This posting is ~3 years years old. You should keep this in mind. IT is a short living business. This information might be outdated.
We have to deal with COVID19 for a year now and from the IT perspective, 2020 was a pretty strange year. Many project were not cancelled, but were placed on-hold. But two kinds of projects went through the roof:
Microsoft 365, and
Horizon View
As you might noticed I blogged a lot about Exchange, Exchange Online and Horizon this year. The reason for this is pretty simple: That was driving my business this year.
In early 2020, when we decided to move into our home offices, we deployed Horizon View on physical PCs at ML Network (my employer). This was a simple solution and it works for us until today.
Some of my customers also deployed Horizon View for the same reason: A secure and easy way to get a desktop. For some of them, the tech was new and they struggled with DEM, Linked Clones, customization etc. The solution in this case was easy: Full Clones with dedicated assignment.
One customer moved from Windows 7 and floating-assignment and Linked Clones to Windows 10 and Full Clones and dedicated assignment (not my project).
Another customer started to implement Horizon View with Horizon 2006 and he started with Instant-Clones, dedicated assignment and DEM. I told him to go with Full Clones, but his IT-company moved on with Instant Clones. Now he’s complaining about gaining complexity.
My 2 cents
Many customers struggle with Windows 10 and the customization of Windows 10. Tools like Dynamic Environment Manager (DEM) are powerful, but they can be quite complex, especially when it comes down to small IT orgs with 50,100 oder 200 desktops, were each member of the IT has to be a jack of all trades.
I always recommend to start with Full Clones, just to get in touch with the technology. And I always recommend to get the requirements clear with the stakeholders and the user. Things like not working software, missing settings after a logoff/ logon or slow response are the main difficutiles who will force a VDI project to fail.
When you are familiar with the technology, proceed further with DEM, Instant Clones, floating assignment. But you should learn to walk, before you start to run.
Maybe I’m getting old. :D I’m not against modern technology and new features. I’m not a grumpy old senior consultant. But I think I’ve learned the hard way why it’s a bad idea to overburden IT-orgs and their users with new tech, especially in times like these.
This posting is ~3 years years old. You should keep this in mind. IT is a short living business. This information might be outdated.
The View Agent Direct-Connection (VADC) Plug-In was designed as an extension to the Horizon Agent, which allows a Horizon Client to directly connect to a VM or physical machine withtout using a Horizon Connection Server.
The VADC is nothing new, it is part of the Horizon View eco system for a couple of years now. Meanwhile, the VADC supports the Blast Exteme protocol, which makes it pretty interesting for remote access to lab environment or home office equipment.
There are a couple of requirements which I want to highlight:
VADC Plug-In has the following additional requirements:
The VM or or physical machine must have a minimum of 128 MB of video RAM
For a virtual machine, you must install VMware Tools before you install Horizon Agent
A physical machine supports Windows 10 Enterprise version 1803 or version 1809, newer releases tend to work flawless
A VM supports Blast and PCoIP protocols
A physical machine supports Blast only
The installation of the VADC is divieded into two steps:
Installation of the View Agent
Installation of the VADC
The View Agent has to be installed silently, because you are unable to add it to a Connection Server. The silent installation allows you to skip this step.
I used this command line to install the View Agent:
The second step is to install the VADC. This is pretty easy: Setup > Next, next, next. :)
Finally, you can start the View Client on another machine and add a Connection Server with the IP or FQDN of you newly installed VADC machine.
This is the output of netstat on my X250 after connecting using the VADC:
TCP 192.168.20.52:443 t480s:50996 ESTABLISHED
TCP 192.168.20.52:443 t480s:50997 ESTABLISHED
TCP 192.168.20.52:443 t480s:50998 ESTABLISHED
TCP 192.168.20.52:22443 t480s:51014 ESTABLISHED
TCP 192.168.20.52:32111 t480s:51027 ESTABLISHED
You might notice the typical Horion View Ports 22443 for Blast Extreme and 32111 for USB redirection.
This posting is ~3 years years old. You should keep this in mind. IT is a short living business. This information might be outdated.
This issue was a bit annoying. I faced this issue not in a customer environment, rather then on my second Lenovo laptop, an X250 with Windows 10 20H2. My intention was to use it headless in a docking station. So how should I access it? RDP? TeamViewer? Why not use the Horizon Direct Connection Plug-in?
The Horizon Direct Connection Plug-in is not a new feature and you can think of it as a View Agent without a Connection Server. You can access it using the View Client, but you don’t have to run the connection through a Connection Server. For pretty small environments or direct access a perfect fit!
Error message View Agent setup
In order to use the Horizon Direct Connection Plug-in, you have to install the View Agent. So I downloaded the latest View 2006 Agent (VMware-Horizon-Agent-x86_64-8.0.0-16530789.exe) and started the setup.
It fails right at the beginning. Okay, I just installed Windows Updates, so I rebooted my laptop. But the setup fails again. Next reboot. And it fails, and fails, and fails.
There are some registry keys you can check of you get such an error. “PendingFileRenameOperations” is one of the common issues when you face this problem. I found a script, but there was no reboot pending.
I finally found it: RunOnce.
HKLM RunOnce
There was an entry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce. After deleting this entry, the setup went through.
Fun Fact: There is an MSI Property for this, when you want to Silently install the View Agent : SUPPRESS_RUNONCE_CHECK.
These beta exams are a cost-effective way to achieve certifications. The last beta exam I took, was the VCP6-DCV beta. Because I already had the VCP6-DTM on my to-do list, the new VCP7-DTM beta exam was released just in the right moment.
Beside of this, VMware can test the questions and is getting feedback to increase the quality of their exams.
Exam preparation
The beta exam preparation guide is quite comprehensive. Desktop and Mobility (DTM) is not only about VMWare Horizon View. VMware Horizon Mirage, App Volumes, User Environment Manager, Thin App, IDM/ Workspace are also part of the exam.
Section 1 – Install and Configure Horizon Server Components
Objective 1.1 – Describe techniques to prepare environment for Horizon
Objective 1.2 Determine procedures to install Horizon Components
Objective 1.3 – Determine steps to configure Horizon Components
Objective 1.4 – Analyze End User Requirements for Display Protocol Performance Knowledge
Objective 1.5 – Diagnose and solve issues related to connectivity between Horizon Server Components
Section 2 – Create and Configure Pools
Objective 2.1 – Configure and Manage Horizon Pools
Objective 2.2 – Build and Customize RDSH Server and Desktop Images
Section 3 – Configure and Administer VMware Mirage
Objective 3.1 – Install and Configure Mirage Components
Objective 3.2 – Configure and Manage Mirage layers
Objective 3.3 – Configure and Manage Mirage Endpoints
Section 4 – Configure and Manage Identity Manager
Objective 4.1 – Install and Configure VMware Identity Manager
Objective 4.2 – Manage VMware Identity Manager
Section 5 – Configure and Manage User Environment Manager
Objective 5.1 – Install and Configure VMware User Environment Manager
Objective 5.2 – Manage VMware User Environment Manager
Section 6 – Configure and Manager App Volumes
Objective 6.1 – Install and Configure VMware App Volumes
Objective 6.2 – Manage VMware AppStacks and writeable Volumes
Section 7 – Configure vRealize Operations for Horizon
Objective 7.1 – Manage VMware Workspace Portal
The preparation guide outlines some documents, which can be used to preapre for the exam. Although I’m working with Horizon View on a regular base, I had some “blind spots”. I used the official documentation and my lab to prepare for the exam.
The exam
The exam contained 175 questions, and I had 245 minutes to answer all the questions. I arrived early at the test center, because I had booked the first available slot for that day. I did not expect to be able to answer all the questions. View, Mirage, App Volumes, Workspace and IDM were the main topics, only a few questions about ThinApp and vROps for Horizon. Many questions were about administrative topics, where to click to achieve something, or where a specific option is located. There were also some questions about requirements, supported databases etc. As far as I can judge, these were all fair questions. If you have intensivly studied the documentation, you have do not have to fear this exam. Experience in administration is a great plus.
I really do not know if I have passed it. It will take some time. The results will be available after the beta phase. If I don not passed, I have at least gained experience.
This posting is ~7 years years old. You should keep this in mind. IT is a short living business. This information might be outdated.
A load balancer is an integral component of (nearly) every VMware Horizon View design. Not only to distribute the connections among a number of connection or security servers, but also to provide high availability in case of a connection or security server failure. Without a load balancer, connection attempts will fail, if a connection or security server isn’t available. Craig Kilborn wrote an excellent article about the different possible designs of load balancing. Craig highlighted Microsoft Network Load Balancing (NLB) as one of the possible ways to implement load balancing. Jason Langer also mentioned Microsoft NLB in his worth reading article “The Good, The Bad, and The Ugly of VMware View Load Balancing“.
Why Microsoft NLB?
Why should I use Microsoft NLB to load balance connections in my VMware Horizon View environment? It’s a question of requirements. If you already have a load balancer (hopefully redundant), then there is no reason to use Microsoft NLB for load balancing. Really no reason? A single load balancer is a single point of failure and therefore you should avoid this. Instead of using a single load balancer, you could use Microsoft NLB. Microsoft NLB is for free, because it’s part of Windows Server. At least two servers can form a highly available load balancer and you can install the NLB role directly onto your Horizon View connection or security servers.
How does it work?
Microsoft Windows NLB is part of the operating system since Windows NT Server. Two or more Windows servers can form a cluster with at one or more virtual ip addresses. Microsoft NLB knows three different operating modes:
Nearly all switches support IGMP Snooping. If not, spend some money on new switches. Let me get this clear: If your switches support IGMP Snooping, enable this for the VLAN to which the cluster nodes are connected. There is no need to configure static multicast mac addresses or dedicated VLANs to avoid flooding.
If you select the multicast (IGMP) mode, each cluster node will periodically send an IGMP join message to the multicast address of the group. This address is always 239.255.x.y, where x and y corresponds to the last two octets of the virtual ip address. Upon receiving these multicast group join messages, the switch can send multicasts only to the ports of the group members. This avoids network flooding. Multicast (IGMP) simplifies the configuration of a Microsoft NLB.
Enable IGMP Snooping for the VLAN of the cluster nodes
Enable the NLB role on each server that should participate the cluster
Create a cluster with multicast (IGMP) mode on the first node
Join the other nodes
That’s it!
The installation process of a Microsoft NLB is not particularly complex, and if the NLB cluster is running, there is not much maintenance to do. As already mentioned, you can put the NLB role on each connection or connection server.
What are the caveats?
Sounds pretty good, right? But there are some caveat when using Microsoft NLB. Microsoft NLB does not support sticky connections and it does not support service awareness. Why is this a problem? Let’s assume that you have enabled “HTTP(S) Secure Tunnel”, “PCoIP Secure Gateway” and “Blast Secure Gateway”.
Patrick Terlisten/ www.vcloudnine.de/ Creative Commons CC0
In this case, all connections are proxied through the connection or security servers.
The initial connection from the Horizon View client to the connection or security server is used for authentication and selection of the desired desktop pool or application. This is a HTTPS connection. At this point, the user has no connection to a pool or an application. When the user connects to a desktop pools or application, the client will open a second HTTPS connection. This connection is used to provide a secure tunnel for RDP. Because it’s the same protocol, the connection will be directed to the same connection or security server as before. The same applies to BLAST connections. But if the user connects to a pool via PCoIP, the View client will open a new connection using PCoIP with destination port 4172. If the PCoIP External URL refers to the load balanced URL, the connection can be directed to another connection or security server. If this is the case, the PCoIP connection will fail. This is because the source ip address might be the same, but another destination port is used. VMware describes this behaviour in KB1036376 (Unable to connect to the PCoIP Secure Gateway when using Microsoft NLB Clustering).
Another big caveat is the missing service awareness. Microsoft NLB does not check, if the load balanced service is available. If the load balanced service fails, Microsoft NLB will not stop to redirect requests to the the cluster node that is running the failed service. In this case, the users connection requests will fail.
Still the ugly?
So is Microsoft NLB still the ugly option? I don’t think so. Especially for small deployments, where the customer does not have a load balancer, Microsoft NLB can be a good option. If you want to load balance connection servers, Microsoft NLB can do a great job. In case of load balancing security servers, you should take a look at KB1036376, because you might need at least 3 public IP addresses for NAT. The missing service awareness can be a problem, but you can workaround it with a responsive monitoring.
In the end, it is a question of requirements. If you plan to implement other services that might require a load balancer, like Microsoft Exchange, you should take a look at a redundant, highly available load balancer appliance.
This posting is ~7 years years old. You should keep this in mind. IT is a short living business. This information might be outdated.
Logging is essential for troubleshooting. VMware Horizon View allows you to configure a SQL database for event logging, and I really recommend to configure the event logging database (I have seen some deployments without). Beside the event logging database, it’s a great idea to configure a secondary log destination. With a event logging database, and logs sent to a syslog, you have two independent log destinations.
To configure a syslog destination, login to the Horizon View admin portal and go to “View Configuration > Event Configuration”.
Patrick Terlisten/ www.vcloudnine.de/ Creative Commons CC0
If you have a vCenter Server Appliance running in your environment, you already have a functional syslog server. There is no need to configure a dedicated syslog server. Just add your vCenter Server Appliance as syslog destination. After applying the settings, the connection servers will start to send logs to the syslog server. This is a capture of the vCenter Server Appliance running in my lab.
vcsa1:/storage/log/remote # ll
total 20
drwx------ 2 root root 4096 Jan 20 20:10 connsrv1
drwx------ 2 root root 4096 Jan 20 10:15 esx1
drwx------ 2 root root 4096 Jan 20 10:15 esx2
drwx------ 2 root root 4096 Jan 20 10:15 esx3
drwx------ 2 root root 4096 Jan 20 10:15 esx4
vcsa1:/storage/log/remote #
The host “connsrv1” is my Horizon View connection server (I only use a single connection server behind a Citrix NetScaler VPX – it’s a lab…).
