Installation and Setup Guide

Table Of Contents
n
(Warn) End users are warned if a self-signed certificate is being presented by the server. Users can
choose whether or not to allow this type of connection.
n
(Full security) Full verification is performed and connections that do not pass full verification are
rejected.
For more information about the types of verification checks performed, see Setting the Certificate
Checking Mode in Horizon Client.
You can use the Horizon Client Configuration ADMX template file (vdm_client.admx) to set the
verification mode. All ADMX files that provide group policy settings are available in a .zip file named
VMware-Horizon-Extras-Bundle-x.x.x-yyyyyyy.zip, where x.x.x is the version and yyyyyyy is the
build number. You can download this GPO bundle from the VMware dowload site at
https://my.vmware.com/web/vmware/downloads. For information about using this template to control GPO
settings, see Using the Group Policy Template to Configure VMware Horizon Client for Windows.
Note You can also use the Horizon Client Configuration ADMX template file to restrict the use of certain
cryptographic algorithms and protocols before establishing an encrypted SSL connection. For more
information about this setting, see Security Settings for Client GPOs.
If you do not want to configure the certificate verification setting as a group policy, you can also enable
certificate verification by adding the CertCheckMode value name to one of the following registry keys on
the client computer:
n
For 32-bit Windows: HKEY_LOCAL_MACHINE\Software\VMware, Inc.\VMware
VDM\Client\Security
n
For 64-bit Windows: HKLM\SOFTWARE\Wow6432Node\VMware, Inc.\VMware
VDM\Client\Security
Use the following values in the registry key:
n
0 implements Do not verify server identity certificates.
n
1 implements Warn before connecting to untrusted servers.
n
2 implements Never connect to untrusted servers.
If you configure both the group policy setting and the CertCheckMode setting in the registry key, the group
policy setting takes precedence over the registry key value.
Note In a future release, configuring this setting using the Windows registry might not be supported. A
GPO setting must be used.
Configuring Advanced TLS/SSL Options
You can select the security protocols and cryptographic algorithms that are used to encrypt
communications between Horizon Client and servers, or between Horizon Client and the agent in the
remote desktop.
These security options are also used to encrypt the USB channel.
VMware Horizon Client for Windows Installation and Setup Guide
VMware, Inc. 49