Administration
Table Of Contents
- Horizon 7 Administration
- Contents
- Horizon 7 Administration
- Using Horizon Administrator
- Configuring Horizon Connection Server
- Configuring vCenter Server and View Composer
- Create a User Account for View Composer AD Operations
- Add vCenter Server Instances to Horizon 7
- Configure View Composer Settings
- Configure View Composer Domains
- Allow vSphere to Reclaim Disk Space in Linked-Clone Virtual Machines
- Configure View Storage Accelerator for vCenter Server
- Concurrent Operations Limits for vCenter Server and View Composer
- Setting a Concurrent Power Operations Rate to Support Remote Desktop Logon Storms
- Accept the Thumbprint of a Default TLS Certificate
- Remove a vCenter Server Instance from Horizon 7
- Remove View Composer from Horizon 7
- Conflicting vCenter Server Unique IDs
- Backing Up Horizon Connection Server
- Configuring Settings for Client Sessions
- Set Options for Client Sessions and Connections
- Change the Data Recovery Password
- Global Settings for Client Sessions
- Global Security Settings for Client Sessions and Connections
- Message Security Mode for Horizon 7 Components
- Configure the Secure Tunnel and PCoIP Secure Gateway
- Configure the Blast Secure Gateway
- Off-load TLS Connections to Intermediate Servers
- Configure the Gateway Location for a Horizon Connection Server or Security Server Host
- Disable or Enable Horizon Connection Server
- Edit the External URLs
- Join or Withdraw from the Customer Experience Program
- View LDAP Directory
- Configuring vCenter Server and View Composer
- Setting Up Smart Card Authentication
- Logging In with a Smart Card
- Configure Smart Card Authentication on Horizon Connection Server
- Configure Smart Card Authentication on Third-Party Solutions
- Prepare Active Directory for Smart Card Authentication
- Verify Your Smart Card Authentication Configuration
- Using Smart Card Certificate Revocation Checking
- Setting Up Other Types of User Authentication
- Using Two-Factor Authentication
- Using SAML Authentication
- Using SAML Authentication for VMware Identity Manager Integration
- Configure a SAML Authenticator in Horizon Administrator
- Configure Proxy Support for VMware Identity Manager
- Change the Expiration Period for Service Provider Metadata on Connection Server
- Generate SAML Metadata So That Connection Server Can Be Used as a Service Provider
- Response Time Considerations for Multiple Dynamic SAML Authenticators
- Configure Workspace ONE Access Policies in Horizon Administrator
- Configure Biometric Authentication
- Authenticating Users Without Requiring Credentials
- Providing Unauthenticated Access for Published Applications
- Create Users for Unauthenticated Access
- Enable Unauthenticated Access for Users
- Entitle Unauthenticated Access Users to Published Applications
- Search Unauthenticated Access Sessions
- Delete an Unauthenticated Access User
- Unauthenticated Access From Horizon Client
- Configure Login Deceleration for Unauthenticated Access to Published Applications
- Configure Users for Hybrid Logon
- Using the Log In as Current User Feature Available with Windows-Based Horizon Client
- Saving Credentials in Mobile and Mac Horizon Clients
- Setting Up True SSO
- Determining an Architecture for True SSO
- Set Up an Enterprise Certificate Authority
- Create Certificate Templates Used with True SSO
- Install and Set Up an Enrollment Server
- Export the Enrollment Service Client Certificate
- Import the Enrollment Service Client Certificate on the Enrollment Server
- Configure SAML Authentication to Work with True SSO
- Configure Horizon Connection Server for True SSO
- Command-line Reference for Configuring True SSO
- Advanced Configuration Settings for True SSO
- Identify an AD User That Does not Have an AD UPN
- Unlock a Desktop With True SSO and Workspace ONE
- Using the System Health Dashboard to Troubleshoot Issues Related to True SSO
- Providing Unauthenticated Access for Published Applications
- Configuring Role-Based Delegated Administration
- Understanding Roles and Privileges
- Using Access Groups to Delegate Administration of Pools and Farms
- Understanding Permissions
- Manage Administrators
- Manage and Review Permissions
- Manage and Review Access Groups
- Manage Custom Roles
- Predefined Roles and Privileges
- Required Privileges for Common Tasks
- Best Practices for Administrator Users and Groups
- Configuring Policies in Horizon Administrator and Active Directory
- Maintaining Horizon 7 Components
- Backing Up and Restoring Horizon 7 Configuration Data
- Monitor Horizon 7 Components
- Monitor Machine Status
- Understanding Horizon 7 Services
- Change the Product License Key
- Monitoring Product License Usage
- Update General User Information from Active Directory
- Migrate View Composer to Another Machine
- Update the Certificates on a Connection Server Instance, Security Server, or View Composer
- Join the Customer Experience Improvement Program
- Managing ThinApp Applications in Horizon Administrator
- Horizon 7 Requirements for ThinApp Applications
- Capturing and Storing Application Packages
- Assigning ThinApp Applications to Machines and Desktop Pools
- Best Practices for Assigning ThinApp Applications
- Assign a ThinApp Application to Multiple Machines
- Assign Multiple ThinApp Applications to a Machine
- Assign a ThinApp Application to Multiple Desktop Pools
- Assign Multiple ThinApp Applications to a Desktop Pool
- Assign a ThinApp Template to a Machine or Desktop Pool
- Review ThinApp Application Assignments
- Display MSI Package Information
- Maintaining ThinApp Applications in Horizon Administrator
- Remove a ThinApp Application Assignment from Multiple Machines
- Remove Multiple ThinApp Application Assignments from a Machine
- Remove a ThinApp Application Assignment from Multiple Desktop Pools
- Remove Multiple ThinApp Application Assignments from a Desktop Pool
- Remove a ThinApp Application from Horizon Administrator
- Modify or Delete a ThinApp Template
- Remove an Application Repository
- Monitoring and Troubleshooting ThinApp Applications in Horizon Administrator
- ThinApp Configuration Example
- Setting Up Clients in Kiosk Mode
- Configure Clients in Kiosk Mode
- Prepare Active Directory and Horizon 7 for Clients in Kiosk Mode
- Set Default Values for Clients in Kiosk Mode
- Display the MAC Addresses of Client Devices
- Add Accounts for Clients in Kiosk Mode
- Enable Authentication of Clients in Kiosk Mode
- Verify the Configuration of Clients in Kiosk Mode
- Connect to Remote Desktops from Clients in Kiosk Mode
- Configure Clients in Kiosk Mode
- Troubleshooting Horizon 7
- Using Horizon Help Desk Tool
- Verify Horizon Help Desk Tool License
- Configure Role-Based Access for Horizon Help Desk Tool
- Log In to Horizon Help Desk Tool
- Troubleshooting Users in Horizon Help Desk Tool
- Session Details for Horizon Help Desk Tool
- Session Processes for Horizon Help Desk Tool
- Application Status for Horizon Help Desk Tool
- Troubleshoot Desktop or Application Sessions in Horizon Help Desk Tool
- Using the VMware Logon Monitor
- Using VMware Horizon Performance Tracker
- Monitoring System Health
- Configuring Load Balancers for Horizon Connection Server Health Monitoring
- Monitor Events in Horizon 7
- Collecting Diagnostic Information for Horizon 7
- Create a Data Collection Tool Bundle for Horizon Agent
- Save Diagnostic Information for Horizon Client for Windows
- Collect Diagnostic Information for View Composer Using the Support Script
- Collect Diagnostic Information for Horizon Connection Server
- Collect Diagnostic Information for Horizon Agent, Horizon Client, or Horizon Connection Server from the Console
- Horizon Connection Server Integration with Skyline Collector Appliance
- Update Support Requests
- Troubleshooting an Unsuccessful Security Server Pairing with Horizon Connection Server
- Troubleshooting Horizon 7 Server Certificate Revocation Checking
- Troubleshooting Smart Card Certificate Revocation Checking
- Further Troubleshooting Information
- Using Horizon Help Desk Tool
- Using the vdmadmin Command
- vdmadmin Command Usage
- Configuring Logging in Horizon Agent Using the -A Option
- Overriding IP Addresses Using the -A Option
- Updating Foreign Security Principals Using the ‑F Option
- Listing and Displaying Health Monitors Using the ‑H Option
- Listing and Displaying Reports of Horizon 7 Operation Using the ‑I Option
- Generating Horizon 7 Event Log Messages in Syslog Format Using the ‑I Option
- Assigning Dedicated Machines Using the ‑L Option
- Displaying Information About Machines Using the -M Option
- Reclaiming Disk Space on Virtual Machines Using the ‑M Option
- Configuring Domain Filters Using the ‑N Option
- Configuring Domain Filters
- Displaying the Machines and Policies of Unentitled Users Using the ‑O and ‑P Options
- Configuring Clients in Kiosk Mode Using the ‑Q Option
- Displaying the First User of a Machine Using the -R Option
- Removing the Entry for a Connection Server Instance or Security Server Using the ‑S Option
- Providing Secondary Credentials for Administrators Using the ‑T Option
- Displaying Information About Users Using the ‑U Option
- Unlocking or Locking Virtual Machines Using the ‑V Option
- Detecting and Resolving LDAP Entry and Schema Collisions Using the -X Option
Note If you upgrade to View 5.1 or later from an earlier Horizon 7 release, the global setting
Require SSL for client connections is displayed in Horizon Administrator, but only if the setting
was disabled in your Horizon 7 configuration before you upgraded. Because TLS is required for
all Horizon Client connections and Horizon Administrator connections to Horizon 7, this setting is
not displayed in fresh installations of Horizon 7 5.1 or later versions and is not displayed after an
upgrade if the setting was already enabled in the previous Horizon 7 configuration.
After an upgrade, if you do not enable the Require SSL for client connections setting, HTTPS
connections from Horizon clients will fail, unless they connect to an intermediate device that
is configured to make onward connections using HTTP. See Off-load TLS Connections to
Intermediate Servers.
Message Security Mode for Horizon 7 Components
You can set the message security mode to specify the security mechanism used when JMS
messages pass among Horizon 7 components.
The following table shows the options you can select to configure the message security mode. To
set an option, select it from the
Message security mode list in the Global Settings dialog window.
Table 2-4. Message Security Mode Options
Option Description
Disabled Message security mode is disabled.
Mixed Message security mode is enabled but not enforced.
You can use this mode to detect components in your Horizon 7 environment that predate Horizon 7 3.0.
The log files generated by Connection Server contain references to these components. This setting is not
recommended. Use this setting only to discover components that need to be upgraded.
Enabled Message security mode is enabled, using a combination of message signing and encryption. JMS
messages are rejected if the signature is missing or invalid, or if a message was modified after it was
signed.
Some JMS messages are encrypted because they carry sensitive information such as user credentials. If
you use the Enabled setting, you can also use IPSec to encrypt all JMS messages between Connection
Server instances, and between Connection Server instances and security servers.
Note Horizon 7 components that predate version 3.0 are not allowed to communicate with other Horizon
7 components.
Enhanced SSL is used for all JMS connections. JMS access control is also enabled so that desktops, security servers,
and Connection Server instances can only send and receive JMS messages on certain topics.
Horizon 7 components that predate Horizon 6 version 6.1 cannot communicate with a Connection Server
6.1 instance.
Note Using this mode requires opening TCP port 4002 between DMZ-based security servers and their
paired Connection Server instances.
Horizon 7 Administration
VMware, Inc. 38