VMware Horizon FLEX Administration Guide

Transcription

1 VMwre Horizon FLEX Administrtion Guide Horizon FLEX 1.5 This document supports the version of ech product listed nd supports ll susequent versions until the document is replced y new edition. To check for more recent editions of this document, see EN

2 You cn find the most up-to-dte technicl documenttion on the VMwre We site t: The VMwre We site lso provides the ltest product updtes. If you hve comments out this documenttion, sumit your feedck to: Copyright 2014, 2015 VMwre, Inc. All rights reserved. Copyright nd trdemrk informtion. VMwre, Inc Hillview Ave. Plo Alto, CA VMwre, Inc.

3 Contents VMwre Horizon FLEX Administrtion Guide 5 1 Introducing Horizon FLEX 7 Horizon FLEX Components 7 Aout Mirge 8 Horizon FLEX Architecture 8 Horizon FLEX System Requirements 10 Horizon FLEX Network Requirements 10 Supported Host nd Guest Operting Systems 11 2 Instlling Horizon FLEX 13 Horizon FLEX Instlltion Overview 13 Instlling nd Configuring Mirge Components for Horizon FLEX 14 Crete Downlod Folder for Horizon FLEX Virtul Mchine Pckges 15 Set Up Certificte for the Horizon FLEX Server y Using OpenSSL 15 Configure the IIS SSL Server Certificte for the Horizon FLEX Server 16 Configure Active Directory Settings 16 Test the Horizon FLEX Admin Console Connection 17 Instlling the Horizon FLEX Client for End Users 18 Crete Mss Deployment Pckge to Instll Fusion Pro 18 Provide Plyer Pro Instlltion Pckge to End Users 18 Run n Unttended Plyer Pro Instlltion 19 3 Setting Up Certifictes for Horizon FLEX Virtul Mchines 21 Creting Trusted Certifictes List 21 Aout the PEM Formt 22 Creting PEM-Formt Certifictes 22 Crete nd Import the Trusted Certifictes List File 23 Updting Certifictes on the Server 24 Using Self-Signed Certifictes 24 Instll Self-Signed Certificte on Windows Computer 24 Instll Self-Signed Certificte on Mc 25 Using Internl CA Certifictes 27 Instll n Internl Root CA Certificte on Windows Computer 27 Instll n Internl Root CA Certificte on Mc 28 4 Creting nd Deploying Horizon FLEX Virtul Mchines 31 Horizon FLEX Virtul Mchine Deployment Overview 31 Crete Source Virtul Mchine in Fusion Pro 32 Crete Source Virtul Mchine in Worksttion (Not included in Horizon FLEX ) 33 Instll the Mirge Client In Source Virtul Mchine 34 VMwre, Inc. 3

4 Prepre Source Virtul Mchine to Join n Active Directory Domin 35 Compress Source Virtul Mchine Pckge 36 Register Source Virtul Mchine with the Horizon FLEX Policy Server 37 Creting Policies nd Entitlements 38 Configure Generl Policy for Horizon FLEX Imge 38 Configure USB Device Policy for Horizon FLEX Imge 40 Configure Custom USB Device Policy for Horizon FLEX Imge 41 Updte Policy for Deployed Horizon FLEX Imge 42 Entitle Horizon FLEX Imge 43 Crete URI to Deploy Horizon FLEX Virtul Mchine 44 5 Mnging Horizon FLEX Virtul Mchines 47 Mnge Horizon FLEX Virtul Mchines 47 6 Mintining the Horizon FLEX System 49 Upgrde from Previous Horizon FLEX Versions 49 Index 51 4 VMwre, Inc.

5 The VMwre Horizon FLEX Administrtion Guide descries how to instll nd dminister VMwre Horizon FLEX. Intended Audience This informtion is intended for nyone who wnts to instll Horizon FLEX. The informtion is written for experienced Windows system dministrtors who re fmilir with virtul mchine technology. VMwre, Inc. 5

6 6 VMwre, Inc.

7 Introducing Horizon FLEX 1 Horizon FLEX is policy-sed, continerized desktop solution tht enles IT dministrtors to crete, secure, nd mnge locl desktops for end users. End users work within restricted virtul mchine, clled Horizon FLEX virtul mchine, on their own computers. Becuse Horizon FLEX virtul mchines re stored loclly, on end-user computers, corporte pplictions re ccessile to offline users. This chpter includes the following topics: Horizon FLEX Components, on pge 7 Horizon FLEX Architecture, on pge 8 Horizon FLEX System Requirements, on pge 10 Horizon FLEX Network Requirements, on pge 10 Supported Host nd Guest Operting Systems, on pge 11 Horizon FLEX Components Horizon FLEX is comintion of VMwre components, including Mirge, Fusion Pro, nd Plyer Pro. VMwre Mirge for Horizon FLEX Horizon FLEX Policy Server Horizon FLEX Admin Console The Mirge Server tht is used y Horizon FLEX. The server provides Horizon FLEX virtul mchine mngement. You cn mnge, ck up, nd ptch virtul mchines y using the Mirge for Horizon FLEX lyering technology. Use of Mirge for Horizon FLEX is optionl. You cn lso use other imge mngement tools to mnge Horizon FLEX virtul mchines. The stndrd Mirge server with n extension tht includes Horizon FLEXspecific functionlity. The Horizon FLEX Policy Server is ctivted fter you pply the Horizon FLEX license to Mirge for Horizon FLEX. The We mngement user interfce for the Horizon FLEX Policy Server. The Horizon FLEX Admin Console is locted in the Mirge We Mnger component. You use the Horizon FLEX Admin Console to perform virtul mchine mngement tsks, including the following: Mnge n inventory of virtul mchines Browse list of users nd groups in the Active Directory service Entitle users nd groups to one or more virtul mchines Specify virtul mchine policies for given entitlement Prevent users from ccessing virtul mchines y using remote lock Exmine virtul mchine detils nd sttus t ny time VMwre, Inc. 7

8 Horizon FLEX Client Horizon FLEX Virtul Mchine The client softwre tht end users use to downlod the Horizon FLEX virtul mchines to their locl computers. The clients include VMwre Fusion Pro for Mc computers nd VMwre Plyer Pro for Windows computers. Fusion Pro nd Plyer Pro re included in the Horizon FLEX pckge. One license key is provided for oth Fusion Pro nd Plyer Pro. The virtul mchine tht end users run on their own computers. You use Fusion Pro to crete source virtul mchines for Horizon FLEX virtul mchines. Fusion Pro is included in the Horizon FLEX pckge. A Horizon FLEX server cn support up to 1,000 users. NOTE You cn lso use VMwre Worksttion to crete source virtul mchines. Worksttion is not included in the Horizon FLEX pckge. Aout Mirge Mirge is integrl to the opertion nd use of Horizon FLEX virtul mchines. Horizon FLEX uses suset of the fetures ville in Mirge: Mirge Server Mirge Mngement Server Mirge We Mnger Mirge Mngement Console This document does not descrie ll of the informtion pertining to Mirge. For complete informtion out Mirge, see the Mirge documenttion t Horizon FLEX Architecture A typicl Horizon FLEX deployment includes the Horizon FLEX server, file server, n HTTPS proxy, red-only domin controller (RODC), nd offsite nd onsite end-user systems. Figure 1-1 shows the reltionships etween the mjor components of Horizon FLEX deployment 8 VMwre, Inc.

9 Chpter 1 Introducing Horizon FLEX Figure 1 1. Smple Horizon FLEX Deployment Without Mirge Horizon FLEX Server Mirge Mngement Console Mirge Mngement Server File Server HTTPS Proxy Offsite Users RODC DMZ Onsite Users Horizon FLEX Server The Horizon FLEX server is composed of the Horizon FLEX Admin Console nd the Horizon FLEX Policy Server. The Horizon FLEX server provides the following functionlity. Assigns Horizon FLEX virtul mchines to users nd groups from directory service Mintins record of Horizon FLEX virtul mchines in use y individul users Provides security certificte mngement to ensure the secure nd trusted communiction etween the deployed Horizon FLEX virtul mchines nd the Horizon FLEX server. Enforces policy settings to the client Enles modifiction of policy settings for given user nd Horizon FLEX virtul mchine comintion Monitors Horizon FLEX virtul mchine sttus The Mirge Mngement Console is the grphicl user interfce used for sclle mintennce, mngement, nd monitoring of deployed endpoints. The Mirge We Mnger mirrors Mirge Mngement Console functionlity. By defult, port 7443 is used y the Horizon FLEX Policy Server for externl ccess, nd port 8443 is used y the Mirge Mngement Server to communicte with the Horizon FLEX Policy Server. You must configure your firewll policies to llow the required ports. For complete list of ports used y Mirge, see the Mirge documenttion t File Server A file server stores the TAR files tht contin the source virtul mchine files for Horizon FLEX virtul mchines. The file server is locted inside the DMZ. VMwre, Inc. 9

10 HTTPS Proxy RODC An HTTPS proxy enles offsite end-user systems to rech the Mirge Mngement Console. The HTTPS proxy is inside the DMZ. An RODC enles office end-user systems to log in to their Horizon FLEX virtul mchines nd join the Active Directory domin for the first oot up of the VM. An RODC is required only if you re llowing outside users to log in without using VPN. The RODC is inside the DMZ. Horizon FLEX System Requirements Ech product in the Horizon FLEX pckge hs certin system requirements. Mirge for Horizon FLEX Fusion Pro Plyer Pro Worksttion The system requirements for Horizon FLEX 1.5 re the sme s for Mirge 5.4. See the Mirge documenttion t Horizon FLEX 1.5 uses Fusion Pro s the client softwre for Mc clients. Horizon FLEX 1.5 is not comptile with erlier versions of Fusion Pro. For Fusion Pro hrdwre nd softwre requirements, see the VMwre Horizon FLEX User Guide. Horizon FLEX 1.5 uses Plyer Pro s the client softwre for Windows clients. Horizon FLEX 1.5 is not comptile with erlier versions of Plyer Pro. For Plyer Pro hrdwre nd softwre requirements, see the VMwre Horizon FLEX User Guide. Horizon FLEX 1.5 is comptile with Worksttion You cn use Worksttion to crete nd open source virtul mchine, ut Worksttion cnnot downlod Horizon FLEX virtul mchine. Worksttion is not included in the Horizon FLEX instlltion pckge. For Worksttion hrdwre nd softwre requirements, see the Worksttion documenttion t Horizon FLEX Network Requirements Horizon FLEX enles end users to run corporte pplictions even when they re disconnected from the network. Horizon FLEX virtul mchines re stored loclly for complete desktop experience tht does not require network connection. A network connection is required etween the Horizon FLEX Policy Server nd the Horizon FLEX Client in the following circumstnces: For the initil downlod of the Horizon FLEX virtul mchine to the user's locl computer. To register Horizon FLEX virtul mchine tht ws provided on USB device or deployed on the user's locl computer. To receive Horizon FLEX virtul mchine restriction nd policy updtes. When you register source virtul mchine for Horizon FLEX virtul mchine, you specify downlod loction URL for virtul mchine pckge. The downlod folder must e ccessile to end user computers for end users to downlod virtul mchines. 10 VMwre, Inc.

11 Chpter 1 Introducing Horizon FLEX Supported Host nd Guest Operting Systems The locl computer on which end users use the Horizon FLEX Client must hve supported host operting system. A Horizon FLEX virtul mchine must use supported guest operting system. Supported Host Operting Systems Your end users cn run the Horizon FLEX Client nd ccess their Horizon FLEX virtul mchine y using physicl computer tht hs one of the following operting systems. Tle 1 1. Supported Host Operting Systems Horizon FLEX Client Supported Operting Systems Plyer Pro Windows 7 Windows 8.1 Enterprise Windows Server 2012 R2 Windows 8 Windows 8.1 Pro NOTE Plyer Pro supports only 64-it operting systems. Fusion Pro Mc OS X Mc OS X 10.9 Supported Guest Operting Systems A Horizon FLEX virtul mchine cn contin one of the following guest operting systems. Windows 7 Windows 8.1 Windows XP Windows Server 2012 R2 Windows 2012 Uuntu VMwre, Inc. 11

12 12 VMwre, Inc.

13 Instlling Horizon FLEX 2 The Horizon FLEX instlltion involves instlling the Horizon FLEX server nd client components, creting folders to store Horizon FLEX virtul mchines, prepring Active Directory, setting up certifictes, nd creting nd deploying Horizon FLEX virtul mchines. This chpter includes the following topics: Horizon FLEX Instlltion Overview, on pge 13 Instlling nd Configuring Mirge Components for Horizon FLEX, on pge 14 Crete Downlod Folder for Horizon FLEX Virtul Mchine Pckges, on pge 15 Set Up Certificte for the Horizon FLEX Server y Using OpenSSL, on pge 15 Configure the IIS SSL Server Certificte for the Horizon FLEX Server, on pge 16 Configure Active Directory Settings, on pge 16 Test the Horizon FLEX Admin Console Connection, on pge 17 Instlling the Horizon FLEX Client for End Users, on pge 18 Horizon FLEX Instlltion Overview Horizon FLEX is comintion of VMwre components, including Mirge, Fusion Pro, nd Plyer Pro. The Horizon FLEX instlltion involves instlling ech of these components nd performing dditionl Horizon FLEX-specific tsks. For successful Horizon FLEX deployment, you must understnd the sequence of required tsks. Before you instll Horizon FLEX, verify tht it meets ll of the hrdwre nd softwre requirements, tht you hve vlid licenses, nd tht you hve downloded the Horizon FLEX component instllers from the VMwre Horizon FLEX product downlod pge. You instll the Horizon FLEX y performing these steps: 1 Instll the Mirge system. See Instlling nd Configuring Mirge Components for Horizon FLEX, on pge Set up certifictes for Horizon FLEX virtul mchines. See Chpter 3, Setting Up Certifictes for Horizon FLEX Virtul Mchines, on pge Crete downlod folder for storing your Horizon FLEX virtul mchine pckges. See Crete Downlod Folder for Horizon FLEX Virtul Mchine Pckges, on pge Add virtul directory in IIS for your Horizon FLEX virtul mchine downlod folder nd edit the site indings. VMwre, Inc. 13

14 See Configure the IIS SSL Server Certificte for the Horizon FLEX Server, on pge (Optionl) Configure Horizon FLEX to synchronize entities in only selected Active Directory orgniztionl unit (OU). See Configure Active Directory Settings, on pge Test the connection to the Horizon FLEX Admin Console. See Test the Horizon FLEX Admin Console Connection, on pge Instll Horizon FLEX Client on ech end-user host, or instruct end users to instll Horizon FLEX Client on their own computers. See Instlling the Horizon FLEX Client for End Users, on pge Crete nd deploy Horizon FLEX virtul mchines. See Chpter 4, Creting nd Deploying Horizon FLEX Virtul Mchines, on pge 31. Instlling nd Configuring Mirge Components for Horizon FLEX The first Horizon FLEX instlltion step is to instll nd configure the Mirge system. The Horizon FLEX pckge includes the following components: VMwre Mirge for FLEX (the Mirge Core Softwre) Mirge PowerCLI for Windows Mirge Gtewy Applince Softwre Downlod the instlltion files from the Horizon FLEX Server product downlod pge. The Mirge deployment involves the instlltion of the following components. 1 Mirge Mngement Server 2 Mirge Server 3 Mirge Mngement Console 4 Mirge We mnger To instll nd configure the Mirge system, follow the instlltion instructions in the Mirge documenttion t When you instll the Mirge system, you must select certin options for the Horizon FLEX server to operte correctly. The Mirge Server nd Mirge console re only required if you re instlling the Mirge client in the source virtul mchines. If plcing the virtul mchine imges on the sme system s the Horizon FLEX Server, plce the imges in the IIS "Defult We" server. The We Mngement Server nd the Mirge Mngement Server should e instlled on the sme server. However, the SQL server should e instlled on seprte server. During Mirge server instlltion, choose SSL for the Mirge server trnsport. SSL is required to use the Mirge Gtewy feture for externl ccess nd mngement of Horizon FLEX systems. Before configuring the Mirge Server for SSL, you must instll the server SSL certificte. Before you instll the Mirge We Mnger, verify tht.net Frmework 4.0 is instlled on the server. The Mirge Mngement Server must run s user who hs Active Directory red permissions. If you pln to join Horizon FLEX virtul mchines to n Active Directory domin, the Mirge Mngement Server must run s user who hs domin join permissions. 14 VMwre, Inc.

15 Chpter 2 Instlling Horizon FLEX Crete Downlod Folder for Horizon FLEX Virtul Mchine Pckges During the Horizon FLEX virtul mchine deployment process, you compress your source virtul mchine pckges into TAR (.tr) formt so tht end users cn esily downlod their Horizon FLEX virtul mchines. You must crete downlod folder for storing these TAR files. 1 Crete the downlod folder on the Horizon FLEX server or on nother server. The downlod folder does not need to e on the Horizon FLEX server, ut the files it contins must e downlodle without ny uthentiction chllenge. 2 Assign permissions to the downlod folder so tht users cn downlod the files tht it contins. 3 (Optionl) Shre the downlod folder with n dministrtive group, such s Horizon FLEX Admins. This cn e n dministrtive group for users to mnge Horizon FLEX deployments. This step cn mke it esier to register your source virtul mchines with the Horizon FLEX Policy Server. Wht to do next Crete virtul directory in IIS to llow the Horizon FLEX virtul mchines to e downloded to end-user systems. See Configure the IIS SSL Server Certificte for the Horizon FLEX Server, on pge 16. Set Up Certificte for the Horizon FLEX Server y Using OpenSSL You cn crete self-signed certificte for the Horizon FLEX server y using OpenSSL. Prerequisites The OpenSSL configurtion file is creted on the Mirge Gtewy Server. See the Mirge documenttion t 1 At the OpenSSL commnd prompt, crete certificte: $ openssl req -new -dys expirtion time -x509 -newkey rs: keyout key filenme -outcertificte filenme -nodes expirtion time represents the numer of dys tht the certificte should e vlid, key filenme represents the filenme for the key, nd certificte filenme represents the new certificte nme. A self-signed certificte nd privte key re generted. The certificte uses 2048-it RSA key nd does not protect the key with pssphrse. 2 When prompted, enter the country nme, stte nme, loclity, orgniztion nme, nd orgniztionl unit nme. 3 In the Common Nme text ox, enter the host nme of the Horizon FLEX server to e protected. This text ox must e completed. 4 Enter the emil ddress. The self-signed certificte nd ssocited privte key re generted. 5 If the privte key must e in.pfx formt, enter the following commnd y using the certificte nme nd key filenme generted in the previous steps: $ openssl pkcs12 -export -outoutput pfx filenme -inkey key filenme -in certificte nme A new pssword-protected.pfx file is generted tht cn e deployed on ny device tht requires.pfx certifictes insted of PEM certifictes. VMwre, Inc. 15

16 Configure the IIS SSL Server Certificte for the Horizon FLEX Server You must configure the IIS SSL server certificte for the Horizon FLEX server to set the certificte chin from the Horizon FLEX server to the Horizon FLEX virtul mchines. Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge Components for Horizon FLEX, on pge 14. Instll the Server SSL Certificte on the Mirge server. See the Mirge documenttion t Configure certificte uthentiction for your Horizon FLEX virtul mchines. See Chpter 3, Setting Up Certifictes for Horizon FLEX Virtul Mchines, on pge 21. Crete downlod folder for your Horizon FLEX virtul mchine pckges. See Crete Downlod Folder for Horizon FLEX Virtul Mchine Pckges, on pge Open IIS Mnger. 2 Nvigte to VMwre Mirge Mngement We Site nd select rvm. 3 Right-click rvm nd select Add Virtul Directory. 4 Type nme in the Alis text ox, rowse to the folder tht you creted to contin the Horizon FLEX virtul mchine pckges, nd click OK. 5 Nvigte to the root node, the connection node defined for the Mirge server. 6 On the Mirge Home pge under IIS, doule click Server Certifictes. The IIS SSL server certifictes window opens. 7 Click Import in the right column. This step imports the creted SSL certificte nd ssigns key to identify the certificte. 8 Select VMwre Mirge Mngement We Site nd click Edit Bindings in the right column. 9 Set the HTTPS port to use your Horizon FLEX server certificte nd click OK. Configure Active Directory Settings When you entitle Horizon FLEX virtul mchine, you dd users nd groups from your existing Active Directory infrstructure to the entitlement. By defult, Horizon FLEX synchronizes your entire Active Directory infrstructure with the Horizon FLEX dtse. You cn optionlly configure Horizon FLEX to synchronize only specific orgniztion unit (OU). Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge Components for Horizon FLEX, on pge VMwre, Inc.

17 Chpter 2 Instlling Horizon FLEX 1 Strt the Horizon FLEX Admin Console. c In We rowser, enter where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Enter the user nme nd pssword of domin ccount tht hs ccess to Mirge. Click Login. 2 In the Horizon FLEX Admin Console, click the Generl System Settings icon nd click Active Directory Settings. 3 Type the OU to synchronize in the Orgniztionl Unit text ox. As you egin to type in the text ox, the ville OUs in your Active Directory infrstructure pper in drop-down menu nd you cn select the pproprite OU. 4 Click OK to sve the OU setting. The Horizon FLEX server vlidtes the OU to verify tht it exists nd is ccessile. The Horizon FLEX server synchronizes the Active Directory entities tht elong only to the OU tht you selected, including entities tht elong to ny child OUs of the selected OU. Any time you configure new OU, the Horizon FLEX server deletes the previously synchronized entities from the dtse nd strts new full synchroniztion process. You cn configure the policy for client virtul mchines so tht the power-on pssword mtches the user's Active Directory pssword fter first strtup. See Configure Generl Policy for Horizon FLEX Imge, on pge 38. Test the Horizon FLEX Admin Console Connection You cn verify your Horizon FLEX deployment y testing the Horizon FLEX Admin Console connection. Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge Components for Horizon FLEX, on pge 14. Configure certificte uthentiction. See Chpter 3, Setting Up Certifictes for Horizon FLEX Virtul Mchines, on pge Strt the Horizon FLEX Admin Console. c In We rowser, enter where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Enter the user nme nd pssword of domin ccount tht hs ccess to Mirge. Click Login. 2 Verify tht the Horizon FLEX Admin Console pge ppers correctly. The Imges, Policies, Entitlements, nd Virtul Mchines uttons should e visile in the left nvigtion pnel. VMwre, Inc. 17

18 Instlling the Horizon FLEX Client for End Users End users must hve the Horizon FLEX Client softwre instlled on their locl computers efore they cn downlod the Horizon FLEX virtul mchines. Supported clients included in the Horizon FLEX pckge re Fusion Pro for Mc OS X mchines nd Plyer Pro for Windows mchines. You cn crete mss deployment to instll the Horizon FLEX Client on mny systems t one time, or you cn instruct end users to otin the Horizon FLEX Client from the VMwre We site nd instll it themselves. You cn lso run n unttended Plyer Pro instlltion on multiple Windows mchines. Crete Mss Deployment Pckge to Instll Fusion Pro You cn crete Fusion Pro mss deployment pckge to instll Fusion Pro on ny numer of end-user Mcs. You cn use stndrd pckge deployment tools, including Apple Remote Desktop Admin, to deploy the mss deployment pckge. When you configure the mss deployment pckge, specify your Horizon FLEX license key in the [Volume License] section of the Deploy.ini file nd plce copy of the Fusion Pro ppliction in the 00Fusion_Deployment_Items folder. You cn use the optionl connectatstrtupurl prmeter in the [Loctions] section of the Deploy.ini file to specify user nme nd the host nme of your Horizon FLEX server, for exmple: connectatstrtupurl = vmwre-rvm://johndoe@yourflexserver.com:7443 If no virtul mchines re instlled on the user's Mc when the user lunches Fusion Pro, the Connect dilog ox opens nd the Server nd Usernme text oxes re prepopulted with the host nme nd user nme tht you specified in the connectatstrtupurl prmeter. For step-y-step informtion out creting mss deployment pckge, see the VMwre knowledge se rticle t Provide Plyer Pro Instlltion Pckge to End Users You cn instll Plyer Pro on end user mchines nd deploy Horizon FLEX virtul mchines y creting uniform resource identifier (URI). Using URI, you cn crete n emil tht contins link tht the end user cn click to connect to server nd downlod the Plyer Pro instller. When instlltion is complete, the end user is prompted to connect to server nd downlod Horizon FLEX virtul mchine. If Plyer Pro is lredy instlled, you cn crete URI to deploy Horizon FLEX virtul mchine only. See Crete URI to Deploy Horizon FLEX Virtul Mchine, on pge 44 Prerequisites Give the end user pssword for the server nd the Plyer Pro license key for use with Horizon FLEX. 1 Construct URI to crete customized Plyer Pro instlltion nd deployment pckge. The commnd line hs the following structure: VMwre-plyer-x.x.x-xxxxxxx.exe /v PLAYER_RVM_URI="vmwre-rvm://usernme@myserver.com:7443 Specify the version nd uild numer of the Plyer Pro.exe file. usernme is the user's login nme nd myserver.com is the host nme of the server. You must include vmwre-rvm:// nd :7443 in the server ddress. Do not include http or https in the server ddress. 2 Enter link text in n emil nd enter hyperlink informtion for the URI. You cn use ny emil system to send the link. However, ecuse the formt of the URI is not recognized s stndrd URL, you must mnully enter the hyperlink informtion. 18 VMwre, Inc.

19 Chpter 2 Instlling Horizon FLEX 3 Crete n emil for the user nd enter some link text. For exmple: Your Pro Plyer Instller File 4 Select the link text, right-click the selected text, nd select Hyperlink. 5 Select Link to: Existing File or We Pge. 6 Enter the URI in the Address text ox. For exmple: vmwre-rvm://johndoe@yourserver.com:7443 The link is now ctive. 7 Click OK. 8 Send the emil to the user. If no virtul mchines re instlled on the user's computer when the user strts Plyer Pro, the Connect to Server dilog ox opens. The Server nd Usernme text oxes re prepopulted with the vlues tht you specified in the URI. The user enters pssword nd connects to the server to downlod Horizon FLEX virtul mchine. Run n Unttended Plyer Pro Instlltion You cn use the unttended instlltion feture of the Microsoft Windows Instller (MSI) to instll Plyer Pro on severl Windows hosts without hving to respond to wizrd prompts. This feture is convenient in lrge enterprise. Prerequisites Verify tht the host system meets the host system requirements. Verify tht the host computer hs version 2.0 or lter of the MSI runtime engine. This version of the instller is ville in versions of Windows eginning with Windows XP nd is ville from Microsoft. See the Microsoft We site for more informtion. 1 Log in to the host system s the dministrtor user or s user who is memer of the locl Administrtors group. If you log in to the domin, the domin ccount must lso e locl dministrtor. 2 Extrct the dministrtive instlltion imge from the Plyer Pro setup file. The setup filenme is similr to VMwre-plyer-xxxx-xxxx.exe, where xxxx-xxxx is the version nd uild numer. For exmple: setup.exe /s /e instll_temp_pth 3 Enter the instlltion commnd on one line. These exmples show the options tht you cn dd to the commnd. VMwre-plyer-x.x.x-xxxxxx.exe /s /nsr /v "EULAS_AGREED=1 INSTALLDIR=""pth_to_progrm_directory"" ADDLOCAL=ALL DISABLE_AUTORUN=0 QUICKLAUNCH_SHORTCUT=0 SERIALNUMBER=""xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"" " VMwre-plyer-x.x.x-xxxxxx.exe /s /v EULAS_AGREED=1 SERIALNUMBER="xxxxx-xxxxx-xxxxx-xxxxxxxxxx" VMwre-plyer-x.x.x-xxxxxx.exe /s /nsr /v EULAS_AGREED=1 REMOVE=NAT SERIALNUMBER="xxxxxxxxxx-xxxxx-xxxxx-xxxxx" You cn use the optionl/nsr commnd to prevent the trget mchine from reooting silently. VMwre, Inc. 19

20 You cn use the optionl INSTALLDIR property to specify file pth for the instlltion tht is different from the defult loction. NOTE The quottion mrks round the file pth re importnt. All the MSI rguments re pssed with the /v option. The outer quottion mrks group the MSI rguments nd the inner quottion mrks put quottion mrk in tht rgument. You cn use the optionl REMOVE property to skip the instlltion of certin fetures. 20 VMwre, Inc.

21 Setting Up Certifictes for 3 Horizon FLEX Virtul Mchines Before you crete nd deploy Horizon FLEX virtul mchines, you must set up certifictes to ensure tht end users cn successfully downlod nd use their virtul mchines. VMwre recommends tht you use certificte tht is issued y certificte uthority (CA), such s Entrust or Go Dddy, or third-prty certificte, on your Horizon FLEX server. If you re using self-signed certificte or certificte from n internl CA insted of generlly trusted certificte, you must tke steps to ensure tht the certificte is trusted on ll end-user computers tht will downlod nd use Horizon FLEX virtul mchines. For informtion out setting up certifictes in Mirge for the Horizon FLEX Server, see the Mirge documenttion t This chpter includes the following topics: Creting Trusted Certifictes List, on pge 21 Using Self-Signed Certifictes, on pge 24 Using Internl CA Certifictes, on pge 27 Creting Trusted Certifictes List You cn crete list of trusted certifictes for Horizon FLEX virtul mchines nd import the list to the Horizon FLEX Policy Server. When you use trusted certifictes list, you do not need to instll certifictes on end-user hosts. Using list of trusted certifictes cn prevent mlicious users from creting their own self-signed certifictes for the sme hostnme nd dding those certifictes to their host's list of trusted certifictes. When you configure the Horizon FLEX Policy Server to use trusted certifictes list, the client host ignores the host's list of certifictes nd uses the trusted certifictes list to verify server connections insted. If the client host cnnot verify certificte y using the trusted certifictes list, the server connection fils. If the trusted certifictes list is empty in the source virtul mchine, Plyer Pro nd Fusion Pro uthenticte ginst the host's list of trusted certifictes. To crete the trusted certifictes list, you export ech certificte to seprte file nd then conctente ll of the files into single file. You use the Horizon FLEX Admin Console to import the conctented certifictes file to the Horizon FLEX Policy Server. You must export certifictes in Privcy Enhnced Mil (PEM) formt. On Windows systems, the PEM certificte encoding is clled Bse-64 encoded X.509 (.CER). Only PEM-encoded certifictes re supported. No other certificte formt (DER, Serilized Certificte Store/SST, PKCS #12/PFX, PKCS #7/P7B) is ccepted. VMwre, Inc. 21

22 Aout the PEM Formt The PEM formt is stndrd certificte formt tht is Bse64 encoded. An exmple of PEM-formt certificte is s follows: -----BEGIN CERTIFICATE----- MIIDojCCAwugAwIBAgIJAMLM0CJRzPyzMA0GCSqGSI3DQEBBQUAMIGTMQswCQYD VQQGEwJVUzETMBEGA1UECBMKQ2FsWZvcm5pYTESMBAGA1UEBxMJUGFsyBBHRv MS8wLQYDVQQKEyZWTXdhcmUsIEluYy4gLSBX3Jrc3RhdGlviBTU0wgVGVzdGlu ZzEqMCgGA1UEAxMhV29y3N0YXRp24gQ2VydGlmWNhdGUgQXV0G9yXR5MB4X DTExMDcxNTAyMjY0OFoXDTE1MDcxNDAyMjY0OFowgZMxCzAJBgNVBAYTAlVTMRMw EQYDVQQIEwpDYWxpZm9ymlhMRIwEAYDVQQHEwlQYWxvIEFsdG8xLzAtBgNVBAoT JlZNd2FyZSwgSW5jLiAtIFdvcmtzdGF0W9uIFNTTCBUZXN0W5nMSowKAYDVQQD EyFX3Jrc3RhdGlviBDZXJ0WZpY2F0ZSBBdXRo3JpdHkwgZ8wDQYJKoZIhvcN AQEBBQADgY0AMIGJAoGBAL/tBlngiEkCK7ssCBe8lZ30FlIHmpECmwEm3AID1C0 lnc+ldrt2ammqiknxbpxgbgyrnrnnshrzp1xxr/wl22ayt7nx+p/xsh2srd cggctn/wh/arcirtlcjrwy55laah9xwzortryr84ibjqphzxcoptsi9o4zviqx AgMBAAGjgfswgfgwHQYDVR0OBBYEFMoT527dtvlgR1EzYK4EnQHS6T2ZMIHIBgNV HSMEgcAwg2AFMoT527dtvlgR1EzYK4EnQHS6T2ZoYGZpIGWMIGTMQswCQYDVQQG EwJVUzETMBEGA1UECBMKQ2FsWZvcm5pYTESMBAGA1UEBxMJUGFsyBBHRvMS8w LQYDVQQKEyZWTXdhcmUsIEluYy4gLSBX3Jrc3RhdGlviBTU0wgVGVzdGluZzEq MCgGA1UEAxMhV29y3N0YXRp24gQ2VydGlmWNhdGUgQXV0G9yXR5ggkAwszQ IlHM/LMwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQBcoiwDWGWXzI+j 0gG/7BNzpNHzR1RGAF4nB9JrnCYWvB313kgYDMHogfiAoQchsu/py/OYBYVRjjFJ YVTJ7DVl/3Gpk3+tcdJfEmqIz76PVWfWTnhuJEMYrMM4W06B/K2cs24kZtcXQ h84fytvcg/l6tp5swgei4vwgrfxga== -----END CERTIFICATE----- When you crete trusted certifictes list, you conctente multiple PEM-formt certifictes into single file. Line endings re uto-detected. The following exmple shows the formt of conctented certifictes list tht contins two certifictes BEGIN CERTIFICATE----- <se64 content here> -----END CERTIFICATE BEGIN CERTIFICATE----- <se64 content here> -----END CERTIFICATE----- Creting PEM-Formt Certifictes You cn crete PEM-formt certifictes y downloding the certificte from the CA's We site or y exporting the certifictes from host system. For exmple, you cn downlod certifictes for Verisign from the Symntec We site t Export PEM-Formt Certificte From Mc You cn export PEM-formt certificte from Mc. Prerequisites Become fmilir with how to use Keychin Access on Mc. For more informtion, see the Apple Support We site t 22 VMwre, Inc.

23 Chpter 3 Setting Up Certifictes for Horizon FLEX Virtul Mchines 1 On the Mc, open Keychin Access. 2 From the sider, select System Roots. 3 Locte the certificte to export. 4 Select File > Export Items. 5 Select loction to sve the certificte nd select the Privcy Enhnced Mil (.pem) file formt. Export PEM-Formt Certificte From Windows System You cn export PEM-formt certificte from Windows system. On Windows, the PEM certificte encoding is clled Bse-64 encoded X.509 (.CER). Prerequisites Become fmilir with how to use Certificte Mnger on Windows system. For more informtion, see the Microsoft TechNet We site t 1 On the Windows system, open Certificte Mnger (certmgr.exe). 2 Right-click the certificte to export nd select All Tsks > Export. 3 Select options in the Certificte Export Wizrd. Select Bse-64 encoded X.509 (.CER) for the file export formt. For the certificte to work with Horizon FLEX, you must choose this option. c Provide loction to sve the certificte nd file nme. Review the settings you selected nd click Finish. The certificte file is sved to the loction you indicted. Crete nd Import the Trusted Certifictes List File After you export your PEM-formt certifictes, you must construct the trusted certificte list nd import the certifictes list file to the Horizon FLEX Policy Server. Prerequisites Export ech certificte in PEM formt. See Creting PEM-Formt Certifictes, on pge To crete the trusted certifictes list file, conctente ech PEM-formt certificte file into single file. You cn use the ct commnd, or you cn copy nd pste the contents of the certificte files into text file. You cn sfely edit Bse64 content in text editor. For exmple: $ ct mycert1.pem mycert2.pem mycert3.pem > list.pem 2 Strt the Horizon FLEX Admin Console. c In We rowser, enter where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Enter the user nme nd pssword of domin ccount tht hs ccess to Mirge. Click Login. 3 In the Horizon FLEX Admin Console, click the Generl System Settings icon nd select Certifictes. VMwre, Inc. 23

24 4 Click Import, rowse to the trusted certifictes list file, nd click Open to import the file. Updting Certifictes on the Server When certificte expires, nd new certificte hs n expirtion dte tht is set fr into the future, you cn dd the new certificte s second certificte to the trusted certifictes list in the Horizon FLEX Policy Server. Adding the new certificte to the trusted certifictes list enles ll Horizon FLEX virtul mchines to downlod the new certificte. Then, when the certificte switch occurs, ll of the Horizon FLEX virtul mchines tht received the new list of certifictes cn connect to the Horizon FLEX server nd you cn remove the old trusted certificte from the policy file. If you chnge the server certificte fter the Horizon FLEX virtul mchines hve lredy een registered nd run, then your end users need to verify tht the chnged certificte is trusted y Fusion Pro or Plyer Pro. If the new server certificte is self-signed, the Horizon FLEX client does not report the instnce sttus correctly to the Horizon FLEX server. The end user should open the Horizon FLEX virtul mchine nd click Connect to connect to the server. If the end user receives the Invlid security certificte error messge, the end user should confirm with you to verify the certificte is vlid nd if so, select the Alwys trust this host with this certificte check ox nd click Connect Anywy. Using Self-Signed Certifictes If you do not configure the self-signed certificte into the source virtul mchine eing prepred, you must instll the certificte on ech end-user host for Horizon FLEX virtul mchines to function correctly. If the list of certifictes is empty in the policy file, Plyer Pro nd Fusion Pro will fll ck to uthenticting ginst the host's list of trusted certifictes. If you include the self-signed certificte of source virtul mchine on the Horizon FLEX Policy Server, nd you configure or instll the self-signed certificte for the Horizon FLEX Client (either in the source virtul mchine's policy file or in the host's list of trusted certifictes), you do not need to instll the certificte on end-user hosts when certificte updtes re required, for exmple, when certificte expires. For informtion out configuring certifictes into source virtul mchine, see Crete Source Virtul Mchine in Fusion Pro, on pge 32. For informtion out creting trusted certifictes list nd importing it to the Horizon FLEX Policy Server, see Creting Trusted Certifictes List, on pge 21. For informtion out updting certifictes, see Updting Certifictes on the Server, on pge 24. Instll Self-Signed Certificte on Windows Computer To instll self-signed certificte on Windows host, you export the certificte from your Horizon FLEX server nd import it to the Windows computer. Prerequisites Become fmilir with how to instll nd use the MMC Certifictes snp-in on Windows system. For more informtion, go to the Windows TechNet We site t Instll Windows IIS. 24 VMwre, Inc.

25 Chpter 3 Setting Up Certifictes for Horizon FLEX Virtul Mchines 1 Export the self-signed certificte from your Horizon FLEX server. c d On the Horizon FLEX server, strt MMC (mmc.exe), dd the Certifictes snp-in for computer ccount, nd mnge certifictes for the locl computer. Select File > Add/Remove Snp-in. Click the Certifictes snp-in nd click Add. On the Certifictes snp-in disply, select Computer ccount nd click Next. This setting is required y the Horizon FLEX server. e f g Select Locl Computer nd click Finish nd then OK. In the left nvigtion pne, expnd Certifictes (Locl Computer). Right-click on Trusted Root Certifiction Authorities nd select All Tsks > Import. The Certificte Import Wizrd opens. h i j Click Next. Browse for the root certificte file nd click Next. Select Plce ll certifictes in the following store: Trusted Root Certifiction Authorities nd click Next, then click Finish. k Right-click on Intermedite Root Certifiction Authorities nd select All Tsks > Import. l m n o p q The Certificte Import Wizrd opens. Browse for the root certificte file nd click Next. Select Plce ll certifictes in the following store: Intermedite Root Certifiction Authorities nd click Next, then click Finish. Repet steps m. nd n. for ech intermedite certificte to e instlled. Nvigte to Trusted Root Certifiction Authorities > Certifictes. Select nd export the self-signed certificte. Export the certificte in DER-encoded inry X.509 (.CER) formt. 2 Copy the self-signed certificte to the client Windows computer. 3 Import the self-signed certificte to the client Windows computer. c On the Windows computer, strt MMC (mmc.exe). Add the Certifictes snp-in for the computer ccount nd mnge certifictes for the locl computer. Import the self-signed certificte into Trusted Root Certifiction Authorities > Certifictes. The self-signed certificte is now trusted for ll users. Instll Self-Signed Certificte on Mc To instll self-signed certificte on Mc host, you export the certificte from your Horizon FLEX server nd import it to the Mc. Prerequisites Become fmilir with how to instll nd use the MMC Certifictes snp-in on Windows system. For more informtion, go to the Windows TechNet We site t VMwre, Inc. 25

26 Become fmilir with how to use Keychin Access on Mc. For more informtion, go to the Apple Support We site t Instll Windows IIS. 1 Export the self-signed certificte from your Horizon FLEX server. c d On the Horizon FLEX server, strt MMC (mmc.exe), dd the Certifictes snp-in for computer ccount, nd mnge certifictes for the locl computer. Select File > Add/Remove Snp-in. Click the Certifictes snp-in nd click Add. On the Certifictes snp-in disply, select Computer ccount nd click Next. This setting is required y the Horizon FLEX server. e f g Select Locl Computer nd click Finish nd then OK. In the left nvigtion pne, expnd Certifictes (Locl Computer). Right-click on Trusted Root Certifiction Authorities nd select All Tsks > Import. The Certificte Import Wizrd opens. h i j Click Next. Browse for the root certificte file nd click Next. Select Plce ll certifictes in the following store: Trusted Root Certifiction Authorities nd click Next, then click Finish. k Right-click on Intermedite Root Certifiction Authorities nd select All Tsks > Import. l m n o p q The Certificte Import Wizrd opens. Browse for the root certificte file nd click Next. Select Plce ll certifictes in the following store: Intermedite Root Certifiction Authorities nd click Next, then click Finish. Repet steps m. nd n. for ech intermedite certificte to e instlled. Nvigte to Trusted Root Certifiction Authorities > Certifictes. Select nd export the self-signed certificte. Export the certificte in DER-encoded inry X.509 (.CER) formt. 2 Copy the self-signed certificte to the Mc. 3 Import the self-signed certificte on the Mc. Doule-click the self-signed certificte to open it in Keychin Access. The self-signed certificte ppers in login. Copy the self-signed certificte to System. You must copy the certificte to System to ensure tht it is trusted y ll users nd locl system processes, including the virtul mchine (vmwre-vmx) processes in Fusion Pro. c Open the self-signed certificte in System, expnd Trust, select Use System Defult, nd sve your chnges. 26 VMwre, Inc.

27 Chpter 3 Setting Up Certifictes for Horizon FLEX Virtul Mchines d e Reopen the self-signed certificte in System, expnd Trust, select Alwys Trust, nd sve your chnges. Delete the self-signed certificte from login. Using Internl CA Certifictes If you use certificte from n internl CA insted of from commercil CA such s Entrust or Go Dddy, nd you do not configure the certificte into the source virtul mchine eing prepred, you must instll the root CA certificte on ech end-user host for Horizon FLEX virtul mchines to function correctly. NOTE Becuse the server certificte is signed y the root CA, you do not need to import the server certificte to end-user hosts. If the list of certifictes is empty in the policy file, Plyer Pro nd Fusion Pro will fll ck to uthenticting ginst the host's list of trusted certifictes. If you include the internl CA certificte of source virtul mchine on the Horizon FLEX Policy Server, nd you configure or instll the certificte for the Horizon FLEX Client (either in the source virtul mchine's policy file or in the host's list of trusted certifictes), you do not need to instll the root CA certificte on enduser hosts when certificte updtes re required, for exmple, when certificte expires. For informtion out configuring certifictes into source virtul mchine, see Crete Source Virtul Mchine in Fusion Pro, on pge 32. For informtion out creting trusted certifictes list nd importing it to the Horizon FLEX Policy Server, see Creting Trusted Certifictes List, on pge 21. For informtion out updting certifictes, see Updting Certifictes on the Server, on pge 24. Instll n Internl Root CA Certificte on Windows Computer To instll n internl root CA certificte on Windows host, you export the certificte from your Horizon FLEX server nd import it to the Windows computer. Prerequisites Become fmilir with how to instll nd use the MMC Certifictes snp-in on Windows system. For more informtion, go to the Windows TechNet We site t Otin nd instll n internl CA certificte. You cn use the Windows MMC Certifictes snp-in to request certificte. Instll Windows IIS. 1 Export the root CA certificte from your Horizon FLEX server. c d On the Horizon FLEX server, strt MMC (mmc.exe), dd the Certifictes snp-in for computer ccount, nd mnge certifictes for the locl computer. Select File > Add/Remove Snp-in. Click the Certifictes snp-in nd click Add. On the Certifictes snp-in disply, select Computer ccount nd click Next. This setting is required y the Horizon FLEX server. e f Select Locl Computer nd click Finish nd then OK. In the left nvigtion pne, expnd Certifictes (Locl Computer). VMwre, Inc. 27

28 g Right-click on Trusted Root Certifiction Authorities nd select All Tsks > Import. The Certificte Import Wizrd opens. h i j k l m n o p q Click Next. Browse for the root certificte file nd click Next. Select Plce ll certifictes in the following store: Trusted Root Certifiction Authorities nd click Next, then click Finish. Right-click on Intermedite Root Certifiction Authorities nd select All Tsks > Import. The Certificte Import Wizrd opens. Browse for the root certificte file nd click Next. Select Plce ll certifictes in the following store: Intermedite Root Certifiction Authorities nd click Next, then click Finish. Repet steps m. nd n. for ech intermedite certificte to e instlled. Nvigte to Trusted Root Certifiction Authorities > Certifictes. Select nd export the root CA certificte. Export the certificte in DER-encoded inry X.509 (.CER) formt. 2 Copy the root CA certificte to the Windows computer. 3 Import the root CA certificte to the Windows computer. c On the Windows computer, strt MMC (mmc.exe). Add the Certifictes snp-in for the computer ccount nd mnge certifictes for the locl computer. Import the root CA certificte into Trusted Root Certifiction Authorities > Certifictes. The root CA certificte is now trusted for ll users. Instll n Internl Root CA Certificte on Mc To instll n internl root CA certificte on Mc host, you export the certificte from your Horizon FLEX server nd import it to the Mc. Prerequisites Become fmilir with how to instll nd use the MMC Certifictes snp-in on Windows system. For more informtion, go to the Windows TechNet We site t Become fmilir with how to use Keychin Access on Mc. For more informtion, go to the Apple Support We site t Instll Windows IIS. 1 Export the root CA certificte from your Horizon FLEX server. c On the Horizon FLEX server, strt MMC (mmc.exe), dd the Certifictes snp-in for computer ccount, nd mnge certifictes for the locl computer. Select File > Add/Remove Snp-in. Click the Certifictes snp-in nd click Add. 28 VMwre, Inc.

29 Chpter 3 Setting Up Certifictes for Horizon FLEX Virtul Mchines d On the Certifictes snp-in disply, select Computer ccount nd click Next. This setting is required y the Horizon FLEX server. e f g Select Locl Computer nd click Finish nd then OK. In the left nvigtion pne, expnd Certifictes (Locl Computer). Right-click on Trusted Root Certifiction Authorities nd select All Tsks > Import. The Certificte Import Wizrd opens. h i j k l m n o p q Click Next. Browse for the root certificte file nd click Next. Select Plce ll certifictes in the following store: Trusted Root Certifiction Authorities nd click Next, then click Finish. Right-click on Intermedite Root Certifiction Authorities nd select All Tsks > Import. The Certificte Import Wizrd opens. Browse for the root certificte file nd click Next. Select Plce ll certifictes in the following store: Intermedite Root Certifiction Authorities nd click Next, then click Finish. Repet steps m. nd n. for ech intermedite certificte to e instlled. Nvigte to Trusted Root Certifiction Authorities > Certifictes. Select nd export the root CA certificte. Export the certificte in DER-encoded inry X.509 (.CER) formt. 2 Copy the root CA certificte to the Mc. 3 Import the root CA certificte on the Mc. Doule-click the root CA certificte to open it in Keychin Access. The root CA certificte ppers in login. Copy the root CA certificte to System. You must copy the certificte to System to ensure tht it is trusted y ll users nd locl system processes, including the virtul mchine (.vmx) processes in Fusion. c d e Open the root CA certificte, expnd Trust, select Use System Defults, nd sve your chnges. Reopen the root CA certificte, expnd Trust, select Alwys Trust, nd sve your chnges. Delete the root CA certificte from login. VMwre, Inc. 29

30 30 VMwre, Inc.

31 Creting nd Deploying 4 Horizon FLEX Virtul Mchines You cn crete multiple Horizon FLEX virtul mchines nd entitle those virtul mchines to vriety of end users, including Mc users. Users cn e connected or disconnected from the enterprise network when they use their Horizon FLEX virtul mchines. When you crete source virtul mchine for Horizon FLEX virtul mchine, you must select certin options for the virtul mchine to function correctly with Horizon FLEX. You cn use Fusion Pro or Worksttion (not included in the Horizon FLEX pckge) to crete source virtul mchine. This chpter includes the following topics: Horizon FLEX Virtul Mchine Deployment Overview, on pge 31 Crete Source Virtul Mchine in Fusion Pro, on pge 32 Crete Source Virtul Mchine in Worksttion (Not included in Horizon FLEX), on pge 33 Instll the Mirge Client In Source Virtul Mchine, on pge 34 Prepre Source Virtul Mchine to Join n Active Directory Domin, on pge 35 Compress Source Virtul Mchine Pckge, on pge 36 Register Source Virtul Mchine with the Horizon FLEX Policy Server, on pge 37 Creting Policies nd Entitlements, on pge 38 Crete URI to Deploy Horizon FLEX Virtul Mchine, on pge 44 Horizon FLEX Virtul Mchine Deployment Overview To deploy Horizon FLEX virtul mchine, you perform tsks in specific order. 1 Crete nd configure source virtul mchine. See Crete Source Virtul Mchine in Fusion Pro, on pge 32 or Crete Source Virtul Mchine in Worksttion (Not included in Horizon FLEX), on pge (Optionl) Prepre the source virtul mchine to join n Active Directory domin. See Prepre Source Virtul Mchine to Join n Active Directory Domin, on pge Compress the source virtul mchine pckge nd sve it in your downlod directory. See Compress Source Virtul Mchine Pckge, on pge Register the source virtul mchine with the Horizon FLEX Policy Server. See Register Source Virtul Mchine with the Horizon FLEX Policy Server, on pge 37. VMwre, Inc. 31