I have a media pool that I am using the default settings of NO regarding.."Allow user to reset desktop". However, users can select Restart on their Win7 VDI VM and it resets. Does this media pool setting disallow rebooting a Win7 VM??? Thanks
I am not sure if I completely understand you when you refer to the pool setting of "Allow user to Reset VM". Resetting your VM and restarting your VM are not exactly the same thing. When you reset your VM in virtual center or in the View manager you are not just rebooting the VM but you are also reloading the contents of the .vmx file. This is often needed when you change hardware settings in the VM such as graphics memory and wish to apply them.
Now on to Windows 7. In windows 7 the pool setting you listed will have no effect on the user being able to reboot their VM. What I have found is that if you want users to not be able to reboot their VMs you should use Windows group policy to remove the shutdown menu from the session. Once you do this then you will be able to enforce such a policy. Of course all this is based on me properly understanding your question. Please let me know and I hope this helps.
For removing the shutdown menu start here: http://www.howtogeek.com/howto/7553/remove-shutdown-and-restart-buttons-in-windows-7/
That makes sense now. So resetting is not the same as restarting. With that said, how would an end user be able to "reset" his VM?
So in summary, if I want to prevent users from restarting or shutting down their workstation, then I should use GPO to implement these settings.
I totally agree with this logic.
Having said that, what is the typical preference set for VDI users. Disallow them to restart, or just disallow shutdown or both? Perhaps this is a community wide question.
Regarding GPO initiatives for use in a VDI environment, is there a TID or whitepaper on the typical best practices of GPO settings for use in a VDI environment?
Thanks in advance...
The reset option from the pool settings simply allows the user to have View reset the machine through vCenter.
I typically allow them them to restart but not allow them to shutdown. I think allowing them to shutdown would generate some kind of helpesk ticket.
I don't recall ever seeing a listing of best practice GPO but you can try http://myvirtualcloud.net/. Andre typically has a wealth of information on everything VDI related.
An end user would be able to reset his VM when you enable that setting in the pool from within View manager. Once enabled that user will be able to reset his VM at the View login prompt. If you are using the View client on a PC you will see a button on it that says 'reset'. If you are using a thin client like me then you will see a button in the View login prompt that says 'reset'. If you see this button but it is greyed out then that means reset is not enabled.
Yes, for dealing with the start menu and many other things you should look to GPO in addition to what is available in View manager. As far as a typical preference set, that is hard to say. It really depends on your environment. If security is your main focus then you would choose one course. If keeping the helpdesk calls to a minimum is a goal then you may wish to go another direction. I would recommend that you take a hard look at your environment and your users. From there you can begin to see what makes sense for you. For example, if your users are tech savvy and tend not to make many helpdesk calls then you may wish to give them more freedom. Who knows? I recommend that whatever you do that you start small and work up from there. But first know your users and begin making decisions based on their needs. In one of our environments we disallow user reseting, restarts and shutdown of VMs. We disallow reseting of VMs in the pool settings. We disable disconnect, restart and shutdown on the AD GPO side. These choices are based on the fact that this particular environment is a training room. We know that the average user may not be too savvy. This works for us.
As for a guide for using GPO in view I would start with the view documentation. View actually includes many GPOs for you to use. I don't know what version of View you use but if you use 4.6 take a look at what VMware recommends: http://www.vmware.com/pdf/view-46-architecture-planning.pdf This should get you off to a good start. Hope this helps.