ymagalif Tracker

Re: VMWare Horizon Client crashing when trying to connect to a server or checking for updates

ymagalif — Fri, 27 Jan 2023 12:55:05 GMT

Harry,

This is basic, but have you tried reinstalling it?

Downgrading to a lower version helps with various problems.

Is this on a Mac or a PC?

Sincerely,

Yury Magalif

Horizon 8 with Domain Functional Level 2008 R2 - what will break?

ymagalif — Fri, 27 May 2022 17:22:56 GMT

Hello community,

My client needs a new on-premises installation of Horizon 8, the latest version (2203/2111 as of now).

Currently, the client has Microsoft Active Directory Domain Functional Level of 2008 R2.

Unfortunately, per VMware KB 78652, for Horizon 8 (from 2006 to 2111), the lowest supported Microsoft Active Directory Domain Functional Level is 2012 R2.

https://kb.vmware.com/s/article/78652

For various reasons, it’s not possible for the client to upgrade to 2012 R2 Domain Functional Level in the near future.

I installed 2 Connection Servers 2111 (8.4.0-19446835) successfully, and they are replicating well.

Under Domains>Connection Server, the current domain is green, status is Normal, No Problems detected.

Our options seem to be:

Leave the installation as is at Horizon 2111/2203 and hope for the best.

We are opening a VMware support ticket to see if VMware can clarify and maybe confirm that nothing bad will happen (even though it is Unsupported).
The configuration will be unsupported, and the client can eventually upgrade to a higher Domain Functional Level.

Scrap Horizon 8 and install Horizon 7.10.3. Horizon 7.10.3 is the last Horizon version that officially supports Domain Functional Level of 2008 R2.

https://docs.vmware.com/en/VMware-Horizon-7/7.10/horizon-installation/GUID-F6075DF0-9614-4A81-B27A-7EE7C4CCB46F.html
Horizon 7.10.3 does fix the log4j vulnerability.
Horizon 7.10.3 is supported by Horizon Cloud Connector 2.1.2 (but not 2.2.0) — this still allows the client to use Horizon Universal Subscription license which they purchased.
The support for 7.10 Extended Service Branch at the “Technical Guidance” phase expires 3-22-2023, which means the client can still call support for major issues.
Hopefully, by the expiration of the “Technical Guidance” support phase on 3-22-2023, the client can eventually upgrade to a higher Domain Functional Level and then upgrade Horizon to 8.

Upgrade to Microsoft Active Directory Domain Functional Level of 2012 R2 or higher — not possible in the near future.

Questions to the community:

Does anyone know what Horizon 8 (2203/2111) functionality will break if using with the unsupported Microsoft Active Directory Domain Functional Level of 2008 R2 ?
Can anyone think of other options in this situation?

Sincerely,

Yury Magalif

Re: External customers connecting to our horizon frequently disconnects.

ymagalif — Tue, 18 Jan 2022 08:34:11 GMT

Lirick,

All excellent suggestions!

Carymiller,

Please follow lirick's and my questions to narrow down the problem. However, much more discovery and data collection is necessary to get to the bottom of such an issue.

Sincerely,

Yury Magalif

Re: High cpu usage on connection servers

ymagalif — Sat, 15 Jan 2022 06:19:11 GMT

All,

A common cause of high CPU on Connection servers in my experience is not having proper antivirus exclusions for the Connection servers. If you have multiple security products, make sure you do exclusions in all of them:

https://kb.vmware.com/s/article/2082045

Sincerely,

Yury Magalif

Re: External customers connecting to our horizon frequently disconnects.

ymagalif — Sat, 15 Jan 2022 06:11:58 GMT

carymiller,

Possibilities:

Machines that are domain joined have Group Policies coming down that adjust Windows Firewall Ports and thus may periodically block some ports.
There may be other Group Policy settings that affect Horizon Client and work OK for their own internal Horizon, but do not apply to your situation.
Are there Group Policies for Windows, like screensaver or time-out policies that are different between the customer's environment and yours?
Domain joined machines may have corporate security software (antivirus or behavioral security), that can detect connections and restrict some ports/addresses. Make sure external customers have exclusions applied for Horizon Client and exclusions to allow connections to your Horizon URLs.
Are the customers connecting to the VPN first (either on domain or non-domain joined), and is that behavior different for the other method?
This also may be something else rather than domain:
1. Are non-domain joined machines being used from a different point on the Internet (i.e. Domain-joined on corporate network, Non-domain joined at Home), and as a result there are different connection quality characteristics between them (latency, jitter, bandwidth)?
2. Do non-domain machines have a different build of Windows and/or a different version of Horizon Client with different settings?

Sincerely,

Yury Magalif

Re: Mouse Cursor Problems Using Horizon VMWare with a Mac

ymagalif — Sat, 15 Jan 2022 05:52:08 GMT

justhelping,

Try uninstalling VMware Horizon Client for Mac 2111, and instead downgrading to Horizon Client for Mac 2106.1. There are a number of issues reported with 2111 lately.

https://customerconnect.vmware.com/en/downloads/details?downloadGroup=CART22FQ2_MAC_2106.1&productId=1027&rPId=80507

Sincerely,

Yury Magalif

Re: VMware Horizon - Black Screen issue on Windows 10 Reconnect

ymagalif — Sun, 10 Jan 2021 09:07:12 GMT

All,

Black screen cause can be many things, and the general approach to troubleshooting this is well described here:

https://kb.vmware.com/s/article/1028332

However, if you see the CPU spiked and cannot get into the machine even through the console, then I recommend using a professional EUC performance monitoring tool like Liquidware Stratusphere UX or ControlUp.

Using an EUC performance monitoring tool, you can look at historical data on a specific date/time on what CPU process was spiking, and what other activities were going on at the time -- like GPU spikes, network or disk IOPS. Correlating those activities with the CPU spike can give you the answer.

For example, a common cause of a CPU spike is antivirus software not having proper exclusions for Horizon processes/files and thus scanning the processes/files. You will get a CPU spike from the Horizon services and IOPS activity from the antivirus.

Sincerely,

Yury Magalif

Re: No sound in my VMWare View Desktop

ymagalif — Mon, 13 Jan 2020 16:56:47 GMT

Brandon,

Uninstall the agent inside the Virtual Desktop, Reboot, uninstall Vmware Tools, Reboot, install Tools, reboot, reinstall Agent, reboot.

Try a different Horizon Client version on your Physical access point (reinstall).

Sincerely,

Yury Magalif

Re: The assigned pools user doesn't see in horizon

ymagalif — Mon, 13 Jan 2020 16:52:33 GMT

Tomek,

If persistent (dedicated) desktops, in addition to the entitlement, did you Assign the user to the specific desktop?

If non-persistent (floating), in addition to the entitlement, are there enough desktops in the pool for the user to get a new desktop?

When you login from a PC/Mac client or Web Browser (not only Thin Client), do you see the pool?

Sincerely,

Yury Magalif

Re: Multi-Site desktop entitlements per location

ymagalif — Mon, 11 Feb 2019 07:13:20 GMT

I also just finished a project with F5s, GTM, LTMs, Cisco ISE and Cloud Pod. Likewise, I am not an F5 expert.

However, the F5 specialists were able to configure directing load balancers to the specific site based on a VLAN (and therefore IP) of the thin client. So it is possible.

What was NOT possible, is to have the F5 direct to a specific site based on AD username and/or specific domain membership derived from Horizon View protocol stream. Apparently, this functionality was removed from F5 code in the last few code versions (we are using 14.1.0 Build 0.0.116).

As a result, what we ended up doing:

1. Thin Client logs into AD.

2. Cisco ISE puts Thin Client into a specific VLAN based on AD login.

3. Horizon View client initiates the connection to a unified namespace.
4. F5 directs connection to the correct site's Connection Servers based on the specific VLAN.

5. Cloud Pod proxies the connection to the correct site's virtual desktop (redundant failsafe, as F5 was not wrong in the first place).

This was quite complex, but educational.

Sincerely,

Yury Magalif

Re: Horizon VDI user-ID or IP address

ymagalif — Mon, 11 Feb 2019 06:29:36 GMT

Alim11,

1. Usually, when you are not tunneling, which means a Horizon virtual desktop connects to a Horizon client directly, you will need to specify the firewall rules based on the IP subnet or IP range of your virtual desktops that is used for DHCP, for example:

Allow all virtual desktops in range 192.168.1.20 to 192.168.1.251 to send/receive traffic to/from all the Horizon clients in range 10.10.10.20 to 10.10.10.251 on X ports.

Like BenFB said, when you are tunneling, which means a Horizon virtual desktop connects to a Horizon Connection Server or Unified Access Gateway, you will need to specify the firewall rules based on the IP subnet or IP range of your virtual desktops that is used for DHCP, and the tunneling server, for example:

Allow all virtual desktops in range 192.168.1.20 to 192.168.1.251 to send/receive traffic to/from Horizon Connection server 10.2.2.5 on X ports.

2. Installing PGP in a golden image -- have not used PGP, but I can imagine possible problems with it and non-persistent (linked or instant clone) virtual desktops.

However, you can use other full disk encryption systems with persistent (full clone) Horizon virtual desktops:

VMware's own vSphere Virtual Machine Encryption:

Configure Full Clones with vSphere Virtual Machine Encryption

HyTrust

Encrypting VMware vSphere VDI VMs

3. SIEM systems -- for persistent virtual desktops, there will be a persistent user name assigned to the desktop, and a DHCP IP address, that rarely, but may change. Therefore, best is to get a SIEM system that understands Active Directory user logons and can correlate events based on them. Otherwise, you will need to rely on the fact that the user will usually (but not always) get the same IP address from DHCP.

For non-persistent virtual desktops, the DHCP address may change much more often, and the user gets a fresh virtual desktop every time. Therefore, your SIEM system MUST understand Active Directory user logons and correlate events based on them.

4. Overall, VDI has some issues with various Security tools, but at the same time improves Security in other areas. For example, all data stays in the datacenter. In addition, in a non-persistent virtual desktop environment, viruses can be killed by logging off, destroying the virtual desktop and the virus in it.

Sincerely,

Yury Magalif

Re: View Service account getting locked

ymagalif — Mon, 11 Feb 2019 05:31:19 GMT

v.balan77@gmail.com,

When you remove and add the service account in View administrator > View configuration > Servers > vCenter Servers for vCenter and Composer, you should use the User Principal Name format of the account, for example:

username@domainname.com

Do not use the down-level logon name like DOMAINNAME\username.

I know this sounds ridiculous, but this tip was a recommendation from VMware support for a different issue, and helped me.

This is due to a rare bug in View 7.x.

Perhaps it can help you in this issue.

Sincerely,

Yury Magalif

Re: Automated Desktop Pool - Full VMs - Name not Changing

ymagalif — Sat, 20 Jan 2018 00:41:24 GMT

FranklinS,

Are you using QuickPrep or Sysprep?

Sometimes, I see such problems when a VM cannot acquire DHCP address properly, which requires you to check your DHCP server/leasing capability.

Sincerely,

Yury Magalif

Re: Slow logon on Windows 10 with Persona Management Appdata\Local redirect

ymagalif — Sat, 20 Jan 2018 00:36:50 GMT

Cenabit,

Appdata/local is always problematic with slower logons in Persona.

Is it an option for you to use good old View Persistent Disks for appdata/local?

UEM and AppVolumes writable volumes may also help, but they require additional cost and setup.

Sincerely,

Yury Magalif

Re: Will a 6.23 agent run with 6.25 Composer, Connection and security server?

ymagalif — Sat, 20 Jan 2018 00:28:59 GMT

LMorganSpartan,

Yes, such minor agent to server versions always run with VMware View. For example, I even have version 6.2 agent that runs with 7.2.3 version of server without any problems. VMware makes backward compatibility a priority on items that are cumbersome to upgrade, like thousands of agents.

Sincerely,

Yury Magalif

Re: View desktops & RDS hosts in same cluster using same vCenter?

ymagalif — Sat, 17 Dec 2016 08:48:22 GMT

Henderson,

View desktops and RDS applications are both part of delivering end-user computing services. Therefore, they are fine to deploy on a single cluster and vCenter. What is important is to try separating server VMs on a separate cluster from desktop VMs, because those definitely have drastically different access patterns - but you are already doing that.

In addition, you are a small shop where it even makes more sense. If your user count was in the thousands, then you might dedicate a whole cluster solely to RDS. A small to medium environment would just be wasting resources.

Sincerely,

Yury Magalif

Re: Managing disk space Windows 7

ymagalif — Sat, 17 Dec 2016 08:37:24 GMT

Bruce,

Some tips from my experience.

1. For recompose speed, SSD and faster storage is essential, and the primary solution. 40 GB is a not a large image, it is considered medium and we have fast recomposes with it, as long as it's on SSD and deduped storage (during a copy, deduped storage often only requires repointing links on the backend - so copies are faster).

2. One of the reasons your image is larger is due to installed applications. When you go to a non-persistent (floating), linked clone model, one of the design goals is to have a lighter master image, but add applications dynamically using VMware AppVolumes, ThinApp, or third party app technologies like Liquidware FlexApp. Some applications can be published using RDSH. You will need to apply this mix of technologies for serving different applications, and therefore reduce the size of your image.

Sincerely,

Yury Magalif

Re: How to increase video performance

ymagalif — Fri, 01 Jul 2016 01:48:51 GMT

Oliver,

Besides Randy's suggestions and your response, some video performance can be improved by adding an Nvidia Grid K1/K2 hardware cards for your installation.

Sincerely,

Yury Magalif

Re: Mac Connection Horizon View Time Out

ymagalif — Fri, 01 Jul 2016 01:43:37 GMT

Blithe,

Not enough info here.

The only thing I can suggest is try using a lower version of the Mac client - 4.0.1 or even lower.

Otherwise:

Is there an error? Is there a black screen?

Can you see pool names to choose?

Do you see any connection attempts logged in events on Connection server?

What do the following logs say (last few entries)?

~/Library/Logs/VMware View Client.log

~/Library/Preferences/ByHost/com.microsoft.rdc.plist

~/Library/Preferences/com.microsoft.rdc.plist

Where "tilde ~" indicates the name of the user logged into the Macintosh Client.

Sincerely,

Yury Magalif

Re: Persona tanking performance?

ymagalif — Fri, 01 Jul 2016 01:12:34 GMT

Mercutio,

Just like LarsonM said, do not use Windows 2003 as your file share, that OS is not longer considered robust.

Your average Disk Queue should be between 1-2 max, 3 is considered poor. So 20 is way too much.

How many Disk read and Disk write requests?

Sincerely,

Yury Magalif