User desktop visible in vsphere-client

[berndweyand]

Hello all,

i have a strange behaviour with the webconsole and vmrc

vCenter is 6.7U3L, Hosts ESXi6.7U3 Build 17499825/17167734, Xen Desktop 7.15LTSB

There are several Windows10-VM which are presented as dedicated desktops via Citrix to the user.
The problem is that as soon as the user is logging in to the vm the users desktop is visible in the screen-preview in the vsphere client.
When i open webconsole or vmrc of the vm i can observe anything the user is doing in realtime.
Logging in via RDP does not showing this, only via citrix.

tried with different browsers, different esxi-versions, updated vmware tools to 11.2.5, but its still visible
it does not occur with server 2016 or windows10 with nvidia-gpu attached, only win10 with standard-vga

how can i prevent this - the vsphere admins should not have the ability to observe the users working.

[scott28tt]

Sounds like what is happening is the equivalent of doing an RDP “console” connection (albeit via Citrix), you might be better asking on a Citrix forum.

[MikeTyler]

We're seeing something very similar. Our environment is comparable to the original poster but we are not running Citrix. We've opened a ticket with VMware and have not found the root cause yet. 

@berndweyand  @scott28tt  Did either of you find more on this issue or a solution?

[scott28tt]

I think this is more Windows-centric than anything to do with vSphere.

A remote “console” session via RDP or similar will be reflected if a vSphere admin is looking at the VM console, but a background remote session will not be visible in the VM console (just like it wouldn’t have been if Windows was installed on a physical system rather than in a VM)

I’m going back some years here, but if you ran “mstsc.exe /console” and opened an RDP session, that’s what I’m referring to.

[MikeTyler]

Hi Scott -

If I understand correctly you're saying that the Remote Console in vSphere will natively behave like Microsoft RDP? Machines with no active sessions will be visible in machine preview and in the web console. Those with an active session however are not visible. Is this what you mean?

In our case we have instances where all machines are visible, including those with active sessions. There may be a windows element here that we're missing in all this. It seems like I recall seeing a switch for this some years back in vSphere 6, possibly when we were running the older vSphere thick client. 

[scott28tt]

I’m saying that the VM console offered by vSphere is the same as walking up to a physical Windows system.

If anyone has remotely connected to that Windows system with a “console” connection (such as “mstsc.exe /console” which will use RDP) then the VM admin will see that remote session to Windows.

[MikeTyler]

Understood. All our environment uses the Horizon View client to connect. Any RDP-connected sessions aren't a concern for us at least at the moment. What is a problem for us are active user sessions in plain view like the OP had described.  

[scott28tt]

Still might be Windows-centric and not anything to do with either vSphere or Horizon…