Installation and Setup Guide

You can use the Horizon Client Conguration ADMX template le (vdm_client.admx) to set the verication
mode. All ADMX les that provide group policy seings are available in a .zip le named VMware-Horizon-
Extras-Bundle-x.x.x-yyyyyyy.zip, where x.x.x is the version and yyyyyyy is the build number. You can
download this GPO bundle from the VMware Horizon download site at
hp://www.vmware.com/go/downloadview. For information about using this template to control GPO
seings, see “Using the Group Policy Template to Congure VMware Horizon Client for Windows,” on
page 44.
N You can also use the Horizon Client Conguration ADMX template le to restrict the use of certain
cryptographic algorithms and protocols before establishing an encrypted SSL connection. For more
information about this seing, see“Security Seings for Client GPOs,” on page 47.
If you do not want to congure the certicate verication seing as a group policy, you can also enable
certicate verication by adding the CertCheckMode value name to one of the following registry keys on the
client computer:
n
For 32-bit Windows: HKEY_LOCAL_MACHINE\Software\VMware, Inc.\VMware VDM\Client\Security
n
For 64-bit Windows: HKLM\SOFTWARE\Wow6432Node\VMware, Inc.\VMware VDM\Client\Security
Use the following values in the registry key:
n
0 implements Do not verify server identity certificates.
n
1 implements Warn before connecting to untrusted servers.
n
2 implements Never connect to untrusted servers.
If you congure both the group policy seing and the CertCheckMode seing in the registry key, the group
policy seing takes precedence over the registry key value.
N In a future release, conguring this seing using the Windows registry might not be supported. A
GPO seing must be used.
Configuring Advanced TLS/SSL Options
You can select the security protocols and cryptographic algorithms that are used to encrypt communications
between Horizon Client and servers, or between Horizon Client and the agent in the remote desktop.
These security options are also used to encrypt the USB channel.
With the default seing, cipher suites use 128- or 256-bit AES, remove anonymous DH algorithms, and then
sort the current cipher list in order of encryption algorithm key length.
By default, TLS v1.0, TLS v1.1, and TLS v1.2 are enabled. SSL v2.0 and v3.0 are not supported.
N If TLS v1.0 and RC4 are disabled, USB redirection does not work when users are connected to
Windows XP desktops. Be aware of the security risk if you choose to make this feature work by enabling
TLS v1.0 and RC4.
If you congure a security protocol for Horizon Client that is not enabled on the server to which the client
connects, a TLS/SSL error occurs and the connection fails.
I At least one of the protocols that you enable in Horizon Client must also be enabled on the
remote desktop. Otherwise, USB devices cannot be redirected to the remote desktop.
Chapter 3 Configuring Horizon Client for End Users
VMware, Inc. 43