All TKB Articles in Digital Workspace

Symptoms - Your PCoIP session unexpectedly disconnect after 15 minutes; - Single sign on (SSO) is not operating properly; Cause a. You have manually edited the userinit string in the registry in one of your virtual desktops; b. You have implemented a new Group Policy Object (GPO) that modify userinit; c  You have just installed a new piece of software; d. You have just installed a new piece of software that auto-protect userinit, such like Gbplugin (commonly used by banks in Brazil to protect financials operations throuth internet); Resolution For the causes "a", "b" and "c" usually the VMware KB 1028975 should solve your problem. For the cause "d" that won´t help you because that particular piece of software auto-protect userinit string changing his valeu to the same as fresh new windows instalation default:      "C:\Windows\system32\userinit.exe", As reported in VMware KB, VMware View agent change userinit string, so a normal userinit in a VMware View virtual desktop looks like this:      C:\Windows\System32\userinit.exe, "C:\Program Files\VMware\VMware View\Agent\bin\wssm.exe", Probably VMware has not created wssm as a service, because it need to be started with the user credential. To solve the problem, follow these steps: 1. Make sure that userinit in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon has the following value:      "C:\Windows\system32\userinit.exe", 2. In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run create a new registry string value with the following caracteristics:      Name: VMware View Session Manager      Value: "C:\Program Files\VMware\VMware View\Agent\bin\wssm.exe" This will ensure that in every login wssm will start with the appropriate credentials. 3. Restart VMware View virtual desktop and it is finished. If you utilize View Composer, you can apply it to you master image or you can create an Active Directory Group Policy to do the job. I have tested it in VMware View 5, but it probably will work on View 4+. The virtual desktop I have tested is a Windows 7 Enterprise 32bit, but i think it will work on 64bit virtual desktops. Regards, Guilherme Schäffer Infiniit - Start Today www.infiniit.com.br

Sintomas Um ou mais dos seguintes sintomas: - Sua Sessão de PCoIP no VMware View cai a cada 15 minutos; - O Single Sign on não está funcionando direito; Causa As seguintes ações podem causar estes sintomas: a. Você manualmente alterou a chave de registro Userinit; b.  Você instalou algum aplicativo que modificou o registro Userinit; c.  Você instalou o aplicativo de segurança (GbPlugin ou nome semelhante) que o seu banco exigiu para que você possa realizar operações financeiras pela internet. No Brasil a grande maioria dos bancos tem utilizado esta estratégia. Resolução Para as causas "a" e "b" normalmente o KB 1028975 da VMware deve resolver o seu problema. Para a causa "c" o citado KB não ajuda, pois este GbPlugin auto protege a chave de registro Userinit, fazendo com que ela fique sempre com o seu valor original de uma instalação "zerada" do windows:      "C:\Windows\system32\userinit.exe", Como relatado no KB mencionado, o VMware View por padrão altera esta chave de registro e precisa que ela contenha, também, o seguinte valor:      "C:\Program Files\VMware\VMware View\Agent\bin\wssm.exe", Este wssm.exe é o VMware View Framework Session Manager, que como o nome acusa, é responsável pelo gerenciamento da Sessão do usuário. Possivelmente a VMware não criou este cara como um serviço do Windows, pois ele precisa ser iniciado com as credencias do usuário, dono do desktop ou da sessão aberta. Para solucionar o problema, siga os seguintes passos: 1. Certifique-se que a chave de registro Userinit, localizada em: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Current Version\Winlogon, tenha o seguinte valor:      C:\Windows\system32\userinit.exe, 2. Em HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run crie um novo registro do tipo "Valor da cadeia de Caracteres" com as seguintes características:      Nome do registro: VMware View Session Manager      Valor: "C:\Program Files\VMware\VMware View\Agent\bin\wssm.exe" Isso garantirá que em todo logon seja iniciado o VMware View session Manager com as credencias adequadas. 3. Reinicie o desktop e está pronto. Se você utiliza o View Composer, pode aplicar isso em sua imagem  mestre. Uma solução mais elegante seria criar uma policy de dominio em seu Active Directory, de forma com que: - Ela altere o Userinit conforme passo 1 acima; - Ela crie a chave descrita no passo 2 do procedimento; Em anexo segue arquivo reg que cria a chave citada no passo dois da solução. Fica, também, a sugestão para a VMware para que ela avalie a possibilidade de, ao invés do View agent alterar o Userinit, que ela crie uma chave no RUN como sugeri acima. Na minha opinião, talvez o único motivo para o Wssm ser iniciado pelo userinit, seja para o usuário não excluir a chave, ou não conseguir matar o processo. Abraços Guilherme Schäffer Infiniit - Start Today www.infiniit.com.br

I saw a really good post on VMware View Limits and Maximums from Andre Leibovici on his site, http://myvirtualcloud.net/?p=2455.   Since this is something I don't see documented a lot I thought it would be nice to include it in the View section.  I asked Andre if this was ok and he has given his blessing to have it reposted here.

Hi I used View for CIUS to connect a Virtual Windows Desktop, and use the skype to call out to another skype user. But the virtual side seems can't send out the voice to another side. Is this a limitation for view client running on Mobile device? It is the same issue in iPad version. Any one know this, please advise, Thanks

Hi Community! This is a step-by-step Guide, how you can connect a Philips SpeechMike Dictation Device or a Philips Foot Control Pedal to a View Session. These devices are often used in hospitals for online dictation (like Philips SpeechMagic Dictation Software). This workaround works over LAN or WAN connections. In my case, I use the following Philips devices and want to connect to my View Desktop: * Philips SpeechMike III Pro (LFH3200/00) * Philips Foot Control (LFH 2310/00) These devices are HID devices (human interface devices). VMware View is underbinding the connection of HID devices by default. First, you must install the following regkey on the device, from where are you connecting to your View infrastructure: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware VDM\USB] "AllowHardwareIDs"=hex(7):56,00,69,00,64,00,5f,00,30,00,39,00,31,00,31,00,26,\   00,50,00,69,00,64,00,5f,00,31,00,38,00,34,00,34,00,00,00,56,00,69,00,64,00,\   5f,00,30,00,39,00,31,00,31,00,26,00,50,00,69,00,64,00,5f,00,30,00,43,00,31,\   00,43,00,00,00,00,00 I´ve also attached this regkey as file for downloading. Please remove the ".txt" file ending or change it to ".reg". This Key allows your View Client on the source to connect/redirect this two Philips devices via USB. If you use a different SpeechMike or Foot Control device, you must correct the AllowHardwareIDs entries (VIDs) in this regkey. Here you can find more informations about this: http://kb.vmware.com/kb/1011600 Now, add the following line to the .vmx file of your View Desktop VM: svga.noHWCursor = "TRUE" If you use a Desktop Pool with Linked Clones, you also can set this in your Golden Master Image. This is required to get the Trackpad in your Philips SpeechMike running. Otherwise your cursor doesn´t follow your mouse if you are using the Trackpad. Next, you estable a connection to your View Desktop. After the successfully authentification and connection to your View Desktop, you can connect the Philips Hardware to your Laptop/PC and connect this via View Client to your View Desktop. ATTENTION: DO NOT CONNECT THE HARDWARE TO YOUR PC BEFORE YOU HAVE A VIEW SESSION OPENED/RUNNING! The Problem if you connect the hardware before you start the View Client and connect: Your PC allocate the Philips HID devices, and the View Client wasn´t able to get this allocation back. So the connection of the devices will fail with an error! The VMware Support was working on a solution. At this moment, this way was the only way to connect your Philips devices. REMEMBER: CONNECT HARDWARE AFTER ESTABLE A CONNECTION TO VIEW. If you follow this step-by-step Guide, you get now a running solution for your Dictation Software: A virtualized desktop, you can reach this everywhere and can dictate everywhere you are. UPDATE: Here is a very nice blog entry how VMware solves this problem in View 5.1: http://blogs.vmware.com/euc/2012/05/vmware-view-usb-redirection-51.html

This document is located at techsupport.teradici.com but I thought I'd share it on the View Forums.  The official title is PCoIP Protocol Virtual Desktop Network Design Checklist.  But my title is much more fun.    

PCoIP Secure Gateway FAQs 1.      How can I get PCoIP Secure Gateway functionality Install a View4.6 Security server or connection server instance on a 64bit windows 2008 R2 machine. It could be physical or Virtual machine. 2.      Is PCoIP Secure Gateway enabled by default once I install connection server or security server on a 2008 R2 machine? No, PCoIP secure gateway feature is disabled by default in view 4.6. This feature should be enabled from Admin UI before you can start using it. 3.      How do I enable PCoIP Secure gateway feature PCoIP Secure Gateway feature is Enabled/Disabled using Admin UI for both connection Server and associated security server. This is controlled by the check box “Use PCoIP secure Gateway for PCoIP connections to desktop” under ’PCoIP Secure gateway’ in General Tab when a View Connection Server entry is edited. 4.      How can I make sure PCoIP session is using PCoIP Secure Gateway? Do a ‘netstat  –nob’ from client, you’ll see network connections made from vmware-remotemks.exe to connection server/security server. If you run the same command inside launched session you can see ‘pcoip_server_win32.exe ‘ has connections made to the same connection/security server. There won’t be any connections made between View Client and View Agent machines. If PCoIP Secure Gateway is not used then these connections will be between View Client and View Agent. 5.      I have my connection server installed on a Non- 2008 R2 machine but I have a security server on 2008 R2 can I enable PCoIP Secure Gateway feature for this configuration? Yes, you can enable PCoIP Secure Gateway but PCoIP Secure Gateway will be only available in associated Security server installed on 2008 R2. 6.      I have two security servers, one installed on Windows Server 2008 R2 and one installed on Windows Server 2003, both paired with a connection server installed on Windows Server 2008 R2. Will I be able to use PCoIP Secure Gateway on all three instances? No, you’ll have PCoIP Secure Gateway functionality only on your connection server and security server which are installed on 2008 R2 machine. 7.      How will I know if PCoIP Secure Gateway in installed in my machine. You can make sure this by checking the PCoIP Secure Gateway service in windows services list. 8.      How can I restart PCoIP Secure Gateway service? PCoIP Secure Gateway service will be listed under windows services. As with any Windows Services, PCoIP Secure Gateway service can also be restarted. 9.      Is it mandatory to have PCoIP Secure Gateway for PCoIP connections? No, PCoIP Secure Gateway is not mandatory. PCoIP Secure Gateway is required in specific scenarios where PCoIP connection needs to be passed through a gateway or a NAT mechanism. 10. I get the following warning “PCoIP Gateway Functionality is not supported for this operating system, please upgrade to windows server 2008 r2 to get this functionality” while installing Connection server/Security server what does it mean? This means the machine on which you are performing installation is not 2008 R2 and PCoIP Secure Gateway feature will not be present on that particular instance. 11. I get a warning when I enable PCoIP Secure Gateway “Warning: This connection server or one of its paired security servers does not have a PCoIP Secure Gateway installed. Ensure that this configuration is correct for your intended use of PCoIP.” What does it mean? This warning indicates that the Connection Server you are editing or at least one of the security server associated with this connection server doesn’t have PCoIP Secure Gateway feature installed. You can ignore this warning if you have one of these instances installed with PCoIP Secure Gateway and all PCoIP connections requiring PCoIP Secure Gateway are going to be made through it. 12. Can I make use of PCoIP Secure Gateway with my old View client? Is it mandatory to update to View4.6 client? View client or View agent doesn’t require an upgrade to use with PCoIP Secure Gateway. Any client/Agent which supports PCoIP will work with PCoIP Secure Gateway. 13. Can I make use of PCoIP Secure Gateway with my old View Agent? Is it mandatory to update to View4.6 client? View client or View agent doesn’t require an upgrade to use with PCoIP Secure Gateway. Any client/Agent which supports PCoIP will work with PCoIP Secure Gateway. 14. What is PCoIP External URL? Can I give a host FQDN here? PCoIP External URL is the IP:Port value provided to view clients by connection server during desktop launch. You cannot give FQDN for this URL, this should be always an IP address reachable from client machines. 15. Will PCoIP Secure Gateway tunnel my PCoIP connections from client to desktop? Does it use a secure tunnel? PCoIP Secure Gateway doesn’t create any additional secure tunnel. What it does is to proxy PCOIP connections between agent and client. It is similar to an Application firewall. 16. If PCoIP Secure Gateway acts as a proxy, can I use my web proxy to act as PCoIP Secure Gateway or other way? No, A normal web proxy cannot ‘proxy’ PCoIP sessions. PCoIP Secure Gateway can only be used for PCoIP protocol. 17. I changed Port numbers used for PCoIP Secure Gateway; Clients are unable to connect now! Make sure the new port value is updated in External URL and required firewall exceptions are added. 18. Is it possible for a user to connect sometimes through a PCoIP Secure Gateway and sometimes not, without any change to the client? View Client is unaware of PCoIP Secure Gateway and doesn’t require any change to use PCoIP Secure Gateway. 19. My connection server PCoIP external URL field is grayed out in Admin UI! This field is enabled only if PCoIP Secure Gateway is installed on connection server machine. Make sure you are using a PCoIP Secure Gateway supported OS (Win-2008 R2). 20. My Security server PCoIP external URL field is grayed out in Admin UI! This field is enabled only if PCoIP Secure Gateway is installed on security server machine. Make sure you are using a PCoIP Secure Gateway supported OS (Win-2008 R2). 21. Can I edit PCoIP External URL from Admin UI? Yes, PCoIP External URL can be modified from Admin UI to make required changes. 22. Should I enable ‘Use Secure Tunnel Connection to Desktops’ to get PCoIP Secure Gateway functionality remotely? Not always. With a Zero Client, only a PCoIP Secure Gateway is needed. With a View Client, this option controls whether USB and MMR connections are tunnelled. It should be enabled if either of these protocols are needed when using a View Client remotely 23. How can I monitor number of sessions going through PCoIP Secure Gateway? PCoIP Gateway Sessions and PCoIP Gateway Sessions High are two counters added to Windows Performance Monitor (perfmon.exe). This can be used to find the number of ongoing sessions and max number of sessions ever present. 24. Can I have RDP connections through PCoIP Secure Gateway? No. RDP connections are not handled by PCoIP Secure Gateway. But you can have same connection/security server handle both RDP and PCoIP traffic together. 25. External URL is an IP! Should I provide users with this IP for PCoIP Secure Gateway to work? Will PCoIP Secure Gateway work if users connect to Connection/Security server with FQDN? Users can either use IP or FQDN to connect to connection/security server with PSG configured. 26. Which port should I open in my firewalls? Do I need to enable this for entire subnet? Client to Security/Connection Server HTTP(S) TCP 80 /443 from View Client to View Security Server. TCP 4172 from View Client to View Security Server. UDP 4172 in both directions Security/Connection Server to Agents TCP 4172 from View Security Server to View Agents. UDP 4172 in both directions 27. I don’t want a set of users to connect using PCoIP Secure Gateway how can I do this? Couple of Connection/Security servers can be PSG enabled while others can be PSG disabled. Provide users with appropriate URLs 28. Where is PCoIP Secure Gateway logs located? Default log location is “C:\ProgramData\VMware\VDM\logs\PCoIP Secure Gateway” 29. How can I change PCoIP Secure Gateway log levels? PCoIP Secure Gateway log levels can be changed using the same “Set View Connection Server Log Levels” tool used to set view log levels. 30. How can I change PCoIP Secure Gateway log file path? This can be done by modifying “HKEY_LOCAL_MACHINE\SOFTWARE\Teradici\SecurityGateway\LogPath” value to new path. 31. Is it possible to have RDP sessions using same server where PCoIP Secure Gateway is enabled? Yes 32. Will smartcard/RSA/SSO/Triple SSO work with PCoIP Secure Gateway? Yes, there are no configuration changes required in other features to work with PCoIP Secure Gateway. 33. Is there any setting required while creating Pools? Should I mention use PCoIP Secure Gateway somewhere? No, PCoIP Secure Gateway is controlled at broker level. There are no configurations required at pool level. 34. If I have a connection server with PCoIP Secure Gateway enabled, is it possible for a user to have a PCoIP session without a PCoIP Secure Gateway. Yes. In that case, users should connect to another instance of connection server where PCoIP Secure Gateway is not enabled. 35. Users are getting the following error "Unable to connect to desktop: There is no available gateway for the display protocol. Try again, or contact your administrator if this problem persists." They are unable to launch desktops using PCoIP Secure Gateway enabled server. This message indicates that PCoIP Secure Gateway feature is enabled but the related PSG (PCoIP Secure Gateway) service is not ready. Check windows services on your security/connection server depending on configuration to make sure ‘PCoIP Secure Gateway’ service is running and is in started state. 36. Can I have multiple PCoIP Secure Gateway? Yes. You can have as many PCoIP Secure Gateway as you require. 37. Do I still require VPN connection to access my desktop from outside company network? No. You can avoid the requirement of a VPN connection using PCoIP Secure Gateway which acts as a NAT device. 38. Can I checkout a desktop through PCoIP Secure Gateway? When connecting remotely, desktops are checked out through the tunnel. Whether or not you have enabled 'Use Secure Tunnel Connection to Desktops’, you must enable 'Use Secure Tunnel Connection for Local Mode Operations' for this to work. 39. Can I use PCoIP Secure Gateway for my terminal services pool? PCoIP protocol is not supported on terminal servers. 40. Where is the certificate used to secure communication is located The certificates are located in C:\ProgramData\VMware\VDM\certificates folder.

Starting at version 4.6, View has the ability to support PCoIP remote access through the View Security Server. See View 4.6 Announcement. I posted an article back in December 2010 in the End User Computing CTO site about this forthcoming View release and described how it works. See Secure Remote Access with View and PCoIP. Some people report that when they setup PCoIP remote access with View 4.6 and try a PCoIP connection from the View Client, they just get a black screen for a few seconds and then an error indicating that the session has ended. On the iPad View Client this problem shows as a message saying "your desktop is loading too slowly". In the vast majority of cases, this was caused because one of the 3 setup steps shown below was not done or not done properly. If you're getting these symptoms, then check very carefully that these 3 simple steps have been done correctly. When View Connection Servers and Security Servers are running 4.6 or newer, you can enable this functionality by following these three steps: 1. Enable PCoIP Gateway functionality on each Connection Server. By default, PCoIP connections are direct from the View Client to the View virtual desktop as they were in View 4.0 and 4.5. If you have some Connection Servers for remote access and some for local access then just do this for the remote access ones. That way local access PCoIP can still be direct to the View virtual desktop. Using View Administrator, go to the Configuration Servers section. Select a Connection Server, select Edit and tick the box "Use PCoIP Secure Gateway for PCoIP connections to desktop". Then for all users of this Connection Server and any Security Servers attached, PCoIP will gateway through either the attached Security Servers or this Connection Server. The server used for the PCoIP gateway (usually the Security Servers) must be running View 4.6 or newer on Windows Server 2008 R2. 2. On every attached Security Server, set up the “External URL” and the new "PCoIP External URL". These URLs are used by the View Clients to connect to the particular View server. These names and addresses must be resolvable and usable by the clients. If remote connections are made directly to the Connection Server then the External URLs must also be setup on the Connection Server. 3. Update the firewall to allow PCoIP to pass through. This is: PCoIP between View Client and Security Server TCP destination port 4172 from Client to Security Server UDP destination port 4172 from Client to Security Server UDP source port 4172 from Security Server to Client (this is the reply UDP data) PCoIP between Security Server and virtual desktop TCP destination port 4172 from Security Server to virtual desktop UDP destination port 4172 from Security Server to virtual desktop UDP source port 4172 from virtual desktop to Security Server (this is the reply UDP data) This is in addition to the firewall rules used in View 4.5. For further details, refer to the View 4.6 Architecture and Planning Guide and the View Administrator Guide here View Documentation. For a more detailed examination of this, take a look at this video. It goes into details on the deployment and architecture for PCoIP remote access with View 4.6 and goes through a worked example involving remote and local access, load balancing, the n+1 VIP model, the external URLs etc. and shows how it is all configured through View Administrator. Mark Benson - VMware - View Architect - End User Computing CTO Office

Has someone been able to deploy a View 4.5 Connection Server (Standard) with a vCenter 4.1 Update 1 server ? I'm getting a "Error saving vCenter entry" error. I did clear out like the VMware KB says the vShield licenses from my vCenter. My View 4.5 has no issues connecting to a vCenter 4.0 or vCenter 4.1, but it's stuborn with my vCenter 4.1 Update 1 Regards, Erik Bussink

During the installation vCenter server, there is an option two choose a DSN which points to en external database or we can make use of the SQLExpress which is buntled with vCenter Server. This Document describes installation of View Composer keeping database on the SQLExpress instance which is configured automatically during vCenter installation. Firstly login to the server where VMware vCenter Server is running. Install SQL Server management Studio Express.This software can be downloaded from Microsoft Website. Now open SQL Server Managemet Studio Express (MS SSMSE) login as below. Now object explorer for the database will be opened. Here you can create a new database but however, view composer does not support windows integrated authentication. Hence new user (SQL user ) need to be defined and map with a new database. Typically such SQL express instance should not have a production DB role. So here I am going to explain creating a new DB and mapping it to the inbuilt SQL admin account named "sa". In our case, by default the "sa" account will be in disabled mode. So as the first step we will enable the account and set a password. On the SQL object explorer  - Under 'Security' select the 'Logins'. Right click on 'sa' and go to properties. set password hereand make necessary password enforce policy if required (else uncheck). On the properties window left side click on the status, and grant the permission to connect to database and enable the login. refer below Right click on the server , go to properties and Change the authentication type to Mixed Modeas below. Restart the SQL Service Now the SA account has been enabled for the SQL instance. Disconnect the object explorer and connect to the SQL again using sa account Now the oject explorer is connected to database using sa credentials. as the final step we need to create a new database that need to use with composer. righ click on the database inventory , and select 'New Database' name the database , and click OK This will create new database, and since it si created using 'sa' account 'sa' will have complete permission on this DB. So no need to configure tha database permission and user mapping for this DB. If you are creating a new user other than 'sa' then the User should have the permissions and db ownership to the database. We are now done with the database configuration. the left out part is DSN configuration. From the control panel , open ODBC configuration and select system DSN. One DSN would be already available for virtual center. Click "Add" to create one for View Composer. Select 'SQL Native Client' and click finish. On the next page fill in the DSN name , Decription, and Server. Name can be of any choice. Description is optional and Server should be in the syndax <Hostname>\SQLEXP_VIM Click next, and choose the authentication and SQL authentication and provide sa credentials. In case new user is defined and mapped database , provide that here. Chage the default DB to the newly created database. proceed the wizard through next page with default options and finaly test the data source. The test should give a successful result as below. Click OK and finish teh wizard. This will return to the DSN configuration page of ODBC, and both VC and newly cretaed DSN will be lister here as below Now install View composer, and when it asks for databse, Give the DSN name as 'View Composer' and username as 'sa' and its password. Proceed the wizard and complete the installation