VMware Horizon View - 5.2 User Manual
VMware Horizon View Architecture
Planning
Horizon View 5.2
View Manager 5.2
View Composer 5.2
This document supports the version of each product listed and
supports all subsequent versions until the document is replaced
by a new edition. To check for more recent editions of this
document, see http://www.vmware.com/support/pubs.
EN-001022-00
VMware Horizon View Architecture Planning
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
docfeedback@vmware.com
Copyright © 2009–2013 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and
intellectual property laws. VMware products are covered by one or more patents listed at
http://www.vmware.com/go/patents.
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks
and names mentioned herein may be trademarks of their respective companies.
VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2 VMware, Inc.
Contents
VMware Horizon View Architecture Planning 5
Introduction to Horizon View 7
1
Advantages of Using Horizon View 7
Horizon View Features 9
How the Components Fit Together 10
Integrating and Customizing Horizon View 14
Planning a Rich User Experience 17
2
Feature Support Matrix 17
Choosing a Display Protocol 19
Using View Persona Management to Retain User Data and Settings 21
Benefits of Using View Desktops in Local Mode 23
Accessing USB Devices Connected to a Local Computer 24
Printing from a View Desktop 25
Streaming Multimedia to a View Desktop 25
Using Single Sign-On for Logging In to a View Desktop 26
Using Multiple Monitors with a View Desktop 26
Managing Desktop Pools from a Central Location 27
3
Advantages of Desktop Pools 27
Reducing and Managing Storage Requirements 28
Application Provisioning 30
Using Active Directory GPOs to Manage Users and Desktops 32
VMware, Inc.
Architecture Design Elements and Planning Guidelines 33
4
Virtual Machine Requirements 33
Horizon View ESX/ESXi Node 39
Desktop Pools for Specific Types of Workers 40
Desktop Virtual Machine Configuration 44
vCenter Server and View Composer Virtual Machine Configuration 45
View Connection Server Maximums and Virtual Machine Configuration 46
View Transfer Server Virtual Machine Configuration and Storage 47
vSphere Clusters 48
Storage and Bandwidth Requirements 50
Horizon View Building Blocks 57
Horizon View Pods 57
Advantages of Using Multiple vCenter Servers in a Pod 59
Planning for Security Features 61
5
Understanding Client Connections 61
3
VMware Horizon View Architecture Planning
Choosing a User Authentication Method 64
Restricting View Desktop Access 66
Using Group Policy Settings to Secure View Desktops 67
Implementing Best Practices to Secure Client Systems 68
Assigning Administrator Roles 68
Preparing to Use a Security Server 69
Understanding Horizon View Communications Protocols 74
Overview of Steps to Setting Up a Horizon View Environment 81
6
Index 83
4 VMware, Inc.
VMware Horizon View Architecture Planning
VMware Horizon View Architecture Planning provides an introduction to VMware® Horizon View™, including
a description of its major features and deployment options and an overview of how the components are
typically set up in a production environment.
This guide answers the following questions:
n
Does VMware Horizon View solve the problems you need it to solve?
n
Would it be feasible and cost-effective to implement a Horizon View solution in your enterprise?
To help you protect your installation, this guide also provides a discussion of security features.
Intended Audience
This information is intended for IT decision makers, architects, administrators, and others who need to
familiarize themselves with the components and capabilities of Horizon View. With this information, architects
and planners can determine whether Horizon View satisfies the requirements of their enterprise for efficiently
and securely delivering Windows desktops and applications to their end users. The example architecture helps
planners understand the hardware requirements and setup effort required for a large-scale deployment.
VMware, Inc.
5
VMware Horizon View Architecture Planning
6 VMware, Inc.
Introduction to Horizon View 1
With Horizon View, IT departments can run virtual desktops in the datacenter and deliver desktops to
employees as a managed service. End users gain a familiar, personalized environment that they can access
from any number of devices anywhere throughout the enterprise or from home. Administrators gain
centralized control, efficiency, and security by having desktop data in the datacenter.
This chapter includes the following topics:
n
“Advantages of Using Horizon View,” on page 7
n
“Horizon View Features,” on page 9
n
“How the Components Fit Together,” on page 10
n
“Integrating and Customizing Horizon View,” on page 14
Advantages of Using Horizon View
When you manage enterprise desktops with Horizon View, the benefits include increased reliability, security,
hardware independence, and convenience.
Reliability and Security
VMware, Inc.
Virtual desktops can be centralized by integrating with VMware vSphere and virtualizing server, storage, and
networking resources. Placing desktop operating systems and applications on a server in the datacenter
provides the following advantages:
n
Access to data can easily be restricted. Sensitive data can be prevented from being copied onto a remote
employee's home computer.
n
RADIUS support provides flexibility when choosing among two-factor authentication vendors.
Supported vendors include RSA SecureID, VASCO DIGIPASS, SMS Passcode, and SafeNet, among others.
n
Integration with Horizon Workspace means that end users have on-demand access to View desktops
through the same Web-based application catalog they use to access SaaS, Web, and Windows applications.
Inside a View desktop, users can also use Horizon Workspace Catalog to access applications.
n
The ability to provision View desktops with pre-created Active Directory accounts addresses the
requirements of locked-down Active Directory environments that have read-only access policies.
n
Data backups can be scheduled without considering when end users' systems might be turned off.
n
Virtual desktops that are hosted in a datacenter experience little or no downtime. Virtual machines can
reside on high-availability clusters of VMware servers.
Virtual desktops can also connect to back-end physical systems and Windows Terminal Services servers.
7
VMware Horizon View Architecture Planning
Convenience
The unified management console is built for scalability on Adobe Flex, so that even the largest
Horizon View deployments can be efficiently managed from a single View Manager interface. Wizards and
dashboards enhance the workflow and facilitate drilling down to see details or change settings. Figure 1-1
provides an example of the browser-based user interface for View Administrator.
Figure 1-1. Administrative Console for View Manager Showing the Dashboard View
Another feature that increases convenience is the VMware remote display protocol PCoIP. PCoIP (PC-overIP) display protocol delivers an end-user experience equal to the current experience of using a physical PC:
n
On LANs, the display is faster and smoother than traditional remote displays.
n
On WANs, the display protocol can compensate for an increase in latency or a reduction in bandwidth,
ensuring that end users can remain productive regardless of network conditions.
Manageability
Provisioning desktops for end users is a quick process. No one is required to install applications one by one
on each end user's physical PC. End users connect to a virtual desktop complete with applications. End users
can access their same virtual desktop from various devices at various locations.
Using VMware vSphere to host virtual desktops provides the following benefits:
n
Administration tasks and management chores are reduced. Administrators can patch and upgrade
applications and operating systems without touching a user's physical PC.
n
Integration with Horizon Workspace means that IT managers can use the Horizon Workspace
Administrator Web interface to monitor user and group entitlements to View desktops.
n
With View Persona Management, physical and virtual desktops can be centrally managed, including user
profiles, application entitlement, policies, performance, and other settings. Deploy View Persona
Management to physical desktop users prior to converting to virtual desktops.
n
Storage management is simplified. Using VMware vSphere, you can virtualize volumes and file systems
to avoid managing separate storage devices.
n
With the View storage accelerator, the IOPS storage load is dramatically reduced, supporting end-user
logins at larger scales without requiring any special storage array technology.
8 VMware, Inc.
n
If View desktops use the space-efficient disk format available with vSphere 5.1 and later, stale or deleted
data within a guest operating system is automatically reclaimed with a wipe and shrink process.
Hardware Independence
Virtual machines are hardware-independent. Because a View desktop runs on a server in the datacenter and
is only accessed from a client device, a View desktop can use operating systems that might not be compatible
with the hardware of the client device.
For example, although Windows 7 and 8 can run only on Windows 7- and 8-enabled devices, you can install
Windows 7 or 8 in a virtual machine and use that virtual machine on a PC that is not Windows 7- or 8-enabled.
Virtual desktops run on PCs, Macs, thin clients, PCs that have been repurposed as thin clients, tablets, and
phones.
If you use the HTML Access feature, end users can open a View desktop inside a browser, without having to
install any client application on the client system or device.
Horizon View Features
Features included in Horizon View support usability, security, centralized control, and scalability.
The following features provide a familiar experience for the end user:
Chapter 1 Introduction to Horizon View
n
On Microsoft Windows client devices, print from a virtual desktop to any local or networked printer that
is defined on the Windows client device. This virtual printer feature solves compatibility issues and does
not require you to install additional print drivers in a virtual machine.
n
On any client device, use the location-based printing feature to map to printers that are physically near
the client system. Location-based printing does require that you install print drivers in the virtual machine.
n
Use multiple monitors. With PCoIP multiple-monitor support, you can adjust the display resolution and
rotation separately for each monitor.
n
Access USB devices and other peripherals that are connected to the local device that displays your virtual
desktop.
You can specify which types of USB devices end users are allowed to connect to. For composite devices
that contain multiple types of devices, such as a video input device and a storage device, you can split the
device so that one device (for example, the video input device) is allowed but the other device (for example,
the storage device) is not.
n
Use View Persona Management to retain user settings and data between sessions even after the desktop
has been refreshed or recomposed. View Persona Management has the ability to replicate user profiles to
a remote profile store (CIFS share) at configurable intervals.
You can also use a standalone version of View Persona Management on physical computers and virtual
machines that are not managed by View.
Horizon View offers the following security features, among others:
n
Use two-factor authentication, such as RSA SecurID or RADIUS (Remote Authentication Dial-In User
Service), or smart cards to log in.
n
Use pre-created Active Directory accounts when provisioning View desktops in environments that have
read-only access policies for Active Directory.
n
Use SSL tunneling to ensure that all connections are completely encrypted.
n
Use VMware High Availability to host desktops and to ensure automatic failover.
VMware, Inc. 9
VMware Horizon View Architecture Planning
Scalability features depend on the VMware virtualization platform to manage both desktops and servers:
n
Integrate with VMware vSphere to achieve cost-effective densities, high levels of availability, and
advanced resource allocation control for your virtual desktops.
n
Use the Horizon View storage accelerator feature to support end-user logins at larger scales with the same
storage resources. This storage accelerator uses features in the vSphere 5 platform to create a host memory
cache of common block reads.
n
Configure View Connection Server to broker connections between end users and the virtual desktops that
they are authorized to access.
n
Use View Composer to quickly create desktop images that share virtual disks with a master image. Using
linked clones in this way conserves disk space and simplifies the management of patches and updates to
the operating system.
The following features provide centralized administration and management:
n
Use Microsoft Active Directory to manage access to virtual desktops and to manage policies.
n
Use View Persona Management to simplify and streamline migration from physical to virtual desktops.
n
Use the Web-based administrative console to manage virtual desktops from any location.
n
Use a template, or master image, to quickly create and provision pools of desktops.
n
Send updates and patches to virtual desktops without affecting user settings, data, or preferences.
n
Integrate with Horizon Workspace so that end users can access View desktops through the Horizon
Workspace Web Client, as well as use the Horizon Workspace Web Client from inside a View desktop.
How the Components Fit Together
End users start View Client to log in to View Connection Server. This server, which integrates with Windows
Active Directory, provides access to a virtual desktop hosted in a VMware vSphere environment, a blade or
physical PC, or a Windows Terminal Services server.
Figure 1-2 shows the relationship between the major components of a Horizon View deployment.
10 VMware, Inc.
Figure 1-2. High-Level Example of a Horizon View Environment
ESXi hosts running
Virtual Desktop virtual machines
View
Connection
Server
View
Administrator
(browser)
VMware vCenter Server
with View Composer
network
Windows
View Client
Mac
View Client
Windows View Client
with Local Mode
Thin Client
virtual desktops
ESXi host
VM VM VM
VM VM VM
VM
virtual machine
desktop OS
app app app
View Agent
Microsoft
Active Directory
Terminal Servers
blade PCs
physical PCs
non-vCenter VMs
View Agent
View
Transfer Server ThinApp
tablet
Chapter 1 Introduction to Horizon View
Client Devices
A major advantage of using Horizon View is that desktops follow the end user regardless of device or location.
Users can access their personalized virtual desktop from a company laptop, their home PC, a thin client device,
a Mac, or a tablet.
From tablets and from Mac, Linux, and Windows laptops and PCs, end users open View Client to display their
View desktop. Thin client devices use View thin client software and can be configured so that the only
application that users can launch directly on the device is View Thin Client. Repurposing a legacy PC into a
thin client desktop can extend the life of the hardware by three to five years. For example, by using
Horizon View on a thin desktop, you can use a newer operating system such as Windows 7 on older desktop
hardware.
If you use the HTML Access feature, end users can open a View desktop inside a browser, without having to
install any client application on the client system or device.
VMware, Inc. 11
VMware Horizon View Architecture Planning
View Connection Server
This software service acts as a broker for client connections. View Connection Server authenticates users
through Windows Active Directory and directs the request to the appropriate virtual machine, physical or
blade PC, or Windows Terminal Services server.
View Connection Server provides the following management capabilities:
n
Authenticating users
n
Entitling users to specific desktops and pools
n
Assigning applications packaged with VMware ThinApp to specific desktops and pools
n
Managing local and remote desktop sessions
n
Establishing secure connections between users and desktops
n
Enabling single sign-on
n
Setting and applying policies
Inside the corporate firewall, you install and configure a group of two or more View Connection Server
instances. Their configuration data is stored in an embedded LDAP directory and is replicated among members
of the group.
Outside the corporate firewall, in the DMZ, you can install and configure View Connection Server as a security
server. Security servers in the DMZ communicate with View Connection Servers inside the corporate firewall.
Security servers ensure that the only remote desktop traffic that can enter the corporate data center is traffic
on behalf of a strongly authenticated user. Users can access only the desktop resources that they are authorized
to access.
Security servers offer a subset of functionality and are not required to be in an Active Directory domain. You
install View Connection Server in a Windows Server 2008 server, preferably on a VMware virtual machine.
View Client
The client software for accessing View desktops can run on a tablet, a Windows, Linux, or Mac PC or laptop,
a thin client, and more.
After logging in, users select from a list of virtual desktops that they are authorized to use. Authorization can
require Active Directory credentials, a UPN, a smart card PIN, or an RSA SecurID or other two-factor
authentication token.
An administrator can configure View Client to allow end users to select a display protocol. Protocols include
PCoIP and Microsoft RDP. The speed and display quality of PCoIP rival that of a physical PC.
View Client with Local Mode (formerly called Offline Desktop) is a version of View Client that has been
extended to allow end users to download virtual machines and use them on their local Windows systems
regardless of whether they have a network connection.
Features differ according to which View Client you use. This guide focuses on View Client for Windows. The
following types of clients are not described in detail in this guide:
n
Details about View Client for tablets, Linux clients, and Mac clients. See the Horizon View clients
documentation at https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.
n
Details about the View Web Client, available with the HTML Access feature, which allows you to open a
View desktop inside a browser. No View Client application is installed on the client system or device. See
the Horizon View clients documentation at
https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.
n
Various third-party thin clients and zero clients, available only through certified partners.
12 VMware, Inc.
Chapter 1 Introduction to Horizon View
n
View Open Client, which supports the VMware partner certification program. View Open Client is not
an official View client and is not supported as such.
View Portal
To use View Portal, end users on a Windows, Linux, or Mac PC or laptop open a Web browser and enter the
URL of a View Connection Server instance. View Portal provides links for downloading the installers for the
full View Client.
By default, when you open a browser and enter the URL of a View Connection Server instance, the View Portal
page that appears contains links to the VMware Downloads site for downloading View Client. The links on
the View Portal page are configurable, however. For example, you can configure the links to point to an internal
Web server, or you can limit which client versions are available on your own View Connection Server.
If you use the HTML Access feature, View Portal also displays a link to the View Web Client, which allows
you to open a View desktop inside a supported browser. No View Client application is installed on the client
system or device. For more information, see the Horizon View clients documentation at
https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.
View Agent
You install the View Agent service on all virtual machines, physical systems, and Terminal Service servers that
you use as sources for View desktops. On virtual machines, this agent communicates with View Client to
provide features such as connection monitoring, virtual printing, View Persona Management, and access to
locally connected USB devices.
If the desktop source is a virtual machine, you first install the View Agent service on that virtual machine and
then use the virtual machine as a template or as a parent of linked clones. When you create a pool from this
virtual machine, the agent is automatically installed on every virtual desktop.
You can install the agent with an option for single sign-on. With single sign-on, users are prompted to log in
only when they connect to View Connection Server and are not prompted a second time to connect to a virtual
desktop.
View Administrator
This Web-based application allows administrators to configure View Connection Server, deploy and manage
View desktops, control user authentication, and troubleshoot end user issues.
When you install a View Connection Server instance, the View Administrator application is also installed. This
application allows administrators to manage View Connection Server instances from anywhere without having
to install an application on their local computer.
View Composer
You can install this software service on a vCenter Server instance that manages virtual machines or on a separate
server. View Composer can then create a pool of linked clones from a specified parent virtual machine. This
strategy reduces storage costs by up to 90 percent.
Each linked clone acts like an independent desktop, with a unique host name and IP address, yet the linked
clone requires significantly less storage because it shares a base image with the parent.
Because linked-clone desktop pools share a base image, you can quickly deploy updates and patches by
updating only the parent virtual machine. End users' settings, data, and applications are not affected. You can
also use linked-clone technology for View desktops that you download and check out to use on local systems.
Although you can install View Composer on its own server host, a View Composer service can operate with
only one vCenter Server instance. Similarly, a vCenter Server instance can be associated with only one View
Composer service.
VMware, Inc. 13
VMware Horizon View Architecture Planning
vCenter Server
This service acts as a central administrator for VMware ESX/ESXiservers that are connected on a network.
vCenter Server, provides the central point for configuring, provisioning, and managing virtual machines in
the datacenter.
In addition to using these virtual machines as sources for View desktop pools, you can use virtual machines
to host the server components of Horizon View including Connection Server instances, Active Directory
servers, and vCenter Server instances.
You can install View Composer on the same server as vCenter Server to create linked-clone desktop pools.
vCenter Server then manages the assignment of the virtual machines to physical servers and storage and
manages the assignment of CPU and memory resources to virtual machines.
With vCenter Server 5.1 or later, if you add the View Desktops plug-in to the vSphere Web Client, you can use
the View Desktops feature in vSphere Web Client to search for a View user, display the user's desktop, and
troubleshoot problems with the underlying virtual machine.
You install vCenter Server in a Windows Server 2008 server, preferably on a VMware virtual machine.
View Transfer Server
This software manages and streamlines data transfers between the datacenter and View desktops that are
checked out for use on end users' local systems. View Transfer Server is required to support desktops that run
View Client with Local Mode.
Several operations use View Transfer Server to send data between the View desktop in vCenter Server and the
corresponding local desktop on the client system.
n
When a user checks in or checks out a desktop, View Manager authorizes and manages the operation.
View Transfer Server transfers the files between the datacenter and the local desktop.
n
View Transfer Server synchronizes local desktops with the corresponding desktops in the datacenter by
replicating user-generated changes to the datacenter.
Replications occur at intervals that you specify in local-mode policies. You can also initiate replications in
View Administrator. You can set a policy that allows users to initiate replications from their local desktops.
n
View Transfer Server distributes common system data from the datacenter to local clients. View Transfer
Server downloads View Composer base images from the Transfer Server repository to local desktops.
Integrating and Customizing Horizon View
To enhance the effectiveness of Horizon View in your organization, you can use several interfaces to integrate
Horizon View with external applications or to create administration scripts that you can run from the command
line or in batch mode.
Integrating with Horizon Workspace
You can integrate Horizon Workspace with Horizon View to provide the following benefits to IT managers
and end users:
n
End users have on-demand access to View desktops through the same Web-based
Horizon Workspace Catalog they use to access SaaS, Web, and Windows applications, with the same single
sign-on convenience.
n
End users can access the Horizon Workspace Web Client from inside a View desktop for applications they
need.
n
If you also use the HTML Access feature, end users can open a View desktop inside a browser, without
having to install any client application on the client system or device.
14 VMware, Inc.
Chapter 1 Introduction to Horizon View
n
IT managers can use the Horizon Workspace Administrator Web interface to monitor user and group
entitlements to View desktops.
Integrating Horizon View with Business Intelligence Software
You can configure View Connection Server to record events to a Microsoft SQL Server or Oracle database.
n
End-user actions such as logging in and starting a desktop session.
n
Administrator actions such as adding entitlements and creating desktop pools.
n
Alerts that report system failures and errors.
n
Statistical sampling such as recording the maximum number of users over a 24-hour period.
You can use business intelligence reporting engines such as Crystal Reports, IBM Cognos, MicroStrategy 9,
and Oracle Enterprise Performance Management System to access and analyze the event database.
For more information, see the VMware Horizon View Integration document.
You can alternatively generate Horizon View events in Syslog format so that the event data can be accessible
to analytics software. If you enable file-based logging of events, events are accumulated in a local log file. If
you specify a file share, the log files are moved to that share. For more information, see the
VMware Horizon View Installation document.
Using View PowerCLI to Create Administration Scripts
Windows PowerShell is a command-line and scripting environment that is designed for Microsoft Windows.
PowerShell uses the .NET object model and provides administrators with management and automation
capabilities. As with any other console environment, you work with PowerShell by running commands, which
are called cmdlets in PowerShell.
The View PowerCLI provides an easy-to-use PowerShell interface to Horizon View. You can use the
View PowerCLI cmdlets to perform various administration tasks on Horizon View components.
n
Create and update desktop pools.
n
Configure multiple network labels to greatly expand the number of IP addresses assigned to virtual
machines in a pool.
n
Add datacenter resources to a full virtual machine or linked-clone pool.
n
Perform rebalance, refresh, or recompose operations on linked-clone desktops.
n
Sample the usage of specific desktops or desktop pools over time.
n
Query the event database.
n
Query the state of services.
You can use the cmdlets in conjunction with the vSphere PowerCLI cmdlets, which provide an administrative
interface to the VMware vSphere product.
For more information, see the Horizon View Integration document.
Modifying LDAP Configuration Data in View
When you use View Administrator to modify the configuration of Horizon View, the appropriate LDAP data
in the repository is updated. View Connection Server stores its configuration information in an LDAP
compatible repository. For example, if you add a desktop pool, View Connection Server stores information
about users, user groups, and entitlements in LDAP.
VMware, Inc. 15
VMware Horizon View Architecture Planning
You can use VMware and Microsoft command-line tools to export and import LDAP configuration data in
LDAP Data Interchange Format (LDIF) files from and into Horizon View. These commands are for advanced
administrators who want to use scripts to update configuration data without using View Administrator or
View PowerCLI.
You can use LDIF files to perform a number of tasks.
n
Transfer configuration data between View Connection Server instances.
n
Define a large number of Horizon View objects, such as desktop pools, and add these to your View
Connection Server instances without using View Administrator or View PowerCLI.
n
Back up a configuration so that you can restore the state of a View Connection Server instance.
For more information, see the Horizon View Integration document.
Using SCOM to Monitor View Components
You can use Microsoft System Center Operations Manager (SCOM) to monitor the state and performance of
Horizon View components, including View Connection Server instances and security servers and the services
running on these hosts.
For more information, see the Horizon View Integration document.
Using the vdmadmin Command
You can use the vdmadmin command line interface to perform a variety of administration tasks on a View
Connection Server instance. You can use vdmadmin to perform administration tasks that are not possible from
within the View Administrator user interface or that need to run automatically from scripts.
For more information, see the Horizon View Administration document.
16 VMware, Inc.
Planning a Rich User Experience 2
VMware Horizon View provides the familiar, personalized desktop environment that end users expect. For
example, on some client systems, end users can access USB and other devices connected to their local computer,
send documents to any printer that their local computer can detect, authenticate with smart cards, and use
multiple display monitors.
Horizon View includes many features that you might want to make available to your end users. Before you
decide which features to use, you must understand the limitations and restrictions of each feature.
This chapter includes the following topics:
n
“Feature Support Matrix,” on page 17
n
“Choosing a Display Protocol,” on page 19
n
“Using View Persona Management to Retain User Data and Settings,” on page 21
n
“Benefits of Using View Desktops in Local Mode,” on page 23
n
“Accessing USB Devices Connected to a Local Computer,” on page 24
n
“Printing from a View Desktop,” on page 25
n
“Streaming Multimedia to a View Desktop,” on page 25
n
“Using Single Sign-On for Logging In to a View Desktop,” on page 26
n
“Using Multiple Monitors with a View Desktop,” on page 26
Feature Support Matrix
Many features, such as RSA SecurID authentication, location-based printing, and PCoIP protocol, are
supported on most client operating systems. You must also take into consideration whether the feature is
supported on the View desktop operating system.
When planning which display protocol and features to make available to your end users, use the following
information to determine which client operating systems and agent (View desktop) operating systems support
the feature.
The types and editions of the supported guest operating system depend on the Windows version.
Table 2-1. View Agent Operating System Support
Guest Operating System Version Edition Service Pack
Windows 8 64-bit and 32-bit Enterprise and
Professional
Windows 7 64-bit and 32-bit Enterprise and
Professional
VMware, Inc. 17
N/A
None and SP1
VMware Horizon View Architecture Planning
Table 2-1. View Agent Operating System Support (Continued)
Guest Operating System Version Edition Service Pack
Windows Vista 32-bit Business and
Enterprise
Windows XP 32-bit Professional SP3
Windows 2008 R2 Terminal Server 64-bit Standard SP1
Windows 2008 Terminal Server 64-bit Standard SP2
SP1 and SP2
Table 2-2. Features Supported on Operating Systems for View Desktops (Where View Agent Is Installed)
Windows
Feature Windows XP
USB access X X X X
RDP display protocol X X X X X
PCoIP display protocol X X X X
Persona Management X X X X
Wyse MMR X X
Location-based printing X X X X
Virtual printing X X X X
Smart cards X X X X X
RSA SecurID or RADIUS X X X N/A X
Single sign-on X X X X X
Multiple monitors X X X With RDP 7 X
Local Mode X X X X
Vista Windows 7 Windows 2008 Windows 8
Table 2-3. Features Supported on Windows-Based View Clients
Feature Windows XP Windows Vista Windows 7 Windows 8
USB access X X X X
RDP display protocol X X X X
PCoIP display protocol X X X X
Persona Management X (not with local
mode)
Wyse MMR X X
Location-based printing X X X X
Virtual printing X X X X
Smart cards X X X X
RSA SecurID or RADIUS X X X X
Single sign-on X X X X
Multiple monitors X X X X
Local Mode X X X X
X (not with local
mode)
X (not with local
mode)
X (not with local mode)
For information about which editions of each client operating system are supported, or which service packs,
see the system requirements topics.
18 VMware, Inc.
In addition, several VMware partners offer thin client devices for Horizon View deployments. The features
that are available for each thin client device are determined by the vendor and model and the configuration
that an enterprise chooses to use. For information about the vendors and models for thin client devices, see
the Thin Client Compatibility Guide, available on the VMware Web site.
NOTE For information about which features are supported on Mac OS X or Linux clients, or on tablets, see the
Horizon View clients documentation at
https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.
Choosing a Display Protocol
A display protocol provides end users with a graphical interface to a View desktop that resides in the
datacenter. Depending on which type of client device you have, you can choose between PCoIP (PC-over-IP),
which VMware provides, or Microsoft RDP (Remote Desktop Protocol).
You can set policies to control which protocol is used or to allow end users to choose the protocol when they
log in to a desktop.
NOTE For some types of clients, neither the PCoIP nor the RDP remote display protocol is used. For example,
when you check out a desktop for use on a local client system, neither of these remote display protocols is
used.
Chapter 2 Planning a Rich User Experience
Similarly, if you use the VMware Horizon View HTML Access client, available with the HTML Access feature,
HTTPS is used, rather than PCoIP or RDP.
Horizon View with PCoIP
PCoIP provides an optimized desktop experience for the delivery of the entire desktop environment, including
applications, images, audio, and video content for a wide range of users on the LAN or across the WAN. PCoIP
can compensate for an increase in latency or a reduction in bandwidth, to ensure that end users can remain
productive regardless of network conditions.
PCoIP is supported as the display protocol for View desktops with virtual machines and with physical
machines that contain Teradici host cards.
PCoIP Features
Key features of PCoIP include the following:
n
Users outside the corporate firewall can use this protocol with your company's virtual private network
(VPN), or users can make secure, encrypted connections to a View security server in the corporate DMZ.
n
Advanced Encryption Standard (AES) 128-bit encryption is supported and is turned on by default. You
can, however, change the encryption key cipher to AES-192 or AES-256.
n
Connections from all types of View clients.
n
MMR redirection is supported for some Windows client operating systems and some View desktop (agent)
operating systems. See “Feature Support Matrix,” on page 17.
n
USB redirection is supported for some client types.
n
Audio redirection with dynamic audio quality adjustment for LAN and WAN is supported.
n
Optimization controls for reducing bandwidth usage on the LAN and WAN.
n
Multiple monitors are supported for some client types. For example, on Windows-based clients, you can
use up to four monitors and adjust the resolution for each monitor separately, with a resolution of up to
2560x1600 per display. Pivot display and autofit are also supported.
When the 3D feature is enabled, up to 2 monitors are supported with a resolution of up to 1920 X 1200.
VMware, Inc. 19
VMware Horizon View Architecture Planning
n
32-bit color is supported for virtual displays.
n
ClearType fonts are supported.
n
Copy and paste of text and images between a Windows-based client operating system and a View desktop
is supported, up to 1MB. Supported file formats include text, images, and RTF (Rich Text Format). You
cannot copy and paste system objects such as folders and files between systems.
For information about which client devices support specific PCoIP features, go to
https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.
Recommended Guest Operating System Settings
Recommended guest operating system settings include the following settings:
n
For Windows XP desktops: 768MB RAM or more and a single CPU.
n
For Windows 7 or 8 desktops: 1GB of RAM or more and a dual CPU is recommended for playing in highdefinition, full screen mode, or 720p or higher formatted video.
Video Quality Requirements
480p-formatted video
720p-formatted video
1080p-formatted video
3D
You can play video at 480p or lower at native resolutions when the View
desktop has a single virtual CPU. If the operating system is Windows 7 or later
and you want to play the video in high-definition Flash or in full screen mode,
the desktop requires a dual virtual CPU. Even with a dual virtual CPU desktop,
as low as 360p-formatted video played in full screen mode can lag behind
audio, particularly on Windows clients.
You can play video at 720p at native resolutions if the View desktop has a dual
virtual CPU. Performance might be affected if you play videos at 720p in high
definition or in full screen mode.
If the View desktop has a dual virtual CPU, you can play 1080p formatted
video, although the media player might need to be adjusted to a smaller
window size.
If you use VMware vSphere 5.1 or later, you can configure View desktops to
use software or hardware accelerated graphics.
n
With Virtual Shared Graphics Acceleration (vSGA), a vSphere 5.1 feature
that uses physical graphics cards installed on the ESXi hosts, you can use
3D applications for design, modeling, and multimedia.
n
With the software accelerated graphics feature, available with vSphere 5.0
and later, you can use less demanding 3D applications such as Windows
Aero themes, Microsoft Office 2010, and Google Earth.
This non-hardware accelerated graphics feature enables you to run
DirectX 9 and OpenGL 2.1 applications without requiring a physical
graphics processing unit (GPU).
For 3D applications, up to 2 monitors are supported, and the maximum screen
resolution is 1920 x 1200. The guest operating system on the View desktops
must be Windows 7 or later.
Hardware Requirements for Client Systems
For information about processor and memory requirements, see the "Using VMware Horizon View Client"
document for the specific type of desktop or mobile client device. Go to
https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.
20 VMware, Inc.
Chapter 2 Planning a Rich User Experience
Microsoft RDP
Remote Desktop Protocol is the same multichannel protocol many people already use to access their work
computer from their home computer. Microsoft Remote Desktop Connection (RDC) uses RDP to transmit data.
Microsoft RDP provides the following features:
n
With RDP 6, you can use multiple monitors in span mode. RDP 7 has true multiple monitor support, for
up to 16 monitors.
n
You can copy and paste text and system objects such as folders and files between the local system and the
View desktop.
n
32-bit color is supported for virtual displays.
n
RDP supports 128-bit encryption.
n
Users outside the corporate firewall can use this protocol with your company's virtual private network
(VPN), or users can make secure, encrypted connections to a View security server in the corporate DMZ.
NOTE For Windows XP desktop virtual machines, you must install the RDP patches listed in Microsoft
Knowledge Base (KB) articles 323497 and 884020. If you do not install the RDP patches, a Windows Sockets
failed error message might appear on the client.
Hardware Requirements for Client Systems
For information about processor and memory requirements, see the "Using VMware Horizon View Client"
document for the specific type of client system. Go to
https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.
NOTE iOS and Android client devices use only the PCoIP display protocol.
Using View Persona Management to Retain User Data and Settings
You can use View Persona Management with View desktops and with physical computers and virtual
machines that are not managed by VMware Horizon View. View Persona Management retains changes that
users make to their profiles. User profiles comprise a variety of user-generated information.
n
User-specific data and desktop settings, which allow the desktop appearance to be the same regard less
of which desktop a user logs in to.
n
Application data and settings. For example, these settings allow applications to remember toolbar
positions and preferences.
n
Windows registry entries configured by user applications.
To facilitate these abilities, View Persona Management requires storage on a CIFS share equal or greater than
the size of the user's local profile.
Minimizing Logon and Logoff Times
View Persona Management minimizes the time it takes to log on to and off of desktops.
n
View takes recent changes in the profile on the View desktop and copies them to the remote repository at
regular intervals. The default is every 10 minutes. In contrast, Windows roaming profiles wait until logoff
time and copy all changes to the server at logoff.
VMware, Inc. 21
VMware Horizon View Architecture Planning
n
During logon, by default, Horizon View downloads only the files that Windows requires, such as user
registry files. Other files are copied to the View desktop when the user or an application opens them from
the profile folder in the View desktop.
You can configure Horizon View to download specified files when the user logs in and download other
files in the background.
n
With View Persona Management, during logoff, only files that were updated since the last replication are
copied to the remote repository.
With View Persona Management, you can avoid making any changes to Active Directory in order to have a
managed profile. To configure Persona Management, you specify a central repository, without changing the
user's properties in Active Directory. With this central repository, you can manage a user's profile in one
environment without affecting the physical machines that users might also log on to.
With View Persona Management, if you provision desktops with VMware ThinApp applications, the ThinApp
sandbox data can also be stored in the user profile. This data can roam with the user but does not significantly
affect logon times. This strategy provides better protection against data loss or corruption.
Configuration Options
You can configure View personas at several levels: a single View desktop, a desktop pool, an OU, or all View
desktops in your deployment. You can also use a standalone version of View Persona Management on physical
computers and virtual machines that are not managed by View.
By setting group policies (GPOs), you have granular control of the files and folders to include in a persona:
n
Specify whether to include the local settings folder. For Windows 7, Windows 8, and Windows Vista, this
policy affects the AppData\Local folder. For Windows XP, this policy affects the Local Settings folder.
n
Specify which files and folders to load at login time. For example: Application
Data\Microsoft\Certificates. Within a folder, you can also specify files to exclude.
n
Specify which files and folders to download in the background after a user logs in to the desktop. Within
a folder, you can also specify files to exclude.
n
Specify which files and folders within a user's persona to manage with Windows roaming profiles
functionality instead of View Persona Management. Within a folder, you can also specify files to exclude.
As with Windows roaming profiles, you can configure folder redirection. You can redirect the following folders
to a network share.
Contacts My Documents Save Games
Cookies My Music Searches
Desktop My Pictures Start Menu
Downloads My Videos Startup Items
Favorites Network Neighborhood Templates
History Printer Neighborhood Temporary Internet Files
Links Recent Items
To configure a remote repository to store personas, you can use either a network share or an existing Active
Directory user profile path that you configured for Windows roaming profiles. The network share can be a
folder on a server, a network-attached storage (NAS) device, or a network server. To support a large View
deployment, you can configure separate repositories for different desktop pools.
With Horizon View 5.1 and later, you can install a standalone version of View Persona Management on physical
computers and virtual machines that are not managed by View, allowing you to accomplish these goals:
n
Share and manage profiles across standalone systems and View desktops.
22 VMware, Inc.
n
Migrate user profiles from physical systems to View desktops.
n
Perform a staged migration from physical systems to View desktops.
n
Support up-to-date profiles when users go offline.
Limitations
View Persona Management has the following limitations and restrictions:
n
You must have a Horizon View license that includes the View Personal Management component.
n
View Persona Management requires a CIFS (Common Internet File System) share.
n
You cannot use View Persona Management with desktops that run in local mode.
n
A user cannot access the same profile if the user switches between desktops that have v1 user profiles and
v2 user profiles. However, redirected folders can be shared between v1 and v2 profiles. Windows XP uses
v1 profiles. Windows Vista, Windows 7, and Windows 8 use v2 profiles.
Benefits of Using View Desktops in Local Mode
With View Client with Local Mode, users can check out and download a View desktop to a local system such
as a laptop. Administrators can manage these local View desktops by setting policies for the frequency of
backups and contact with the server, access to USB devices, and permission to check in desktops.
Chapter 2 Planning a Rich User Experience
For employees at remote offices with poor network connections, applications run faster on a local View desktop
than on a remote desktop. Also, users can use the local version of the desktop with or without a network
connection.
If a network connection is present on the client system, the desktop that is checked out continues to
communicate with View Connection Server to provide policy updates, and ensure that locally cached
authentication criteria is current. By default, contact is attempted every 6 minutes.
View desktops in local mode behave in the same way as their remote desktop equivalents, yet can take
advantage of local resources. Latency is eliminated, and performance is enhanced. Users can disconnect from
their local View desktop and log in again without connecting to the View Connection Server. After network
access is restored, or when the user is ready, the checked-out virtual machine can be backed up, rolled back,
or checked in.
Local resource
utilization
After a local desktop is checked out, it can take advantage of the memory and
CPU capabilities of the local system. For example, memory available beyond
what is required for the host and guest operating systems is usually split
between the host and the local View desktop, regardless of the memory settings
that are specified for the virtual machine in vCenter Server. Similarly, the local
View desktop can automatically use up to two CPUs available on the local
system, and you can configure the local desktop to use up to four CPUs.
Although a local desktop can take advantage of local resources, a Windows 8,
Windows 7, or Windows Vista View desktop that is created on an ESX/ESXi
3.5 host cannot produce 3D and Windows Aero effects. This limitation applies
even when the desktop is checked out for local use on a Windows 8, Windows
7, or Windows Vista host. Windows Aero and 3D effects are available only if
the View desktop is created using vSphere 4.x or later.
Conserving datacenter
resources by requiring
local mode
You can reduce datacenter costs associated with bandwidth, memory, and CPU
resources by requiring that View desktops be downloaded and used only in
local mode. This strategy is sometimes called a bring-your-own-PC program
for employees and contractors.
VMware, Inc. 23
VMware Horizon View Architecture Planning
Check-outs
Backups
Rollbacks
Check-ins
When the View desktop is checked out, a snapshot is taken in vCenter Server,
to preserve the state of the virtual machine. The vCenter Server version of the
desktop is locked so that no other users can access it. When a View desktop is
locked, vCenter Serveroperations are disabled, including operations such as
powering on the online desktop, taking snapshots, and editing the virtual
machine settings. View administrators can, however, still monitor the local
session and access the vCenter Server version to remove access or roll back the
desktop.
During backups, a snapshot is taken on the client system, to preserve the state
of the checked-out virtual machine. The delta between this snapshot and the
snapshot in vCenter Server is replicated to vCenter Server and merged with
the snapshot there. The View desktop in vCenter Server is updated with all
new data and configurations, but the local desktop remains checked out on the
local system and the lock remains in place in vCenter Server.
During rollbacks, the local View desktop is discarded and the lock is released
in vCenter Server. Future client connections are directed to the View desktop
in vCenter Server until the desktop is checked out again.
When a View desktop is checked in, a snapshot is taken on the client system,
to preserve the state of the virtual machine. The delta between this snapshot
and the snapshot in vCenter Server is replicated to vCenter Server and merged
with the snapshot there. The virtual machine in vCenter Server is unlocked.
Future client connections are directed to the View desktop in vCenter Server
until the desktop is checked out again.
The data on each local system is encrypted with AES. 128-bit encryption is the default, but you can configure
192-bit or 256-bit encryption. The desktop has a lifetime controlled through policy. If the client loses contact
with View Connection Server, the maximum time without server contact is the period in which the user can
continue to use the desktop before the user is refused access. Similarly, if user access is removed, the client
system becomes inaccessible when the cache expires or after the client detects this change through View
Connection Server.
View Client with Local Mode has the following limitations and restrictions:
n
You must have a Horizon View license that includes the Local Mode component.
n
End users cannot access their local desktop while rollbacks and check-ins are taking place.
n
This feature is available only for virtual machines that are managed by vCenter Server.
n
You cannot use View Persona Management with desktops that run in local mode.
n
Assigning application packages created with VMware ThinApp is not supported for View desktops that
are downloaded and used in local mode. Rolling back a desktop might cause View Connection Server to
have incorrect information about the ThinApps on the rolled-back desktop.
n
For security reasons, you cannot access the host CD-ROM from within the View desktop.
n
Also for security reasons, you cannot copy and paste text or system objects such as files and folders between
the local system and the View desktop.
Accessing USB Devices Connected to a Local Computer
Administrators can configure the ability to use USB devices, such as thumb flash drives, VoIP (voice-over-IP)
devices, and printers, from a View desktop. This feature is called USB redirection.
When you use this feature, most USB devices that are attached to the local client system become available from
a menu in View Client. You use the menu to connect and disconnect the devices.
24 VMware, Inc.
Chapter 2 Planning a Rich User Experience
You can specify which types of USB devices end users are allowed to connect to. For composite devices that
contain multiple types of devices, such as a video input device and a storage device, on some client systems,
you can split the device so that one device (for example, the video input device) is allowed but the other device
(for example, the storage device) is not.
NOTE With this USB redirection feature, you can connect to and manage an iPad from a View desktop. For
example, you can sync your iPad with iTunes installed in your View desktop.
USB devices that do not appear in the menu, but are available in a View desktop, include smart card readers
and human interface devices such as keyboards and pointing devices. The View desktop and the local computer
use these devices at the same time.
This feature has the following limitations:
n
When you access a USB device from a menu in View Client and use the device in a View desktop, you
cannot access the device on the local computer.
n
USB redirection is not supported on View desktops sourced from Microsoft Terminal Servers.
n
The USB redirection feature is available only on some types of clients. To find out whether this feature is
supported on a particular type of client, see the feature support matrix included in the "Using
VMware Horizon View Client" document for the specific type of desktop or mobile client device. Go to
https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.
Printing from a View Desktop
The virtual printing feature allows end users with View Client on Windows systems to use local or network
printers from a View desktop without requiring that additional print drivers be installed in the View desktop.
The location-based printing feature allows you to map View desktops to the printer that is closest to the
endpoint client device.
With virtual printing, after a printer is added on a local Windows computer, View adds that printer to the list
of available printers on the View desktop. No further configuration is required. For each printer available
through this feature, you can set preferences for data compression, print quality, double-sided printing, color,
and so on. Users who have administrator privileges can still install printer drivers on the View desktop without
creating a conflict with the virtual printing component.
To send print jobs to a USB printer, you can either use the USB redirection feature or use the virtual printing
feature.
The location-based printing feature is available for both Windows and non-Windows client systems. Locationbased printing allows IT organizations to map View desktops to the printer that is closest to the endpoint client
device. For example, as a doctor moves from room to room in a hospital, each time the doctor prints a document,
the print job is sent to the nearest printer. Using this feature does require that the correct printer drivers be
installed in the View desktop.
Streaming Multimedia to a View Desktop
Wyse MMR (multimedia redirection) enables full-fidelity playback when multimedia files are streamed to a
View desktop.
The MMR feature supports the media file formats that the client system supports, because local decoders must
exist on the client. File formats include MPEG2, WMV, AVI, and WAV, among others.
This feature has the following limitations:
n
For best quality, use Windows Media Player 10 or later, and install it on both the local computer, or client
access device, and the View desktop.
n
The Wyse MMR port, which is 9427 by default, must be added as a firewall exception in the View desktop.
VMware, Inc. 25
VMware Horizon View Architecture Planning
n
MMR is not supported on all versions of Windows clients and virtual desktops. To find out whether this
feature is supported on a particular type of client, see the feature support matrix included in the "Using
VMware Horizon View Client" document for the specific type of desktop or mobile client device. Go to
https://www.vmware.com/support/viewclients/doc/viewclients_pubs.html.
Using Single Sign-On for Logging In to a View Desktop
The single-sign-on (SSO) feature allows you to configure View Manager so that end users are prompted to log
in only once.
If you do not use the single-sign-on feature, end users must log in twice. They are first prompted to log in to
View Connection Server and then are prompted log in to their View desktop. If smart cards are also used, end
users must sign in three times because users must also log in when the smart card reader prompts them for a
PIN.
For View desktops, this feature includes the Graphical Identification and Authentication (GINA) dynamic-link
library for Windows XP and a credential provider dynamic-link library for Windows Vista, Windows 7, and
Windows 8.
Using Multiple Monitors with a View Desktop
Regardless of the display protocol, you can use multiple monitors with a View desktop.
If you use PCoIP, the display protocol from VMware, you can adjust the display resolution and rotation
separately for each monitor. PCoIP allows a true multiple-monitor session rather than a span mode session.
A span mode remote session is actually a single-monitor session. The monitors must be the same size and
resolution, and the monitor layout must fit within a bounding box. If you maximize an application window,
the window spans across all monitors. Microsoft RDP 6 uses span mode.
In a true multiple-monitor session, monitors can have different resolutions and sizes, and a monitor can be
pivoted. If you maximize an application window, the window expands to the full screen of only the monitor
that contains it.
This feature has the following limitations:
n
If you use PCoIP, the maximum number of monitors that you can use to display a View desktop is 4. When
3D feature is enabled, up to 2 monitors are supported with a resolution of up to 1920 X 1200. Pivoted
monitors are supported, but stacked monitors are not.
n
If you use Microsoft RDP 7, the maximum number of monitors that you can use to display a View desktop
is 16.
n
If you use Microsoft RDP display protocol, you must have Microsoft Remote Desktop Connection (RDC)
6.0 or higher installed in the View desktop.
n
If you use a View desktop in local mode, no remote display protocol is used. You can use up to 2 monitors
in span mode.
26 VMware, Inc.
Loading...