All Posts

apt -y install nginx-full   systemctl enable nginx   rm -f /etc/nginx/sites-enabled/default   echo \ 'user www-data; worker_processes auto; pid /run/nginx.pid; include /etc/nginx/modules-enabled/*.conf;   events { worker_connections 1000; }   http { sendfile on; tcp_nopush on; tcp_nodelay on; keepalive_timeout 30; types_hash_max_size 2048;   include /etc/nginx/mime.types; default_type application/octet-stream;   access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log;   gzip on; gzip_disable "msie6"; gzip_vary on; gzip_proxied any; gzip_comp_level 6; gzip_buffers 16 8k; gzip_http_version 1.1; gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;   }' > /etc/nginx/nginx.conf   echo \ 'ssl on;   ssl_certificate /etc/nginx/ssl/nginx.crt; ssl_certificate_key /etc/nginx/ssl/nginx.key; ssl_dhparam /etc/nginx/ssl/dhparams.pem;   ssl_session_timeout 1d; ssl_session_cache shared:SSL:50m; ssl_session_tickets off;   ssl_protocols TLSv1.2; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; ssl_ecdh_curve secp384r1; ssl_prefer_server_ciphers on;   ssl_stapling on; ssl_stapling_verify on; ssl_stapling_file /etc/nginx/ssl/nginx-staple.crt; resolver 10.10.10.8 valid=300s; resolver_timeout 5s;' > /etc/nginx/conf.d/ssl.conf   echo \ 'add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;   add_header Accept "*"; add_header Access-Control-Allow-Origin "*"; add_header Access-Control-Allow-Methods "GET, POST, PUT" always; add_header Access-Control-Expose-Headers "Authorization" always;   add_header X-Content-Type-Options nosniff; add_header X-Frame-Options SAMEORIGIN; add_header X-XSS-Protection "1; mode=block";   proxy_cookie_path / "/; HTTPOnly; Secure";' > /etc/nginx/conf.d/hsts.conf   echo \ 'upstream uags {     ip_hash;     server 10.10.10.101:443;     server 10.10.10.102:443; }   server {     listen 80;     server_name horizon.local;     return 301 https://$server_name$request_uri; }   proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=uag_cache:10m max_size=3g inactive=120m use_temp_path=off;   server {     listen 443 ssl;     server_name horizon.local;       access_log /var/log/nginx/cloud-access.log;     error_log /var/log/nginx/cloud-errors.log;       location ~ / {         client_max_body_size 50M;         proxy_set_header Connection "";         proxy_set_header Host $http_host;         proxy_set_header X-Real-IP $remote_addr;         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;         proxy_set_header X-Forwarded-Proto $scheme;         proxy_set_header X-Frame-Options SAMEORIGIN;         proxy_buffers 256 16k;         proxy_buffer_size 16k;         proxy_read_timeout 600s;         proxy_cache uag_cache;         proxy_cache_revalidate on;         proxy_cache_min_uses 2;         proxy_cache_use_stale timeout;         proxy_cache_lock on;         proxy_http_version 1.1;           proxy_pass https://uags;     }       include /etc/nginx/conf.d/ssl.conf; include /etc/nginx/conf.d/hsts.conf;   }' > /etc/nginx/sites-available/lb   ln -s /etc/nginx/sites-available/lb -t /etc/nginx/sites-enabled/   systemctl restart nginx  

@J_Levine  Use the [ExcludeIndividualRegistryKeys] header and add your reg key below. E.g.: [ExcludeIndividualRegistryKeys] HKCU\Software\Microsoft\Windows\CurrentVersion\Run This will exclude that key and any values from being stored in the profile.  If you want exclude a specific value from that key you can use:  [ExcludeIndividualRegistryValues] HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Ref.: Section Headers (vmware.com)

@gabeoverse  The site you followed refers to load-balancing security servers for external access to Horizon. I don't know what version of Horizon you are running but I do hope you don't have any security servers running anymore because they've been EOL for several years.  I've made a blog to use HAProxy as Load Balancer in front of Horizon connection servers, you might want to check that out and maybe use it as base for your NGINX config. You can find the blog post here: https://itpro.peene.be/vmware-horizon-appvolumes-lb-with-haproxy-and-keepalived-on-photonos/  

Thanks Phil. We managed to work it out ourselves. The solution was to factory reset the Android device and follow the link provided by Google to the Intelligent Hub app install. Previously we tried deleting all accounts from the device and installing Intelligent Hub via Google Play. This option left the device in COPE mode (Corporate-Owned, Personally Enabled) and that was the problem. The reboot option is now available, plus other options that were missing before.

Yeah it's over a year with this non-sense. Why actually fix the issue when VMware and T-Mobile can just finger-point at each other and continue to make money. It doesn't make good business sense to actually fix the issue. Why would they? We're trying get away from VMware because of nonsense like this.    

Additionally in "Programs and Features" there are two version of "VMWare Horizon Client", and trying to uninstall the newer one (8.11) fails with error "Install Failed" and "The product must be installed first before attempting to make changes with the installer". After uninstalling the previous version and manually downloading the installer for the newer version, installation was successful without any BSOD.

Hey Daniel, if you are using a trial, then the best course of action is to speak with your partner or your VMware SE to get them to log a support call on your behalf. VMware have EUC Specialist SEs that can also assist. 

Confirming 'Work Managed' is enabled is enabled - the Enrollment Settings are the same as in your screenshot. I tried to contact support to organize a call but it doesn't appear to be possible. At the following page: https://customerconnect.vmware.com/support/create-request/technical I get a message that says "The selected Organization has no products associated with it. Try selecting a different Organization to see the products you are entitled to." The correct (and only) Organization is selected and Workspace ONE is added as a product. However it's currently in trial mode, could this be why support is not available? Is there another way to contact support?

Its configured at the tenant level. Goto Groups & Settings > All Settings > Devices & Users > Android > Android EMM Registration (see screenshot). default is Work Managed meaning it should be showing. If not, please log a support call and they should be able to troubleshoot.

There looks to be two APIs you can use: https://host/api/system/users/enrolleddevices/search which returns { "EnrolledDeviceInfoList": [ { "DeviceID": 1, "SerialNumber": "RZ1G124JZ6W", "AssetNumber": "ea856771ba6277bfca16528a79c5ce1f", "FriendlyName": "TestUser's iPhone", "UserName": "TestUser", "EnrolledDate": "04/24/2017", "RegistrationDate": "04/24/2017", "LastSeen": "04/24/2017", "Platform": "Apple", "OrganizationGroup": "TestOg", "CustomAttributes": [ { "Name": "identity.deviceModel", "Value": "TC25", "Source": "Device", "Application": "com.airwatch.androidagent.identity.xml" } ] } ] }  https://host/api/system/users/registereddevices/search { "RegisteredDeviceInfoList": [ { "OrganizationGroup": "TestOg", "Username": "TestUser", "FriendlyName": "Testuser's iPhone", "AssetNumber": "ea856771ba6277bfca16528a79c5ce1f", "UDID": "9bf5ae7cf74efe385bbe3b18261fd21c", "RegistrationDate": "04/24/2017", "SerialNumber": "RZ1G124JZ6W", "Platform": "Apple", "CustomAttributes": [ { "Name": "identity.deviceModel", "Value": "TC25", "Source": "Device", "Application": "com.airwatch.androidagent.identity.xml" } ] } ] } if neither of these return the correct details, please confirm that the device was registered by DEP into UEM. I think you can see the devices listed in the Devices > Lifecycle > Enrollment Status page. If they are showing then please log a support ticket so that we can get this escalated and assigned to the correct engineer.

Thanks for the reply. The Ownership mode as viewed under Devices > List View is showing as "Corporate - Dedicated". Is this the same as "Work Managed Device Mode"? If not, how can the ownership mode be changed?  

which ownership mode did you enrol the device into? See this page for the commands available for each mode - https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/Android_Platform/GUID-AndroidManagementManageAndroid.html