a remote

desktop or a remote application, and how the administrator configures the desktop or application pool.

PCoIP

PCoIP (PC over IP) provides an optimized desktop experience for the delivery of a remote

application or an entire remote desktop environment, including applications, images, audio, and

video content for a wide range of users on the LAN or across the WAN. PCoIP can compensate for

an increase in latency or a reduction in bandwidth, to ensure that end users can remain productive

regardless of network conditions.

Microsoft RDP

Remote Desktop Protocol is the same multichannel protocol many people already use to access

their work computer from their home computer. Microsoft Remote Desktop Connection (RDC) uses

RDP to transmit data.

VMware Blast Extreme

Optimized for the mobile cloud, VMware Blast Extreme supports the broadest range of client devices

that are H.264 capable. Of the display protocols, VMware Blast offers the lowest CPU consumption

for longer battery life on mobile devices. VMware Blast Extreme can compensate for an increase in

latency or a reduction in bandwidth and can leverage both TCP and UDP network transports.

VMware, Inc. 14

Page 15

View Installation

PCoIP

PCoIP (PC over IP) provides an optimized desktop experience for the delivery of a remote application or

an entire remote desktop environment, including applications, images, audio, and video content for a wide

range of users on the LAN or across the WAN. PCoIP can compensate for an increase in latency or a

reduction in bandwidth, to ensure that end users can remain productive regardless of network conditions.

The PCoIP display protocol can be used for remote applications and for remote desktops that use virtual

machines, physical machines that contain Teradici host cards, or shared session desktops on an RDS

host.

PCoIP Features

Key features of PCoIP include the following:

Users outside the corporate firewall can use this protocol with your company's virtual private network

(VPN), or users can make secure, encrypted connections to a security server or Access Point

appliance in the corporate DMZ.

Advanced Encryption Standard (AES) 128-bit encryption is supported and is turned on by default. You

can, however, change the encryption key cipher to AES-256.

Connections to Windows desktops with the Horizon Agent operating system versions listed in

Supported Operating Systems for Horizon Agent are supported.

Connections from all types of client devices.

Optimization controls for reducing bandwidth usage on the LAN and WAN.

32-bit color is supported for virtual displays.

ClearType fonts are supported.

Audio redirection with dynamic audio quality adjustment for LAN and WAN.

Real-Time Audio-Video for using webcams and microphones on some client types.

Copy and paste of text and, on some clients, images between the client operating system and a

remote application or desktop. For other client types, only copy and paste of plain text is supported.

You cannot copy and paste system objects such as folders and files between systems.

Multiple monitors are supported for some client types. On some clients, you can use up to 4 monitors

with a resolution of up to 2560 x 1600 per display or up to 3 monitors with a resolution of 4K (3840 x

2160) for Windows 7 remote desktops with Aero disabled. Pivot display and autofit are also

supported.

When the 3D feature is enabled, up to 2 monitors are supported with a resolution of up to 1920 x

1200, or one monitor with a resolution of 4K (3840 x 2160).

USB redirection is supported for some client types.

MMR redirection is supported for some Windows client operating systems and some remote desktop

operating systems (with Horizon Agent installed).

VMware, Inc. 15

Page 16

View Installation

For information about which desktop operating systems support specific PCoIP features, see "Feature

Support Matrix for Horizon Agent" in the View Architecture Planning document.

For information about which client devices support specific PCoIP features, go to

https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.

Recommended Guest Operating System Settings

1GB of RAM or more and a dual CPU is recommended for playing in high-definition, full screen mode, or

720p or higher formatted video. To use Virtual Dedicated Graphics Acceleration for graphics-intensive

applications such as CAD applications, 4GB of RAM is required.

Video Quality Requirements

480p-formatted video You can play video at 480p or lower at native resolutions when the remote

desktop has a single virtual CPU. If you want to play the video in high-

definition Flash or in full screen mode, the desktop requires a dual virtual

CPU. Even with a dual virtual CPU desktop, as low as 360p-formatted

video played in full screen mode can lag behind audio, particularly on

Windows clients.

720p-formatted video You can play video at 720p at native resolutions if the remote desktop has a

dual virtual CPU. Performance might be affected if you play videos at 720p

in high definition or in full screen mode.

1080p-formatted video If the remote desktop has a dual virtual CPU, you can play 1080p formatted

video, although the media player might need to be adjusted to a smaller

window size.

3D rendering You can configure remote desktops to use software- or hardware-

accelerated graphics. The software-accelerated graphics feature enables

you to run DirectX 9 and OpenGL 2.1 applications without requiring a

physical graphics processing unit (GPU). The hardware-accelerated

graphics features enable virtual machines to either share the physical

GPUs (graphical processing unit) on a vSphere host or dedicate a physical

GPU to a single virtual machine desktop.

For 3D applications, up to 2 monitors are supported, and the maximum

screen resolution is 1920 x 1200. The guest operating system on the

remote desktops must be Windows 7 or later.

Hardware Requirements for Client Systems

For information about processor and memory requirements, see the "Using VMware Horizon Client"

document for the specific type of desktop or mobile client device. Go to

https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.

VMware, Inc. 16

Page 17

View Installation

Microsoft RDP

Remote Desktop Protocol is the same multichannel protocol many people already use to access their

work computer from their home computer. Microsoft Remote Desktop Connection (RDC) uses RDP to

transmit data.

Microsoft RDP is a supported display protocol for remote desktops that use virtual machines, physical

machines, or shared session desktops on an RDS host. (Only the PCoIP display protocol and the

VMware Blast display protocol are supported for remote applications.) Microsoft RDP provides the

following features:

RDP 7 has true multiple monitor support, for up to 16 monitors.

You can copy and paste text and system objects such as folders and files between the local system

and the remote desktop.

32-bit color is supported for virtual displays.

RDP supports 128-bit encryption.

Users outside the corporate firewall can use this protocol with your company's virtual private network

(VPN), or users can make secure, encrypted connections to a View security server in the corporate

DMZ.

To support TLSv1.1 and TLSv1.2 connections to Windows 7 and Windows Server 2008 R2, you must

apply Microsoft hotfix KB3080079.

Hardware Requirements for Client Systems

For information about processor and memory requirements, see the "Using VMware Horizon Client"

document for the specific type of client system. Go to

https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.

Note Mobile client 3.x devices use only the PCoIP display protocol. Mobile client 4.x clients use only the

PCoIP display protocol or the VMware Blast display protocol.

VMware Blast Extreme

Optimized for the mobile cloud, VMware Blast Extreme supports the broadest range of client devices that

are H.264 capable. Of the display protocols, VMware Blast offers the lowest CPU consumption for longer

battery life on mobile devices. VMware Blast Extreme can compensate for an increase in latency or a

reduction in bandwidth and can leverage both TCP and UDP network transports.

The VMware Blast display protocol can be used for remote applications and for remote desktops that use

virtual machines or shared-session desktops on an RDS host. The RDS host can be a physical machine

or a virtual machine. The VMware Blast display protocol does not operate on a single-user physical

computer.

VMware, Inc. 17

Page 18

View Installation

VMware Blast Extreme Features

Key features of VMware Blast Extreme include the following:

Users outside the corporate firewall can use this protocol with the corporate virtual private network

(VPN), or users can make secure, encrypted connections to a security server or Access Point

appliance in the corporate DMZ.

Advanced Encryption Standard (AES) 128-bit encryption is supported and is turned on by default. You

can, however, change the encryption key cipher to AES-256.

Connections to Windows desktops with the Horizon Agent operating system versions listed in

Supported Operating Systems for Horizon Agent are supported.

Connections from all types of client devices.

Optimization controls for reducing bandwidth usage on the LAN and WAN.

Performance counters displayed using PerfMon on Windows agents for Blast session, imaging,

audio, CDR, USB, and virtual printing provide an accurate representation of the current state of the

system that also updates at a constant rate.

Network continuity during momentary network loss on Windows clients.

32-bit color is supported for virtual displays.

ClearType fonts are supported.

Audio redirection with dynamic audio quality adjustment for LAN and WAN.

Real-Time Audio-Video for using webcams and microphones on some client types.

Copy and paste of text and, on some clients, images between the client operating system and a

remote application or desktop. For other client types, only copy and paste of plain text is supported.

You cannot copy and paste system objects such as folders and files between systems.

Multiple monitors are supported for some client types. On some clients, you can use up to four

monitors with a resolution of up to 2560 x 1600 per display or up to three monitors with a resolution of

4K (3840 x 2160) for Windows 7 remote desktops with Aero disabled. Pivot display and autofit are

also supported.

When the 3D feature is enabled, up to two monitors are supported with a resolution of up to 1920 x

1200, or one monitor with a resolution of 4K (3840 x 2160).

USB redirection is supported for some client types.

MMR redirection is supported for some Windows client operating systems and some remote desktop

operating systems (with Horizon Agent installed).

Connections to physical machines that have no monitors attached are supported with NVIDIA

graphics cards. For best performance, use a graphics card that supports H.264 encoding. This is a

technical preview feature for Horizon 7 version 7.1.

VMware, Inc. 18

Page 19

View Installation

If you have an add-in discrete GPU and an embedded GPU, the operating system might default to the

embedded GPU. To fix this problem, you can disable or remove the device in Device Manager. If the

problem persists, you can install the WDDM graphics driver for the embedded GPU, or disable the

embedded GPU in the system BIOS. Refer to your system documentation on how disable the

embedded GPU.

Caution Disabling the embedded GPU might cause future loss of access to functionality such as

console access to BIOS setup or NT Boot Loader.

For information about which client devices support specific VMware Blast Extreme features, go to

https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.

Recommended Guest Operating System Settings

1 GB of RAM or more and a dual CPU is recommended for playing in high-definition, full screen mode, or

720p or higher formatted video. To use Virtual Dedicated Graphics Acceleration for graphics-intensive

applications such as CAD applications, 4 GB of RAM is required.

Video Quality Requirements

480p-formatted video You can play video at 480p or lower at native resolutions when the remote

desktop has a single virtual CPU. If you want to play the video in high-

definition Flash or in full screen mode, the desktop requires a dual virtual

CPU. Even with a dual virtual CPU desktop, as low as 360p-formatted

video played in full screen mode can lag behind audio, particularly on

Windows clients.

720p-formatted video You can play video at 720p at native resolutions if the remote desktop has a

dual virtual CPU. Performance might be affected if you play videos at 720p

in high definition or in full screen mode.

1080p-formatted video If the remote desktop has a dual virtual CPU, you can play 1080p formatted

video, although the media player might need to be adjusted to a smaller

window size.

3D rendering You can configure remote desktops to use software- or hardware-

accelerated graphics. The software-accelerated graphics feature enables

you to run DirectX 9 and OpenGL 2.1 applications without requiring a

physical graphics processing unit (GPU). The hardware-accelerated

graphics features enable virtual machines to either share the physical

GPUs (graphical processing unit) on a vSphere host or dedicate a physical

GPU to a single virtual desktop.

For 3D applications, up to two monitors are supported, and the maximum

screen resolution is 1920 x 1200. The guest operating system on the

remote desktops must be Windows 7 or later.

VMware, Inc. 19

Page 20

View Installation

Hardware Requirements for Client Systems

For information about processor and memory requirements, see the "Using VMware Horizon Client"

document for the specific type of desktop or mobile client device. Go to

https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.

VMware, Inc. 20

Page 21

Installing Horizon 7 in an IPv6

Environment 3

Horizon 7 supports IPv6 as an alternative to IPv4. The environment must be either IPv6 only or IPv4 only.

Horizon 7 does not support a mixed IPv6 and IPv4 environment.

Not all Horizon 7 features that are supported in an IPv4 environment are supported in an IPv6

environment. Horizon 7 does not support upgrading from an IPv4 environment to an IPv6 environment.

Also, Horizon 7 does not support migration between IPv4 and IPv6 environments.

Important To run Horizon 7 in an IPv6 environment, you must specify IPv6 when you install all Horizon 7

components.

This section includes the following topics:

Setting Up Horizon 7 in an IPv6 Environment

Supported vSphere, Database, and Active Directory Versions in an IPv6 Environment

Supported Operating Systems for Horizon 7 Servers in an IPv6 Environment

Supported Windows Operating Systems for Desktops and RDS Hosts in an IPv6 Environment

Supported Clients in an IPv6 Environment

Supported Remoting Protocols in an IPv6 Environment

Supported Authentication Types in an IPv6 Environment

Other Supported Features in an IPv6 Environment

Setting Up Horizon 7 in an IPv6 Environment

To run Horizon 7 in an IPv6 environment, you must be aware of the requirements and choices that are

specific to IPv6 when you perform certain administrative tasks.

Before you install Horizon 7, you must have a working IPv6 environment. The following Horizon 7

administrative tasks have options that are specific to IPv6.

Installing Horizon Connection Server. See Install Horizon Connection Server with a New

Configuration.

Installing View Replica Server. See Install a Replicated Instance of Horizon Connection Server.

Installing View Security Server. See Install a Security Server.

VMware, Inc.

Page 22

View Installation

Configuring the PCoIP External URL. See Configuring External URLs for Secure Gateway and Tunnel

Connections.

Setting the PCoIP External URL. See Set the External URLs for an Horizon Connection Server

Instance.

Modifying the PCoIP External URL. See Set the External URLs for an Horizon Connection Server

Instance.

Installing Horizon Agent. See the Horizon Agent installation topics in the Setting Up Desktop and

Application Pools document.

Installing Horizon Client for Windows. See the VMware Horizon Client for Windows document in

https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html. Only Windows clients are

supported.

Note Horizon 7 does not require you to enter an IPv6 address in any administrative tasks. In cases

where you can specify either a fully qualified domain name (FQDN) or an IPv6 address, it is highly

recommended that you specify an FQDN to avoid potential errors.

Supported vSphere, Database, and Active Directory Versions in an IPv6 Environment

In an IPv6 environment, Horizon 7 supports specific vSphere, database server, and Active Directory

versions.

The following vSphere versions are supported in an IPv6 environment.

6.5

6.0

5.5 U2

The following database servers are supported in an IPv6 environment.

Database Server Version Edition

SQL Server 2014 SP2 32/64-bit Standard, Enterprise

SQL Server 2012 SP1 32/64-bit Standard, Enterprise

SQL Server 2012 Express 32/64-bit Free

Oracle 11g R2 32/64-bit Standard, Standard Edition One, Enterprise

The following Active Directory versions are supported in an IPv6 environment.

Microsoft Active Directory 2008 R2

Microsoft Active Directory 2012 R2

VMware, Inc. 22

Page 23

View Installation

Supported Operating Systems for Horizon 7 Servers in an IPv6 Environment

In an IPv6 environment, you must install Horizon 7 servers on specific Windows Server operating

systems.

Horizon 7 servers include Connection Server instances, replica servers, security servers, and View

Composer instances.

Operating System Edition

Windows Server 2016 Standard, Enterprise

Windows Server 2008 R2 SP1 Standard, Enterprise

Windows Server 2012 R2 Standard

Supported Windows Operating Systems for Desktops and RDS Hosts in an IPv6 Environment

In an IPv6 environment, Horizon 7 supports specific Windows operating systems for desktop machines

and RDS hosts. RDS hosts provide session-based desktops and applications to users.

The types and editions of the supported guest operating system depend on the Windows version. For

updates to the list of supported Windows 10 operating systems, see the VMware Knowledge Base (KB)

article http://kb.vmware.com/kb/2149393. For Windows operating systems other than Windows 10, see

the VMware Knowledge Base (KB) article http://kb.vmware.com/kb/2150295.

To see a list of specific remote experience features supported on Windows operating systems where

Horizon Agent is installed, see the VMware Knowledge Base (KB) article

http://kb.vmware.com/kb/2150305.

Supported Clients in an IPv6 Environment

In an IPv6 environment, Horizon 7 supports clients that run on specific desktop operating systems.

Table 3‑1. Supported Windows Operating Systems

Operating System Version Edition

Windows 7 32/64-bit Home, Professional, Enterprise, Ultimate

Windows 7 SP1 32/64-bit Home, Professional, Enterprise, Ultimate

Windows 8 32/64-bit Enterprise, Professional

Windows 8.1 32/64-bit Enterprise, Professional

Windows 10 32/64-bit Enterprise, Professional

On iOS devices, iOS 9.2 or later is supported with Horizon Client 4.1 or later.

VMware, Inc. 23

Page 24

View Installation

The following types of clients are not supported.

Clients that run on Mac, Android, Linux, or Windows Store

iOS 9.1 or earlier

PCoIP Zero Client

Supported Remoting Protocols in an IPv6 Environment

In an IPv6 environment, Horizon 7 supports specific remoting protocols.

The following remoting protocols are supported:

RDP

RDP with Secure Tunnel

PCoIP

PCoIP through PCoIP Secure Gateway

VMware Blast

VMware Blast through Blast Secure Gateway

Supported Authentication Types in an IPv6 Environment

In an IPv6 environment, Horizon 7 supports specific authentication types.

The following authentication types are supported:

Password authentication using Active Directory

Smart Card

Single Sign-On

The following authentication types are not supported:

SecurID

RADIUS

SAML

Other Supported Features in an IPv6 Environment

In an IPv6 environment, Horizon 7 supports certain features that are not covered in previous topics.

The following features are supported:

Application pools

Audio-out

VMware, Inc. 24

Page 25

View Installation

Automated desktop pools of full virtual machines or View Composer linked clones

Note Automated desktop pools of instant clones are not supported.

Customer Experience Improvement Program (CEIP)

Disk space reclamation

Events

LDAP backup

Manual desktop pools, including vCenter Server virtual machines, physical computers, and virtual

machines not managed by vCenter Server

Native NFS snapshots (VAAI)

PCoIP

PCoIP smart card

Persona Management

PSG

RDS desktop pools

RDS Host 3D

Role-based administration

Single Sign-on, including the Log in as current user feature

System health dashboard

ThinApp

Unity touch

USB

USB redirection

View Composer Agent

View Storage Accelerator

View Composer database backup

Virtual printing

VMware audio

VMware video

The following features are not supported:

Blast UDP

Client drive redirection

VMware, Inc. 25

Page 26

View Installation

Client IP Transparency (only 64-bit)

Cloud Pod Architecture

Flash URL redirection

HTML access

Log Insight

Lync

Multimedia redirection (MMR)

Real-time audio-video (RTAV)

Scanner redirection

Serial port redirection

Syslog

Teradici TERA host card

TSMMR

Virtual SAN

Virtual Volumes

vRealize Operations Desktop Agent

VMware, Inc. 26

Page 27

Installing Horizon 7 in FIPS

Mode 4

Horizon 7 can perform cryptographic operations using FIPS (Federal Information Processing Standard)

140-2 compliant algorithms. You can enable the use of these algorithms by installing Horizon 7 in FIPS

mode.

Not all Horizon 7 features are supported in FIPS mode. Also, Horizon 7 does not support upgrading from

a non-FIPS installation to a FIPS installation.

Note To ensure that Horizon 7 runs in FIPS mode, you must enable FIPS when you install all Horizon 7

components.

This section includes the following topics:

Overview of Setting Up Horizon 7 in FIPS Mode

System Requirements for FIPS Mode

Overview of Setting Up Horizon 7 in FIPS Mode

To set up Horizon 7 in FIPS mode, you must first enable FIPS mode in the Windows environment. Then

you install all the Horizon 7 components in FIPS mode.

The option to install Horizon 7 in FIPS mode is available only if FIPS mode is enabled in the Windows

environment. For more information about enabling FIPS mode in Windows, see

https://support.microsoft.com/en-us/kb/811833.

Note Horizon Administrator does not indicate whether Horizon 7 is running in FIPS mode.

To install Horizon 7 in FIPS mode, perform the following administrative tasks.

When installing Connection Server, select the FIPS mode option. See Install Horizon Connection

Server with a New Configuration.

When installing View Replica Server, select the FIPS mode option. See Install a Replicated Instance

of Horizon Connection Server.

Before installing a security server, deselect the global setting Use IPSec for Security Server

Connections in Horizon Administrator and configure IPsec manually. See

http://kb.vmware.com/kb/2000175.

VMware, Inc.

Page 28

View Installation

When installing View Security Server, select the FIPS mode option. See Install a Security Server.

Disable weak ciphers for View Composer and Horizon Agent machines. See Disable Weak Ciphers in

SSL/TLS.

When installing View Composer, select the FIPS mode option. See Chapter 6 Installing View

Composer.

When installing Horizon Agent, select the FIPS mode option. See the Horizon Agent installation

topics in the Setting Up Virtual Desktops in Horizon 7 or Setting Up Published Desktops and

Applications in Horizon 7 document.

For Windows clients, enable FIPS mode in the client operating system and select the FIPS mode

option when installing Horizon Client for Windows. See the VMware Horizon Client for Windows

Installation and Setup Guide document.

For Linux clients, enable FIPS mode in the client operating system. See the VMware Horizon Client

for Linux Installation and Setup Guide document.

System Requirements for FIPS Mode

To support FIPS mode, your Horizon 7 deployment must meet the following requirements.

vSphere

Remote desktop

vCenter Server 6.0 or later

ESXi 6.0 or later

Any Windows platform that has a FIPS certificate. For information, see

"FIPS 140 Validation" on the Microsoft TechNet website.

View Agent 6.2 or later or Horizon Agent 7.0 or later, for Windows

platforms only

Horizon Client

Any Windows platform that has a FIPS certificate. For information, see

"FIPS 140 Validation" on the Microsoft TechNet website.

Horizon Client for Windows 3.5 or later

Cryptographic protocol

TLSv1.2

VMware, Inc. 28

Page 29

Preparing Active Directory 5

Horizon 7 uses your existing Microsoft Active Directory infrastructure for user authentication and

management. You must perform certain tasks to prepare Active Directory for use with Horizon 7.

Horizon 7 supports the following Active Directory Domain Services (AD DS) domain functional levels:

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

This section includes the following topics:

Configuring Domains and Trust Relationships

Creating an OU for Remote Desktops

Creating OUs and Groups for Kiosk Mode Client Accounts

Creating Groups for Users

Creating a User Account for vCenter Server

Creating a User Account for a Standalone View Composer Server

Create a User Account for View Composer AD Operations

Create a User Account for Instant-Clone Operations

Configure the Restricted Groups Policy

Using Horizon 7 Group Policy Administrative Template Files

Prepare Active Directory for Smart Card Authentication

Disable Weak Ciphers in SSL/TLS

VMware, Inc.

Page 30

View Installation

Conﬁguring Domains and Trust Relationships

You must join each Connection Server host to an Active Directory domain. The host must not be a

domain controller.

Active Directory also manages the Horizon Agent machines, including single-user machines and RDS

hosts, and the users and groups in your Horizon 7 deployment. You can entitle users and groups to

remote desktops and applications, and you can select users and groups to be administrators in View

Administrator.

You can place Horizon Agent machines, View Composer servers, and users and groups, in the following

Active Directory domains:

The Connection Server domain

A different domain that has a two-way trust relationship with the Connection Server domain

A domain in a different forest than the Connection Server domain that is trusted by the Connection

Server domain in a one-way external or realm trust relationship

A domain in a different forest than the Connection Server domain that is trusted by the Connection

Server domain in a one-way or two-way transitive forest trust relationship

Users are authenticated using Active Directory against the Connection Server domain and any additional

user domains with which a trust agreement exists.

If your users and groups are in one-way trusted domains, you must provide secondary credentials for the

administrator users in Horizon Administrator. Administrators must have secondary credentials to give

them access to the one-way trusted domains. A one-way trusted domain can be an external domain or a

domain in a transitive forest trust.

Secondary credentials are required only for Horizon Administrator sessions, not for end users' desktop or

application sessions. Only administrator users require secondary credentials.

You can provide secondary credentials by using the vdmadmin -T command.

You configure secondary credentials for individual administrator users.

For a forest trust, you can configure secondary credentials for the forest root domain. Connection

Server can then enumerate the child domains in the forest trust.

For details, see "Providing Secondary Credentials for Administrators Using the -T Option" in the View

Administration document.

Note Because security servers do not access any authentication repositories, including Active Directory,

they do not need to reside in an Active Directory domain.

VMware, Inc. 30

Page 31

View Installation

Trust Relationships and Domain Filtering

To determine which domains it can access, a Connection Server instance traverses trust relationships

beginning with its own domain.

For a small, well-connected set of domains, Connection Server can quickly determine the full list of

domains, but the time that it takes increases as the number of domains increases or as the connectivity

between the domains decreases. The list might also include domains that you would prefer not to offer to

users when they connect to their remote desktops and applications.

You can use the vdmadmin command to configure domain filtering to limit the domains that a Connection

Server instance searches and that it displays to users. See the View Administration document for more

information.

If a forest trust is configured with name suffix exclusions, the configured exclusions are used to filter the

list of forest child domains. Name suffix exclusion filtering is applied in addition to the filtering that is

specified with the vdmadmin command.

Creating an OU for Remote Desktops

You should create an organizational unit (OU) specifically for your remote desktops. An OU is a

subdivision in Active Directory that contains users, groups, computers, or other OUs.

To prevent group policy settings from being applied to other Windows servers or workstations in the same

domain as your desktops, you can create a GPO for your Horizon 7 group policies and link it to the OU

that contains your remote desktops. You can also delegate control of the OU to subordinate groups, such

as server operators or individual users.

If you use View Composer, you should create a separate Active Directory container for linked-clone

desktops that is based on the OU for your remote desktops. Administrators that have OU administrator

privileges in Active Directory can provision linked-clone desktops without domain administrator privileges.

If you change administrator credentials in Active Directory, you must also update the credential

information in View Composer.

Creating OUs and Groups for Kiosk Mode Client Accounts

A client in kiosk mode is a thin client or a locked-down PC that runs the client software to connect to a

Connection Server instance and launch a remote desktop session. If you configure clients in kiosk mode,

you should create dedicated OUs and groups in Active Directory for kiosk mode client accounts.

Creating dedicated OUs and groups for kiosk mode client accounts partitions client systems against

unwarranted intrusion and simplifies client configuration and administration.

See the View Administration document for more information.

VMware, Inc. 31

Page 32

View Installation

Creating Groups for Users

You should create groups for different types of users in Active Directory. For example, you can create a

group called Horizon 7 Users for your end users and another group called Horizon 7 Administrators for

users that will administer remote desktops and applications.

Creating a User Account for vCenter Server

You must create a user account in Active Directory to use with vCenter Server. You specify this user

account when you add a vCenter Server instance in Horizon Administrator.

You must give the user account privileges to perform certain operations in vCenter Server. You can create

a vCenter Server role with the appropriate privileges and assign the role to the vCenter Server user. The

list of privileges you add to the vCenter Server role varies, depending on whether you use Horizon 7 with

or without View Composer. See Configuring User Accounts for vCenter Server, View Composer, and

Instant Clones for information on configuring these privileges.

If you install View Composer on the same machine as vCenter Server, you must add the vCenter Server

user to the local Administrators group on the vCenter Server machine. This requirement allows View to

authenticate to the View Composer service.

If you install View Composer on a different machine than vCenter Server, you do not have to make the

vCenter Server user a local administrator on the vCenter Server machine. However, you do have to

create a standalone View Composer Server user account that must be a local administrator on the View

Composer machine.

Creating a User Account for a Standalone View Composer Server

If you install View Composer on a different machine than vCenter Server, you must create a domain user

account in Active Directory that Horizon 7 can use to authenticate to the View Composer service on the

standalone machine.

The user account must be in the same domain as your Connection Server host or in a trusted domain.

You must add the user account to the local Administrators group on the standalone View Composer

machine.

You specify this user account when you configure View Composer settings in Horizon Administrator and

select Standalone View Composer Server. See Configure View Composer Settings.

VMware, Inc. 32

Page 33

View Installation

Create a User Account for View Composer AD Operations

If you use View Composer, you must create a user account in Active Directory that allows View Composer

to perform certain operations in Active Directory. View Composer requires this account to join linked-clone

virtual machines to your Active Directory domain.

To ensure security, you should create a separate user account to use with View Composer. By creating a

separate account, you can guarantee that it does not have additional privileges that are defined for

another purpose. You can give the account the minimum privileges that it needs to create and remove

computer objects in a specified Active Directory container. For example, the View Composer account

does not require domain administrator privileges.

Procedure

1 In Active Directory, create a user account in the same domain as your Connection Server host or in a

trusted domain.

2 Add the Create Computer Objects, Delete Computer Objects, and Write All Properties

permissions to the account in the Active Directory container in which the linked-clone computer

accounts are created or to which the linked-clone computer accounts are moved.

The following list shows all the required permissions for the user account, including permissions that

are assigned by default:

List Contents

Read All Properties

Write All Properties

Read Permissions

Reset Password

Create Computer Objects

Delete Computer Objects

Note Fewer permissions are required if you select the Allow reuse of pre-existing computer

accounts setting for a desktop pool. Make sure that the following permissions are assigned to the

user account:

List Contents

Read All Properties

Read Permissions

Reset Password

3 Make sure that the user account's permissions apply to the Active Directory container and to all child

objects of the container.

VMware, Inc. 33

Page 34

View Installation

What to do next

Specify the account in Horizon Administrator when you configure View Composer domains in the Add

vCenter Server wizard and when you configure and deploy linked-clone desktop pools.

Create a User Account for Instant-Clone Operations

Before you deploy instant clones, you must create a user account that has the permission to perform

certain operations in Active Directory.

Select this account when you add an instant-clone domain administrator before deploying instant-clone

desktop pools. For more information, see "Add an Instant-Clone Domain Administrator" in the Setting Up

Virtual Desktops in Horizon 7 document.

Procedure

1 In Active Directory, create a user account in the same domain as the Connection Server or in a

trusted domain.

2 Add the Create Computer Objects, Delete Computer Objects, and Write All Properties

permissions to the account on the container for the instant-clone computer accounts.

The following list shows the required permissions for the user account, including permissions that are

assigned by default:

List Contents

Read All Properties

Write All Properties

Read Permissions

Reset Password

Create Computer Objects

Delete Computer Objects

Make sure that the permissions apply to the correct container and to all child objects of the container.

Conﬁgure the Restricted Groups Policy

To be able to connect to a remote desktop, users must belong to the local Remote Desktop Users group

of the remote desktop. You can use the Restricted Groups policy in Active Directory to add users or

groups to the local Remote Desktop Users group of every remote desktop that is joined to your domain.

The Restricted Groups policy sets the local group membership of computers in the domain to match the

membership list settings defined in the Restricted Groups policy. The members of your remote desktop

users group are always added to the local Remote Desktop Users group of every remote desktop that is

joined to your domain. When adding new users, you need only add them to your remote desktop users

group.

VMware, Inc. 34

Page 35

View Installation

Prerequisites

Create a group for remote desktop users in your domain in Active Directory.

Procedure

1 On the Active Directory server, navigate to the Group Policy Management plug-in.

AD Version Navigation Path

Windows 2003 a Select Start > All Programs > Administrative Tools > Active Directory

Users and Computers.

b Right-click your domain and click Properties.

c On the Group Policy tab, click Open to open the Group Policy Management

plug-in.

d Right-click Default Domain Policy, and click Edit.

Windows 2008 a Select Start > Administrative Tools > Group Policy Management.

b Expand your domain, right-click Default Domain Policy, and click Edit.

Windows 2012R2 a Select Start > Administrative Tools > Group Policy Management.

b Expand your domain, right-click Default Domain Policy, and click Edit.

Windows 2016 a Select Start > Administrative Tools > Group Policy Management.

b Expand your domain, right-click Default Domain Policy, and click Edit.

2 Expand the Computer Configuration section and open Windows Settings\Security Settings.

3 Right-click Restricted Groups, select Add Group, and add the Remote Desktop Users group.

4 Right-click the new restricted Remote Desktop Users group and add your remote desktop users

group to the group membership list.

5 Click OK to save your changes.

Using Horizon 7 Group Policy Administrative Template Files

Horizon 7 includes several component-specific group policy administrative (ADMX) template files.

All ADMX files that provide group policy settings for Horizon 7 are available in a bundled .zip file named

VMware-Horizon-Extras-Bundle-x.x.x-yyyyyyy.zip, where x.x.x is the version and yyyyyyy is the

build number. You can download the file from the VMware download site at

https://my.vmware.com/web/vmware/downloads. Under Desktop & End-User Computing, select the

VMware Horizon 7 download, which includes the bundled .zip file.

You can optimize and secure remote desktops by adding the policy settings in these files to a new or

existing GPO in Active Directory and then linking that GPO to the OU that contains your desktops.

See the View Administration and Configuring Remote Desktop Features in Horizon 7 documents for

information on using Horizon 7 group policy settings.

VMware, Inc. 35

Page 36

View Installation

Prepare Active Directory for Smart Card Authentication

You might need to perform certain tasks in Active Directory when you implement smart card

authentication.

Add UPNs for Smart Card Users

Because smart card logins rely on user principal names (UPNs), the Active Directory accounts of

users and administrators that use smart cards to authenticate in Horizon 7 must have a valid UPN.

Add the Root Certificate to Trusted Root Certification Authorities

If you use a certification authority (CA) to issue smart card login or domain controller certificates, you

must add the root certificate to the Trusted Root Certification Authorities group policy in Active

Directory. You do not need to perform this procedure if the Windows domain controller acts as the

root CA.

Add an Intermediate Certificate to Intermediate Certification Authorities

If you use an intermediate certification authority (CA) to issue smart card login or domain controller

certificates, you must add the intermediate certificate to the Intermediate Certification Authorities

group policy in Active Directory.

Add the Root Certificate to the Enterprise NTAuth Store

If you use a CA to issue smart card login or domain controller certificates, you must add the root

certificate to the Enterprise NTAuth store in Active Directory. You do not need to perform this

procedure if the Windows domain controller acts as the root CA.

Add UPNs for Smart Card Users

Because smart card logins rely on user principal names (UPNs), the Active Directory accounts of users

and administrators that use smart cards to authenticate in Horizon 7 must have a valid UPN.

If the domain a smart card user resides in is different from the domain that your root certificate was issued

from, you must set the user’s UPN to the Subject Alternative Name (SAN) contained in the root certificate

of the trusted CA. If your root certificate was issued from a server in the smart card user's current domain,

you do not need to modify the user's UPN.

Note You might need to set the UPN for built-in Active Directory accounts, even if the certificate is

issued from the same domain. Built-in accounts, including Administrator, do not have a UPN set by

default.

Prerequisites

Obtain the SAN contained in the root certificate of the trusted CA by viewing the certificate properties.

If the ADSI Edit utility is not present on your Active Directory server, download and install the

appropriate Windows Support Tools from the Microsoft Web site.

VMware, Inc. 36

Page 37

View Installation

Procedure

1 On your Active Directory server, start the ADSI Edit utility.

2 In the left pane, expand the domain the user is located in and double-click CN=Users.

3 In the right pane, right-click the user and then click Properties.

4 Double-click the userPrincipalName attribute and type the SAN value of the trusted CA certificate.

5 Click OK to save the attribute setting.

Add the Root Certiﬁcate to Trusted Root Certiﬁcation Authorities

If you use a certification authority (CA) to issue smart card login or domain controller certificates, you

must add the root certificate to the Trusted Root Certification Authorities group policy in Active Directory.

You do not need to perform this procedure if the Windows domain controller acts as the root CA.

Procedure

1 On the Active Directory server, navigate to the Group Policy Management plug-in.

AD Version Navigation Path

Windows 2003 a Select Start > All Programs > Administrative Tools > Active Directory

Users and Computers.

b Right-click your domain and click Properties.

c On the Group Policy tab, click Open to open the Group Policy Management

plug-in.

d Right-click Default Domain Policy, and click Edit.

Windows 2008 a Select Start > Administrative Tools > Group Policy Management.

b Expand your domain, right-click Default Domain Policy, and click Edit.

Windows 2012R2 a Select Start > Administrative Tools > Group Policy Management.

b Expand your domain, right-click Default Domain Policy, and click Edit.

Windows 2016 a Select Start > Administrative Tools > Group Policy Management.

b Expand your domain, right-click Default Domain Policy, and click Edit.

2 Expand the Computer Configuration section and open Windows Settings\Security

Settings\Public Key.

3 Right-click Trusted Root Certification Authorities and select Import.

4 Follow the prompts in the wizard to import the root certificate (for example, rootCA.cer) and click

OK.

5 Close the Group Policy window.

All of the systems in the domain now have a copy of the root certificate in their trusted root store.

VMware, Inc. 37

Page 38

View Installation

What to do next

If an intermediate certification authority (CA) issues your smart card login or domain controller certificates,

add the intermediate certificate to the Intermediate Certification Authorities group policy in Active

Directory. See Add an Intermediate Certificate to Intermediate Certification Authorities.

Add an Intermediate Certiﬁcate to Intermediate Certiﬁcation Authorities

If you use an intermediate certification authority (CA) to issue smart card login or domain controller

certificates, you must add the intermediate certificate to the Intermediate Certification Authorities group

policy in Active Directory.

Procedure

1 On the Active Directory server, navigate to the Group Policy Management plug-in.

AD Version Navigation Path

Windows 2003 a Select Start > All Programs > Administrative Tools > Active Directory

Users and Computers.

b Right-click your domain and click Properties.

c On the Group Policy tab, click Open to open the Group Policy Management

plug-in.

d Right-click Default Domain Policy, and click Edit.

Windows 2008 a Select Start > Administrative Tools > Group Policy Management.

b Expand your domain, right-click Default Domain Policy, and click Edit.

Windows 2012R2 a Select Start > Administrative Tools > Group Policy Management.

b Expand your domain, right-click Default Domain Policy, and click Edit.

Windows 2016 a Select Start > Administrative Tools > Group Policy Management.

b Expand your domain, right-click Default Domain Policy, and click Edit.

2 Expand the Computer Configuration section and open the policy for Windows Settings\Security

Settings\Public Key.

3 Right-click Intermediate Certification Authorities and select Import.

4 Follow the prompts in the wizard to import the intermediate certificate (for example,

intermediateCA.cer) and click OK.

5 Close the Group Policy window.

All of the systems in the domain now have a copy of the intermediate certificate in their intermediate

certification authority store.

VMware, Inc. 38

Page 39

View Installation

Add the Root Certiﬁcate to the Enterprise NTAuth Store

If you use a CA to issue smart card login or domain controller certificates, you must add the root

certificate to the Enterprise NTAuth store in Active Directory. You do not need to perform this procedure if

the Windows domain controller acts as the root CA.

Procedure

On your Active Directory server, use the certutil command to publish the certificate to the

Enterprise NTAuth store.

For example: certutil -dspublish -f path_to_root_CA_cert NTAuthCA

The CA is now trusted to issue certificates of this type.

Disable Weak Ciphers in SSL/TLS

To achieve greater security, you can configure the domain policy GPO (group policy object) to ensure that

View Composer and Windows-based machines running View Agent or Horizon Agent do not use weak

ciphers when they communicate using the SSL/TLS protocol.

Procedure

1 On the Active Directory server, edit the GPO by selecting Start > Administrative Tools > Group

Policy Management, right-clicking the GPO, and selecting Edit.

2 In the Group Policy Management Editor, navigate to the Computer Configuration > Policies >

Administrative Templates > Network > SSL Configuration Settings.

3 Double-click SSL Cipher Suite Order.

4 In the SSL Cipher Suite Order window, click Enabled.

5 In the Options pane, replace the entire content of the SSL Cipher Suites text box with the following

cipher list:

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256,

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P384,

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P256,

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384,

TLS_RSA_WITH_AES_128_CBC_SHA256,

TLS_RSA_WITH_AES_128_CBC_SHA,

TLS_RSA_WITH_AES_256_CBC_SHA256,

TLS_RSA_WITH_AES_256_CBC_SHA

The cipher suites are listed above on separate lines for readability. When you paste the list into the

text box, the cipher suites must be on one line with no spaces after the commas.

6 Exit the Group Policy Management Editor.

VMware, Inc. 39

Page 40

View Installation

7 Restart the View Composer and View Agent or Horizon Agent machines for the new group policy to

take effect.

VMware, Inc. 40

Page 41

Installing View Composer 6

To use View Composer, you create a View Composer database, install the View Composer service, and

optimize your View infrastructure to support View Composer. You can install the View Composer service

on the same host as vCenter Server or on a separate host.

View Composer is an optional feature. Install View Composer if you intend to deploy linked-clone desktop

pools.

You must have a license to install and use the View Composer feature.

Note Before installing View Composer, verify that you have prepared Active Directory.

This section includes the following topics:

Prepare a View Composer Database

Configuring an SSL Certificate for View Composer

Install the View Composer Service

Enable TLSv1.0 on vCenter and ESXi Connections from View Composer

Configuring Your Infrastructure for View Composer

Prepare a View Composer Database

You must create a database and data source name (DSN) to store View Composer data.

The View Composer service does not include a database. If a database instance does not exist in your

network environment, you must install one. After you install a database instance, you add the View

Composer database to the instance.

You can add the View Composer database to the instance on which the vCenter Server database is

located. You can configure the database locally, or remotely, on a network-connected Linux, UNIX, or

Windows Server computer.

The View Composer database stores information about connections and components that are used by

View Composer:

vCenter Server connections

Active Directory connections

VMware, Inc.

Page 42

View Installation

Linked-clone desktops that are deployed by View Composer

Replicas that are created by View Composer

Each instance of the View Composer service must have its own View Composer database. Multiple View

Composer services cannot share a View Composer database.

For a list of supported database versions, see Database Requirements for View Composer and the

Events Database.

To add a View Composer database to an installed database instance, choose one of these procedures.

Create a SQL Server Database for View Composer

View Composer can store linked-clone desktop information in a SQL Server database. You create a

View Composer database by adding it to SQL Server and configuring an ODBC data source for it.

Create an Oracle Database for View Composer

View Composer can store linked-clone desktop information in an Oracle 12c or 11g database. You

create a View Composer database by adding it to an existing Oracle instance and configuring an

ODBC data source for it. You can add a new View Composer database by using the Oracle

Database Configuration Assistant or by running a SQL statement.

Create a SQL Server Database for View Composer

View Composer can store linked-clone desktop information in a SQL Server database. You create a View

Composer database by adding it to SQL Server and configuring an ODBC data source for it.

Procedure

1 Add a View Composer Database to SQL Server

You can add a new View Composer database to an existing Microsoft SQL Server instance to store

linked-clone data for View Composer.

2 (Optional) Set SQL Server Database Permissions By Manually Creating Database Roles

By using this recommended method, the View Composer database administrator can set

permissions for View Composer administrators to be granted through Microsoft SQL Server

database roles.

3 Add an ODBC Data Source to SQL Server

After you add a View Composer database to SQL Server, you must configure an ODBC connection

to the new database to make this data source visible to the View Composer service.

Add a View Composer Database to SQL Server

You can add a new View Composer database to an existing Microsoft SQL Server instance to store

linked-clone data for View Composer.

If the database resides locally, on the system on which View Composer will be installed, you can use the

Integrated Windows Authentication security model. If the database resides on a remote system, you

cannot use this method of authentication.

VMware, Inc. 42

Page 43

View Installation

Prerequisites

Verify that a supported version of SQL Server is installed on the computer on which you will install

View Composer or in your network environment. For details, see Database Requirements for View

Composer and the Events Database.

Verify that you use SQL Server Management Studio to create and administer the database.

Alternatively, you can use SQL Server Management Studio Express, which you can download and

install from the following Web site.

http://www.microsoft.com/en-us/download/details.aspx?id=7593

Procedure

1 On the View Composer computer, select Start > All Programs > Microsoft SQL Server 2014,

Microsoft SQL Server 2012 or Microsoft SQL Server 2008.

2 Select SQL Server Management Studio and connect to the SQL Server instance.

3 In the Object Explorer panel, right-click the Databases entry and select New Database.

You can use the default values for the Initial size and Autogrowth parameters for the database

and log files.

4 In the New Database dialog box, type a name in the Database name text box.

For example: ViewComposer

5 Click OK.

SQL Server Management Studio adds your database to the Databases entry in the Object Explorer

panel.

6 Exit Microsoft SQL Server Management Studio.

What to do next

Optionally, follow the instructions in (Optional) Set SQL Server Database Permissions By Manually

Creating Database Roles

Follow the instructions in Add an ODBC Data Source to SQL Server.

(Optional) Set SQL Server Database Permissions By Manually Creating Database Roles

By using this recommended method, the View Composer database administrator can set permissions for

View Composer administrators to be granted through Microsoft SQL Server database roles.

VMware recommends this method because it removes the requirement to set up the db_owner role for

View Composer administrators who install and upgrade View Composer.

In this procedure, you can provide your own names for the database login name, user name, and

database roles. The user [vcmpuser] and database roles, VCMP_ADMIN_ROLE and

VCMP_USER_ROLE, are example names. The dbo schema is created when you create the View

Composer database. You must use the dbo schema name.

VMware, Inc. 43

Page 44

View Installation

Prerequisites

Verify that a View Composer database is created. See Add a View Composer Database to SQL

Server.

Procedure

1 Log in to a Microsoft SQL Server Management Studio session as the sysadmin (SA) or a user

account with sysadmin privileges.

2 Create a user who will be granted the appropriate SQL Server database permissions.

use ViewComposer

CREATE LOGIN [vcmpuser] WITH PASSWORD=N'vcmpuser!0', DEFAULT_DATABASE=ViewComposer,

DEFAULT_LANGUAGE=us_english, CHECK_POLICY=OFF

CREATE USER [vcmpuser] for LOGIN [vcmpuser]

use MSDB

CREATE USER [vcmpuser] for LOGIN [vcmpuser]

3 In the View Composer database, create the database role VCMP_ADMIN_ROLE.

4 In the View Composer database, grant privileges to the VCMP_ADMIN_ROLE.

a Grant the schema permissions ALTER, REFERENCES, and INSERT on the dbo schema.

b Grant the permissions CREATE TABLE, CREATE VIEW, and CREATE PROCEDURES.

5 In the View Composer database, create the VCMP_USER_ROLE.

6 In the View Composer database, grant the schema permissions SELECT, INSERT, DELETE,

UPDATE, and EXECUTE on the dbo schema to the VCMP_USER_ROLE.

7 Grant the VCMP_USER_ROLE to the user [vcmpuser].

8 Grant the VCMP_ADMIN_ROLE to the user [vcmpuser].

9 In the MSDB database, create the database role VCMP_ADMIN_ROLE.

10 Grant privileges to the VCMP_ADMIN_ROLE in MSDB.

a On the MSDB tables syscategories, sysjobsteps, and sysjobs, grant the SELECT

permission to the user [vcmpuser].

b On the MSDB stored procedures sp_add_job, sp_delete_job, sp_add_jobstep,

sp_update_job, sp_add_jobserver, sp_add_jobschedule, and sp_add_category, grant the

EXECUTE permission to the role VCMP_ADMIN_ROLE.

11 In the MSDB database, grant the VCMP_ADMIN_ROLE to the user [vcmpuser].

12 Create the ODBC DSN using the SQL Server login vcmpuser.

13 Install View Composer.

VMware, Inc. 44

Page 45

View Installation

14 In the MSDB database, revoke the VCMP_ADMIN_ROLE from the user [vcmpuser].

After you revoke the role, you can leave the role as inactive or remove the role for increased security.

For instructions for creating an ODBC DSN, see Add an ODBC Data Source to SQL Server.

For instructions for installing View Composer, see Install the View Composer Service.

Add an ODBC Data Source to SQL Server

After you add a View Composer database to SQL Server, you must configure an ODBC connection to the

new database to make this data source visible to the View Composer service.

When you configure an ODBC DSN for View Composer, secure the underlying database connection to an

appropriate level for your environment. For information about securing database connections, see the

SQL Server documentation.

If the underlying database connection uses SSL encryption, we recommend that you configure your

database servers with SSL certificates signed by a trusted CA. If you use self-signed certificates, your

database connections might be susceptible to man-in-the-middle attacks.

Prerequisites

Complete the steps described in Add a View Composer Database to SQL Server.

Procedure

1 On the computer on which View Composer will be installed, select Start > Administrative Tools >

Data Source (ODBC).

2 Select the System DSN tab.

3 Click Add and select SQL Native Client from the list.

4 Click Finish.

5 In the Create a New Data Source to SQL Server setup wizard, type a name and description of the

View Composer database.

For example: ViewComposer

6 In the Server text box, type the SQL Server database name.

Use the form host_name\server_name, where host_name is the name of the computer and

server_name is the SQL Server instance.

For example: VCHOST1\VIM_SQLEXP

7 Click Next.

VMware, Inc. 45

Page 46

View Installation

8 Make sure that the Connect to SQL Server to obtain default settings for the additional

configuration options check box is selected and select an authentication option.

Option Description

Integrate Windows authentication Select this option if you are using a local instance of SQL Server. This option is

also known as trusted authentication. Integrate Windows authentication is

supported only if SQL Server is running on the local computer.

SQL Server authentication Select this option if you are using a remote instance of SQL Server. Windows NT

authentication is not supported on remote SQL Server.

If you manually set SQL Server database permissions and assigned them to a

user, authenticate with that user. For example, authenticate with the user

vcmpuser. If not, authenticate as the sysadmin (SA) or a user account with

sysadmin privileges.

9 Click Next.

10 Select the Change the default database to check box and select the name of the View Composer

database from the list.

For example: ViewComposer

11 If the SQL Server connection is configured with SSL enabled, navigate to the Microsoft SQL Server

DSN Configuration page and select Use strong encryption for data.

12 Finish and close the Microsoft ODBC Data Source Administrator wizard.

What to do next

Install the new View Composer service. See Install the View Composer Service.

Create an Oracle Database for View Composer

View Composer can store linked-clone desktop information in an Oracle 12c or 11g database. You create

a View Composer database by adding it to an existing Oracle instance and configuring an ODBC data

source for it. You can add a new View Composer database by using the Oracle Database Configuration

Assistant or by running a SQL statement.

Add a View Composer Database to Oracle 12c or 11g

You can use the Oracle Database Configuration Assistant to add a new View Composer database to

an existing Oracle 12c or 11g instance.

Use a SQL Statement to Add a View Composer Database to an Oracle Instance

Configure an Oracle Database User for View Composer

By default, the database user that runs the View Composer database has Oracle system

administrator permissions. To restrict the security permissions for the user that runs the View

Composer database, you must configure an Oracle database user with specific permissions.

VMware, Inc. 46

Page 47

View Installation

Add an ODBC Data Source to Oracle 12c or 11g

After you add a View Composer database to an Oracle 12c or 11g instance, you must configure an

ODBC connection to the new database to make this data source visible to the View Composer

service.

Add a View Composer Database to Oracle 12c or 11g

You can use the Oracle Database Configuration Assistant to add a new View Composer database to an

existing Oracle 12c or 11g instance.

Prerequisites

Verify that a supported version of Oracle 12c or 11g is installed on the local or remote computer. See

Database Requirements for View Composer and the Events Database.

Procedure

1 Start the Database Configuration Assistant on the computer on which you are adding the View

Composer database.

Database Version Action

Oracle 12c Select Start > All Programs > Oracle-OraDb12c_home > Configuration and

Migration Tools > Database Configuration Assistant.

Oracle 11g Select Start > All Programs > Oracle-OraDb11g_home > Configuration and

Migration Tools > Database Configuration Assistant.

2 On the Operations page, select Create a database.

3 On the Database Templates page, select the General Purpose or Transaction Processing

template.

4 On the Database Identification page, type a Global Database Name and an Oracle System Identifier

(SID) prefix.

For simplicity, use the same value for both items.

5 On the Management Options page, click Next to accept the default settings.

6 On the Database Credentials page, select Use the Same Administrative Passwords for All

Accounts and type a password.

7 On the remaining configuration pages, click Next to accept the default settings.

8 On the Creation Options page, verify that Create Database is selected and click Finish.

9 On the Confirmation page, review the options and click OK.

The configuration tool creates the database.

10 On the Database Creation Complete page, click OK.

What to do next

Follow the instructions in Add an ODBC Data Source to Oracle 12c or 11g.

VMware, Inc. 47

Page 48

View Installation

Use a SQL Statement to Add a View Composer Database to an Oracle Instance

When you create the database, you can customize the location of the data and log files.

Prerequisites

The View Composer database must have certain table spaces and privileges. You can use a SQL

statement to create the View Composer database in an Oracle 12c or 11g database instance.

Verify that a supported version of Oracle 12c or 11g is installed on the local or remote computer. For

details, see Database Requirements for View Composer and the Events Database.

Procedure

1 Log in to a SQL*Plus session with the system account.

2 Run the following SQL statement to create the database.

CREATE SMALLFILE TABLESPACE "VCMP" DATAFILE '/u01/app/oracle/oradata/vcdb/vcmp01.dbf'

SIZE 512M AUTOEXTEND ON NEXT 10M MAXSIZE UNLIMITED LOGGING EXTENT MANAGEMENT LOCAL SEGMENT

SPACE MANAGEMENT AUTO;

In this example, VCMP is the sample name of the View Composer database and vcmp01.dbf is the

name of the database file.

For a Windows installation, use Windows conventions in the directory path to the vcmp01.dbf file.

What to do next

If you want to run the View Composer database with specific security permissions, follow the instructions

in Configure an Oracle Database User for View Composer.

Follow the instructions in Add an ODBC Data Source to Oracle 12c or 11g

Conﬁgure an Oracle Database User for View Composer

By default, the database user that runs the View Composer database has Oracle system administrator

permissions. To restrict the security permissions for the user that runs the View Composer database, you

must configure an Oracle database user with specific permissions.

Prerequisites

Verify that a View Composer database was created in an Oracle 12c or 11g instance.

Procedure

1 Log in to a SQL*Plus session with the system account.

VMware, Inc. 48

Page 49

View Installation

2 Run the following SQL command to create a View Composer database user with the correct

permissions.

CREATE USER "VCMPADMIN" PROFILE "DEFAULT" IDENTIFIED BY "oracle" DEFAULT TABLESPACE

"VCMP" ACCOUNT UNLOCK;

grant connect to VCMPADMIN;

grant resource to VCMPADMIN;

grant create view to VCMPADMIN;

grant create sequence to VCMPADMIN;

grant create table to VCMPADMIN;

grant create materialized view to VCMPADMIN;

grant execute on dbms_lock to VCMPADMIN;

grant execute on dbms_job to VCMPADMIN;

grant unlimited tablespace to VCMPADMIN;

In this example, the user name is VCMPADMIN and the View Composer database name is VCMP.

By default the resource role has the create procedure, create table, and create sequence

privileges assigned. If the resource role does not have these privileges, explicitly grant them to the

View Composer database user.

Add an ODBC Data Source to Oracle 12c or 11g

After you add a View Composer database to an Oracle 12c or 11g instance, you must configure an ODBC

connection to the new database to make this data source visible to the View Composer service.

When you configure an ODBC DSN for View Composer, secure the underlying database connection to an

appropriate level for your environment. For information about securing database connections, see the

Oracle database documentation.

If the underlying database connection uses SSL encryption, we recommend that you configure your

database servers with SSL certificates signed by a trusted CA. If you use self-signed certificates, your

database connections might be susceptible to man-in-the-middle attacks.

Prerequisites

Verify that you completed the steps described in Add a View Composer Database to Oracle 12c or 11g or

Use a SQL Statement to Add a View Composer Database to an Oracle Instance.

Procedure

1 On the View Composer database computer, select Start > Administrative Tools > Data Source

(ODBC).

2 From the Microsoft ODBC Data Source Administrator wizard, select the System DSN tab.

3 Click Add and select the appropriate Oracle driver from the list.

For example: OraDb11g_home

4 Click Finish.

VMware, Inc. 49

Page 50

View Installation

5 In the Oracle ODBC Driver Configuration dialog box, type a DSN to use with View Composer, a

description of the data source, and a user ID to connect to the database.

If you configured an Oracle database user ID with specific security permissions, specify this user ID.

Note You use the DSN when you install the View Composer service.

6 Specify a TNS Service Name by selecting the Global Database Name from the drop-down menu.

The Oracle Database Configuration Assistant specifies the Global Database Name.

7 To verify the data source, click Test Connection and click OK.

What to do next

Install the new View Composer service. See Install the View Composer Service.

Conﬁguring an SSL Certiﬁcate for View Composer

By default, a self-signed certificate is installed with View Composer. You can use the default certificate for

testing purposes, but for production use you should replace it with a certificate that is signed by a

Certificate Authority (CA).

You can configure a certificate before or after you install View Composer. In View 5.1 and later releases,

you configure a certificate by importing it into the Windows local computer certificate store on the

Windows Server computer where View Composer is, or will be, installed.

If you import a CA-signed certificate before you install View Composer, you can select the signed

certificate during the View Composer installation. This approach eliminates the manual task of

replacing the default certificate after the installation.

If you intend to replace an existing certificate or the default, self-signed certificate with a new

certificate after you install View Composer, you must import the new certificate and run the

SviConfig ReplaceCertificate utility to bind your new certificate to the port used by View

Composer.

For details about configuring SSL certificates and using the SviConfig ReplaceCertificate utility, see

Chapter 8 Configuring SSL Certificates for Horizon 7 Servers.

If you install vCenter Server and View Composer on the same Windows Server computer, they can use

the same SSL certificate, but you must configure the certificate separately for each component.

Install the View Composer Service

To use View Composer, you must install the View Composer service. Horizon 7 uses View Composer to

create and deploy linked-clone desktops in vCenter Server.

You can install the View Composer service on the Windows Server computer on which vCenter Server is

installed or on a separate Windows Server computer. A standalone View Composer installation works

with vCenter Server installed on a Windows Server computer and with the Linux-based vCenter Server

Appliance.

VMware, Inc. 50

Page 51

View Installation

The View Composer software cannot coexist on the same virtual or physical machine with any other

Horizon 7 software component, including a replica server, security server, Connection Server, Horizon

Agent, or Horizon Client.

For enhanced security, we recommend configuring cipher suites to remove known vulnerabilities. For

instructions on how to set up a domain policy on cipher suites for Windows machines that run View

Composer or Horizon Agent, see Disable Weak Ciphers in SSL/TLS.

Prerequisites

Verify that your installation satisfies the View Composer requirements described in View Composer

Requirements.

Verify that no other Horizon 7 component, including Connection Server, security server, Horizon

Agent, or Horizon Client, is installed on the machine on which you intend to install View Composer.

Verify that you have a license to install and use View Composer.

Verify that you have the DSN, domain administrator user name, and password that you provided in

the ODBC Data Source Administrator wizard. You enter this information when you install the View

Composer service.

If you plan to configure an SSL certificate signed by a CA for View Composer during the installation,

verify that your certificate is imported in the Windows local computer certificate store. See Chapter 8

Configuring SSL Certificates for Horizon 7 Servers.

Verify that no applications that run on the View Composer computer use Windows SSL libraries that

require SSL version 2 (SSLv2) provided through the Microsoft Secure Channel (Schannel) security

package. The View Composer installer disables SSLv2 on the Microsoft Schannel. Applications such

as Tomcat, which uses Java SSL, or Apache, which uses OpenSSL, are not affected by this

constraint.

To run the View Composer installer, you must be a user with administrator privileges on the system.

Procedure

1 Download the View Composer installer file from the VMware product page at

http://www.vmware.com/products/ to the Windows Server computer.

The installer filename is VMware-viewcomposer-y.y.y-xxxxxx.exe, where xxxxxx is the build

number and y.y.y is the version number. This installer file installs the View Composer service on 64-bit

Windows Server operating systems.

2 To start the View Composer installation program, right-click the installer file and select Run as

administrator.

3 Accept the VMware license terms.

4 Accept or change the destination folder.

VMware, Inc. 51

Page 52

View Installation

5 Type the DSN for the View Composer database that you provided in the Microsoft or Oracle ODBC

Data Source Administrator wizard.

For example: VMware View Composer

Note If you did not configure a DSN for the View Composer database, click ODBC DSN Setup to

configure a name now.

6 Type the domain administrator user name and password that you provided in the ODBC Data Source

Administrator wizard.

If you configured an Oracle database user with specific security permissions, specify this user name.

7 Type a port number or accept the default value.

View Connection Server uses this port to communicate with the View Composer service.

8 Provide an SSL certificate.

Option Action

Create default SSL certificate Select this radio button to create a default SSL certificate for the View Composer

service.

After the installation, you can replace the default certificate with an SSL certificate

signed by a CA.

Use an existing SSL certificate Select this radio button if you installed a signed SSL certificate that you want to

use for the View Composer service. Select an SSL certificate from the list.

9 Click Install and Finish to complete the View Composer service installation.

The VMware Horizon View Composer service starts.

View Composer uses the cryptographic cipher suites that are provided by the Windows Server operating

system. You should follow your organization's guidelines for managing cipher suites on Windows Server

systems. If your organization does not provide guidelines, VMware recommends that you disable weak

cryptographic cipher suites on the View Composer server to enhance the security of your Horizon 7

environment. For information about managing cryptographic cipher suites, see your Microsoft

documentation.

What to do next

If you have an older version of vCenter Server, see Enable TLSv1.0 on vCenter and ESXi Connections

from View Composer.

If you manually set SQL Server database permissions and assigned them to a user, you can revoke the

database administrator role from that user. For details, see the last step in the procedure in (Optional) Set

SQL Server Database Permissions By Manually Creating Database Roles.

VMware, Inc. 52

Page 53

View Installation

Enable TLSv1.0 on vCenter and ESXi Connections from View Composer

Horizon 7 and later components have the TLSv1.0 security protocol disabled by default. If your

deployment includes an older version of vCenter Server that supports only TLSv1.0, you might need to

enable TLSv1.0 for View Composer connections after installing or upgrading to View Composer 7.0 or a

later release.

Some earlier maintenance releases of vCenter Server 5.0, 5.1, and 5.5 support only TLSv1.0, which is no

longer enabled by default in Horizon 7 and later releases. If it is not possible to upgrade vCenter Server to

a version that supports TLSv1.1 or TLSv1.2, you can enable TLSv1.0 for View Composer connections.

If your ESXi hosts are not running ESXi 6.0 U1b or later, and you cannot upgrade, you might also need to

enable TLSv1.0 connections to ESXi hosts from View Composer.

Prerequisites

Verify that you have View Composer 7.0 or a later release installed.

Verify that you can log in to the View Composer machine as an Administrator to use the Windows

Registry Editor.

Procedure

1 On the machine that hosts View Composer, open the Windows Registry Editor (regedit.exe).

2 Navigate to

HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS

1.0\Client

If this key does not already exist, create this key.

3 Delete the value Enabled if it exists.

4 Create or edit the DWORD value DisabledByDefault and set it to 0.

5 Restart the VMware Horizon View Composer service.

TLSv1.0 connections from View Composer to vCenter are now enabled.

6 In the Windows Registry on the View Composer machine, navigate to HKLM\SOFTWARE\VMware,

Inc.\VMware View Composer.

7 Create or edit the String value EnableTLS1.0 and set it to 1.

8 If the View Composer host is a 64-bit machine, navigate to HKLM\SOFTWARE\WOW6432Node\VMware,

Inc\VMware View Composer.

9 Create or edit the String value EnableTLS1.0 and set it to 1.

10 Restart the VMware Horizon View Composer service.

TLSv1.0 connections from View Composer to ESXi hosts are now enabled.

VMware, Inc. 53

Page 54

View Installation

Conﬁguring Your Infrastructure for View Composer

You can take advantage of features in vSphere, vCenter Server, Active Directory, and other components

of your infrastructure to optimize the performance, availability, and reliability of View Composer.

Conﬁguring the vSphere Environment for View Composer

To support View Composer, you should follow certain best practices when you install and configure

vCenter Server, ESXi, and other vSphere components.

These best practices let View Composer work efficiently in the vSphere environment.

After you create the path and folder information for linked-clone virtual machines, do not change the

information in vCenter Server. Instead, use Horizon Administrator to change the folder information.

If you change this information in vCenter Server, Horizon 7 cannot successfully look up the virtual

machines in vCenter Server.

Make sure that the vSwitch settings on the ESXi host are configured with enough ports to support the

total number of virtual NICs that are configured on the linked-clone virtual machines that run on the

ESXi host.

When you deploy linked-clone desktops in a resource pool, make sure that your vSphere

environment has enough CPU and memory to host the number of desktops that you require. Use

vSphere Client to monitor CPU and memory usage in resource pools.

In vSphere 5.1 and later, a cluster that is used for View Composer linked clones can contain more

than eight ESXi hosts if the replica disks are stored on VMFS5 or later datastores or NFS datastores.

If you store replicas on a VMFS version earlier than VMFS5, a cluster can have at most eight hosts.

Use vSphere DRS. DRS efficiently distributes linked-clone virtual machines among your hosts.

Note Storage vMotion is not supported for linked-clone desktops.

Additional Best Practices for View Composer

To make sure that View Composer works efficiently, check that your dynamic name service (DNS)

operates correctly, and run antivirus software scans at staggered times.

By making sure that DNS resolution operates correctly, you can overcome intermittent issues caused by

DNS errors. The View Composer service relies on dynamic name resolution to communicate with other

computers. To test DNS operation, ping the Active Directory and View Connection Server computers by

name.

If you stagger the run times for your antivirus software, performance of the linked-clone desktops is not

affected. If the antivirus software runs in all linked clones at the same time, excessive I/O operations per

second (IOPS) occur in your storage subsystem. This excessive activity can affect performance of the

linked-clone desktops.

VMware, Inc. 54

Page 55

Installing Horizon Connection

Server 7

To use Connection Server, you install the software on supported computers, configure the required

components, and, optionally, optimize the components.

This section includes the following topics:

Installing the Horizon Connection Server Software

Installation Prerequisites for Horizon Connection Server

Install Horizon Connection Server with a New Configuration

Install a Replicated Instance of Horizon Connection Server

Configure a Security Server Pairing Password

Install a Security Server

Firewall Rules for Horizon Connection Server

Reinstall Horizon Connection Server with a Backup Configuration

Microsoft Windows Installer Command-Line Options

Uninstalling Horizon 7 Components Silently by Using MSI Command-Line Options

Installing the Horizon Connection Server Software

Depending on the performance, availability, and security needs of your Horizon 7 deployment, you can

install a single instance of Connection Server, replicated instances of Connection Server, and security

servers. You must install at least one instance of Connection Server.

When you install Connection Server, you select a type of installation.

Standard installation Generates a Connection Server instance with a new View LDAP

configuration.

Replica installation Generates a Connection Server instance with a View LDAP configuration

that is copied from an existing instance.

VMware, Inc. 55

Page 56

View Installation

Security server

installation

Enrollment Server

installation

Generates a Connection Server instance that adds an additional layer of

security between the Internet and your internal network.

Installs an enrollment server that is required for the True SSO (single sign-

on) feature, so that after users log in to VMware Identity Manager, they can

connect to a remote desktop or application without having to provide Active

Directory credentials. The enrollment server requests the short-lived

certificates that are used for authentication.

Note Because this feature requires that a certificate authority also be set

up, and specific configuration performed, the installation procedure for the

enrollment server is provided in the View Administration document, in the

chapter "Authenticating Users Without Requiring Credentials," rather than

in this installation document.

Installation Prerequisites for Horizon Connection Server

Before you install Connection Server, you must verify that your installation environment satisfies specific

prerequisites.

You must have a valid license key for Horizon 7.

You must join the Connection Server host to an Active Directory domain. Connection Server supports

the following Active Directory Domain Services (AD DS) domain functional levels:

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Windows Server 2012 R2

Windows Server 2016

The Connection Server host must not be a domain controller.

Note Connection Server does not make, nor does it require, any schema or configuration updates to

Active Directory.

Do not install Connection Server on systems that have the Windows Terminal Server role installed.

You must remove the Windows Terminal Server role from any system on which you install Connection

Server.

Do not install Connection Server on a system that performs any other functions or roles. For example,

do not use the same system to host vCenter Server.

The system on which you install Connection Server must have an IP address that does not change.

In an IPv4 environment, configure a static IP address. In an IPv6 environment, machines

automatically get IP addresses that do not change.

VMware, Inc. 56

Page 57

View Installation

To run the Horizon Connection Server installer, you must use a domain user account with

Administrator privileges on the system.

When you install Connection Server, you authorize an Administrators account. You can specify the

local Administrators group or a domain user or group account. Horizon 7 assigns full administration

rights, including the right to install replicated Connection Server instances, to this account only. If you

specify a domain user or group, you must create the account in Active Directory before you run the

installer.

Install Horizon Connection Server with a New

Conﬁguration

To install Connection Server as a single server or as the first instance in a group of replicated Connection

Server instances, you use the standard installation option.

When you select the standard installation option, the installation creates a new, local View LDAP

configuration. The installation loads the schema definitions, Directory Information Tree (DIT) definition,

and ACLs and initializes the data.

After installation, you manage most View LDAP configuration data by using Horizon Administrator.

Connection Server automatically maintains some View LDAP entries.

The Connection Server software cannot coexist on the same virtual or physical machine with any other

Horizon 7 software component, including a replica server, security server, View Composer, Horizon

Agent, or Horizon Client.

When you install Connection Server with a new configuration, you can participate in a customer

experience improvement program. VMware collects anonymous data about your deployment in order to

improve VMware's response to user requirements. No data that identifies your organization is collected.

You can choose not to participate by deselecting this option during the installation. If you change your

mind about participating after the installation, you can either join or withdraw from the program by editing

the Product Licensing and Usage page in Horizon Administrator. To review the list of fields from which

data is collected, including the fields that are made anonymous, see "Information Collected by the

Customer Experience Improvement Program" in the View Administration document.

By default, the HTML Access component is installed on the Connection Server host when you install

Connection Server. This component configures the Horizon 7 user portal page to display an

HTML Access icon in addition to the Horizon Client icon. The additional icon allows users to select

HTML Access when they connect to their desktops.

For an overview of setting up Connection Server for HTML Access, see the VMware Horizon HTML

Access Installation and Setup Guide document, located on the Horizon Client Documentation page.

Prerequisites

Verify that you can log in as a domain user with administrator privileges on the Windows Server

computer on which you install Connection Server.

Verify that your installation satisfies the requirements described in Horizon Connection Server

Requirements.

VMware, Inc. 57

Page 58

View Installation

Prepare your environment for the installation. See Installation Prerequisites for Horizon Connection

Server.

If you intend to authorize a domain user or group as the Administrators account, verify that you

created the domain account in Active Directory.

If you use MIT Kerberos authentication to log in to a Windows Server 2008 R2 computer on which

you are installing Connection Server, install the Microsoft hotfix that is described in KB 978116 at

http://support.microsoft.com/kb/978116.

Prepare a data recovery password. When you back up Connection Server, the View LDAP

configuration is exported as encrypted LDIF data. To restore the encrypted backup Horizon 7

configuration, you must provide the data recovery password. The password must contain between 1

and 128 characters. Follow your organization's best practices for generating secure passwords.

Important You will need the data recovery password to keep Horizon 7 operating and avoid

downtime in a Business Continuity and Disaster Recovery (BCDR) scenario. You can provide a

password reminder with the password when you install Connection Server.

Familiarize yourself with the network ports that must be opened on the Windows Firewall for

Connection Server instances. See Firewall Rules for Horizon Connection Server.

If you plan to pair a security server with this Connection Server instance, verify that Windows Firewall

with Advanced Security is set to on in the active profiles. It is recommended that you turn this setting

to on for all profiles. By default, IPsec rules govern connections between security server and

Connection Server and require Windows Firewall with Advanced Security to be enabled.

If your network topology includes a back-end firewall between a security server and the Connection

Server instance, you must configure the firewall to support IPsec. See Configuring a Back-End

Firewall to Support IPsec.

Procedure

1 Download the Connection Server installer file from the VMware download site at

https://my.vmware.com/web/vmware/downloads.

Under Desktop & End-User Computing, select the VMware Horizon 7 download, which includes

Connection Server.

The installer filename is VMware-viewconnectionserver-x86_64-y.y.y-xxxxxx.exe, where

xxxxxx is the build number and y.y.y is the version number.

2 To start the Connection Server installation program, double-click the installer file.

3 Accept the VMware license terms.

4 Accept or change the destination folder.

5 Select the View Standard Server installation option.

6 Select the Internet Protocol (IP) version, IPv4 or IPv6.

You must install all Horizon 7 components with the same IP version.

VMware, Inc. 58

Page 59

View Installation

7 Select whether to enable or disable FIPS mode.

This option is available only if FIPS mode is enabled in Windows.

8 Make sure that Install HTML Access is selected if you intend to allow users to connect to their

desktops by using a Web browser.

If IPv4 is selected, this setting is selected by default. If IPv6 is selected, this setting is not displayed

because HTML Access is not supported in an IPv6 environment.

9 Type a data recovery password and, optionally, a password reminder.

10 Choose how to configure the Windows Firewall service.

Option Action

Configure Windows Firewall

automatically

Do not configure Windows Firewall Configure the Windows firewall rules manually.

Let the installer configure Windows Firewall to allow the required network

connections.

Select this option only if your organization uses its own predefined rules for

configuring Windows Firewall.

11 Authorize a Horizon Administrators account.

Only members of this account can log in to Horizon Administrator, exercise full administration rights,

and install replicated Connection Server instances and other Horizon 7 servers.

Option Description

Authorize the local Administrators

group

Authorize a specific domain user or

domain group

Allows users in the local Administrators group to administer Horizon 7.

Allows the specified domain user or group to administer Horizon 7.

12 If you specified a domain Horizon Administrators account, and you are running the installer as a local

administrator or another user without access to the domain account, provide credentials to log in to

the domain with an authorized user name and password.

Use domain name\user name or user principal name (UPN) format. UPN format can be

user@domain.com.

13 Choose whether to participate in the customer experience improvement program.

If you participate, you can optionally select the type, size, and location of your organization.

14 Complete the installation wizard to finish installing Connection Server.

15 Check for new patches on the Windows Server computer and run Windows Update as needed.

Even if you fully patched the Windows Server computer before you installed Connection Server, the

installation might have enabled operating system features for the first time. Additional patches might

now be required.

VMware, Inc. 59

Page 60

View Installation

The Horizon 7 services are installed on the Windows Server computer:

VMware Horizon Connection Server

VMware Horizon View Framework Component

VMware Horizon View Message Bus Component

VMware Horizon View Script Host

VMware Horizon View Security Gateway Component

VMware Horizon View PCoIP Secure Gateway

VMware Horizon View Blast Secure Gateway

VMware Horizon View Web Component

VMware VDMDS, which provides View LDAP directory services

For information about these services, see the View Administration document.

If the Install HTML Access setting was selected during the installation, the HTML Access component is

installed on the Windows Server computer. This component configures the HTML Access icon in the

Horizon 7 user portal page and enables the VMware Horizon View Connection Server (Blast-In) rule in

the Windows Firewall. This firewall rule allows Web browsers on client devices to connect to the

Connection Server on TCP port 8443.

What to do next

Configure SSL server certificates for Connection Server. See Chapter 8 Configuring SSL Certificates for

Horizon 7 Servers.

If you have an older version of vCenter Server, see Enable TLSv1.0 on vCenter Connections from

Connection Server.

Perform initial configuration on Connection Server. See Chapter 9 Configuring Horizon 7 for the First

Time.

If you plan to include replicated Connection Server instances and security servers in your deployment,

you must install each server instance by running the Connection Server installer file.

If you are reinstalling Connection Server and you have a data collector set configured to monitor

performance data, stop the data collector set and start it again.

Install Horizon Connection Server Silently

You can use the silent installation feature of the Microsoft Windows Installer (MSI) to perform a standard

installation of Connection Server on several Windows computers. In a silent installation, you use the

command line and do not have to respond to wizard prompts.

With silent installation, you can efficiently deploy Horizon 7 components in a large enterprise.

VMware, Inc. 60

Page 61

View Installation

Prerequisites

Verify that you can log in as a domain user with administrator privileges on the Windows Server

computer on which you install Connection Server.

Verify that your installation satisfies the requirements described in Horizon Connection Server

Requirements.

Prepare your environment for the installation. See Installation Prerequisites for Horizon Connection

Server.

If you intend to authorize a domain user or group as the Horizon Administrators account, verify that

you created the domain account in Active Directory.