Configuring Remote Desktop Features

Video feature. In some cases, a USB device might not be excluded from redirection by default but might
require administrators to explicitly exclude the device from redirection. For example, the following types of
USB devices are not good candidates for USB redirection and must not be automatically connected to a
remote desktop:
n
USB Ethernet devices. If you redirect a USB Ethernet device, your client system might lose network
connectivity if that device is the only Ethernet device.
n
Touch screen devices. If you redirect a touch screen device, the remote desktop will receive touch input
but not keyboard input.
If you have set the remote desktop to autoconnect USB devices, you can congure a policy to exclude
specic devices such as touch screens and network devices. For more information, see “Conguring Filter
Policy Seings for USB Devices,” on page 79.
On Windows clients, as an alternative to using seings that automatically connect all but excluded devices,
you can edit a conguration le on the client that sets Horizon Client to reconnect only a specic device or
devices, such as smart phones and tablets, to the remote desktop. For instructions, see Using
VMware Horizon Client for Windows.
Deploying USB Devices in a Secure Horizon 7 Environment
USB devices can be vulnerable to a security threat called BadUSB, in which the rmware on some USB
devices can be hijacked and replaced with malware. For example, a device can be made to redirect network
trac or to emulate a keyboard and capture keystrokes. You can congure the USB redirection feature to
protect your Horizon 7 deployment against this security vulnerability.
By disabling USB redirection, you can prevent any USB devices from being redirected to your users'
Horizon 7 desktops and applications. Alternatively, you can disable redirection of specic USB devices,
allowing users to have access only to specic devices on their desktops and applications.
The decision whether to take these steps depends on the security requirements in your organization. These
steps are not mandatory. You can install USB redirection and leave the feature enabled for all USB devices in
your Horizon 7 deployment. At a minimum, consider seriously the extent to which your organization
should try to limit its exposure to this security vulnerability.
Disabling USB Redirection for All Types of Devices
Some highly secure environments require you to prevent all USB devices that users might have connected to
their client devices from being redirected to their remote desktops and applications. You can disable USB
redirection for all desktop pools, for specic desktop pools, or for specic users in a desktop pool.
Use any of the following strategies, as appropriate for your situation:
n
When you install Horizon Agent on a desktop image or RDS host, deselect the USB redirection setup
option. (The option is deselected by default.) This approach prevents access to USB devices on all
remote desktops and applications that are deployed from the desktop image or RDS host.
n
In Horizon Administrator, edit the USB access policy for a specic pool to either deny or allow access.
With this approach, you do not have to change the desktop image and can control access to USB devices
in specic desktop and application pools.
Only the global USB access policy is available for RDS desktop and application pools. You cannot set
this policy for individual RDS desktop or application pools.
n
In View Administrator, after you set the policy at the desktop or application pool level, you can
override the policy for a specic user in the pool by selecting the User Overrides seing and selecting a
user.
n
Set the Exclude All Devices policy to true, on the Horizon Agent side or on the client side, as
appropriate.
Chapter 4 Using USB Devices with Remote Desktops and Applications
VMware, Inc. 73