Locking remote screen on Connection

[luisjorge]

Hi,

we are currently evaluating physical PC connection using VMware Horizon View 6.2. We are using the View Agent.

Our problem: After connecting from an remote Horizon View Client using PCoiP or RDP, the screen on the physical PC does not go blank or get locked in any way.

Someone with access to the monitors on that PC can watch all on screen, what the remote user does.

Is there any way to overcome this security problem?

Regards,

[Vanekm]

We have same issue. I have to switch protocol on Physical PC Pool to RDP. Other pool with VM I use Blast.

[Netjim]

I'll try forcing RDP on the pool, but I think when I connect via SSL and Horizon Web interface (HTML access), you can still see what I'm doing if you are sitting in front of the physical machine.

Also, the display resolution gets all jacked up and has to be reset when you go back to physically sitting in front of the machine.

[BenFB]

This is a known issue with Blast but I thought PCoIP was not impacted by it.

Be aware that Horizon View 6.x goes end of support next week on 2019/06/19. You need to upgrade to 7.x to continue getting support and new releases.

https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/support/product-lifecycle-matrix.p...

[mihalitsch]

How to fix a blast problem

[Shreyskar]

To support Physical PC access through Horizon, First of all validate if below conditions are met:

- Physical PC is only supported with Windows 10 Enterprise Edition with Horizon view 7.7 or higher. (See Release Notes for VMware Horizon 7 version 7.7   )

- Windows 10 Pro Edition may work but is not officially supported. The RDP protocol should be used for Windows 10 Pro Edition

- Recommended protocol is BLAST Extreme. You can use RDP Protocol as well

- Windows 10 versions supported are 1803, 1809, 1903 and 1909

-For Windows 10 1903 or higher, only View agent 7.12 is supported. (See https://kb.vmware.com/s/article/67763 )

- Ensure that Microsoft updates are upto date as KB4517211 and KB4520390 are must for 1903 and 1909, otherwise, you might see a black screen when connect to Win 10 Physical PC with Agent 7.12 (See Release Notes for VMware Horizon 7 version 7.12 )

-Once above conditions are met and if you still facing the problem, feel free to post here.

Make sure below registry is created in remote physical PC so that it doesn't mirror:

Registry Hive HKEY_LOCAL_MACHINE

Registry Path SOFTWARE\Policies\VMware, Inc.\VMware Blast\Config

Value Name BlankScreenEnabled

Value Type REG_SZ

Enabled Value 1

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	SOFTWARE\Policies\VMware, Inc.\VMware Blast\Config
Value Name	BlankScreenEnabled
Value Type	REG_SZ
Enabled Value	1

[mihalitsch]

Hey. I am very glad that you answered me.

Yes, we use (in the test area) windows 10 Pro.

version 1803.

I know that the extreme blast protocol should be used only with windows 10 enterprise.

I specified the registry value and it was applied through group policies.

But I still have a problem: when I connect to a physical computer, the user session is not blocked, and you can see what is happening on the remote computer.

You will advise updating the version of Windows to 1903?

I will be very happy if you tell me how to overcome this problem.

[Shreyskar]

Windows 10 Pro is NOT supported on physical PC with horizon View. As per my previous post, only Enterprise release is supported to use in physical PC.

Try below registry in physical PC but upgrade to windows 10 1803 enterprise or higher:

If the hive is not present, create it and set the value fEnableWinStation to 1.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\VMware-RDS]

"fEnableWinStation"=dword:1

[mihalitsch]

Yes, I know about this the registry parameter.

I want to tell what I do:

install windows 10 pro

I change from "1" to "0" [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Terminal Server \ WinStations \ VMware-RDS]

"FEnableWinStation" = DWORD: 1

through the registry (or GPO) I turn on: BlankScreenEnabled, put "1".

These actions allow you to use the Blast protocol on windows 10 pro, but the user session on the physical computer is not blocked.

If I install an enterprise license, I change the registry back to "1"

[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Terminal Server \ WinStations \ VMware-RDS]

"FEnableWinStation" = DWORD: 1

then everything works fine.

I ask you to tell me how to solve the problem, if possible.

[Shreyskar]

If enterprise version is working fine, we should be good.

Win10 pro on physical PC is not supported by VMware so it is difficult to troubleshoot anything there.