VMware Horizon FLEX Administration Guide

Transcription

1 VMwre Horizon FLEX Administrtion Guide Horizon FLEX 1.1 This doument supports the version of eh produt listed nd supports ll susequent versions until the doument is repled y new edition. To hek for more reent editions of this doument, see EN

2 VMwre Horizon FLEX Administrtion Guide You n find the most up-to-dte tehnil doumenttion on the VMwre We site t: The VMwre We site lso provides the ltest produt updtes. If you hve omments out this doumenttion, sumit your feedk to: [email protected] Copyright 2014, 2015 VMwre, In. All rights reserved. Copyright nd trdemrk informtion. VMwre, In Hillview Ave. Plo Alto, CA VMwre, In.

3 Contents VMwre Horizon FLEX Administrtion Guide 5 1 Introduing Horizon FLEX 7 Horizon FLEX Components 7 Horizon FLEX Arhiteture 8 Horizon FLEX System Requirements 9 Horizon FLEX Network Requirements 10 Supported Host nd Guest Operting Systems 10 2 Instlling Horizon FLEX 13 Horizon FLEX Instlltion Overview 13 Instlling nd Configuring Mirge for Horizon FLEX 14 Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges 15 Crete Virtul Diretory nd Edit Site Bindings in IIS 15 Configure Ative Diretory Settings 16 Test the Horizon FLEX Admin Console Connetion 16 Host System Requirements for Fusion Pro 17 Instll Fusion Pro on M 17 Running n Unttended Plyer Pro Instlltion 18 Creting Mss Deployment Pkge to Deploy Fusion Pro 18 3 Setting Up Certifites for Horizon FLEX Virtul Mhines 19 Creting Trusted Certifites List 19 Using Self-Signed Certifites 22 Using Internl CA Certifites 23 4 Creting nd Deploying Horizon FLEX Virtul Mhines 27 Horizon FLEX Virtul Mhine Deployment Overview 27 Crete Soure Virtul Mhine in Fusion Pro 28 Prepre Soure Virtul Mhine to Join Domin 30 Compress Soure Virtul Mhine Pkge 30 Register Soure Virtul Mhine with the Horizon FLEX Poliy Server 31 Creting Poliies nd Entitlements 32 Crete URI to Deploy Horizon FLEX Virtul Mhine 36 Mnge Horizon FLEX Virtul Mhines 37 Index 39 VMwre, In. 3

4 VMwre Horizon FLEX Administrtion Guide 4 VMwre, In.

5 VMwre Horizon FLEX Administrtion Guide The VMwre Horizon FLEX Administrtion Guide desries how to instll nd dminister VMwre Horizon FLEX. Intended Audiene This informtion is intended for nyone who wnts to instll Horizon FLEX. The informtion is written for experiened Windows system dministrtors who re fmilir with virtul mhine tehnology. VMwre, In. 5

6 VMwre Horizon FLEX Administrtion Guide 6 VMwre, In.

7 Introduing Horizon FLEX 1 Horizon FLEX is poliy-sed, ontinerized desktop solution tht enles IT dministrtors to rete, seure, nd mnge lol desktops for end users. End users work within restrited virtul mhine, lled Horizon FLEX virtul mhine, on their own omputers. Beuse Horizon FLEX virtul mhines re stored lolly, on end-user omputers, orporte pplitions re essile to offline users. This hpter inludes the following topis: Horizon FLEX Components, on pge 7 Horizon FLEX Arhiteture, on pge 8 Horizon FLEX System Requirements, on pge 9 Horizon FLEX Network Requirements, on pge 10 Supported Host nd Guest Operting Systems, on pge 10 Horizon FLEX Components Horizon FLEX is omintion of existing VMwre produts, inluding dditionl Horizon FLEX-speifi funtionlity. VMwre Mirge for Horizon FLEX Horizon FLEX Poliy Server Horizon FLEX Admin Console The stndrd Mirge server tht provides optionl Horizon FLEX virtul mhine mngement. You n mnge, k up, nd pth virtul mhines y using the Mirge for Horizon FLEX lyering tehnology. An extension of the Mirge server tht inludes Horizon FLEX-speifi funtionlity. The Horizon FLEX Poliy Server is tivted fter you pply the Horizon FLEX liense to Mirge for Horizon FLEX. The We mngement user interfe for the Horizon FLEX Poliy Server. The Horizon FLEX Admin Console is loted in the Mirge We Mngement omponent. You n use the Horizon FLEX Admin Console to perform virtul mhine mngement tsks, inluding the following: Mnge n inventory of virtul mhines Browse list of users nd groups in the Ative Diretory servie Entitle users nd groups to one or more virtul mhines Speify virtul mhine poliies for given entitlement Prevent users from essing virtul mhines y using remote lok Exmine virtul mhine detils nd sttus t n given point in time VMwre, In. 7

8 VMwre Horizon FLEX Administrtion Guide Horizon FLEX Client Horizon FLEX Virtul Mhine The lient softwre tht end users use to downlod the Horizon FLEX virtul mhines to their lol omputers. The lients inlude VMwre Fusion Pro for M omputers nd VMwre Plyer Pro for Windows omputers. Fusion Pro nd Plyer Pro re inluded in the Horizon FLEX pkge. One liense key is provided for oth Fusion Pro nd Plyer Pro. The virtul mhine tht end users run on their own omputers. You use Fusion Pro to rete soure virtul mhines for Horizon FLEX virtul mhines. Fusion Pro is inluded in the Horizon FLEX pkge. A Horizon FLEX server n support up to 1000 users. NOTE You n lso use VMwre Worksttion to rete soure virtul mhines. Worksttion is not inluded in the Horizon FLEX pkge. Aout Mirge Mirge is integrl to the opertion nd use of Horizon FLEX virtul mhines. Horizon FLEX uses only suset of the fetures ville in Mirge. This doument does not desrie ll of the informtion pertining to Mirge. For omplete informtion out Mirge, see the Mirge doumenttion t Horizon FLEX Arhiteture A typil Horizon FLEX deployment inludes the Horizon FLEX server, file server, n HTTPS proxy, red-only domin ontroller (RODC), nd offsite nd onsite end user systems. Figure 1-1 shows the reltionships etween the mjor omponents of Horizon FLEX deployment. Figure 1 1. Smple Horizon FLEX Deployment Horizon FLEX Server Mirge Mngement Console Mirge Mngement Server File Server HTTPS Proxy Offsite Users RODC DMZ Onsite Users 8 VMwre, In.

9 Chpter 1 Introduing Horizon FLEX Horizon FLEX Server The Horizon FLEX server is omposed of the Mirge Mngement Console nd Mirge Mngement Server omponents of the Mirge system. The Horizon FLEX server provides the following funtionlity. Assigns Horizon FLEX virtul mhines to users nd groups from diretory servie Mintins reord of Horizon FLEX virtul mhines in use y individul users Enfores poliy settings to the lient Enles modifition of poliy settings for given user nd Horizon FLEX virtul mhine omintion Monitors Horizon FLEX virtul mhine sttus The Mirge Mngement Console is the grphil user interfe used for slle mintenne, mngement, nd monitoring of deployed endpoints. The Mirge We Mnger mirrors Mirge Mngement Console funtionlity. The Mirge We Mnger nd Mirge We Mngement Console ommunite y using TCP/IP ports 7080 nd The Mirge Mngement Console nd Mirge Mngement Servie ommunite y using TCP/IP port File Server A file server stores the TAR files tht ontin the soure virtul mhine files for Horizon FLEX virtul mhines. The file server is loted inside the DMZ. HTTPS Proxy RODC An HTTPS proxy enles offsite end-user systems to reh the Mirge Mngement Console. The HTTPS proxy is inside the DMZ. A RODC enles offsite end-user systems to log in to their Horizon FLEX virtul mhines fter their virtul mhines re joined to n Ative Diretory domin. A RODC is required only if you wnt to llow outside users to log in without using VPN. The RODC is inside the DMZ. Horizon FLEX System Requirements Eh produt in the Horizon FLEX pkge hs ertin system requirements. Mirge for Horizon FLEX Plyer Pro Fusion Pro The system requirements re the sme s for Mirge 5.3. See the Mirge doumenttion t Horizon FLEX 1.1 is omptile with Plyer Pro 7.1. Plyer Pro 7.1 is inluded in the Horizon FLEX 1.1 instlltion pkge. For Plyer Pro hrdwre nd softwre requirements, see the VMwre Horizon FLEX User Guide. Horizon FLEX 1.1 is omptile with Fusion Pro Fusion Pro is inluded in the Horizon FLEX 1.1 instlltion pkge. VMwre, In. 9

10 VMwre Horizon FLEX Administrtion Guide For Fusion Pro hrdwre nd softwre requirements, see Host System Requirements for Fusion Pro, on pge 17. Worksttion Horizon FLEX 1.1 is omptile with Worksttion You n use Worksttion to rete nd open soure virtul mhine, ut Worksttion nnot downlod Horizon FLEX virtul mhine. Worksttion is not inluded in the Horizon FLEX 1.1 instlltion pkge. For Worksttion hrdwre nd softwre requirements, see the Worksttion doumenttion t Horizon FLEX Network Requirements Horizon FLEX enles end users to run orporte pplitions even when they re disonneted from the network. Horizon FLEX virtul mhines re stored lolly for omplete desktop experiene tht does not require network onnetion. A network onnetion is required etween the Horizon FLEX Poliy Server nd the Horizon FLEX Client in the following irumstnes: For the initil downlod of the Horizon FLEX virtul mhine to the user's lol omputer. To register Horizon FLEX virtul mhine tht ws provided on USB devie or deployed on the user's lol omputer. To reeive Horizon FLEX virtul mhine restrition nd poliy updtes. When you register soure virtul mhine for Horizon FLEX virtul mhine, you speify downlod lotion URL for virtul mhine pkge. The downlod folder must e essile to end user omputers for end users to downlod virtul mhines. Supported Host nd Guest Operting Systems The lol omputer on whih end users use the Horizon FLEX Client must hve supported host operting system. A Horizon FLEX virtul mhine must use supported guest operting system. Supported Host Operting Systems Your end users n run the Horizon FLEX Client nd ess their Horizon FLEX virtul mhine y using physil omputer tht hs one of the following operting systems. Tle 1 1. Supported Host Operting Systems Horizon FLEX Client Supported Operting Systems Plyer Pro Windows 7 Windows 8.1 Enterprise Windows Server 2012 R2 Windows 8 Windows 8.1 Pro NOTE Plyer Pro supports only 64-it operting systems. Fusion Pro M OS X M OS X 10.9 Supported Guest Operting Systems A Horizon FLEX virtul mhine n ontin one of the following guest operting systems. Windows 7 10 VMwre, In.

11 Chpter 1 Introduing Horizon FLEX Windows 8.1 Windows XP Windows Server 2012 R2 Windows 2012 Uuntu VMwre, In. 11

12 VMwre Horizon FLEX Administrtion Guide 12 VMwre, In.

13 Instlling Horizon FLEX 2 Instlling Horizon FLEX involves instlling the Horizon FLEX server nd lient omponents, reting folders to store Horizon FLEX virtul mhines, prepring Ative Diretory, setting up ertifites, nd reting nd deploying Horizon FLEX virtul mhines. This hpter inludes the following topis: Horizon FLEX Instlltion Overview, on pge 13 Instlling nd Configuring Mirge for Horizon FLEX, on pge 14 Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge 15 Crete Virtul Diretory nd Edit Site Bindings in IIS, on pge 15 Configure Ative Diretory Settings, on pge 16 Test the Horizon FLEX Admin Console Connetion, on pge 16 Host System Requirements for Fusion Pro, on pge 17 Instll Fusion Pro on M, on pge 17 Running n Unttended Plyer Pro Instlltion, on pge 18 Creting Mss Deployment Pkge to Deploy Fusion Pro, on pge 18 Horizon FLEX Instlltion Overview Horizon FLEX is omintion of existing VMwre produts, inluding Mirge, Fusion Pro, nd Plyer Pro. Instlling Horizon FLEX involves instlling eh of these produts nd performing dditionl Horizon FLEX-speifi steps. To ensure suessful Horizon FLEX deployment, you must understnd the sequene of tsks required. Before you instll Horizon FLEX, ensure tht ll of the hrdwre nd softwre requirements re met, tht you hve vlid lienses, nd tht you hve downloded the Horizon FLEX omponent instllers from the VMwre Horizon FLEX produt downlod pge. You instll Horizon FLEX in this order: 1 Instll the Mirge system. See Instlling nd Configuring Mirge for Horizon FLEX, on pge Set up ertifites for Horizon FLEX virtul mhines. See Chpter 3, Setting Up Certifites for Horizon FLEX Virtul Mhines, on pge Crete downlod folder to store your Horizon FLEX virtul mhine pkges. See Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge 15. VMwre, In. 13

14 VMwre Horizon FLEX Administrtion Guide 4 Add virtul diretory in IIS for your Horizon FLEX virtul mhine downlod folder nd edit site indings. See Crete Virtul Diretory nd Edit Site Bindings in IIS, on pge (Optionl) Configure Horizon FLEX to synhronize entities in only seleted Ative Diretory orgniztionl unit (OU). See Configure Ative Diretory Settings, on pge Test the onnetion to the Horizon FLEX Admin Console. See Test the Horizon FLEX Admin Console Connetion, on pge Instll Fusion Pro on M in your network. You use Fusion Pro to rete soure virtul mhines for Horizon FLEX virtul mhines. See Instll Fusion Pro on M, on pge Crete nd deploy Horizon FLEX virtul mhines. See Chpter 4, Creting nd Deploying Horizon FLEX Virtul Mhines, on pge Instll Horizon FLEX Client on eh end-user host, or instrut end users to instll Horizon FLEX Client on their own omputers. Horizon FLEX inludes Plyer Pro for Windows hosts nd Fusion Pro for M hosts. For single-host instlltion instrutions, see the VMwre Horizon FLEX User Guide. For Windows hosts, you n run n unttended instlltion to instll Plyer Pro on severl Windows hosts without hving to respond to wizrd prompts. See Running n Unttended Plyer Pro Instlltion, on pge 18. For M hosts, you n rete mss deployment pkge to deploy Fusion Pro to ny numer of enduser Ms. See Creting Mss Deployment Pkge to Deploy Fusion Pro, on pge 18. Instlling nd Configuring Mirge for Horizon FLEX The first Horizon FLEX instlltion step is to instll nd onfigure the Mirge system. The Horizon FLEX pkge inludes the Mirge Core Softwre, Mirge Gtewy Appline Softwre, nd Mirge PowerCLI for Windows. The Mirge deployment involves numer of omponents, inluding the Mirge Mngement Server, Mirge Mngement Console, Windows Internet Informtion Servies (IIS), nd other omponents, whih you must instll in speifi order. To instll nd onfigure the Mirge system, follow the instlltion instrutions in the Mirge doumenttion t When you instll the Mirge system, you must selet ertin options to ensure tht the Horizon FLEX server opertes orretly. During Mirge server instlltion, hoose SSL for the Mirge server trnsport. SSL is required to use the Mirge Gtewy feture for externl ess nd mngement of Horizon FLEX systems. Before you instll the Mirge We Mnger, mke sure tht.net Frmework 4.0 is instlled on the server. The Mirge Mngement Server must run s user tht hs Ative Diretory red permissions. If you pln to join Horizon FLEX virtul mhines to n Ative Diretory domin, the Mirge Mngement Server must run s user tht hs domin join permissions. 14 VMwre, In.

15 Chpter 2 Instlling Horizon FLEX Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges During the Horizon FLEX virtul mhine deployment proess, you ompress your soure virtul mhine pkges into TAR (.tr) formt so tht end users n esily downlod their Horizon FLEX virtul mhines. You must rete downlod folder to store these TAR files. 1 Crete the downlod folder on the Horizon FLEX server or on nother server. The downlod folder does not need to reside on the Horizon FLEX server, ut the files it ontins must e downlodle without ny uthentition hllenge. 2 Assign permissions to the downlod folder so tht users n downlod the files tht it ontins. 3 (Optionl) Shre the downlod folder to n dministrtive group, suh s Domin Admins. This step n mke it esier to register your soure virtul mhines with the Horizon FLEX Poliy Server. Wht to do next Crete virtul diretory in IIS to llow the Horizon FLEX virtul mhines to e downloded to end-user systems. See Crete Virtul Diretory nd Edit Site Bindings in IIS, on pge 15. Crete Virtul Diretory nd Edit Site Bindings in IIS You must rete virtul diretory in IIS to llow Horizon FLEX virtul mhine pkges to e downloded to end-user omputers. This doument does not desrie how to set up IIS for the Mirge system. For informtion out setting up IIS for the Mirge system, see the Mirge doumenttion t Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge for Horizon FLEX, on pge 14. Configure ertifite uthentition. See Chpter 3, Setting Up Certifites for Horizon FLEX Virtul Mhines, on pge 19. Crete downlod folder for your Horizon FLEX virtul mhine pkges. See Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge Open IIS Mnger. 2 Nvigte to VMwre Mirge Mngement We Site nd selet rvm. 3 Right-lik rvm nd selet Add Virtul Diretory. 4 Type nme in the Alis text ox, rowse to the folder tht you reted to ontin the Horizon FLEX virtul mhine pkges, nd lik OK. 5 Selet VMwre Mirge Mngement We Site nd lik Edit Bindings in the right olumn. 6 Set the HTTPS port to use your Horizon FLEX server ertifite nd lik OK. VMwre, In. 15

16 VMwre Horizon FLEX Administrtion Guide Configure Ative Diretory Settings When you entitle Horizon FLEX virtul mhine, you dd users nd groups from your existing Ative Diretory infrstruture to the entitlement. By defult, Horizon FLEX synhronizes your entire Ative Diretory infrstruture into the Horizon FLEX dtse. You n optionlly onfigure Horizon FLEX to synhronize only speifi OU. Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge for Horizon FLEX, on pge Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 2 In the Horizon FLEX Admin Console, lik the Generl System Settings ion nd lik Ative Diretory Settings. 3 Type the OU to synhronize in the Orgniztionl Unit text ox. As you egin to type in the text ox, the ville OUs in your Ative Diretory infrstruture pper in drop-down menu nd you n selet the pproprite OU. 4 Clik OK to sve the OU setting. The Horizon FLEX server vlidtes the OU to mke sure it exists nd is essile. The Horizon FLEX server synhronizes the Ative Diretory entities tht elong only to the OU tht you seleted, inluding entities tht elong to ny hild OUs of the seleted OU. Any time you onfigure new OU, the Horizon FLEX server deletes the previously synhronized entities from the dtse nd strts new full synhroniztion proess. Test the Horizon FLEX Admin Console Connetion You n verify your Horizon FLEX deployment y testing the Horizon FLEX Admin Console onnetion. Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge for Horizon FLEX, on pge 14. Configure ertifite uthentition. See Chpter 3, Setting Up Certifites for Horizon FLEX Virtul Mhines, on pge Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 16 VMwre, In.

17 Chpter 2 Instlling Horizon FLEX 2 Verify tht the Horizon FLEX Admin Console pge ppers orretly. The Imges, Poliies, Entitlements, nd Virtul Mhines uttons should e visile in the left nvigtion pnel. Host System Requirements for Fusion Pro The physil omputer on whih you instll Fusion Pro is lled the host system nd its operting system is lled the host operting system. To run Fusion Pro, the host system nd the host operting system must meet speifi hrdwre nd softwre requirements. Proessor Requirements for Host Systems You n instll Fusion Pro on ny M tht hs 64-it Intel proessor. Fusion Pro is omptile with Core 2 Duo, Xeon, i3, i5, i7, nd newer proessors. Memory Requirements for Host Systems The host system must hve enough memory to run M OS X, the guest operting systems tht run inside the virtul mhines on the M, nd the pplitions tht run in the M nd guest operting systems. The minimum memory required on the host system is 4GB. 8GB is reommended. The host system must hve 750MB of free disk spe for Fusion Pro nd t lest 5GB of free disk spe for eh virtul mhine Supported Host Operting Systems To instll Fusion Pro, your M must hve supported M OS X operting system. M OS X 10.9 M OS X Instll Fusion Pro on M You instll Fusion Pro in the sme wy you instll other M OS X pplitions. Prerequisites Verify tht your M meets the system requirements for Fusion Pro. See Host System Requirements for Fusion Pro, on pge 17. Verify tht you hve the dministrtor pssword for your M. Downlod the Fusion Pro instller to your M. You n otin the Fusion Pro instller from the VMwre wesite. Verify tht you hve Horizon FLEX liense key for Fusion Pro. You must provide Horizon FLEX liense key during instlltion to tive the Horizon FLEX fetures in Fusion Pro. 1 Doule-lik the VMwre Fusion.dmg file to open it. The ontents of the disk imge pper in the VMwre Fusion Finder window. 2 In the VMwre Fusion Finder window, doule-lik the VMwre Fusion ion or drg it to the Applitions folder. 3 Clik the VMwre Fusion ion in the Applitions folder. 4 Type the dministrtor-level user redentils for your M to omplete the instlltion. VMwre, In. 17

18 VMwre Horizon FLEX Administrtion Guide 5 Aept the liense greement nd enter your Horizon FLEX liense key. Running n Unttended Plyer Pro Instlltion You n use the unttended instlltion feture of the Mirosoft Windows Instller (MSI) to instll Plyer Pro on severl Windows hosts without hving to respond to wizrd prompts. This feture is onvenient in lrge enterprise. Running n unttended instlltion of Plyer Pro is similr to running n unttended instlltion of VMwre Worksttion. For more informtion, see the VMwre Worksttion doumenttion t Creting Mss Deployment Pkge to Deploy Fusion Pro You n rete Fusion mss deployment pkge to instll Fusion Pro on ny numer of end-user Ms. You n use stndrd pkge deployment tools, inluding Apple Remote Desktop Admin, to deploy the mss deployment pkge. When you onfigure the mss deployment pkge, speify your Horizon FLEX liense key in [Volume Liense] setion of the Deploy.ini file nd ple opy of the Fusion Pro pplition to the 00Fusion_Deployment_Items folder. You n use the optionl onnetatstrtupurl prmeter in the [Lotions] setion of the Deploy.ini file to speify user nme nd the hostnme of your Horizon FLEX server, for exmple: onnetatstrtupurl = vmwre-rvm://[email protected]:7443 If there re no virtul mhines instlled on the user's M when the user lunhes Fusion Pro, the Connet dilog ox opens nd the Server nd Usernme text oxes re prepopulted with the hostnme nd user nme tht you speified in the onnetatstrtupurl prmeter. For step-y-step informtion out reting mss deployment pkge, see VMwre KB rtile : Creting VMwre Fusion mss deployment pkge. 18 VMwre, In.

19 Setting Up Certifites for 3 Horizon FLEX Virtul Mhines Before you rete nd deploy Horizon FLEX virtul mhines, you must set up ertifites to ensure tht end users n suessfully downlod nd use their virtul mhines. VMwre reommends tht you use ertifite tht is issued y ertifite uthority (CA), suh s Entrust or Go Dddy, or third-prty ertifite, on your Horizon FLEX server. If you re using self-signed ertifite or ertifite from n internl CA insted of generlly trusted ertifite, you must tke steps to ensure tht the ertifite is trusted on ll end-user omputers tht will downlod nd use Horizon FLEX virtul mhines. This doument does not desrie how to set up ertifites in Mirge. For informtion out setting up ertifites in Mirge, see the Mirge doumenttion t This hpter inludes the following topis: Creting Trusted Certifites List, on pge 19 Using Self-Signed Certifites, on pge 22 Using Internl CA Certifites, on pge 23 Creting Trusted Certifites List You n rete list of trusted ertifites for Horizon FLEX virtul mhines nd import the list to the Horizon FLEX Poliy Server. When you use trusted ertifites list, you do not need to instll ertifites on end-user hosts. Using list of trusted ertifites n prevent mliious users from reting their own self-signed ertifites for the sme hostnme nd dding those ertifites to their host's list of trusted ertifites. When you onfigure the Horizon FLEX Poliy Server to use trusted ertifites list, the server ignores the host's list of ertifites nd uses the trusted ertifites list to verify server onnetions insted. If the Horizon FLEX Poliy Server nnot verify ertifite y using the trusted ertifites list, the server onnetion fils. If the trusted ertifites list is empty in the soure virtul mhine, Plyer Pro nd Fusion Pro uthentite ginst the host's list of trusted ertifites. To rete the trusted ertifites list, you export eh ertifite to seprte file nd then ontente ll of the files into single file. You use the Horizon FLEX Admin Console to import the ontented ertifites file to the Horizon FLEX Poliy Server. You must export ertifites in Privy Enhned Mil (PEM) formt. On Windows systems, the PEM ertifite enoding is lled Bse-64 enoded X.509 (.CER). Only PEM-enoded ertifites re supported. No other ertifite formt (DER, Serilized Certifite Store/SST, PKCS #12/PFX, PKCS #7/P7B) is epted. VMwre, In. 19

20 VMwre Horizon FLEX Administrtion Guide Aout the PEM Formt The PEM formt is stndrd ertifite formt tht is Bse64 enoded. An exmple of PEM-formt ertifite is s follows: -----BEGIN CERTIFICATE----- MIIDojCCAwugAwIBAgIJAMLM0CJRzPyzMA0GCSqGSI3DQEBBQUAMIGTMQswCQYD VQQGEwJVUzETMBEGA1UECBMKQ2FsWZvm5pYTESMBAGA1UEBxMJUGFsyBBHRv MS8wLQYDVQQKEyZWTXdhmUsIEluYy4gLSBX3Jr3RhdGlviBTU0wgVGVzdGlu ZzEqMCgGA1UEAxMhV29y3N0YXRp24gQ2VydGlmWNhdGUgQXV0G9yXR5MB4X DTExMDxNTAyMjY0OFoXDTE1MDxNDAyMjY0OFowgZMxCzAJBgNVBAYTAlVTMRMw EQYDVQQIEwpDYWxpZm9ymlhMRIwEAYDVQQHEwlQYWxvIEFsdG8xLzAtBgNVBAoT JlZNd2FyZSwgSW5jLiAtIFdvmtzdGF0W9uIFNTTCBUZXN0W5nMSowKAYDVQQD EyFX3Jr3RhdGlviBDZXJ0WZpY2F0ZSBBdXRo3JpdHkwgZ8wDQYJKoZIhvN AQEBBQADgY0AMIGJAoGBAL/tBlngiEkCK7ssCBe8lZ30FlIHmpECmwEm3AID1C0 ln+ldrt2ammqiknxbpxgbgyrnrnnshrzp1xxr/wl22ayt7nx+p/xsh2srd GGCTN/wh/ArirTLCjRwY55lAAH9xwzortRYR84IBJQpHzxopTSI9o4ZVIqx AgMBAAGjgfswgfgwHQYDVR0OBBYEFMoT527dtvlgR1EzYK4EnQHS6T2ZMIHIBgNV HSMEgAwg2AFMoT527dtvlgR1EzYK4EnQHS6T2ZoYGZpIGWMIGTMQswCQYDVQQG EwJVUzETMBEGA1UECBMKQ2FsWZvm5pYTESMBAGA1UEBxMJUGFsyBBHRvMS8w LQYDVQQKEyZWTXdhmUsIEluYy4gLSBX3Jr3RhdGlviBTU0wgVGVzdGluZzEq MCgGA1UEAxMhV29y3N0YXRp24gQ2VydGlmWNhdGUgQXV0G9yXR5ggkAwszQ IlHM/LMwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQBoiwDWGWXzI+j 0gG/7BNzpNHzR1RGAF4nB9JrnCYWvB313kgYDMHogfiAoQhsu/py/OYBYVRjjFJ YVTJ7DVl/3Gpk3+tdJfEmqIz76PVWfWTnhuJEMYrMM4W06B/K2s24kZtXQ h84fytvcg/l6tp5swgei4vwgrfxga== -----END CERTIFICATE----- When you rete trusted ertifites list, you ontente multiple PEM-formt ertifites into single file. Line endings re uto-deteted. The following exmple shows the formt of ontented ertifites list tht ontins two ertifites BEGIN CERTIFICATE----- <se64 ontent here> -----END CERTIFICATE BEGIN CERTIFICATE----- <se64 ontent here> -----END CERTIFICATE----- Crete PEM-Formt Certifites You n rete PEM-formt ertifites y downloding the ertifite from the CA's We site or y exporting the ertifites from host system. For exmple, you n downlod ertifites for Verisign from the Symnte We site t Export PEM-Formt Certifite From M You n export PEM-formt ertifite from M. Prerequisites Beome fmilir with how to use Keyhin Aess on M. For more informtion, see the Apple Support We site t 20 VMwre, In.

21 Chpter 3 Setting Up Certifites for Horizon FLEX Virtul Mhines 1 On the M, open Keyhin Aess. 2 From the sider, selet System Roots. 3 Lote the ertifite to export. 4 Selet File > Export Items. 5 Selet lotion to sve the ertifite nd selet the Privy Enhned Mil (.pem) file formt. Export PEM-Formt Certifite From Windows System You n export PEM-formt ertifite from Windows system. On Windows, the PEM ertifite enoding is lled Bse-64 enoded X.509 (.CER). Prerequisites Beome fmilir with how to use Certifite Mnger on Windows system. For more informtion, see the Mirosoft TehNet We site t 1 On the Windows system, open Certifite Mnger (ertmgr.exe). 2 Right-lik the ertifite to export nd selet All Tsks > Export. 3 Selet options in the Certifite Export Wizrd. Deide if you will export the privte key with the ertifite. Selet Bse-64 enoded X.509 (.CER) for the file export formt. For the ertifite to work with Horizon FLEX, you must hoose this option. d Provide lotion to sve the ertifite nd file nme. Review the settings you seleted nd lik Finish. The ertifite file is sved to the lotion you indited. Crete nd Import the Trusted Certifites List File After you export your PEM-formt ertifites, you must onstrut the trusted ertifite list nd import the ertifites list file to the Horizon FLEX Poliy Server. Prerequisites Export eh ertifite in PEM formt. See Crete PEM-Formt Certifites, on pge To rete the trusted ertifites list file, ontente eh PEM-formt ertifite file into single file. You n use the t ommnd, or you n opy nd pste the ontents of the ertifite files into text file. You n sfely edit Bse64 ontent in text editor. For exmple: $ t myert1.pem myert2.pem myert3.pem > list.pem 2 Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. VMwre, In. 21

22 VMwre Horizon FLEX Administrtion Guide 3 In the Horizon FLEX Admin Console, lik the Generl System Settings ion nd selet Certifites. 4 Clik Import, rowse to the trusted ertifites list file, nd lik Open to import the file. Updting Certifites on the Server When ertifite expires, nd new ertifite hs n expirtion dte tht is set fr into the future, you n dd the new ertifite s seond ertifite to the trusted ertifites list in the Horizon FLEX Poliy Server. Adding the new ertifite to the trusted ertifites list enles ll Horizon FLEX virtul mhines to downlod the new ertifite. Then, when the ertifite swith ours, ll of the Horizon FLEX virtul mhines tht reeived the new list of ertifites n onnet to the Horizon FLEX server nd you n remove the old trusted ertifite from the poliy file. Using Self-Signed Certifites If you do not onfigure the self-signed ertifite into the soure virtul mhine eing prepred, you must instll the ertifite on eh end-user host for Horizon FLEX virtul mhines to funtion orretly. If the list of ertifites is empty in the poliy file, Plyer Pro nd Fusion Pro will fll k to uthentiting ginst the host's list of trusted ertifites. If you inlude the self-signed ertifite of soure virtul mhine on the Horizon FLEX Poliy Server, nd you onfigure or instll the self-signed ertifite for the Horizon FLEX Client (either in the soure virtul mhine's poliy file or in the host's list of trusted ertifites), you do not need to instll the ertifite on end-user hosts when ertifite updtes re required, for exmple, when ertifite expires. For informtion out onfiguring ertifites into soure virtul mhine, see Crete Soure Virtul Mhine in Fusion Pro, on pge 28. For informtion out reting trusted ertifites list nd importing it to the Horizon FLEX Poliy Server, see Creting Trusted Certifites List, on pge 19. For informtion out updting ertifites, see Updting Certifites on the Server, on pge 22. Instll Self-Signed Certifite on Windows Computer To instll self-signed ertifite on Windows host, you export the ertifite from your Horizon FLEX server nd import it to the Windows omputer. Prerequisites Beome fmilir with how to instll nd use the MMC Certifites snp-in on Windows system. For more informtion, go to the Windows TehNet We site t 1 Export the self-signed ertifite from your Horizon FLEX server. On the Horizon FLEX server, strt MMC (mm.exe), dd the Certifites snp-in for omputer ount, nd mnge ertifites for the lol omputer. Nvigte to Trusted Root Certifition Authorities > Certifites. Selet nd export the self-signed ertifite. Export the ertifite in DER-enoded inry X.509 (.CER) formt. 2 Copy the self-signed ertifite to the Windows omputer. 22 VMwre, In.

23 Chpter 3 Setting Up Certifites for Horizon FLEX Virtul Mhines 3 Import the self-signed ertifite to the Windows omputer. On the Windows omputer, strt MMC (mm.exe). Add the Certifites snp-in for the omputer ount nd mnge ertifites for the lol omputer. Import the self-signed ertifite into Trusted Root Certifition Authorities > Certifites. The self-signed ertifite is now trusted for ll users. Instll Self-Signed Certifite on M To instll self-signed ertifite on M host, you export the ertifite from your Horizon FLEX server nd import it to the M. Prerequisites Beome fmilir with how to instll nd use the MMC Certifites snp-in on Windows system. For more informtion, go to the Windows TehNet We site t Beome fmilir with how to use Keyhin Aess on M. For more informtion, go to the Apple Support We site t 1 Export the self-signed ertifite from your Horizon FLEX server. On the Horizon FLEX server, strt MMC (mm.exe), dd the Certifites snp-in for omputer ount, nd mnge ertifites for the lol omputer. Nvigte to Trusted Root Certifition Authorities > Certifites. Selet nd export the self-signed ertifite. Export the ertifite in DER-enoded inry X.509 (.CER) formt. 2 Copy the self-signed ertifite to the M. 3 Import the self-signed ertifite on the M. Doule-lik the self-signed ertifite to open it in Keyhin Aess. The self-signed ertifite ppers in login. Copy the self-signed ertifite to System. You must opy the ertifite to System to ensure tht it is trusted y ll users nd lol system proesses, inluding the virtul mhine (.vmx) proesses in Fusion Pro. d e Open the self-signed ertifite in System, expnd Trust, selet Use System Defult, nd sve your hnges. Reopen the self-signed ertifite in System, expnd Trust, selet Alwys Trust, nd sve your hnges. Delete the self-signed ertifite from login. Using Internl CA Certifites If you use ertifite from n internl CA insted of from ommeril CA suh s Entrust or Go Dddy, nd you do not onfigure the ertifite into the soure virtul mhine eing prepred, you must instll the root CA ertifite on eh end-user host for Horizon FLEX virtul mhines to funtion orretly. NOTE Beuse the server ertifite is signed y the root CA, you do not need to import the server ertifite to end-user hosts. VMwre, In. 23

24 VMwre Horizon FLEX Administrtion Guide If the list of ertifites is empty in the poliy file, Plyer Pro nd Fusion Pro will fll k to uthentiting ginst the host's list of trusted ertifites. If you inlude the internl CA ertifite of soure virtul mhine on the Horizon FLEX Poliy Server, nd you onfigure or instll the ertifite for the Horizon FLEX Client (either in the soure virtul mhine's poliy file or in the host's list of trusted ertifites), you do not need to instll the root CA ertifite on enduser hosts when ertifite updtes re required, for exmple, when ertifite expires. For informtion out onfiguring ertifites into soure virtul mhine, see Crete Soure Virtul Mhine in Fusion Pro, on pge 28. For informtion out reting trusted ertifites list nd importing it to the Horizon FLEX Poliy Server, see Creting Trusted Certifites List, on pge 19. For informtion out updting ertifites, see Updting Certifites on the Server, on pge 22. Instll n Internl Root CA Certifite on Windows Computer To instll n internl root CA ertifite on Windows host, you export the ertifite from your Horizon FLEX server nd import it to the Windows omputer. Prerequisites Beome fmilir with how to instll nd use the MMC Certifites snp-in on Windows system. For more informtion, go to the Windows TehNet We site t Otin nd instll n internl CA ertifite. You n the Windows MMC Certifites snp-in to request ertifite. 1 Export the root CA ertifite from your Horizon FLEX server. On the Horizon FLEX server, strt MMC (mm.exe), dd the Certifites snp-in for omputer ount, nd mnge ertifites for the lol omputer. Nvigte to Trusted Root Certifition Authorities > Certifites. Selet nd export the root CA ertifite. Export the ertifite in DER-enoded inry X.509 (.CER) formt. 2 Copy the root CA ertifite to the Windows omputer. 3 Import the root CA ertifite to the Windows omputer. On the Windows omputer, strt MMC (mm.exe). Add the Certifites snp-in for the omputer ount nd mnge ertifites for the lol omputer. Import the root CA ertifite into Trusted Root Certifition Authorities > Certifites. The root CA ertifite is now trusted for ll users. Instll n Internl Root CA Certifite on M To instll n internl root CA ertifite on M host, you export the ertifite from your Horizon FLEX server nd import it to the M. Prerequisites Beome fmilir with how to instll nd use the MMC Certifites snp-in on Windows system. For more informtion, go to the Windows TehNet We site t 24 VMwre, In.

25 Chpter 3 Setting Up Certifites for Horizon FLEX Virtul Mhines Beome fmilir with how to use Keyhin Aess on M. For more informtion, go to the Apple Support We site t 1 Export the root CA ertifite from your Horizon FLEX server. On the Horizon FLEX server, strt MMC (mm.exe), dd the Certifites snp-in for omputer ount, nd mnge ertifites for the lol omputer. Nvigte to Trusted Root Certifition Authorities > Certifites. Selet nd export the root CA ertifite. Export the ertifite in DER-enoded inry X.509 (.CER) formt. 2 Copy the root CA ertifite to the M. 3 Import the root CA ertifite on the M. Doule-lik the root CA ertifite to open it in Keyhin Aess. The root CA ertifite ppers in login. Copy the root CA ertifite to System. You must opy the ertifite to System to ensure tht it is trusted y ll users nd lol system proesses, inluding the virtul mhine (.vmx) proesses in Fusion. d e Open the root CA ertifite, expnd Trust, selet Use System Defults, nd sve your hnges. Reopen the root CA ertifite, expnd Trust, selet Alwys Trust, nd sve your hnges. Delete the root CA ertifite from login. VMwre, In. 25

26 VMwre Horizon FLEX Administrtion Guide 26 VMwre, In.

27 Creting nd Deploying 4 Horizon FLEX Virtul Mhines You n rete multiple Horizon FLEX virtul mhines nd entitle those virtul mhines to vriety of end users, inluding M users. Users n e onneted or disonneted from the enterprise network when they use their Horizon FLEX virtul mhines. When you rete soure virtul mhine for Horizon FLEX virtul mhine, you must selet ertin options to ensure tht the virtul mhine funtions orretly with Horizon FLEX. This doument desries how to use Fusion Pro to rete soure virtul mhine. For informtion out using Worksttion to rete soure virtul mhine, see the Worksttion doumenttion t This hpter inludes the following topis: Horizon FLEX Virtul Mhine Deployment Overview, on pge 27 Crete Soure Virtul Mhine in Fusion Pro, on pge 28 Prepre Soure Virtul Mhine to Join Domin, on pge 30 Compress Soure Virtul Mhine Pkge, on pge 30 Register Soure Virtul Mhine with the Horizon FLEX Poliy Server, on pge 31 Creting Poliies nd Entitlements, on pge 32 Crete URI to Deploy Horizon FLEX Virtul Mhine, on pge 36 Mnge Horizon FLEX Virtul Mhines, on pge 37 Horizon FLEX Virtul Mhine Deployment Overview To deploy Horizon FLEX virtul mhine, you perform tsks in speifi order. 1 Crete nd onfigure soure virtul mhine in Fusion Pro. See Crete Soure Virtul Mhine in Fusion Pro, on pge (Optionl) Prepre the soure virtul mhine to join n Ative Diretory domin. See Prepre Soure Virtul Mhine to Join Domin, on pge Compress the soure virtul mhine pkge nd sve it in your downlod diretory. See Compress Soure Virtul Mhine Pkge, on pge Register the soure virtul mhine with the Horizon FLEX Poliy Server. See Register Soure Virtul Mhine with the Horizon FLEX Poliy Server, on pge Crete poliy for the Horizon FLEX imge nd entitle the imge to your Ative Diretory users nd groups. VMwre, In. 27

28 VMwre Horizon FLEX Administrtion Guide See Creting Poliies nd Entitlements, on pge (Optionl) Crete URI to deploy the Horizon FLEX virtul mhine. See Crete URI to Deploy Horizon FLEX Virtul Mhine, on pge 36. Crete Soure Virtul Mhine in Fusion Pro You n use Fusion Pro to rete soure virtul mhine for Horizon FLEX virtul mhine. When you rete soure virtul mhine, you must set enryption nd restrition informtion so tht the virtul mhine funtions orretly with Horizon FLEX. NOTE You n lso use Worksttion 11.0 to rete soure virtul mhine. Worksttion is not inluded in the Horizon FLEX pkge. If you the enle USB devie use, drg nd drop, nd opy nd pste when you rete the virtul mhine, you n set poliies in the Horizon FLEX Admin Console to enle or disle these fetures for end users. However, if you disle these fetures when you rete the virtul mhine, you nnot override the virtul mhine settings to enle the fetures y setting poliies. Prerequisites Beome fmilir with how to rete virtul mhine in Fusion Pro. See the Fusion doumenttion t Beome fmilir with the supported guest operting systems for Horizon FLEX virtul mhines. See Supported Host nd Guest Operting Systems, on pge 10. Instll Fusion Pro. See Instll Fusion Pro on M, on pge Open Fusion Pro nd rete virtul mhine. Selet guest operting system tht is supported for Horizon FLEX virtul mhines. Configure the virtul mhine in the wy you wnt to distriute it to your end users. 2 From the Virtul Mhine Lirry, selet the newly reted virtul mhine nd selet Settings > Enryption & Restritions. 3 Chek Enle Enryption nd set pssword for opening the virtul mhine. The pssword must e six hrters or longer. You must give this enryption pssword to your end users to enle them to open the virtul mhine. IMPORTANT Mke sure you retin the enryption pssword. The virtul mhine nnot e essed without this pssword. 4 Chek Enle Restritions nd set pssword for editing the restritions on the virtul mhine. This pssword should e different thn the virtul mhine enryption pssword. IMPORTANT Mke sure you retin the restritions pssword. You nnot edit the restritions on the virtul mhine without this pssword. 5 Clik Configure. The restritions onfigurtion window opens. 6 Set the Restrition Type to Mnged. You must set the restrition type to Mnged to distriute nd use the virtul mhine with Horizon FLEX. 28 VMwre, In.

29 Chpter 4 Creting nd Deploying Horizon FLEX Virtul Mhines 7 Type the URL of the Horizon FLEX server on whih you intend to host the virtul mhine in the Restritions Mngement Server text ox. 8 Clik Chek Server to verify the Horizon FLEX server URL. 9 (Optionl) To dd trusted ertifites to the virtul mhine, lik the + utton nd nvigte to the lotion of eh ertifite file. If you dd ertifites to the virtul mhine, the Horizon FLEX Client uses the ertifites in the virtul mhine nd does not use the ertifites on the host. To ontrol ertifites for ll virtul mhines from the Horizon FLEX Poliy Server, leve the ertifites ox lnk. 10 Clik Sve. 11 Clik the Lok ion to prevent further hnges to the restritions of the virtul mhine. You n edit restritions for the virtul mhine y using the restritions pssword. Wht to do next If you intend to join the Horizon FLEX virtul mhine to n Ative Diretory domin, prepre the virtul mhine to join the domin. See Prepre Soure Virtul Mhine to Join Domin, on pge 30. To instll the Mirge lient in the soure virtul mhine, see Instll the Mirge Client In Soure Virtul Mhine, on pge 29. Instll the Mirge Client In Soure Virtul Mhine If the soure virtul mhine hs Windows guest operting system, you n instll the Mirge lient in the virtul mhine. Instlling the Mirge lient is optionl. If you instll the Mirge lient in soure virtul mhine, you n selet disster reovery senrios when you entitle the virtul mhine. For exmple, you n selet n option to mke the Mirge server rete CVD for the Horizon FLEX virtul mhines tht the end user downlods. Mirge periodilly synhronizes end-user dt into the dtenter sed on the seleted Mirge poliy. You n use this dt to restore the CVD or ess files on the virtul mhine y using the Mirge File Portl in the min Mirge Mngement Console. Prerequisites Crete the soure virtul mhine. See Crete Soure Virtul Mhine in Fusion Pro, on pge 28. Otin the VMwre Mirge Instlltion Guide for Mirge lient instlltion instrutions. 1 In Fusion Pro, strt the soure virtul mhine nd log in to the guest operting system. 2 Instll the ltest version of VMwre Tools. d e From the menu r, selet Virtul Mhine > Instll VMwre Tools. Clik Next to progress through the instlltion. Selet Complete, unless you need to exlude ertin fetures of VMwre Tools, nd lik Next. Clik Instll. When the instlltion finishes, lik Yes to restrt the virtul mhine. 3 Instll the Mirge lient. 4 In the Mirge Mngement onsole, verify tht the endpoint ppers s Pending Assignment. 5 Power off the soure virtul mhine. VMwre, In. 29

30 VMwre Horizon FLEX Administrtion Guide Prepre Soure Virtul Mhine to Join Domin If you intend to join Horizon FLEX virtul mhine to speifi Ative Diretory domin, you must prepre the soure virtul mhine to join the domin efore you register it with the Horizon FLEX Poliy Server. Prerequisites Crete soure virtul mhine. See Crete Soure Virtul Mhine in Fusion Pro, on pge 28. NOTE Do not instll Windows 7 Home edition or non-windows guest operting system in the soure virtul mhine. You nnot join Windows 7 Home edition operting system or non-windows guest operting system to domin. Verify tht you hve the dministrtor pssword for the soure virtul mhine. 1 In Fusion Pro, strt the soure virtul mhine nd log in to the guest operting system. 2 (Optionl) Turn off Windows updte. 3 Instll the ltest version of VMwre Tools. d e From the menu r, selet Virtul Mhine > Instll VMwre Tools. Clik Next to progress through the instlltion. Selet Complete, unless you need to exlude ertin fetures of VMwre Tools, nd lik Next. Clik Instll. When the instlltion finishes, lik Yes to restrt the virtul mhine. 4 Run instll-rvmsetup.md s n dministrtor to instll the VMwre RVM Setup Servie in the soure virtul mhine. The VMwre RVM Setup Servie performs the domin join opertion. instll-rvmsetup.md is inluded with VMwre Tools. 5 Open the Windows Servies snp-in (servies.ms) nd verify tht the VMwre RVM Setup Servie strtup type is set to Automti. 6 Shut down the soure virtul mhine. The VMwre RVM Setup Servie strts the next time you oot up the soure virtul mhine. Compress Soure Virtul Mhine Pkge You must ompress the soure virtul mhine pkge in TAR (.tr) formt so tht end users n esily downlod the virtul mhine. A virtul mhine pkge (sometimes lled undle) inludes ll of the virtul mhine files required to run virtul mhine. Prerequisites Crete the soure virtul mhine. See Crete Soure Virtul Mhine in Fusion Pro, on pge 28. Crete nd onfigure downlod folder for your Horizon FLEX virtul mhine pkges. See Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge 15 nd Crete Virtul Diretory nd Edit Site Bindings in IIS, on pge If the soure virtul mhine is running, shut it down. 30 VMwre, In.

31 Chpter 4 Creting nd Deploying Horizon FLEX Virtul Mhines 2 In Fusion Pro, nvigte to the soure virtul mhine. 3 Selet File > Export to TAR nd export the soure virtul mhine pkge to TAR file. NOTE Remove ny spes from the TAR file nme. Removing spes from the file nme n mke it esier to onnet to the downlod URL for the virtul mhine. 4 Export the TAR file to your Horizon FLEX virtul mhine pkges downlod folder. Wht to do next Register the soure virtul mhine with the Horizon FLEX Poliy Server. See Register Soure Virtul Mhine with the Horizon FLEX Poliy Server, on pge 31. Register Soure Virtul Mhine with the Horizon FLEX Poliy Server You must register soure virtul mhine with the Horizon FLEX Poliy Server s Horizon FLEX imge efore you n distriute the virtul mhine to end users. Prerequisites Compress the soure virtul mhine files in TAR (.tr) rhive file. See Compress Soure Virtul Mhine Pkge, on pge 30. Verify tht your Horizon FLEX virtul mhine pkges downlod diretory is set up properly. See Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge 15 nd Crete Virtul Diretory nd Edit Site Bindings in IIS, on pge 15. Verify tht restritions re lredy set in the soure virtul mhine's onfigurtion (.vmx) file. If you selet virtul mhine does not hve restritions set, the Horizon FLEX Poliy Server rejets the.vmx file s invlid. For informtion out setting restritions in virtul mhine, see Crete Soure Virtul Mhine in Fusion Pro, on pge If the soure virtul mhine is on M, perform these steps. Find the virtul mhine pkge (.vmwrevm) file for the virtul mhine, right-lik the file nme, nd selet Show Pkge Content. Copy the virtul mhine onfigurtion (.vmx) file to lotion tht is essile to the Horizon FLEX server. 2 Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 3 Clik Imges in the left nvigtion pnel. 4 Clik the New (+) utton. 5 Clik Selet next to the Selet Imge File text ox nd rowse to the virtul mhine onfigurtion (.vmx) file for the soure virtul mhine. 6 Type user-friendly nme for the Horizon FLEX virtul mhine file in the Imge Nme text ox. For exmple: Windows 7 VM 7 (Optionl) Type desription of the Horizon FLEX virtul mhine in the Desription text ox. VMwre, In. 31

32 VMwre Horizon FLEX Administrtion Guide 8 (Optionl) Clik the Chnge utton next to Ion nd uplod n ion for the Horizon FLEX virtul mhine. Uploded ions must e PNG (.png) files. 9 (Optionl) In the Imge URL text ox type the fully qulified pth of the TAR file tht ontins the soure virtul mhine pkge. End users will downlod the Horizon FLEX virtul mhine from this URL. The URL formt is where server is the hostnme or IP ddress of the server where you stored the TAR file, port is the port numer on the server, downlod_folder is the nme of the Horizon FLEX virtul mhine downlod folder tht ontins the TAR file, nd filenme.tr is the nme of the TAR file tht ontins the soure virtul mhine pkge. For exmple: 10 (Optionl) Type text in the Dislimer (Optionl) text ox. If you do not speify ny text, the Horizon FLEX Client does not disply dislimer text when user downlods the Horizon FLEX virtul mhine. 11 Clik OK to register the soure virtul mhine s Horizon FLEX imge. 12 (Optionl) Type the imge URL in We rowser to verify the URL. For exmple: You should e prompted to sve the file. If you reeive permissions error, you might need to djust the NTFS permissions for the downlod folder. Wht to do next Add poliies to the Horizon FLEX imge. See Configure Poliy for Horizon FLEX Imge, on pge 33. Creting Poliies nd Entitlements You use poliies to set n expirtion dte nd ontrol the fetures in virtul mhine instnes reted from Horizon FLEX imge. You use entitlements to llow speifi users nd groups to rete virtul mhine instnes from prtiulr Horizon FLEX imge. You ssoite poliy with eh entitlement tht you rete. This poliy defines the defult restrition settings for the virtul mhine instnes reted from the Horizon FLEX imge in the entitlement. You n inlude the sme Horizon FLEX imge in multiple entitlements, nd you n ssoite eh entitlement with different poliy. The sme user n e memer of multiple entitlements. When user retes virtul mhine instne from n entitlement, the instne inherits the most restritive poliy settings of ll the entitlements of whih the user is memer. When virtul mhine instne is reted, the poliies ssoited with entitlements determine the instne's initil restritions. As n dministrtor, you n hnge the restrition settings for prtiulr virtul mhine instne. Instne-speifi restritions t s the de fto restritions for speifi user nd virtul mhine omintion. For informtion out editing restritions for virtul mhines, see Mnge Horizon FLEX Virtul Mhines, on pge VMwre, In.

33 Chpter 4 Creting nd Deploying Horizon FLEX Virtul Mhines Configure Poliy for Horizon FLEX Imge You onfigure poliies to set n expirtion dte nd ontrol the fetures in virtul mhine instnes reted from Horizon FLEX imge, inluding USB devie use nd opy nd pste opertions. IMPORTANT If the USB devie use, drg nd drop, nd opy nd pste fetures re enled in the soure virtul mhine, you n onfigure poliy to enle or disle these fetures when users downlod n instne of the virtul mhine. If these fetures re disled in the soure virtul mhine, you nnot override the virtul mhine settings y enling the fetures in poliy. You selet the poliy to ssign to Horizon FLEX imge when you entitle the imge to users. You n use the sme poliy in multiple entitlements. 1 Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 2 Clik Poliies in the left nvigtion pne. 3 Clik the New (+) utton to dd new poliy, or selet n existing poliy nd lik Edit to modify it. 4 Type nme for the poliy in the Poliy Nme text ox. 5 (Optionl) Type desription for the poliy in the Desription text ox. 6 In Generl Restritions, onfigure virtul mhine restritions. Option Expirtion dte Use of USB devies Copy nd Pste opertions Drg nd Drop opertions Require the user to hnge the power on pssphrse when moving or opying the virtul mhine Ation Use the lendr widget to set n expirtion dte for the virtul mhine. Speify whether to llow the use of USB devies in the virtul mhine. Speify whether to llow opy nd pste opertions in the virtul mhine. Speify whether to llow drg nd drop opertions in the virtul mhine. Speify whether to require users to hnge the enryption pssword if they move or opy the virtul mhine. 7 (Optionl) In End User Messges, onfigure virtul mhine expirtion settings. Type messge to disply to the user when the virtul mhine expires. Selet the Disply this messge hek ox, selet the numer of dys efore the virtul mhine expires to disply ustom messge, nd type the ustom messge text. VMwre, In. 33

34 VMwre Horizon FLEX Administrtion Guide 8 In Server Settings, onfigure Horizon FLEX server settings. Option FLEX Server URL Server Contt Frequeny Offline Time Limit Ation Type the URL of the Horizon FLEX server tht hosts the virtul mhine pkge. For exmple: IMPORTANT Do not dd /rvm to the end of the URL. Selet the frequeny with whih the virtul mhine ontts the server for synhroniztion. Set the numer of dys tht users n use the virtul mhine efore the virtul mhine must onnet to the Horizon FLEX server. When the offline time limit is exeeded, the virtul mhine must onnet to the Horizon FLEX server efore it n power on. 9 Clik OK to sve the poliy. The new poliy ppers in the poliy list. Wht to do next Entitle the Horizon FLEX virtul mhine. See Entitle Horizon FLEX Imge, on pge 34. Entitle Horizon FLEX Imge You use entitlements to llow speifi users nd groups to rete virtul mhine instnes from prtiulr Horizon FLEX imge. Users n downlod ny Horizon FLEX virtul mhine to whih they re entitled. Users re not required to enter pssword efore they downlod Horizon FLEX virtul mhine. All soure virtul mhines must e reted with n enryption pssword. Users nnot use Horizon FLEX virtul mhine without providing the enryption pssword. You n shre the enryption pssword with users t your disretion. Prerequisites Mke sure the pproprite Ative Diretory users nd groups re synhronized in the Horizon FLEX dtse. See Configure Ative Diretory Settings, on pge 16. Register the soure virtul mhine with the Horizon FLEX Poliy Server. See Register Soure Virtul Mhine with the Horizon FLEX Poliy Server, on pge 31. Configure poliy for the Horizon FLEX imge. See Configure Poliy for Horizon FLEX Imge, on pge Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 2 Clik Entitlements in the left pne. 3 Clik the New (+) utton to rete new entitlement, selet n existing entitlement nd lik Edit to modify it, or selet n existing entitlement nd lik Duplite to duplite it. 34 VMwre, In.

35 Chpter 4 Creting nd Deploying Horizon FLEX Virtul Mhines 4 Type nme for the entitlement in the Entitlement Nme text ox, selet Horizon FLEX imge to dd to the entitlement, nd lik Next. You n use the serh field to filter the list of Horizon FLEX imges. If you duplite n existing entitlement, you must renme the duplite entitlement efore sving it. 5 Selet the Ative Diretory users nd groups to inlude in the entitlement. Use the serh field to find nd selet users nd groups to dd to the entitlement. Newly reted Ative Diretory users nd groups n tke up to 15 minutes to pper in serh results. Clik Add to dd user or group to the Entitlement Memers list. You n use the Remove or Cler All uttons to mnge the list of memers. Clik Next. 6 Selet poliy for the entitlement nd lik Next. You n use the serh field to filter the list of poliies nd the Cler Filter nd Show Filter uttons to mnge your serhes. 7 (Optionl) To use virtul mhine nming pttern, selet the Use mhine nme onfigurtion hek ox nd onfigure the nming pttern. Type the mhine nme pttern to use in the Mhine Nme Pttern text ox. To ensure tht eh virtul mhine reeives different nme nd n join the domin, inlude the {usernme} pleholder. This pleholder is repled y the individul user's nme when the user downlods the virtul mhine. For exmple, if the nme pttern is vm-{usernme}, nd user1 downlods the virtul mhine, the virtul mhine nme is hnged to vm-user1. The mhine nme is limited to 15 hrters. Selet domin nme from the Domin Nme drop-down menu. (Optionl) Type n OU in the Orgniztionl Unit text ox, or leve the text ox lnk to use the defult OU. For exmple: OU=hr1, OU=hr, OU=flex, DC=ws, DC=test, DC=om VMwre, In. 35

36 VMwre Horizon FLEX Administrtion Guide 8 (Optionl) If you instlled the Mirge lient in the virtul mhine, selet whether to mnge the virtul mhine with Mirge. Option Use VMwre Mirge for disster reovery nd Imge mngement senrios Use VMwre Mirge for disster reovery senrios Do not use VMwre Mirge to mnge the virtul mhines Desription Selet this option to selet CVD poliy, se lyer, n pps lyer, nd other onfigurtions. The Mirge server utomtilly retes CVD for virtul mhines the end user downlods. Mirge periodilly synhronizes end-user dt into the dtenter sed on the seleted Mirge poliy. In the min Mirge Mngement Console, you n use this dt to restore the CVD or ess files on the virtul mhine y using the Mirge File Portl. The Mirge server lso utomtilly deploys se nd pp lyers to the virtul mhine fter it hs een provisioned to ensure imge ompline nd remote pp delivery. Selet this option to selet CVD poliy. The Mirge server utomtilly retes CVD for virtul mhines the end user downlods. You n use this dt to restore the CVD or ess files on the virtul mhine y using the Mirge File Portl in the min Mirge Mngement Console. Selet this option to opt out of mnging the virtul mhine with Mirge. NOTE If you delete virtul mhine in whih the Mirge lient is instlled, the Mirge server utomtilly rhives the CVD of the deleted virtul mhine. 9 Clik Next nd review the settings of the entitlement. 10 Clik Finish to sve the entitlement, or lik Bk to return to the previous pge nd edit the entitlement. Crete URI to Deploy Horizon FLEX Virtul Mhine You n deploy Horizon FLEX virtul mhine y reting uniform resoure identifier (URI). Using URI, you n rete n emil tht ontins link tht the end user n lik to onnet to server nd downlod Horizon FLEX virtul mhine. Prerequisites Give the user pssword for the server nd the enryption pssword for the virtul mhine. 1 Construt URI for the end user. A URI hs the following struture: vmwre-rvm://[email protected]:7443 usernme is the user's login nme nd myserver.om is the hostnme of the server. You must inlude vmwre-rvm:// nd :7443 in the server ddress. Do not inlude http or https in the server ddress. 2 Type link text in n emil nd enter hyperlink informtion for the URI. You n use ny emil system to send the link. However, euse the formt of the URI is not reognized s stndrd URL, you must mnully enter the hyperlink informtion. For exmple, to inlude the link in n emil in Mirosoft Outlook, perform these steps. Crete n emil for the user nd type some link text. For exmple: Your Horizon FLEX virtul mhine Highlight the link text, right-lik the highlighted text, nd selet Hyperlink. 36 VMwre, In.

37 Chpter 4 Creting nd Deploying Horizon FLEX Virtul Mhines d Selet Link to: Existing File or We Pge. Type the URI in the Address field. For exmple: vmwre-rm://[email protected]:7443 The link is now tive. e f Clik OK. Send the emil to the user. When the user liks the link in the emil, the user's Horizon FLEX Client strts nd the server onnetion dilog ox opens. The server nd user nme text oxes re prepopulted with the vlues you speified in the URI. The user enters pssword nd onnets to the server to downlod virtul mhine. Mnge Horizon FLEX Virtul Mhines You n view the inventory of deployed Horizon FLEX virtul mhines in the Horizon FLEX Admin Console. You n use the Serh field to filter the virtul mhine list nd the sortle olumn hedings to find speifi virtul mhine. The olumn heding drop-down menu enles you to selet the olumns to view or hide. When you selet virtul mhine in the list, you n expnd the Properties window t the ottom of the pge to view generl settings for the virtul mhine nd poliies pplied to the virtul mhine. 1 Lunh the Horizon FLEX Admin Console. In We rowser, type where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Type the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 2 Clik Virtul Mhines in the left nvigtion pne. The inventory of deployed Horizon FLEX virtul mhines ppers on the Virtul Mhines pge. 3 To mnge speifi virtul mhine, selet the virtul mhine in the list. Option Edit Lokout Retivte Arhive Delete Ation Selet virtul mhine nd lik Edit to hnge the poliies ssigned to this virtul mhine. Selet virtul mhine nd lik Lokout to revoke user ess to the speifi virtul mhine. Selet n expired or loked-out virtul mhine nd lik Retivte to reset the virtul mhine. Selet virtul mhine nd lik Arhive to disle the virtul mhine for use nd keep n offline reord of the virtul mhine. Chek the Disply rhived instnes ox t the ottom of the Virtul Mhines pge to view virtul mhines tht hve een rhived. You n lik Retivte to enle n rhived virtul mhine. Selet n rhived virtul mhine nd lik Delete. You nnot delete virtul mhine tht hs ny other sttus thn Arhived. VMwre, In. 37

38 VMwre Horizon FLEX Administrtion Guide 4 To determine the tions you n tke for virtul mhine, view the virtul mhine sttus in the Sttus olumn. Sttus Ative Intive Expired Pending Expired Loked Out Pending Lokout Pending Retivte Downloding Requires Downlod Arhived Domin Join Fil Desription The virtul mhine is use, hs ontted the server, nd hs not expired. The Horizon FLEX Client tht the user used to open the virtul mhine hs filed to ontt the server for longer thn the offline working poliy period. The expirtion dte hs een rehed nd the virtul mhine hs een turned off. The server is witing for onfirmtion from the Horizon FLEX Client tht the virtul mhine is expired. An dministrtor hs loked out the user of the virtul mhine. A lok out hs een initited. The sttus remins Pending until the Horizon FLEX Client onfirms the virtul mhine hs een loked out. The server is witing for onfirmtion from the Horizon FLEX Client tht the virtul mhine is retivted. The user is downloding the virtul mhine. The user deleted the virtul mhine fter downloding it. Beuse the user's Horizon FLEX Client will never reuse this instne of the virtul mhine, you should rhive or delete the virtul mhine. If the user downlods new version of the virtul mhine, the Horizon FLEX Client will downlod new virtul mhine tht hs different nme. The virtul mhine hs een rhived. NOTE You must selet the Disply rhived instnes hek ox to view rhived virtul mhines. The virtul mhine filed to join domin. The most ommon reson why virtul mhine might fil to join domin is tht the ojet lredy exists in Ative Diretory. In this se, hek the offline domin join log, whih is mintined y the operting system, to determine how to solve the filure. 38 VMwre, In.

39 Index A Ative Diretory 16, 30, 34 rhiteture 8 rhiving virtul mhines 37 C ertifites 19, 20, omponents 7 opy nd pste 33 D deleting virtul mhines 37 deployment overview 27 domin join 30 downlod folder 15 drg nd drop 33 E editing virtul mhines 37 emil link 36 enryption settings 28 entitlements 34 EULA 31 expirtion dte 33 expired ertifites 22 exporting ertifites 20, 21 G glossry 5 guest operting systems 10 H Horizon FLEX Admin Console 16 host operting systems 10, 17 I IIS virtul diretory 15 imge URL 31 instlltion overview 13 instlling Fusion Pro 17 intended udiene 5 internl CA ertifites 23, 24 introdution 7 K Keyhin Aess 20, 24 L loking out virtul mhines 37 M M ertifites 20, 24 mhine nme onfigurtion 34 mss deployment feture 18 memory requirements 17 Mirge 8, 14 Mirge lient 29 N network requirements 10 O orgniztionl units 16 P PEM formt 20, 21 poliies 33 poliies nd entitlements 32 poliy server 31 proessor requirements 17 R retivting virtul mhines 37 restrition settings 28 RVM Setup Servie 30 S self-signed ertifites 22, 23 soure virtul mhines 27, 28, 31 sttus vlues 37 system requirements 9, 17 T TAR file 30 terminology 7 trusted ertifites list 19, 21 U unttended Plyer Pro instlltion 18 VMwre, In. 39

40 VMwre Horizon FLEX Administrtion Guide URI formt 36 USB settings 33 V virtul mhine pkge 30 VMwre RVM Setup Servie 30 VMwre Tools 30 W Windows ertifites VMwre, In.