VMWorld

#DW3727KU – The Digital Workspaces Showcase Keynote Live Blog

/ seanpmassey

In a few minutes, the Digital Workspace Showcase keynote will take place. This keynote will show the future of end-user computing. I will be updating this blog as they make announcements and perform demonstrations.

4:32 PM – Room is pretty full. Looks like we are running a few minutes behind while everyone takes their seats.

4:34 PM – The keynote is starting with a video about EUC issues. Some laughter in the crowd.

4:35 PM – Shankar Iyer and Noah Wasmer take the stage. They’re talking about the history of EUC at VMware. Noah is talking about the business transformation that VMware EUC can provide to a variety of use cases.

4:38 PM – Companies with engaged workforce’s earn 147% more per share than their non-engaged competitors.

4:39 PM – Horizon cloud services are available over 25 regions between AWS, Azure, and IBM Softlayer. Workspace ONE is processing over 450 BILLION events per month.

4:41 PM – CIOs are saying that they can’t recruit talent unless they upgrade their end-user computing infrastructure.

4:43 PM – Workspace ONE is the platform that will unify, abstract, and reduce device silos. There are five key pillars around reducing digital silos:

  • Employee Experience
  • Modern Management
  • Virtualization
  • Insights
  • Automation
  • There are three core ideas to bring an intelligence-driven digital workspace to life. These three pillars are built on a foundation of intelligence and automation.
  • 4:45 PM – Shankar announces the first Employees-First Award to highlight a customer that brings digital transformation to their employees. Adobe Systems wins the award.
  • 4:49 PM – Shawn Bass, VMware EUC CTO, takes the stage to talk about Redefining Modern Management of End-User Computing
  • The first announcement is Dell “Ready to Work” Solutions. Brett Hansen, VP at Dell, joins Shawn on stage.
  • The first point that they are discussing is the ability to manage Dell hardware with Workspace ONE.
  • Dell is providing factory integration of Workspace ONE so users can receive a laptop directly from Dell, already integrated with Workspace ONE, so they can boot it and have their applications provisioned as if they were a mobile device. Large applications are preloaded in the factory. This sounds like the existing Dell factory process with Workspace ONE preinstalled and registered.
  • In order to prevent untrusted applications from being run on the machine, Workspace ONE will integrate with Device Guard to prevent untrusted applications from running. Trusted applications can be downloaded and run through the Workspace ONE portal.
  • 4:57 PM – Announcing Windows 10 Industry Baselines. These are prepopulated templates with policies configured to meet various industry baselines. Baselines can be updated and modified by administrators. This solution provides 100% GPO coverage and 100% modern policy management coverage.
  • Device Update Readiness is an automation capability that will let IT fully automate the process of application compatibility testing. Workspace ONE Intelligence will detect applications that are blocking the deployment of the latest version of Windows and allow IT to automatically send alerts to the developers.
  • CVE Vulnerability Remediation is a Workspace ONE Intelligence service. It pulls in a CVE database into intelligence and provide information about the vulnerability and provides the ability to automate the approval of a patch, deployment of the patch, and alerting the security team that it was being proactively addressed.
  • 5:05 PM – Windows 10 isn’t the only ecosystem that is being updated. Enhancements are coming to MacOS, Android, Chrome, Google Glass, and Rugged/IoT.
  • 5:05 PM – Changes to work styles require changes to IT security.
  • Zero-trust security is a principle that states the device should never be trusted. Workspace ONE can help create a zero-trust environment. Workspace ONE allows for a defense-in-depth strategy where security can be applied at multiple layers.
  • The partnership with Okta enables IT to set policies that can prevent users from accessing Okta applications unless the device is managed. When attempting to access the application, WS ONE will perform a device check before sending the user to Okta for authentication.
  • Workspace ONE Trust Networks allows security tools to integrate with Workspace ONE Intelligence. This allows Workspace ONE to automate actions to prevent the user from introducing security risks into the environment.
  • VMware is also announcing four new Trust Networks partners – Checkpoint, Palo Alto Networks, Trend Micro, and zScaler.
  • 5:15 PM – Shikha Mittal and Angela Ge take the stage to discuss modernization of Windows Application Delivery.
  • Intelligence and automation are being added into the Horizon control plane. This is built into the Horizon Cloud Control Plane. A cloud connector will be available to enable automation and intelligence for on-premises Horizon environments. Horizon is also available on VMC, and the cloud connector enables management of these environments as well. Horizon Cloud on Softlayer and Horizon Cloud on Azure IaaS are managed directly from the Horizon Cloud Management Console.
  • The Horizon Cloud Management Console allows administrators to view all of their Horizon environments, both on-premises and in the cloud, and perform management actions against them. It also allows administrators to provision both Horizon on VMC and Horizon Cloud on Azure.
  • 5:25 PM – The Workpsace ONE agent can be installed on Horizon desktops, and when the desktop is provisioned, it becomes a managed device. This enables VMware UEM policies to be applied to Horizon desktops as well as view intelligence about the desktop, applications, and security posture of the entire physical and virtual desktop estate.
  • 5:30 PM – Announcing the Workspace ONE Intelligent Hub – combining the Workspace ONE app and the Airwatch Agent. Workspace ONE Intelligent Hub enables workflow driven activities with integrations into other enterprise systems like Service Now, an internal people directory, and a notifications page where the user can keep track of tickets and alerts from application notifications.
  • 5:36 PM – Shawn wraps up the keynote by announcing the EUC Beta Program. You can learn more at https://goo.gl/wZmXqK

    • VMworld Vegas Tips and Tricks

    / seanpmassey

    VMworld is only a few weeks away.  Like the last two VMworlds, VMworld 2018 will be held at the Mandalay Bay Conference Center in Las Vegas.  This will be the last year that VMworld is at Mandalay Bay – it should make a return to San Francisco’s Moscone Center for 2019.

    Whether you’re a seasoned pro or attending VMworld for the first time, there are a few things you should know for getting the most out of your VMworld experience.

    1. Wear Comfortable, Broken-In Shoes – You will be doing A LOT of walking. And I mean a lot.  If you track your steps, you will probably find that you do over 20,000 steps each day.  And when you’re not walking, you will probably be spending a lot of time on your feet.  Having a comfortable pair of walking shoes is key to surviving the week.  Make sure you break these shoes in before you go to Vegas.
    2. Lighten Your Load – If your backpack is anything like mine, it’s filled with most things that we think we need on a day-to-day basis.  This could be an extra power supply, dongles and adapters for projectors, spare whiteboard markers, or whatever else ends up in our backpacks.  That can be a lot of extra weight that you carry around.  You won’t need most of this for VMworld.  Clean out your backpack before you go and leave the extra stuff at home.  If you plan to bring electronics with you that you won’t carry every day, make sure you take advantage of the safe in your hotel room to keep them secure.
    3. Spend Time in the Community Areas and Solutions Exchange – VMworld is about the sessions, right?  Nope.  While the sessions are important, don’t fill your entire schedule with back-to-back sessions and talks.  You will want to spend time exploring the solutions exchange to talk to vendors and in the community areas.  The Blogger Tables and the vBrownbag Community Stage are great places to meet others.
    4. Join Twitter – If you’re not already on Twitter, make sure you join it for VMworld.  There is a lot going on, and you can keep up with sessions and after-hours activities by tracking various hashtags like #VMworld and #VMworld3Word.  It’s also a great way to meet people.
    5. Go Outside – Yes, Vegas is hot.  But you’ll be spending most of the day indoors breathing recycled and air-conditioned air.  Step outside, even if its for 15 minutes and get some fresh air.
    6. Be Safe – There is a lot to do in Vegas, but if you step out at night to explore the town, make sure you’re safe.  The usual tourism rules apply.  Don’t carry any more cash than you need to, keep your wallet and cell phone in your front pocket, and be aware of your surroundings.

    #VMworld EUC Showcase Keynote – #EDW7002KU Live Blog

    / seanpmassey

    Good afternoon from Las Vegas.  The EUC Showcase keynote is about to start.  During this session, VMware EUC CTO Shawn Bass and GM of End User Computing Sumit Dhawan will showcase the latest advancements in VMware’s EUC technology portfolio.  So sit tight as we bring you the latest news here shortly.

    3:30 PM – Session is about to begin.  They’re reading off the disclaimers.

    3:30 PM – Follow hashtag #EUCShowcase on Twitter for real-time updates from EUC Champions like @vhojan and @youngtech

    3:31 PM – The intro video covers some of the next generation technologies like AI and Machine Learning, and how people are the power behind this power.  EUC is fundamentally about people and using technology to improve how people get work done.

    3:34 PM – “Most of you are here to learn how to redefine work.” Sumit Dhawan

    3:38 PM – Marginal costs of endpoint management will continue to increase due to the proliferation of devices and applications.  IoT will only make this worse.

    3:39 PM – VMware is leveraging public APIs to build a platform to manage devices and applications.  The APIs provide a context of the device along with the identity that allow the device to receive the proper level of security and management.  Workspace One combines identity and context seamlessly to deliver this experience to mobile devices.

    3:42 PM – There is a tug of war between the needs of the business, such as security and application management, and the needs of the end user, such as privacy and personal data management.  VMware is using the Workspace One platform to deliver a balance between the needs of the employer and the needs of the end user without increasing marginal costs of management.

    3:45 PM – Shawn Bass is now onstage.  He’s going to be showing a lot of demos.  Demos will include endpoint management of Windows 10, MacOS, and ChromeBook, BYO, and delivering Windows as a Service.

    3:47 PM – Legacy Windows management is complex.  Imaging has a number of challenges, and delivering legacy applications has more complex challenge.  Workspace One can provide the same experience for delivering applications to Windows 10 as users get with mobile devices.  The process allows users to self-enroll their devices by just entering their email and joining it to an Airwatch-integrated Azure AD.

    Application delivery is simplified and performance is improved by using Adaptiva.  This removes the need for local distribution points.  Integration with Workspace One also allows users to self-service enroll in applications without having to open a ticket with IT or manually install software.

    3:54 PM – MacOS support is enabled in Workspace One.  The user experience is similar to what users experience on Windows 10 devices and mobile devices – both for enrollment and application experience.  A new Workspace One app experience is being delivered for MacOS.

    3:57 PM – Chromebook integration can be configured out of the box and have devices joined to the Workspace One environment.  It also supports the Android Google Play store integration and allows users to get a curated app-store experience.

    3:59 PM – The core message of Workspace One is that one solution can manage mobile devices, tablets, and desktop machines, removing the need for point solutions and management silos.

    4:01 PM – Capital One and DXC are on stage to talk about their experience around digital workspace.  The key message is that the workplace is changing from one where everyone is an employee to a gig economy where employees are temporary and come and go.  Bring-Your-Own helps solve this challenge, but it raises new challenges around security and access.

    Capital One sees major benefits of using Workspace One to manage Windows 10.  Key features include the ability to apply an MDM framework to manage devices and removing the need for application deployment and imaging.

    4:10 PM – The discussion has now moved into BYO and privacy.

    4:11 PM – And that’s it for me folks.  I need to jet.

    Top 10 EUC Sessions at #VMworld 2017 Las Vegas

    / seanpmassey

    VMworld 2017 is just around the corner.  The premier virtualization conference will be returning to the Mandalay Bay convention center in Las Vegas at the end of August. 

    There is one major addition to the EUC content at VMworld this year.  VMware has decided to move the Airwatch Connect conference, which cover’s VMware’s offerings in the mobility management space, from Atlanta and colocate it with VMworld.  So not only do attendees interested in EUC get great expert content on VMware’s Horizon solutions, they’ll get more content on Airwatch, mobility management, identity management, and IoT as well.

    My top 10 EUC sessions for 2017 are:

    1. ADV1594BU – Beyond the Marketing: VMware Horizon 7.1 Instant Clones Deep Dive – This session, by Jim Yanik and Oswald Chen, is a technical deep dive into how Instant Clone desktops work.  This updated session will cover new features that have been added to Instant Clones since they were released in Horizon 7.  I’m often wary of “deep dive sessions,” but I’ve seen Jim give a similar presentation at various events and he does a great job talking through the Instant Clone technology in a way that all skill levels can understand it.  If you’re interested in VMware EUC, this is the one session you must attend as this technology will be relevant for years to come. 
    2. ADV1609BU – Deliver Any App, Any Desktop, Anywhere in the World Using VMware Blast Extreme – Blast Extreme is VMware’s new protocol that was officially introduced in Horizon 7.  Pat Lee and Ramu Panayappan will provide a deep dive into Blast Extreme.  Pat does a good job talking about Blast Extreme and how it works, and attendees will definitely walk away having learned something.
    3. ADV1681GU/ADV1607BU – Delivering 3D graphics desktops and applications in the real world with VMware Horizon, BEAT and NVIDIA GRID – VMware’s Kiran Rao and NVIDIA’s Luke Wignall talk about how Blast Extreme utilizes NVIDIA GPUs to provide a better user experience in End-User Computing environments.  This session was actually listed twice in the Content Catalog, so don’t worry if you miss one.
    4. ADV1583BU – Delivering Skype for Business with VMware Horizon: All You Need to Know – Official support for Skype for Business GA’d with Horizon 7.2.  This session will dive into how that the new Skype for Business plugin works to provide a better telephony experience in EUC environments.
    5. ADV3370BUS – DeX Solutions: How Samsung and VMware are Pioneering Digital Transformation – Samsung DeX is a new cell phone from Samsung that, when placed in a dock, can utilize a keyboard, mouse, and monitor to act as a virtual thin client endpoint while still having all the capabilities of a phone.  DeX has the potential to revolutionize how businesses provide endpoints and cellular phones to users.
    6. ADV1655GU – CTOs perspective on the Workspace 2020 and beyond: time to act now! – End-User Computing expert and technology evangelist Ruben Spruijt talks about the future of the end-user workspace and strategies on how to implement next-generation workspace technology.
    7. UEM1359BU – Best Practices in Migrating Windows 7 to Windows 10 – Windows 10 migrations are a hot topic, and almost every business will need a Windows 10 strategy.  This session will explore the best practices for migrating to Windows 10 in any type of organization.
    8. SAAM1684GU – Ask the Experts: How to Enable Secure Access from Personal/BYO Devices and All Types of Users with Workspace ONE – How do you enable secure remote access to company resources while allowing employees, contractors, and other types of workers to use their personal devices?  This group discussion will cover best practices for using VMware Workspace ONE to provide various levels of secure access to company resources from personal devices based on various context settings.  Unlike most sessions, this is a group discussion.  There are very few slides, and most of the session time will be devoted to allowing attendees to ask questions to the discussion leaders.
    9. ADV1588BU – Architecting Horizon 7 and Horizon Apps – A successful EUC environment starts with a solid architecture.  This session covers how to architect an integrated Horizon environment consisting of all components of the Horizon Suite. 
    10. vBrownbag TechTalks on EUC – There are three community driven vBrownbag Tech Talks focusing on EUC led by EUC Champions.  These talks are:
      1. GPU-Enabled Linux VDI by Tony Foster – Tony will cover how to build GPU-enabled Linux virtual desktops in Horizon and some of the pain points he encountered while implementing this solution at a customer.
      2. Windows 10 and VDI – Better Come Prepared – Rob Beekmans and Sven Huisman will cover lessons they’ve learned while implementing Windows 10 in VDI environments.
      3. Leveraging User Environment Manager to Remove GPOs – Nigel Hickey will cover how to use VMware UEM as a Group Policy replacement tool.
    11. ADV1605PU – Ask the Experts: Practical Tips and Tricks to Help You Succeed in EUC – So this top 10 list will actually have 11 entries, and this one is a bit of shameless self-promotion.  This session is s a repeat of last year’s EUC champions session featuring Earl Gay, VCDX Johan van Amersfoot, moderator Matt Heldstab, and I.  We’re answering your questions about EUC based on our experiences in the trenches.  Last year, we also had some prizes. 

    Bonus Session

    There is one bonus session that you must put on your schedule.  It’s not EUC-related, but it is put on by two of the smartest people in the business today.  They were also two of my VCDX mentors.  The session is Upgrading to vSphere 6.5 the VCDX Way [SER2318BU] by Rebecca Fitzhugh and Melissa Palmer.  You should seriously check this session out as they’ll provide a roadmap to take your environment up to vSphere 6.5. 

    EUC5404 – Deliver High Performance Desktops with VMware Horizon and NVIDIA GRID vGPU

    / seanpmassey

    Notes from EUC5405.

    Reasons for 3D Graphics

    • Distributed Workforces with Large Datasets – harder to share
    • Contractors/3rd Party workers that need revocable access – worried about data Leakage and Corporate Security

    Engineering firm gained 70% productivity improvements for CATIA users by implementing VDI – slide only shows 20%

    Windows 7 drives 3D graphics, Aero needs 3D.  Newer versions of Windows and new web browsers do even more.

    History of 3D Graphics in Horizon

    • Soft3D was first
    • vSGA – shared a graphics card amongst VM, limited to productivity and lightweight use
    • vDGA – hardwire card to virtual machine
    • GRID vGPU – Mediated Pass-thru, covers the middle space between vSGA and vDGA

    vGPU defined – Shared access to physical GPU on a GRID card, gets access to native NVIDIA drivers

    vGPU has official support statements from application vendors

    Product Announcement – 3D graphics on RDSH

    vGPU does not support vMotion, but it does support HA and DRS placement

    Upgrade Path to Horizon vGPU

    If you already have GRID cards and are using vDGA or vSGA, there is an upgrade path to vGPU.

    Steps:

    • Upgrade to vSphere 6.0
    • Upgrade Horizon to 6.1 or newer
    • Install NVIDIA VIBs on host
    • Upgrade VMs to version 11
    • Set vGPU profiles
    • Install drivers in VMs

    vGPU has Composer Support

    GRID Profiles set in vCenter

    Two settings to configure – one in vCenter (vGPU Profiles) and one in Horizon

    GRID 2.0 – bringing Maxwell to GRID

    More users, Linux Support

    Moving to Platform – software on top of hardware instead of dedicated product line for GRID

    GRID 2.0 is hardware plus software.  Changing from being a driver into a platform and software with additional features

    Licensing is changing. Licensed user groups.

    Grid Editions

    vMotion not coming today – much more complicated problem to solve

    GRID editions

    GRID Use Cases

    Virtual PC – business users who expect great perf, AutoCAD, PhotoShop

    Virtual Workstation – Siemens, Solidworks, CATIA, REVIT

    Virtual Workstation Extended – Very high end.  Autodesk Maya

     

    High-Perf VDI is not the same your regular VDI

    • Density goes down, CPU/Memory/IOPS/Rich Graphics capabilities go up
    • Workloads are different than traditional VDI

    Hardware Recommendations

    • vSphere 6.0 Required
    • VM must be HW version 11
    • 2-8 vCPUs, at least 4 for Power Users
    • Minimum 4GB RAM
    • 64-bit OS

    Required Components in VMs:

    • VM Tools
    • View Agent
    • NVIDIA Driver

    Use the VMware OS Optimization Tool fling.  Users can see up to 40% in resource savings.

    Sizing Rich Graphics – Storage

    Storage still critical factor in performance

    CAD users can demand more than 1TB of storage per desktop

    Size and performance matter now

    Storage Options:

    • Virtual SAN – SSD based local storage
    • Or All-Flash based SANs

    Bringing Rich 3D into Production

    • Establish End-User Acceptance Criteria to verify that User Experience is acceptable
    • Have end users test applications and daily tasks
    • Time how long it takes to complete tasks

    VAPP5483 – Virtualizing Active Directory the Right Way

    / seanpmassey / 1 Comment

    Notes from VAPP5483 – Virtualizing Active Directory the Right Way

    Active Directory Overview

    Windows Active Directory multi-master replication conundrum

    Writes originate from any DC

    Changes must converge

    • Eventually
    • preferably on time

    Why virtualize Active Directory

    • Virtualization is mainstream at this point
    • Active Directory is fully supported in virtual environments
    • Active Directory is virtualization friendly -> Distributed multi-master model, low resource requirements
    • Domain Controllers are interchangable -> one breaks, they can be replaced. Cattle, not pets
    • Physical domain controllers waste compute resources

    Common Objections to DC Virtualization

    • Fear of the stolen VMDK -> no different than stolen server or backup tape
    • Priviledge Escalation -> vCenter priviledges are separate
    • Have to keep certain roles physical -> no technical reason for this, can seize or move roles if needed
    • Deviates from standards/build process -> helps standardization
    • Time Keeping in VMs is hard -> Presenters agree

    Time Sync Issues

    Old way – VMs get time from ESXi

    Changed to use Windows time tools

    KB 1189 -> time sync with host still happens on vMotion or Guest OS reboot

    http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1189

    Demo -> moving PDC emulator to host with bad clock

    If time on host is more than 1 year old, NTP cannot update or fix the time

    How do we determine the correct time

    Ask ESXi host?

    This could be OK if…

    • Host times are always right
    • CMOS doesn’t go bad
    • Rogue operations don’t happen
    • Security is a thing other people worry about

    Reality – Stuff happens…

    vSphere default behavior corrects time on the PDC emulator

    Can cause a lot of issues in impacted Windows Forests

    Preventing Bad Time Sync

    • Ensure hardware clock is correct
    • Configure reliable NTP
    • Disable DRS on PDCe
    • Use Host-Guest Affinity for PDCes
    • Advanced Settings to disable Time Sync –> KB 1189

    Best Practices

    Don’t use WAN for Auth –  Place domain controllers locally

    Distribute FSMO Roles

    Use Effective RBAC – don’t cross roles unless needed, give rights only to trusted operators

    To P2V or Not – don’t do it unless you hate yourself

    Use Anti-Affinity Rules -> don’t have DCs on the same hosts, use host rules to place important

    Sizing

    vCPU – under 10K users, 1 vCPU, over that, start with 2 vCPU

    RAM – database server, database is held in RAM, more RAM is better, perfmon counter shows cache usage

    Networking – VMXNET3

    Storage – Space that it needs plus room to grow

    DNS –

    70% of issues are DNS issues

    AD requires effective DNS

    DNS solution – doesn’t matter if Windows or Appliance, but must be AD-Aware

    Avoid pointing DNS to itself, otherwise DNS cannot start

    Virtual Disk -> Caching MS KB 888794

    Preventing USN Rollback

    AD is distributed directory service, relies on clock-based replication

    Each DC keeps track of all transactions and tags them with a GUID

    If a DC is snapshotted and rolled back, local DC will believe it is right, but all others will know it is bad and refuse to replicate with it. This is called USN rollback

    Demo USN rollback

    If you have 2008 R2 and below DCs, they will stop replicating. Both will still advertise as domain controllers

    VM-Generation ID – exposes counter to guest

    • 2012 and newer. Operating system level feature and must be supported by hypervisor
    • vSphere 5.0 Update 2 and newer
    • Attribute is tracked in local copy of database on local domain controller, triggered by snapshots and snapshot rollback

    Provides protection against USN rollback

    Invented specifically for virtual domain controllers, allows for cloning of domain controllers

    Demo – Clone a Domain Controller

    Domain Controller must have software and services that support cloning – agents have to support cloning

    Do NOT hot clone a domain controller. Must be in powered off state

    Do not clone a DC that holds FSMO roles

    Can Clone the PDCe, must power up reference domain controller before powering on clone

    DNS must work

    Do not sysprep the system

    DC Safeguard allows a DC that has been reverted/restored to function as a DC

    How it works:

    • VM Generation ID checked on DC boot, when a snapshot is created,  or when the VM is reverted to an old snapshot.  VM Generation-ID on VM is checked against the copy in the local database.
    • If it differs, RID Pool dumped and new RID pool issued
    • When Generation ID has changed, AD will detect it and remediate it
    • RID pool discarded, get new RID Pool and objects are re-replicated. VM essentially becomes a new DC

    What’s New in VMware Horizon 6.2–User Experience

    / seanpmassey / 1 Comment

    One of the areas where Horizon 6.2 has a lot of improvements is in the User Experience category.  The new version adds new features as well as brings a few older features out of tech preview.

    Client Drive Redirection for VDI and RDSH

    Client Drive redirection for Windows was in Tech Preview in Horizon 6.1.1.  It officially comes out of Tech Preview in Horizon 6.2, and it is now supported on both Windows and Mac clients.  It is also available as a tech preview for Linux clients.

    This feature, when installed on the virtual desktop, allows users to remotely access files and data that might have stored on their local PC.  It utilizes compression and encryption when transferring files from the endpoint into the virtual desktop or server. 

    Windows 10 Support

    Although Windows 10 was officially supported on vSphere 6 on Day 1, it wasn’t supported in Horizon.  Virtual desktops built on Windows 10 would work, but there limits to what you could do, and other components of the Horizon Suite were not designed to work with or support it.

    Horizon 6.2 has full support for Windows 10.  The Horizon Agent and Client are supported.  This includes Smart Card authentication support.

    Windows 10 is only supported when running ESXi 5.5 Update 3 or ESXi 6.0 Update 1.

    File Type Associations for Published Apps

    There are times when I may want to allow a user to launch an application or work with files without installing the required applications on their machines.  In these cases, the user would then have to log into Horizon, launch the application, and then navigate to the network location where the file was stored.

    But what if I could register a file handler in Windows that would allow me to double click on that file and have it launch the remote application automatically?  Horizon 6.2 now adds this capability.

    In order to improve the user experience when opening files remotely, a data compression algorithm is utilized when transferring the files up to the remote host.  This transfer is also protected with SHA 256 encryption for when clients are remotely accessing the remote application over the Internet.

    Mac OSX and IOS Support

    Horizon Client 3.5 will be supported on OSX 10.11 and IOS 9.

    Biometric Authentication

    The Horizon Client for IOS will support biometric authentication.  This feature will allow users to store their credentials in Keychain and utilize their fingerprints to sign into their virtual desktops or published applications.  Administrators can also define polices for who can use this feature from with the Horizon Administrator console.

    This feature is only supported with Horizon 6.2 when using Horizon Client 3.5.  The mobile device must also be running IOS 8 or IOS 9.

    What’s New in VMware Horizon 6.2–3D Graphics

    / seanpmassey / 1 Comment

    3D graphics are becoming increasingly important in virtual desktop environments.  While a number of high-end applications and use cases, such as CAD and medical imaging, require 3D graphics, modern applications are increasingly turning to the GPU to offload some processing.  These days, most web browsers, Microsoft Office, and even Windows are utilizing the GPU to assist with rendering and other tasks.

    VMware has been slowly adding 3D support to Horizon.  Initially, this was limited to dedicating GPUs to a virtual machine or sharing the GPU through hypervisor-level components.  Horizon 6.1 added  NVIDIA’s vGPU to provide better shared GPU access.

    Horizon 6.2 includes a significant number of improvements to virtual 3D acceleration.  In fact, most of the improvements are in this category.

    NVIDIA GRID 2.0

    NVIDIA announced the next generation of GRID on Sunday afternoon.  For more information, see my write-up on it here.

    vDGA for AMD GPUs

    AMD/ATI graphics cards were supported on virtual desktops in vSphere 5.x and Horizon 5.x.  This did not carry over to Horizon 6.  AMD support has been reintroduced in Horizon 6.2 for vDGA.

    3D Support for RDS Hosted Applications

    RDS desktops and published applications will now support both vDGA and vGPU when utilizing supported NVIDIA graphics cards.  3D acceleration is supported on RDSH servers running Windows Server 2008 R2 and Windows Server 2012.

    Linux Desktop vSGA and vGPU Support

    When Linux desktops were introduced in Horizon 6.1.1, they only supported vDGA for 3D graphics.  This limited Linux to a few specific use cases.

    Horizon 6.2 adds significant support for 3D acceleration.  Both vSGA and vGPU are now available when utilizing supported NVIDIA graphics cards.

    Linux desktops with vGPU will be able to utilize OpenGL 2.1, 3.x, and 4.x, while desktops with vSGA will be limited to OpenGL 2.1.

    4K Resolution Support

    4K content is extremely high resolution content, and more 4K content will appear as the displays start to come down in price.  These displays, which have a resolution of 3840×2160, are useful in situations where high resolution imaging is needed.

    Horizon 6.2 will support in-guest resolutions up to 3840×2160.  In order to achieve this, Horizon Agent 6.2 is needed in the guest, and the client must be connecting with Horizon Client 3.5.

    The guest operating system must be running Windows.  A Windows 7 virtual desktop can support up to three 4K monitors when running on a VM with HW version 11 and with Aero disabled.  Windows 7 machines with Aero enabled, or Windows 8 desktops running on HW version 10 can support a single 4K monitor.

    Please note that this is for in-guest display resolutions.  Clients that have a 4K display with High DPI scaling are not supported at this time.

    What’s New in VMware Horizon 6.2 – RDSH and Application Publishing

    / seanpmassey / 1 Comment

    Publishing applications from RDSH servers was one of the big additions to Horizon 6.0.  Horizon 6.2 greatly expands on this feature set, and it offers many new capabilities under the covers to improve the management of the environment.

    Cloud Pod Support for Applications

    Horizon’s Cloud Pod for multi-datacenter architectures has been expanded to include support for RDSH-published applications.  Users can now be entitled to an application once and access them across Horizon pods and/or datacenters. 

    image

    Enhanced RDSH Load Balancing

    The load balancing and user placement algorithms have been enhanced in Horizon 6.2 to ensure that users do not get placed on an already overloaded server.  There are two main improvements that enable this:

    1. The load balancing algorithm utilizes Perfmon counters to determine which hosts are optimal for starting new sessions.  The View agent runs a script to collect system performance data, and it reports back to the connection servers with a recommendation based on the system’s current performance.  A server placement order is calculated based on the data that the View Agents return.

    2. Application anti-affinity rules will look at the number instances of an application that is running on an RDSH host.  If the number of a particular application is higher than a predefined value, user connections will be directed to another host.  Application anti-affinity rules process after the server placement order has been determined.

    There are a couple of things to be aware of with the new load balancing algorithms.  First, they only apply to new sessions, so if a user already has a session on an RDSH server, they will be reconnected to that session and be able to launch any application, even if it violates an anti-affinity rule.

    Application anti-affinity rules also do not apply to RDSH desktop sessions.

    Linked-Clone Support and Horizon Composer for RDSH

    If you had wanted to build an RDSH Farm for Horizon 6.0, you would have had to build, deploy, and manage each server manually.  There was no built-in way for managing server images or server updates.  This could also be an inefficient use of storage.

    Horizon 6.2 changes this.  Composer now supports linked-clone RDSH servers.  This brings the benefits of linked-clone desktops, such as automated pool builds, single image management, and system and application consistency, to server-based computing.

    What’s New in VMware Horizon 6.2–Core Infrastructure

    / seanpmassey / 1 Comment

    In order to set up and run VMware Horizon, you need to have a vSphere infrastructure and Windows VMs to run the server components.  Horizon 6.2

    Horizon Access Point

    One of the challenges of deploying Horizon is that, in order to provide external access, you need to deploy Windows machines into your network’s DMZ.  These servers, called Security Servers, run a subset of the Connection Broker that proxies or tunnels PCOIP, Blast, and RDP connections into your environment.

    Horizon Security Servers have their limitations, though.  To start with, they are usually not joined to an Active Directory domain, so they cannot be configured or managed with the Group Policies that manage the rest of your infrastructure.  Because these servers live in the DMZ, they also need to be patched frequently and secured.

    Security Servers are also paired directly with a Connection Server.  If the Connection Server is not available, users who connect with that particular security server would not be able to authenticate or connect to a desktop.  This also limits the number of servers you can deploy to a maximum of seven. 

    Horizon 6.2 will now include a new method of providing remote access called the Access Point.  The Access Point is a locked-down virtual appliance built on SUSE Linux Enterprise Edition 11 that has feature parity with the Security Server.  It allows you to remove Windows VMs from your DMZ, and it does not need to be paired with a Connection Server, so you can scale out your external access without having to add additional connection servers.

    The Access Point will not be dedicated to Horizon View.  It is designed to work with all components of the Horizon Suite – reducing the number of external access components that you need to manage.

    image

    One-Way Trust Support

    If you work in a multi-domain or federated environment, Horizon View required a two-way trust between domains or forests in order to authenticate and entitle users.

    There are a number of environments where two-way trusts aren’t feasible.  Think about companies that routinely undergo mergers, acquisitions, or divestitures.  They have use cases for virtual desktop environments, but a two-way trust between Active Directory environments would pose security and integration challenges.

    Horizon 6.2 takes a step towards resolving this by adding support for 1-way Active Directory trusts.  Users and groups from external (trusted) domains can now be granted access to Horizon desktops without having to create a full two-way trust.

    image

    In order to fully support one-way forest trusts, Horizon will need to utilize a service account with permissions to authenticate against the trusted domain.  This account is stored in the Horizon LDAP database, and all of its credentials are encrypted.

    Secondary credentials are managed by using the vdmadmin command line tool that is installed on Connection Servers.

    vSphere 6 Update 1 Support

    Horizon 6.2 will support vSphere 6 Update 1 on Day 1.

    FIPS and Common Criteria Certification

    The US Federal Government has a number of criteria that IT products must meet.  These include things like IPv6 compatibility, FIPS cryptographic support, and Common Criteria certification.

    Horizon 6.1 introduced support for IPv6.  Horizon 6.2 expands upon this with support for FIPS on all Horizon Windows components.  FIPS will also be supported in Horizon Client 3.5 for Windows.

    FIPS mode is optional, and it can be enabled if it is required.

    VMware will also be submitting Horizon 6.2 for Common Criteria certification, and this testing is currently in process.  It should be completed sometime in 2016.

    Enhanced License Console

    The license console in previous versions of Horizon was not very detailed.  It would give you the current number of active users with a breakdown by virtual machine type.

    Horizon 6.2 overhauls the licensing console on the Admin page.  The new licensing console shows part of the key that is in use along with the number of concurrent connections and unique named users that have logged in.