User manual

Use the Client Conguration ADM or ADMX template le (vdm_client.adm or vdm_client.admx) to set the
verication mode. All ADM and ADMX les that provide group policy seings are available in a .zip le
named VMware-Horizon-Extras-Bundle-x.x.x-yyyyyyy.zip, where x.x.x is the version and yyyyyyy is the
build number. You can download this GPO bundle from the VMware Horizon download site at
hp://www.vmware.com/go/downloadview. For information about using this template to control GPO
seings, see “Using the Group Policy Template to Congure VMware Horizon Client for Windows,” on
page 44.
N You can also use the Client Conguration ADM or ADMX template le to restrict the use of certain
cryptographic algorithms and protocols before establishing an encrypted SSL connection. For more
information about this seing, see“Security Seings for Client GPOs,” on page 47.
If you do not want to congure the certicate verication seing as a group policy, you can also enable
certicate verication by adding the CertCheckMode value name to one of the following registry keys on the
client computer:
n
For 32-bit Windows: HKEY_LOCAL_MACHINE\Software\VMware, Inc.\VMware VDM\Client\Security
n
For 64-bit Windows: HKLM\SOFTWARE\Wow6432Node\VMware, Inc.\VMware VDM\Client\Security
Use the following values in the registry key:
n
0 implements Do not verify server identity certificates.
n
1 implements Warn before connecting to untrusted servers.
n
2 implements Never connect to untrusted servers.
If you congure both the group policy seing and the CertCheckMode seing in the registry key, the group
policy seing takes precedence over the registry key value.
N In a future release, conguring this seing using the Windows registry might not be supported. A
GPO seing must be used.
Setting the Certificate Checking Mode for Horizon Client
Administrators and sometimes end users can congure whether client connections are rejected if any or
some server certicate checks fail.
Certicate checking occurs for SSL connections between Connection Server and Horizon Client. Certicate
verication includes the following checks:
n
Has the certicate been revoked?
n
Is the certicate intended for a purpose other than verifying the identity of the sender and encrypting
server communications? That is, is it the correct type of certicate?
n
Has the certicate expired, or is it valid only in the future? That is, is the certicate valid according to
the computer clock?
n
Does the common name on the certicate match the host name of the server that sends it? A mismatch
can occur if a load balancer redirects Horizon Client to a server that has a certicate that does not match
the host name entered in Horizon Client. Another reason a mismatch can occur is if you enter an IP
address rather than a host name in the client.
Using VMware Horizon Client for Windows
42 VMware, Inc.