Optimization Guide for Desktops and Servers in View in VMware Horizon 6 and VMware Horizon Air Desktops and VMware Horizon Air Apps

Transcription

1 Optimization Guide for Desktops and Servers in View in VMware Horizon 6 and VMware Horizon Air Desktops and VMware Horizon Air Apps VMware Horizon 6 Version 6.x, VMware Horizon Air Desktops Standard, VMware Horizon Air Desktops Advanced, VMware Horizon Air Desktops Enterprise, and VMware Horizon Air Apps TECHNICAL WHITE PAPER

2 Table of Contents Introduction... 4 VMware Operating System Optimization Tool Audience... 4 How This Guide Is Organized View in Horizon Horizon Air Desktops and Horizon Air Apps Why Optimize? What Are You Optimizing? When Do You Optimize? VMware OS Optimization Tool Using the OSOT... 7 OSOT Features Tab Functions OSOT Template Choices... 8 OSOT Template Groups and Settings System Information Analysis Summary OSOT Optimization Pane Road Map for Using the OSOT Best Practices Analyze a Master Image Apply Optimizations Review the Optimization Results Interpret the Analysis Summary Export Results View Optimization History Roll Back to the Pre-Optimized State of the Master Image View Rollback History Perform Remote Analysis of Master Images Customizing OSOT Built-In Templates Groups Add a Group Modify a Group Remove a Group TECHNICAL WHITE PAPER / 2

3 ... Steps Add or Modify Steps Remove Steps Change the Order of Steps Set the Operating System Delete a Custom Template Add Custom Templates to the Repository Windows 7 and Windows 8.x OS Optimizations Windows 7 and Windows 8.x Service Modifications Windows Optimizations Available Using Group Policy Windows 7 and Windows 8.x Optimizations Using the Registry Windows Server 2008 and Windows Server 2012 OS Optimizations Windows Server Optimizations Using Group Policy Windows Server Optimizations Using the Registry SMB File Server Tuning Recommended General Windows Server Optimizations References About the Authors and Contributors Appendix A: Optimizations Reference Appendix B: Release Notes for the OSOT VMware OS Optimization Tool VMware OS Optimization Tool TECHNICAL WHITE PAPER / 3

4 Introduction This guide presents the ways to optimize virtual desktops and servers for View in VMware Horizon 6 and for VMware Horizon Air Desktops using the VMware Operating System Optimization Tool (OSOT). VMware Operating System Optimization Tool The free VMware OSOT makes it easy to apply configuration settings to virtual desktops and servers. It includes settings to optimize the following Windows operating systems for both desktops and servers that reside in the data center and in the cloud: Windows 7 (for desktops) Windows 8.x (for desktops) Windows Server 2008 (including R2) Windows Server 2012 (including R2) The OSOT optimizes RDSH servers for both View and Horizon Air. Both Horizon 6 and Horizon Air use the desktop and server optimizations that the OSOT can supply. Note: The optimization information in this guide pertains only to these Windows OS versions. It does not pertain to Windows XP, which Microsoft no longer supports. For more information, see the Windows XP Deployment Guide. Audience This guide is written for data center administrators and IT personnel who want to optimize Windows operating systems for View virtual desktops in Horizon 6 and for Horizon Air desktop and app environments. The guide assists you in working with the OSOT and provides an ongoing reference as you become a more proficient OSOT user. VMware will periodically update this document to reflect continuing enhancements to the OSOT and future releases of the Windows operating system. How This Guide Is Organized This guide is organized into the following sections: Introduction provides a brief description of the guide and its target audience, and summarizes the Horizon 6 and Horizon Air products. Why Optimize? explains why Microsoft Windows should be optimized for virtual machines for desktops and servers, the specific areas in the OS that you customize, and the benefits of doing so. VMware OS Optimization Tool presents an overview of the tool, the link to download it, and the steps to use it. Note: The section Road Map for Using the OSOT outlines the steps to perform an optimization. It is the quickest path to get started on the process. You can then use the other parts of this document as a reference when you have questions along the way. Windows 7 and Windows 8.x OS Optimizations provides details about the modifications that you can make to these versions of the operating system with the OSOT. Windows 2008 R2 and Windows 2012 R2 Server OS Optimizations provides details about the modifications that you can make to these versions of the operating system with the OSOT. References supplies additional sources of information. Appendix A (Customizations Reference) lists the values and settings for all items in all OSOT built-in templates. Appendix B (Release Notes for the OSOT) contains the latest changes and updates to the OSOT. TECHNICAL WHITE PAPER / 4

5 View in Horizon 6 View in Horizon 6 is a desktop virtualization solution that enables organizations to deliver virtualized or remote desktops and applications to end users through a single platform. The three Horizon 6 editions, VMware Horizon 6 Standard Edition, VMware Horizon 6 Advanced Edition, and VMware Horizon 6 Enterprise Edition, include View as their foundation. Each edition builds successively on the other so that Horizon 6 Advanced Edition is based on Horizon 6 Standard Edition with additional components and products, and Horizon 6 Enterprise Edition extends the capabilities of Horizon 6 Advanced Edition. For more information, see the VMware Horizon Pricing, Packaging, and Licensing white paper. Horizon Air Desktops and Horizon Air Apps Horizon Air Desktops and Horizon Air Apps provide virtual desktops and hosted apps as a cloud service, deploying and managing them in the cloud. Like the user experience in Horizon 6, users can securely access their desktops and apps from any device or browser. TECHNICAL WHITE PAPER / 5

6 Why Optimize? Windows was designed for physical hardware, specifically desktops, and for that hardware to be accessed by just one user at a time. Windows uses many resources to achieve a powerful PC, but many of these settings are unnecessary or even detrimental when applied to the virtual environment. These actions include, for example, animating windows as the user opens them. Performing this animation takes significant CPU resources, which decreases the number of desktops that you can host per VMware vsphere server. Consequently, this nonessential function in a virtual machine (VM) environment increases the amount of system hardware that you need. Even if hardware is plentiful, Windows animations do not perform well when accessed remotely, especially when connecting over a slow WAN or Internet connection. Thus, keeping animations enabled (in addition to other unnecessary tasks for VMs) impairs the end-user experience. Another example of desktop optimization in a VM environment is to disable Windows Update so that control of the service is isolated to administrators. Administrators can run Windows Update in batch mode for the VMs as opposed to users performing this task, which they do in traditional Windows desktop environments. What Are You Optimizing? Using the recommendations provided in the OSOT, you are maximizing the efficiency and performance of your virtual desktops and RDSH servers. Note: The OSOT can also be used with standalone desktops, either virtual or physical, although the focus of this document is on the administration of master images. Optimizing virtual desktops Increases virtual desktop performance Increases virtual desktop density, boosting the number of virtual desktops that can be hosted per vsphere server, thereby reducing infrastructure costs Improves the desktop experience for end users Reduces desktop support because of fewer end-user calls to address Optimizing RDSH servers Increases hosted desktop and application performance Reduces the amount of system resources that each RDSH server requires Increases the number of RDSH servers that can be hosted virtually on Windows Server 2008 R2 or Windows Server 2012 (RDSH server density) Increases the number of users that can be supported per RDSH server Improves the hosted desktop and application experience for end users Reduces system support When Do You Optimize? The traditional approach to optimizing virtual desktops or RDSH servers is to use a main virtual machine that acts as a master image. You apply the optimizations to the master image, which is then used to create pools of desktops. You can also use the master image as a template to deploy multiple RDSH servers. Another type of optimization that is frequently performed is one that is made spontaneously to running systems. This kind of optimization is done to tune something that should have been optimized when the system was first deployed. However, it is also executed because something has changed, and the new optimizations are needed on running systems that cannot be redeployed. You can perform both types of optimization, including the creation of a master image, using the OSOT. TECHNICAL WHITE PAPER / 6

7 VMware OS Optimization Tool The OSOT provides the easiest and most efficient way to optimize your Windows desktops and server master images. It offers many advantages over traditional scripts, including the ability to roll back changes, selectively modify optimization values, and view detailed audit information before applying optimizations. The OSOT includes customizable built-in templates to enable or disable Windows system services and features across multiple systems per VMware recommendations and best practices. Because most Windows system services are enabled by default, you can use the OSOT to disable unnecessary services and features to improve performance. The OSOT is a free VMware Fling that you can download. Using the OSOT Before using the OSOT, which contains recommended configurations using the OSOT built-in templates, your IT organization should investigate and evaluate the benefits of the various optimizations. There is sometimes a trade-off between productivity and optimization. Also, test before and after using the OSOT to ensure that optimizations do not interfere with other software that might be in use within your master image. Appendix A lists all the optimization settings in the OSOT templates. Review these for applicability to your organization s specific use cases. Figure 1: OSOT Analysis Results You can perform the following actions using the OSOT: Analyze Optimize View the history Customize the OSOT built-in templates TECHNICAL WHITE PAPER / 7

8 The Remote OS Optimization Tool is also included in the OSOT download. It uses the same functionality as the OSOT but connects to a remote desktop broker so that the master image VMs can be found and optimized. For more information, see the VMware Remote Analysis Tool Guide. OSOT Features This section describes some of the tool s graphical features. Tab Functions When you open the OSOT, four tabs provide the main functions of the OSOT: Analyze Analyze the registry entries, services, and scheduled tasks of the VM that you want to optimize. History View the past details of the optimization and roll back to the pre-optimized state of the master image. Remote Analysis Browse a list of virtual machines in a remote desktop environment to analyze and optimize them. Templates Modify the OSOT built-in templates and save the changes to create your own set of OSOT templates. Figure 2: Main Tabs Available in the OSOT (Before Optimization) OSOT Template Choices The following OSOT built-in templates come with a list of modifications for a standard master image. Each OSOT template is an XML file that contains the coding for the optimizations. The default settings are the recommended values for optimizing your Windows operating system. Windows7 (built-in) Optimizes Windows 7 desktops. (built-in) Optimizes all versions of Windows 8 desktops. WindowsServer (built-in) Optimizes Windows Server 2008 and Windows Server 2012 servers. Note: When Windows Server 2008 or 2012 is used as a single-session desktop, use the WindowsServer (built-in) template. The key to optimization is to update services and configurations. Some service names and configuration keys are different between Windows (the personal or desktop version) and Windows Server. Therefore, always use the OSOT template with the correct OS version that your virtual machine is using. For example, if the target system is running Windows 7, use the Windows7 (built-in) template to optimize it. Note: The OSOT selects the appropriate OSOT built-in template by detecting the OS of the target machine. However, if you inadvertently select a template from the drop-down menu, remember to choose the correct OSOT template for your VM. Figure 3: Selecting a Template Name in the OSOT You can also create your own templates within the OSOT, as described in Customizing Templates. TECHNICAL WHITE PAPER / 8

9 OSOT Template Groups and Settings Each OSOT built-in template has a list of the modifications organized by group. The Windows7 (built-in) template contains the following groups: Apply HKCU Settings to Registry Apply HKLM Settings Disable Features Disable Scheduled Tasks Disable Services Disable Visual Effects VMware Components Figure 4: Windows 7 Built-In Template Optimizations For information about the settings for each optimization in the Windows7 (built-in) template, see Appendix A: Optimizations Reference. TECHNICAL WHITE PAPER / 9

10 The (built-in) template contains the following groups: Apply HKCU Settings to Registry Apply HKLM Settings Disable Features Disable Scheduled Tasks Disable Services Disable Visual Effects VMware Components Figure 5: Windows 8 Built-In Template Optimizations For information about the settings for each optimization in the (built-in) template, see Appendix A: Optimizations Reference. TECHNICAL WHITE PAPER / 10

11 The WindowsServer (built-in) template contains the following groups: Apply HKCU Settings to Registry Apply HKLM Settings Disable Scheduled Tasks Disable Services For information about the settings for each optimization in the WindowsServer (built-in) template, see Appendix A: Optimizations Reference. Figure 6: Windows Server 2008 and 2012 Built-in Template Optimizations TECHNICAL WHITE PAPER / 11

12 System Information The System Information pane in the upper left of the main OSOT window, below the four main tabs, has details about the system (local or remote) that you are targeting. Selected definitions for the following window items in the System Information section are: OS Operating system on which the OSOT is running User Name Current logged-in user Physical Memory Installed physical memory Windows Locale OS setting that identifies, by geographical location, the language specified for the system prompts for the targeted Windows machine Figure 7: System Information Pane of the Main OSOT Window Analysis Summary The Analysis Summary pane in the upper right of the main OSOT window provides a graphical representation of the results that you obtain after you perform an analysis of the optimizations using a particular OSOT template. For more information, see Analyze a Master Image. Figure 8: Analysis Summary Pane of the Main OSOT Window TECHNICAL WHITE PAPER / 12

13 OSOT Optimization Pane When you first encounter the OSOT Optimization pane, to the right of the Template Name menu in the VMware OS Optimization Tool window, you see that the area is largely blank. The only elements shown are a check box and four columns: Optimizations, Description, Expected Result, and Actual Result. Figure 9: Main OSOT Pane Before You Analyze After you select a template from the Template Name menu and perform an analysis by clicking the Analyze button, the columns populate with the results. Figure 10: Main OSOT Pane After You Analyze TECHNICAL WHITE PAPER / 13

14 Road Map for Using the OSOT Using the OSOT involves the following steps: 1. Analyze a master image. 2. Review the results of the analysis. 3. (Optional) Export the analysis result. 4. Optimize the master image. 5. Analyze the optimization results (SUCCESS, FAILED). 6. Troubleshoot FAILED results: Click the respective FAILED links to review the error code and error string information. 7. (Optional) View the optimization history. 8. (Optional) Perform a rollback (if you want to return a master image to its pre-optimized state). 9. (Optional) Create a custom OSOT template. 10. (Optional) Place the custom OSOT templates in the OSOT template repository to display them in the Template Name list. Best Practices To make the most of the OSOT, follow these best practices: Use the OSOT on a clean image. Apply the tool to an unused system that has been built to match the configuration that you will deploy for virtual desktops or RDSH servers. Disable as many unnecessary Windows OS components as possible without causing a conflict with required applications or user satisfaction. Consider disabling everything and then performing some user-acceptance testing (UAT) to see if there are problems. Re-enable the required components. TECHNICAL WHITE PAPER / 14

15 Analyze a Master Image First, you analyze the current state of a desktop master image, and later, you apply the template s optimizations according to your choices. Before you begin to analyze your first master image, the OSOT window looks like this, with the Analyze tab selected by default: Figure 11: Main OSOT Window Before You Analyze The lower right pane in the main OSOT window has blank entries for the Optimizations, Description, Expected Result, and Actual Result columns. To analyze a master image: 1. Run the OSOT from the master image that you want to optimize. Apply the tool to an unused system that has been built to match the configuration that you will deploy for virtual desktops or RDSH servers. 2. From the Template Name drop-down menu in the left pane, select an OSOT built-in or custom template that matches the OS of the system that you are optimizing. Your chosen template opens, with the optimizations for that template in the left pane. Note: Use a template that matches the target machine; this is critical because each OS has different optimizations. If you see elements in the template that are marked with red Xs, they are not available in the targeted image that you are optimizing, and the OSOT cannot perform those optimizations. TECHNICAL WHITE PAPER / 15

16 3. Click Analyze. 4. In the Product/Feature Compatibility dialog box, select the options that pertain to the master image that you are going to optimize. Your selections in the dialog box ensure that the optimization changes do not interfere with the selected product or feature. TECHNICAL WHITE PAPER / 16

17 5. Click Continue to Analyze. The right lower pane fills in with detailed optimization information for the target system. The Optimizations column shows which optimizations are mandatory, optional, or recommended for optimal performance. Additionally, it might also list items considered suboptimal based on the OSOT analysis. If you want to save the optimization analysis, you can export the results to a file. See Exporting Results. Apply Optimizations You can choose which optimizations to apply to your target system from the Optimizations list and then run the tool. If the optimizations are not applied, you can troubleshoot. Different permissions, an incorrect configuration, or a Group Policy setting in the target system are some of the reasons why certain optimizations might not be applied. After troubleshooting, click Analyze again to see whether the optimizations are successful. TECHNICAL WHITE PAPER / 17

18 1. In the Optimizations list, review the items that you want to optimize according to their icons and the meaning of those icons (categories). Mandatory You must apply the optimization to the item in the target system because of problems or issues that the OSOT has identified. The Actual Result is not equal to the Expected Result for the recommended optimization. The Expected Result is the recommended value. The Actual Result is what is configured in the target system. The OSOT is indicating that the Actual Result (value) should be the same as the Expected Result (value) for the recommended optimization. See the action to take or the value to apply in the Description column. Optional VMware does not have an opinion regarding applying the optimization to the item in the target system. See the information in the Description column. Recommended Even if the OSOT recommends an optimization, there can be valid reasons not to apply it. Decide if the recommendation is applicable to your organization s use cases. Review the information in the Description column and in the section Using the OSOT. OK The item has the proper value or setting and does not require any optimization. No severity level is associated with this status. Table 1: Optimization Categories Each severity level is the result of comparing the suggested optimization setting with the current setting. 2. Select the items that you want to optimize. To select or deselect all items, select the check box in the title bar. By default, all settings are selected. TECHNICAL WHITE PAPER / 18

19 Here is a before-and-after example of what you see when you apply an optimization: Using the Windows7 (built-in) template, you see that the Apply HKCU Settings to Registry group includes two services: Lower Terminal Server Client Send Interval Reduce Menu Show Delay 3. Click Optimize. 4. Wait for the optimization to complete, indicated by the progress bar showing 100%. 5. Review the items that you have optimized and note the following: New Optimize tab (shown selected) in the row of tabs New Optimization Result column that appears before the Steps column The selected items for optimization that show SUCCESS for the Optimization Result (such as those specified in the example from Step 2, Lower Terminal Server Client Send Interval and Reduce Menu Show Delay) TECHNICAL WHITE PAPER / 19

20 Review the Optimization Results In the Optimization Result column, SUCCESS means that the item has been successfully optimized. From the OSOT perspective, this value has been corrected. Figure 12: Optimization Result Column At this point, you do not have to be concerned about the Expected Result or Actual Result values in those respective columns because the item has been optimized. For those items that show a FAILED result, click the FAILED link to review the error code and error string and possibly troubleshoot the issue. Figure 13: Addressing FAILED Results A failure can occur for numerous reasons. Permissions, an incorrect configuration, or a Group Policy are just some of the possibilities. For example, if the system is in a domain and the system administrator forbids users to change the settings on their desktops, the optimization could fail. Interpret the Analysis Summary When you click the Analyze button, in addition to the list of individual optimizations, an Analysis Summary displays in the upper right pane of the main OSOT window. The graphical chart makes it easy to review how close the analyzed system is to being optimally configured for best performance in terms of the severity levels. You can interpret the severity levels in the Analysis Summary as follows: Mandatory The item on the targeted system has a different configuration (the value shown in the Actual Result column) than the OSOT template (the recommended value in the Expected Result column). Optional It is advised to optimize the item in the targeted system due to problems or issues that the OSOT has identified. Recommended You can choose whether to optimize the item. Within each severity level, the number of items in which the optimization has not been applied (orange) or has been applied (blue) is shown. Orange indicates that the value of the item in the target system and the OSOT template do not match. Blue indicates that the target system item and the OSOT template do match. TECHNICAL WHITE PAPER / 20

21 In the following example, the mandatory column shows 15 items to be configured in the selected OSOT template, with 1 mismatch (orange) and 14 matches (blue), meaning that their values or settings in the target system are what the OSOT expected. Moreover, the optimization has not yet been applied. Figure 14: Analysis Summary Pane of the Main OSOT Window Your next step might be to identify the one mismatch in the list of optimizations and apply the optimization. Export Results Before you optimize the master image, you can export the analysis results as an HTML file for record keeping and to share with other personnel. You can also use the results as a comparison with the post-optimization results. 1. In the lower right of the OSOT main window, click Export Analysis Result. TECHNICAL WHITE PAPER / 21

22 2. Save the HTML file in your desired location. View Optimization History You can view the details of the optimizations that you have performed. 1. Click the History tab. 2. Review the information for the optimization processes that you have performed. TECHNICAL WHITE PAPER / 22

23 The following table defines the elements that you can view in the optimization history. SCREEN ITEM Template Name Machine Name Date Time Type DESCRIPTION Name of the template for which the optimization has been completed Name of the machine for which the optimization has been completed Date when the optimization was completed Time when the optimization was completed Operation type, such as Optimization or Rollback Table 2: Optimization History Elements Roll Back to the Pre-Optimized State of the Master Image A rollback returns the master image to its pre-optimized state before you performed the analysis function with the OSOT template. You can roll back any master image that you have optimized and reverse all optimizations, including any registry changes that you made with the OSOT. 1. Click the History tab. 2. In the Template Name column, select the check box for the optimized entry that you want to roll back and click Rollback. 3. When the rollback operation is complete, click OK in the dialog box. TECHNICAL WHITE PAPER / 23

24 View Rollback History You can view the details of the rollbacks that you have performed. 1. Click the History tab. 2. Review the information for the rollbacks that you have performed. Perform Remote Analysis of Master Images Remote analysis enables you to analyze and optimize remote master images that are managed in your remote desktop environment. 1. Click the Remote Analysis tab. 2. In the Login window, enter your desktop broker (View Connection Server) information to browse a list of master images in the remote desktop environment. 3. Click Login. 4. When connected, perform an analysis and remediation just as you would on a local machine. For more information, see the VMware Remote Analysis Tool Guide. TECHNICAL WHITE PAPER / 24

25 Customizing OSOT Built-In Templates Beyond its built-in optimization capabilities, the OSOT enables you to create custom templates. Using the OSOT template editor, you can apply your own optimizations. There is no limit to the number of customized templates that you can produce. The OSOT built-in templates are read only, so you do not have to worry about accidentally breaking them. However, you can edit an OSOT built-in template and save the modified version as a new file. You can customize the OSOT built-in templates in these ways: Add a new group or step Change the order of the steps Edit the properties of steps and the action types Execute particular steps on different operating systems Note: If you have not saved your changes, you can remove all your changes by clicking the Discard button. Figure 15: Overview of the Key UI Items for Creating a Customized Template TECHNICAL WHITE PAPER / 25

26 Groups A group is a set of optimization settings that are organized as a category, such as Apply HKLM Settings. You can add, modify, or remove a group to design and customize an OSOT template. Add a Group You can add a group to an existing or new OSOT template. 1. Click the Templates tab, and from the Template Name drop-down menu, select the template. 2. From the left pane, right-click a group and select Add Group. The OSOT allows for nested groups, so you are adding a group to the group that you selected. However, in the Add Group dialog box, you have the option to add the group at the current level or the nested level. 3. In the Add Group dialog box: a. Enter the name of the group. b. Enter a description of the group. c. Select whether to add the group at the current level or nested level. The current level adds the group to the same level as the selected group. The nested level option adds the group as a subgroup of the selected group. TECHNICAL WHITE PAPER / 26

27 4. Click Add. 5. Click Save As. 6. Enter the filename. 7. Click Save. Modify a Group You can make changes to an existing group. 1. Click the Templates tab, and from the Template Name drop-down menu, select the template. 2. Select the group to modify. 3. Change the name and description of the group. 4. Click Set. 5. Click Save As to save the changes made to the group. 6. In the Save As dialog box, enter the template s filename and click Save. TECHNICAL WHITE PAPER / 27

28 7. In the Save Template dialog box, click OK. Saving your changes creates a new, customized OSOT template. You are not changing the OSOT built-in templates, because they are read-only. The OSOT template name is the same as the filename without the.xml extension. Remove a Group You can remove a group from a template. You can also remove a group that is nested in another group. 1. Click the Templates tab, and from the Template Name drop-down menu, select the template. 2. Right-click the group to remove and select Remove. You can also select the group and click the Remove button. 3. Click Save As, enter the name of the template in the Save As dialog box, and then click Save. TECHNICAL WHITE PAPER / 28

29 Steps A step is an optimization setting within a group. You can create and add steps and modify, reorder, or remove them to design and customize an OSOT template. Warning: In the group Apply HKCU Settings to Registry, do not change any settings in the steps for Load HKCU for editing Unload HKCU for editing Changes to these settings can break everything in that step. Figure 16: Do Not Change Settings for Load HKCU for editing and Unload HKCU for editing (See Warning Above) TECHNICAL WHITE PAPER / 29

30 Figure 17: Changes to hku\temp Could Cause Steps in the Custom Template to Malfunction Add or Modify Steps You can add a new step or modify an existing step under a group. 1. Click the Templates tab, and from the Template Name drop-down menu, select the template. 2. Right-click the group to which you want to add a step and select Add Step. When adding or changing step information, the Add button is grayed out until you click Set. The information is not saved until you click Add. To modify a step, click the group that it belongs to, and then click the existing step. 3. Enter the information in Step Details. For the steps in the group Apply HKCU Settings to Registry: In the Key Name field, do not change the \hku\temp part of the path. However, you can change any other elements in the path name. Changes to \hku\temp could cause the steps in the custom template to malfunction. TECHNICAL WHITE PAPER / 30

31 4. Click Save. 5. Select what you want to do from the Action Type drop-down menu: 6. Select the action parameters. After you select the type from the Type drop-down menu, the field names change according to your selection. Note: Depending on your selection, another Type field might appear. This type field modifies the field directly above it. For example, the Type field below Value is the data type of the value that you enter. The field names and values for each type are described in the following substeps and tables. a. Provide the following information for the Registry type. TECHNICAL WHITE PAPER / 31

32 FIELD Command Key Name Value Type Data DESCRIPTION AND VALUES Command to execute. The options are: ADD Add a registry key and value to the host that you are optimizing LOAD Open the HKCU registry hive for editing UNLOAD Close the HKCU registry hive after editing is completed to save the changes Name of the registry key where the registration information from a particular file is opened. Value of the registry key. Data type of the specified value. The supported data types are: REG_SZ REG_BINARY REG_DWORDREG_QWORD Data given for the value. Table 3: Parameters for the Registry Type b. Provide the following information for the Service type. FIELD Service Name Start Mode DESCRIPTION AND VALUES Specify the action to perform. Expected startup mode for the service. The options are: Auto Boot Disabled Manual System Table 4: Parameters for the Service Type TECHNICAL WHITE PAPER / 32

33 c. Provide the following information for the ShellExecute type. FIELD Command DESCRIPTION AND VALUES Command line to execute. Table 5: Parameters for the ShellExecute Type d. Provide the following information for the SchTasks type. FIELD Command Task Name Status DESCRIPTION AND VALUES Action to perform for the task. Only the Change command is supported. Full path of where the task is located. Choose whether to enable or disable the command. Table 6: Parameters for the SchTasks Type TECHNICAL WHITE PAPER / 33

34 7. Click Set. To erase all the changes, click Remove. Note: You can edit the values individually without clicking Remove. The Remove feature clears the information so that you can add new values. 8. To save the information, click Add. 9. Create, modify, and delete as many steps and groups as you want. 10. To make the template changes permanent, click Save As. 11. Enter the name of the template in the Save As dialog box and click Save. Remove Steps You can design a new OSOT template by removing steps. 1. Click the Templates tab, and from the Template Name drop-down menu, select the template. 2. Select the group that contains the steps that you want to remove, and expand it to view the steps. 3. Select the steps to remove and click Remove. 4. Do one of the following: To change the existing custom template, click Save. To create a new custom template, click Save As, name the template, and then click Save. Change the Order of Steps You can change the order of the steps within an OSOT template. 1. Click the Templates tab, and from the Template Name drop-down menu, select the template. 2. Select the group that contains the steps that you want to move within a selected group, and expand it to view the steps. 3. Select each step to move, and click Up or Down to move it. 4. Click Save. Set the Operating System Setting the operating system enables you to execute a step from the template for the specific operating system. You can include or exclude an operating system for a specific step by clicking the pencil icon. 1. Click the Templates tab, and from the Template Name drop-down menu, select the template. 2. Click the step to modify. 3. In the Step Details section, click the pencil icon in the Operating System field. 4. In the List of Available Operating Systems, select the operating system to add, include, or exclude. 5. In the List Selection, select Include or Exclude and click > and then click OK. 6. Click Update to update the operating system for the step. 7. Click Save. TECHNICAL WHITE PAPER / 34

35 Delete a Custom Template You can delete custom OSOT templates that you no longer need. You cannot delete the built-in templates. 1. Locate your OSOT template directory. 2. Delete the file manually within the directory. Add Custom Templates to the Repository You can add your custom OSOT templates to the Template Name drop-down menu to appear along with the built-in templates by adding them to the OSOT template repository. 1. Click the Templates tab. 2. On the Templates page, note the path of the OSOT template repository. 3. Save the custom OSOT template to the template repository folder. TECHNICAL WHITE PAPER / 35

36 Windows 7 and Windows 8.x OS Optimizations The following modifications are carried out in the OSOT templates as recommended optimizations for the Windows 7 and Windows 8.x operating systems in a remote desktop environment. These optimizations are the most common ones that apply to many environments. The Windows 7 and 8.x optimizations are divided into the following sections: Services The OSOT disables services that are useful only in a physical desktop (hardware) environment, such as transferring files in the background using idle network bandwidth (BITS). Group Policy Objects (GPO) The OSOT recommends certain optimizations that are carried out through GPOs. Registry Many optimizations in the OSOT are programmatically handled through the Windows registry. These affect the operating system or user desktops, such as screensavers and backgrounds. Windows 7 and Windows 8.x Service Modifications The following table outlines the OSOT-recommended state of services for optimizing Windows 7 and Windows 8.x virtual machines. The services are common to both operating systems, except where noted. Beginning with Windows 8, most unneeded services in a virtual environment are in a manual (triggered start) state. Even if a service is configured as manual by default, disable the service to avoid potential issues. You can disable all these services in your initial image before capturing. Analyze each service for applicability in your corporate environment. Some services, such as Windows Themes, might be desired and left at default values. Discretionary changes are marked with an asterisk (*). Nonapplicable services for Windows 8.x are designated under Comments. SERVICE NAME IN OSOT Application Experience Lookup Service Background Intelligent Transfer Service* BitLocker Drive Encryption Service Block Level Backup Engine Service WINDOWS INTERNAL NAME AeLookupSvc DEFAULT Manual Win8.x Manual (Triggered Start) RECOMMENDED STATE Disable COMMENTS Automatically applies software updates to programs to make sure that they run on newly released service packs. Used in Windows 8.x. bits Manual Disable Transfers files in the background using idle network bandwidth. If the service is disabled, Windows Update and MSN Explorer cannot automatically download programs and other information. dbesvc Manual Disable Not recommended to encrypt virtual desktop infrastructure (VDI) virtual machines. wbengine Manual Disable Leveraged for backing up data on a workstation. BranchCache PeerDistSvc Manual Disable Caches files on the server in a branch office. * Discretionary changes TECHNICAL WHITE PAPER / 36

37 SERVICE NAME IN OSOT WINDOWS INTERNAL NAME DEFAULT RECOMMENDED STATE COMMENTS Computer Browser Desktop Window Manager Session Manager* Diagnostic Policy Service Diagnostic Service Host Diagnostic System Host Disk Defragmenter Function Discovery Provider Host Function Discovery Resource Publication Group Policy Client Home Group Listener Home Group Provider Hyper-V Data Exchange Service * Discretionary changes Browser Manual Disable Browses computers on the same network. UxSms Auto Disable Provides part of the new Windows Themes, and reverts to basic styles when running applications that are not compatible with Windows 7. DPS Auto Disable Problem detection and troubleshooting resolution. Disabled on Windows 8.x. WdiServiceHost Manual Disable Problem detection and troubleshooting resolution. WdiSystemHost Manual Disable Problem detection and troubleshooting resolution. Defragsvc Manual Disable Provides disk defragmenting services for hard drives and can impact performance if run on a virtual machine. Not applicable on Windows 8.x. fdphost Manual Disable Hosts the Function Discovery network discovery providers that supply services for the Simple Services Discovery Protocol and Web Services Discovery protocol. FDResPub Manual Disable Publishes this computer and resources attached to this computer so that they can be discovered over the network. gpsvc Auto Manual Applies settings configured by the administrator for the computer and users through the Group Policy component. HomeGroupListener Manual Disable Leveraged for home networking. HomeGroupProvider Manual Disable Leveraged for home networking. vmickvpexchange Manual Disable Enables data exchange between the virtual machine and the operating system running on the physical host machine. Windows 8.x only. TECHNICAL WHITE PAPER / 37

38 SERVICE NAME IN OSOT WINDOWS INTERNAL NAME DEFAULT RECOMMENDED STATE COMMENTS Hyper-V Guest Shutdown Service Hyper-V Heartbeat Service Hyper-V Remote Desktop Virtualization Service Hyper-V Time Synchronization Service Hyper-V Volume Shadow Copy Requestor vmicshutdown Manual Disable Facilitates shutdown of the virtual machine from the management interface on the physical computer. Windows 8.x only. vmicheartbeat Manual Disable Monitors the state of the virtual machine by reporting a heartbeat at regular intervals. Windows 8.x only. vmicrdv Manual Disable Provides a platform for communication between the virtual machine and the operating system running on the physical computer. Windows 8.x only. vmictimesync Manual Disable Synchronizes the virtual machine s system time with the physical computer s computer time. Windows 8.x only. vmicvss Manual Disable Coordinates the communications that are required to use the Volume Shadow Copy Service to back up applications and data on the virtual machine from the operating system on the physical computer. Windows 8.x only. Family Safety WPCSvc Manual Disable Stub for Windows Parental Control functionality that existed in Windows Vista. Windows Biometric Service Windows Store Service * Discretionary changes Windows 8.x only. wbiosrvc Manual Disable Gives client applications the ability to capture, compare, manipulate, and store biometric data without gaining direct access to biometric hardware or samples. WSService Manual (Triggered Start) Disable Windows 8.x only. Provides infrastructure support for Windows Store. Started on demand. If disabled, apps bought using the Windows Store do not behave correctly. Windows 8.x only. TECHNICAL WHITE PAPER / 38

39 SERVICE NAME IN OSOT WINDOWS INTERNAL NAME DEFAULT RECOMMENDED STATE COMMENTS Interactive Services Detection UI0Detect Manual Disable Displays a dialog box when a service tries to send a message to the console. IP Helper* IP Helper Auto Disable Disable if not leveraging IPv6. Media Center Extender Microsoft iscsi Initiator Service Microsoft Software Shadow Copy Provider Mcx2Svc Manual Disable Allows Media Center Extenders to locate and connect to the computer. Not applicable on Windows 8.x. MSiSCSI Manual Disable Not needed for virtual machines. swprv Manual Disable or Enable Leveraged by the Volume Shadow Copy Service for backups. Disable if you are not using System Restore and View Persona Management. Must be enabled when using Persona Management. Offline Files* CscService Manual Manual Used for maintenance of the Offline Files cache. Leave as manual for local mode desktops. Reports and Solutions Control Panel Support Secure Socket Tunneling Protocol Service wercplsupport Manual Disable Supports viewing, sending, and deletion of system-level problem reports for the Problem Reports and Solutions control panel. SstpSvc Manual Disable Provides VPN capability. Security Center wscsvc Auto Disable Monitors configuration of security-related services. SSDP Discovery SSDPSRV Manual Disable Discovers UPnP devices. Superfetch* SysMain Auto Disable Loads applications into memory for faster reload over time. Nonpersistent virtual machines usually do not benefit from this setting being enabled. Tablet PC Input Service TabletInputService Manual Disable Enables Tablet PC services. * Discretionary changes TECHNICAL WHITE PAPER / 39

40 SERVICE NAME IN OSOT WINDOWS INTERNAL NAME DEFAULT RECOMMENDED STATE COMMENTS Themes* Themes Auto Disable Disable on Windows 7 if you want to use the Classic interface (no orb for the start button). UPnP Host Service Volume Shadow Copy Service Not applicable on Windows 8.x upnphost Manual Disable Dependent on SSDP service. VSS Manual Disable or Enable Disable if you are not using System Restore and View Persona Management. Enable if using Persona Management. Windows Backup SDRSVC Manual Disable Backs up workstation data. Windows Defender* Windows Error Reporting Service Windows Firewall* Windows Media Center Receiver Service Windows Media Center Scheduler Service Windows Media Center Network Sharing Service WinDefend Auto Disable Disable if antispyware and antimalware is not needed. WerSvc Manual Disable Supports Windows error reporting. MpsSvc Auto Auto Do not disable the service. Instead, disable the firewall profiles. ehrecvr Manual Disable Used by Media Center. Not applicable on Windows 8.x. ehsched Manual Disable Used by Media Center. Not applicable on Windows 8.x. WMPNetworkSvc Manual Disable Used by Media Center. Not applicable on Windows 8.x. Windows Search* WSearch Auto Disable Disable if you are not doing a lot of searching on a virtual machine. Windows Update* WLAN AutoConfig WWAN AutoConfig * Discretionary changes wuauserv Auto Disable Disable, unless needed for updates. Wlansvc Manual Disable For managing wireless networks. WwanSvc Manual Disable Used for Mobile Broadband Devices. Table 7: Windows 7 and 8.x Service Parameters TECHNICAL WHITE PAPER / 40

41 Windows Optimizations Available Using Group Policy The OSOT carries out some Windows optimizations using Group Policy. Group Policy is a feature of Windows operating systems. It provides centralized management and configuration of computers and remote users in an Active Directory environment. Group Policy settings are contained in entities called Group Policy objects (GPOs). GPOs are associated with Active Directory objects. You can apply GPOs to View components at a domain-wide level to control various areas of the View environment. After they are applied, GPO settings are stored in the local Windows registry of the specified component. You can apply optimizations dynamically after building the master image with GPOs. Many organizations prefer to use GPOs because you can leverage existing policies that manage physical machines for virtual desktops. GPOs provide many benefits for desktop management, but you must be careful in your design and implementation. When using GPOs for virtual desktops, the recommended approach is to place virtual machines in a dedicated OU within Active Directory, block inheritance, and enforce loopback processing for user-based GPOs. With this method, user GPOs applied at your dedicated OU override other user-based GPOs applied previously. If you apply optimizations to the master image, they are persistent only if users cannot change them. If individual users have administrative rights, they can override the optimizations. To preserve your optimizations, modify the desktops by GPO so that the optimizations are enforced. Blocking inheritance is an important step if you want to manage virtual machines. In some cases, a Group Policy being applied for computer accounts in other OUs might conflict with a setting, such as a wallpaper policy, that you want to apply in your environment. For more information about inheritance, see the Microsoft Group Policy blog entry, Tales from the Community: Enforced vs. Block Inheritance. Loopback policy processing is useful when you want to have Group Policies applied to users according to where the computer account is located in Active Directory. If a computer account is located in a special OU that has certain Group Policy settings applied for end users of those systems, use loopback policy processing to verify that Group Policies are applied in the expected and preferred fashion. For more information, see the Loopback Processing section of the Microsoft TechNet Step-by-Step Guide to Understanding the Group Policy Feature Set. The following table provides the group policies that the OSOT applies to the remote desktop environment, their locations, and their settings. Discretionary changes are marked with an asterisk (*). POLICY IN OSOT LOCATION IN WINDOWS RECOMMENDED SETTINGS Action Center Icon Removal Event Logs User Configuration > Administrative Templates > Start Menu and Taskbar Computer Configuration > Administrative Templates > Event Log Service > Specific Event Log Remove the Action Center icon = Enabled Maximum application log size = 1024 Maximum security log size = 1024 Maximum system log size = 1024 To set the security log size to 1024 with this Group Policy setting, you are restricted to 2048x0, unless you set this using the previous Group Policy setting valid for Windows XP SP2 and Server 2003 and later, located under Computer Configuration > Windows Settings > Security Settings > Event Log. * Discretionary changes TECHNICAL WHITE PAPER / 41

42 POLICY IN OSOT LOCATION IN WINDOWS RECOMMENDED SETTINGS Firewall* Internet Explorer Settings (cache) Internet Explorer Settings (IE First Run Wizard) Recycle Bin For Windows 7: Remote Desktop Remote Desktop RSS Feeds Screen Saver* System Restore User Access Control * Discretionary changes Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall Properties User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Advanced Page Computer Configuration > Administrative Templates > Windows Components > Internet Explorer User Configuration > Administrative Templates > Windows Components > Windows Explorer For Windows 8: User Configuration > Administrative Templates > Windows Components > File Explorer Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security User Configuration > Administrative Templates > Windows Components > RSS Feeds User Configuration > Administrative Templates > Control Panel > Personalization Computer Configuration > Administrative Templates > System > System Restore Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options Firewall State = On (Recommended) or Off Note: Do not disable the Firewall Service. Disable the firewall profiles as needed. Empty Temporary Internet Files folder when browser is closed = Enabled Prevent performance of First Run Customize settings = Enabled To eliminate user undelete capabilities to save on disk storage: Do not move deleted files to the recycle bin = Enable Enables users to connect remotely using Remote Desktop Services = Enabled To require user authentication for remote connections: Network Level Authentication = Enabled Turn off background synchronization for feeds and Web Slices = Enabled Password protect the screen saver = Enabled Screen saver timeout = 600 Force specific screen saver = %windir%\system32\scrnsave.scr Turn off System Restore = Enabled Behavior of the elevation prompt for administrators in Admin Approval Mode = Elevate without prompting Detect application installations and prompt for elevation = Disabled Only elevate UIAccess applications that are installed in secure locations = Disabled Run all administrators in Admin Approval Mode = Disabled TECHNICAL WHITE PAPER / 42