Standalone Physical Machine not on Domain

[Tibmeister]

I need to bring a physical standalone machine running Horizon Agent into a manual pool, but the physical machine can't be joined to the domain for a few different reasons.  So, I've loaded the agent and done the entitlements in the pool, but when I try to log on through the broker, I don't get much of a screen and it disconnects after some time.  I did see in the logs it's trying to do SSO with my username that's logged into the connection server, but, I have SSO disabled globally, so not sure why it's still doing this.

I have installed the Direct Connect plugin and verified that I can connect and using the non-domain login everything works as expected.

I need to access this from external using a UAG, so can't use the direct connect method for that, so I'm at a loss.

[vDruid]

Hello,

Horizon requires a Microsoft Active Directory infrastructure for user authentication and management. So that is an expected behaviour from my point of vue.

[vDruid]

Hello,

Horizon requires a Microsoft Active Directory infrastructure for user authentication and management. So that is an expected behaviour from my point of vue. But you can try to play with the AllowSingleSignon GPO (or reg entry) to deactivate SSO at agent level.

[Kinnison]

Hi,

It may well be, but there are various cases of use for which it may be necessary to use systems running a Microsoft operating system in combination with Horizon which, however, are not joined to any AD domain and whether they are physical or virtual makes no difference.

Over time I ran into some problems that I solved "my way" some time ago:

By disabling the "SSO" at the agent level.
By disabling the "Use my sign in info to automatically finish setting up after an update" (or restart).
In the case of physical systems I also disable the "fast boot option" (otherwise the WOL feature is almost never working) and any form of energy "saving related" to the network card.

Of course your mileage may vary.

Regards,
Ferdinando

[Tibmeister]

Disabled SSO on the agent using the local group policy editor, I didn't see any other method of doing this.  As that as the second piece, not seeing that option.

After doing a little more observation, what I am seeing is that GINA is not coming up, and following some articles doesn't help much on that front.

Now, one thing that I forgot about, is that I am using a Microsoft Account to log into the machine, which works great with RDP, but may not work with View.  I created a pure local account on the machine and I can log into that account via View, so I think it's the whole online Microsoft Account thing that is being forced down our throats that is the problem.

[Kinnison]

Hi,

Using the local "Group policy Editor" the second option I was referring to is under "Computer Configuration > Administrative Templates > Windows Components > Windows Logon Options" and is named "Sign-in and lock last interactive user automatically after a restart". With that option enabled (or not configured), there are circumstances in which from the point of view of "Horizon" a local user may already be "logged-in" to the desktop and thus unwilling to accept a connection with a different user.

About forcing the use of a Microsoft account, for good manners it's better not to comment.

Regards,
Ferdinando

[Tibmeister]

Definitely works great after converting the online account to a local one, so that was the key all along.  Now, need to get the Universal Gateway working...

[Kinnison]

Hi,

Just an educated guess, your system is running Microsoft Windows 11 pro 22h2? This version, unlike the previous version 21H2, started by forcing the use of a Microsoft account and obviously having an internet connection, the way around this requirement exists (for now) but it's still a hassle. For UAG I really don't know what to tell you, I only tried it in a laboratory context for a short time because in my operational contexts it has no concrete use.

According to what is written here it should work: https://techzone.vmware.com/resource/using-horizon-access-physical-windows-machines

Regards,
Ferdinando

[Tibmeister]

Windows 10 Pro.  I also was thinking, what about places that don't have AD at all, they can't use Horizon View then?  What about pure Linux shops, again, left out in the cold?  Seems like a huge gap that could be filled by VMware that others are possibly filling.

As for the UAG, I can't get it to work on either the physical or VM, so not sure what's going on there.  It's a single NIC deployment with no separate DMZ, so that may be the issue I have to address, where it requires the multi-homed system with distinct DMZ space.  Right now, it's on the same subnet as the rest of my LAN and has a single NAT from Internet to it.

[Kinnison]

Hi,

Well, one of my physical systems is running Microsoft Windows 10 22H2 and all updates available to date and is not joined to any domain (actually none of my desktops are domain joined). In combination with physical systems running he HOME/PRO versions of Microsoft's desktop operating systems the "BLAST" and "PCOIP" protocols are not supported (is documented), meaning that they do not work so only RDP remains, at least AFAIK via a "connection server".

As I see "things", I fully share your considerations, there are certain IT contexts in which a product like "Horizon" would have undoubted benefits but where its strictly dependence on AD infrastructure (costs aside) can only prove to be a useless complication (or a substantial limit).

Regards,
Ferdinando

[jimbeem]

"I don't get much of a screen and it disconnects after some time." looks to me more like a firewall problem, is the screen always black till it gets disconnect or can you see something for a short time?

If I entitle a standalone machine within my environment, the connection itself is done via a domain user. The session opens, SSO fails on the Agent part and I have to enter the local credentials. In my case it was a standalone virtual machine, but there should not be any difference.

[Tibmeister]

I disabled the 3D in the video card and no longer have the issue.  BTW, this is on an internal network with no firewall in-between