5.2

For users who run View desktops locally on their client systems, if the policy is set to disconnect user
sessions
on smart card removal, when users remove a smart card, the guest operating system in the View
desktop is locked. The View Client window remains open, and users can select Options > Send Ctrl-Alt-
Delete to reauthenticate.
5 Click OK.
6 Restart the View Connection Server service.
You must restart the View Connection Server service for changes to smart card settings to take effect, with
one exception. You can change the Smart card authentication setting between Optional and Required
without having to restart the View Connection Server service.
Currently logged in users are not affected by changes to smart card settings.
What to do next
Prepare Active Directory for smart card authentication, if required. See “Prepare Active Directory for Smart
Card Authentication,” on page 162.
Verify your smart card authentication configuration. See “Verify Your Smart Card Authentication
Configuration,” on page 164.
Prepare Active Directory for Smart Card Authentication
You might need to perform certain tasks in Active Directory when you implement smart card authentication.
n
Add UPNs for Smart Card Users on page 162
Because smart card logins rely on user principal names (UPNs), the Active Directory accounts of users
that use smart cards to authenticate in View must have a valid UPN.
n
Add the Root Certificate to the Enterprise NTAuth Store on page 163
If you use a CA to issue smart card login or domain controller certificates, you must add the root certificate
to the Enterprise NTAuth store in Active Directory. You do not need to perform this procedure if the
Windows domain controller acts as the root CA.
n
Add the Root Certificate to Trusted Root Certification Authorities on page 163
If you use a certification authority (CA) to issue smart card login or domain controller certificates, you
must add the root certificate to the Trusted Root Certification Authorities group policy in Active
Directory. You do not need to perform this procedure if the Windows domain controller acts as the root
CA.
n
Add an Intermediate Certificate to Intermediate Certification Authorities on page 164
If you use an intermediate certification authority (CA) to issue smart card login or domain controller
certificates, you must add the intermediate certificate to the Intermediate Certification Authorities group
policy in Active Directory.
Add UPNs for Smart Card Users
Because smart card logins rely on user principal names (UPNs), the Active Directory accounts of users that
use smart cards to authenticate in View must have a valid UPN.
If the domain a smart card user resides in is different from the domain that your root certificate was issued
from, you must set the user’s UPN to the Subject Alternative Name (SAN) contained in the root certificate of
the trusted CA. If your root certificate was issued from a server in the smart card user's current domain, you
do not need to modify the user's UPN.
NOTE You might need to set the UPN for built-in Active Directory accounts, even if the certificate is issued
from the same domain. Built-in accounts, including Administrator, do not have a UPN set by default.
VMware Horizon View Administration
162 VMware, Inc.