Horizon Cloud Administration Guide For service level starting MAR 21, 2019 VMware Horizon Cloud Service Horizon Cloud Administration Guide You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/ If you have comments about this documentation, submit your feedback to [email protected] VMware, Inc. 3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com Copyright © 2016–2019 VMware, Inc. All rights reserved. Copyright and trademark information. VMware, Inc. 2 Contents About This Horizon Cloud Administration Guide 7 1 Introduction to Horizon Cloud 10 End-to-End Workflow When Your Very First Cloud-Connected Pod is from Deploying into VMware Cloud 12 End-to-End Workflow When Your Very First Cloud-Connected Pod is from Connecting Horizon Cloud with an Existing Manually Deployed Horizon 7 Pod 12 Suggested Workflow for When Your Very First Cloud-Connected Pod is from Deploying into Microsoft Azure 14 2 Getting Started Using Your Horizon Cloud Environment 18 Performing Your First Active Directory Domain Registration in the Horizon Cloud Environment 20 Service Accounts That Horizon Cloud Requires For Its Operations 29 Locating the Information Required for the Register Active Directory Workflow's NETBIOS Name and DNS Domain Name Fields 32 Horizon Cloud Support for Active Directory Domain Controllers That Have LDAP Server Signing Requirements 34 Log in to the Horizon Cloud Administration Console 35 Give Administrative Access to People in Your Organization 36 Register Additional Active Directory Domains as Cloud-Configured Active Directory Domains 38 Add Additional Auxiliary Bind Accounts for a Cloud-Configured Active Directory Domain 43 Assign Horizon Cloud Administrative Roles to Active Directory Groups 44 Join or Leave the Customer Experience Improvement Program 46 Remove the Active Directory Domain Registration 47 Upgrade Horizon 7 Cloud Connector Virtual Appliance 49 Troubleshoot the Horizon 7 Cloud Connector Virtual Appliance Upgrade 50 3 Unified Visibility, Health Monitoring, and Help Desk Operations Using the Horizon Cloud Administration Console 51 Tour of the Horizon Cloud Administration Console 51 Dashboard Page 53 Capacity Page 57 Deploying Pods Using the Capacity Page 62 Help Desk Features in Your Horizon Cloud Environment 104 Using the Console's Search Feature 105 The User Card in the Horizon Cloud Administration Console 106 VMware, Inc. 3 Horizon Cloud Administration Guide 4 Introduction to Horizon Cloud Pods in Microsoft Azure 110 Creating Desktop Images for a Horizon Cloud Pod in Microsoft Azure 116 Create a Master Virtual Machine Automatically from the Microsoft Azure Marketplace 118 Customize the Master Image VM's Windows Operating System 129 Install NVIDIA Graphics Drivers in a GPU-Enabled Master Image 135 Convert a Configured Master Virtual Machine to an Assignable Image 137 Manually Build the Master Virtual Machine in Microsoft Azure 139 Install the User Environment Manager Agent in the Master Virtual Machine 166 Using Microsoft Azure Disk Encryption with Your Farms and VDI Desktops 168 Using Data Disks with Virtual Desktops from a Horizon Cloud Pod in Microsoft Azure 171 Setting Up a Data Disk for a Master Image VM 173 VMware NSX Cloud and Horizon Cloud Pods in Microsoft Azure 179 Install the NSX Agent in the Master Image 182 Firewall Rules Required in NSX Manager for Pod-Provisioned VMs 185 Add the Required Forwarding Policy in NSX Manager for the Pod-Provisioned VMs 186 Farms in Horizon Cloud 187 Create a Farm 187 Managing Farms in Horizon Cloud 198 Example of Farm Rolling Maintenance 203 Applications in Your Horizon Cloud Inventory 204 Importing New Applications from an RDSH Farm Using Auto-Scan from Farm 205 Manually Adding Custom Applications from an RDSH Farm 206 Create a Remote Application Assignment 207 Creating Desktop Assignments in Horizon Cloud 209 Types of Desktop Assignments 209 Create an RDSH Session Desktop Assignment 211 Create a Floating VDI Desktop Assignment 212 Create a Dedicated VDI Desktop Assignment 222 Create a URL Redirection Customization and Assign it to Users 231 Understanding What URL Content Redirection Is 234 Configuring Agent-to-Client Redirection 235 Managing Assignable Images 238 Actions You Can Perform on Assignable Images 239 Change RDS-Enabled Images Used for Farms 242 Change Images Used for VDI Desktop Assignments 244 Managing Assignments 246 View an Assignment 250 Edit an Assignment 251 Delete an Assignment 252 Resizing a VDI Desktop Assignment 253 About Network Security Groups and Your VDI Desktops 254 VMware, Inc. 4 Horizon Cloud Administration Guide Updating the Agent-Related Software Used by Horizon Cloud 256 Update Agent Software for RDSH Images 256 Update Agent Software for Dedicated VDI Desktop Assignments 260 Update Agent Software for Images Used by Floating VDI Desktop Assignments 268 Update the User Environment Manager Agent Software in Images 272 Managing Your Pods Deployed in Microsoft Azure 274 Obtain the Pod's Load Balancer Information to Map in your DNS Server 275 Upload SSL Certificates to a Horizon Cloud Pod for Direct Connections 277 Update the Subscription Information Associated with Deployed Pods 279 Examine a Subscription's Current Usage of Your Microsoft Azure Limits 279 Updating Your Horizon Cloud Pod 281 Backup and Restore Service for Pods in Microsoft Azure 285 Change the Horizon Cloud Pod's NTP Setting 285 Change the FQDN and Certificate Used for the Pod's Unified Gateway Configuration 286 Add a Unified Access Gateway Configuration to a Pod, With or Without Two-Factor Authentication 287 Removing a Subscription Entry 293 Convert a Certificate File to the PEM Format Required for Pod Deployment 294 Horizon Cloud DNS, Ports, Protocols Requirements 297 Integrate a Horizon Cloud Pod in Microsoft Azure with a VMware Identity Manager™ Environment 307 Configure a Pod in Microsoft Azure for VMware Identity Manager™ 311 Confirm End-User Access to Desktop Assignments in VMware Identity Manager™ 313 Configure True SSO for Use with Your Horizon Cloud Environment 313 Install and Configure a Windows Server 2012 R2 Certificate Authority 315 Set Up a Certificate Template on the CA 316 Download the Horizon Cloud Pairing Bundle 319 Set up the Enrollment Server 320 Complete Configuring True SSO for your Horizon Cloud Environment 321 End User Connections to Desktops and Applications Provided by Your Horizon Cloud Environment 322 Enable Time Zone Redirection for RDS Desktop and RDS-Based Application Sessions 322 Multiple-Monitor Support for Desktops and Remote Applications Provided By a Horizon Cloud Pod in Microsoft Azure 322 Access Desktops and Applications 324 5 About Menu Selections in the Administration Console 330 About the Monitor Icon 331 Activity Page 332 Reports Page 334 Notifications Page 337 About the Assign Icon 337 About the Inventory Icon 338 Imported VMs Page 339 VMware, Inc. 5 Horizon Cloud Administration Guide About the Settings Icon 340 Edit General Settings 340 Horizon Client Timeout Settings 344 Domain Security Settings on General Settings Page 345 File Share Page 354 Utility VMs Page 354 Identity Management Page 355 About the Horizon Cloud Getting Started Wizard 357 6 Using the Filter Field in the Administration Console 361 7 Troubleshooting for Administrators of Horizon Cloud Environments 363 Cannot Successfully Log In at the First Login Screen of the Administration Console 363 Convert to Image Task Fails with Timeout Error Even After Addressing the Logged Microsoft Windows Sysprep Errors 364 For a Windows Server 2012 Image, Convert to Image Task Fails with Timeout Error 365 Notifications When the Primary Domain-Bind Account is Locked Out 365 New Farm Remains In Progress 366 Windows Error Message Appears When Trying to Connect to a Desktop from a Floating VDI Desktop Assignment 366 Give Feedback Menu Choice Does Not Work 367 Considerations For Using Nested Active Directory Domain Organizational Units 368 Horizon 7 Cloud Connector Known Considerations 368 Set a Password Expiry Policy for the Horizon 7 Cloud Connector Root User 369 When Your Pod is Not Yet Upgraded to this Release, How to Configure the Ability for Domain Accounts to Remote Connect to the Imported Image 370 VMware, Inc. 6 About This Horizon Cloud Administration Guide ® This Administration Guide explains how to use VMware Horizon Cloud Service™ to administer the pods you have connected to this cloud service. The service offers more than one deployment mode. This document applies when you are using the Horizon Cloud Administration Console to work with the following items: n VMware Horizon 7 pods that you installed on-premises and then connected to Horizon Cloud n VMware Horizon 7 pods that you manually installed in your VMware Cloud on AWS SDDC and then connected to Horizon Cloud. n Pods in your Microsoft Azure cloud capacity that you automatically deployed and configured using Horizon Cloud n VMware Horizon 7 pods in your VMware Cloud on AWS software-defined data centers (SDDCs) that were deployed using this release's Tech Preview automated deployer feature. To find out more about all of the various Horizon Cloud deployment modes, see https://www.vmware.com/cloud-services/desktop.html. For information about how VMware handles information collected through this product, click here: https://www.vmware.com/help/privacy.html The information in this document describes how to use the Horizon Cloud capabilities after the cloud service is connected to one of the its supported environments: a VMware Horizon 7 pod in VMware Cloud on AWS, a VMware Horizon 7 pod on-premises, or a pod in Microsoft Azure. For information on how to connect a supported environment to the cloud service, see the Horizon Cloud Deployment Guide. Important This document describes features available in the Administration Console for the current release of the Horizon Cloud Service working with the connected environments. When you have pods that are not yet updated to the currently supported release level, you will not see all of the features that this document describes when those features depend on the latest pod software level. Also, in a particular release, Horizon Cloud might include separately licensed features. The Administration Console reflects the elements related to such features only when your license includes use of such features. When you are not seeing a feature in the Administration Console that you are expecting to see, contact your VMware account representative to verify whether your license entitles your use of that feature. VMware, Inc. 7 Horizon Cloud Administration Guide Document Revision History This document, Horizon Cloud Administration Guide, is updated with each release of the product or when necessary. This table provides the update history. Revision Description 21 MAR 2019 Initial version, when the described features were deployed live into production. For features relating to pods in Microsoft Azure, those features correspond to the software at manifest version 1273 and later. Intended Audience This document is intended for experienced IT system administrators who are familiar with virtual machine technology and datacenter operations. Depending on your organization's needs and the type of pod you are working with, you might find it helpful to be familiar with these software products, software components, and their features: ® n VMware Horizon 7 n VMware Cloud™ on AWS n VMware Unified Access Gateway™ n VMware Identity Manager™ n VMware Workspace™ ONE™ ® n VMware Horizon Client™ ® n VMware Horizon HTML Access™ n Microsoft Azure and its Marketplace n Microsoft Active Directory n VMware User Environment Manager™ About the Screenshots Used in This Document The screenshots typically: n Show only that portion of the overall user interface screen that corresponds to the text at which point the screenshot appears, and not necessarily the full user interface. n Have blurred areas where appropriate to maintain data anonymity. Note Some screenshots are taken at a higher resolution than others, and might look grainy when the PDF is viewed at 100%. However, if you zoom to 200%, those images start to look clear and readable. VMware, Inc. 8 Horizon Cloud Administration Guide Horizon Cloud Community Use the following communities to ask questions, explore answers given for questions asked by other users, and access links to useful information. n VMware Horizon Cloud Service community at https://communities.vmware.com/community/vmtn/horizon-cloud-service n VMware Horizon Cloud on Microsoft Azure sub-community at https://communities.vmware.com/community/vmtn/horizon-cloud-service/horizon-cloud-on-azure, a sub-community of the VMware Horizon Cloud Service community. Contacting VMware Support Contact VMware Support when you need help with your Horizon Cloud environment. ® n You can submit a support request to VMware Support online using your My VMware account or by phone. n KB 2144012 Customer Support Guidelines provides details for getting support depending on the issue encountered. n After you have configured at least one cloud-connected pod, you can submit a support request by logging in to the Administration Console and clicking > Support. VMware Information Experience Glossary VMware Information Experience provides a glossary of terms that might be unfamiliar to you. For definitions of terms as they are used in VMware technical documentation, go to http://www.vmware.com/support/pubs. VMware, Inc. 9 1 Introduction to Horizon Cloud Your overall Horizon Cloud environment consists of the VMware-hosted cloud service, your provided capacity, and VMware software deployed into that capacity and connected to the cloud service. When the VMware software installed in that capacity is appropriately configured and connected to the cloud service, that configured entity is called a pod. For these cloud-connected pods, you use the Horizon Cloud Administration Console for unified visibility, health monitoring, and help desk services. Horizon Cloud A control plane hosted in the cloud by VMware for the central orchestration and management of virtual desktops and applications. cloud-connected pod VMware software deployed into a supported capacity environment and connected to the cloud control plane. Supported capacity environments are ones such as Microsoft Azure cloud or VMware Cloud™ on AWS or on- premises infrastructure. Depending on the type of capacity you are using, you can use the Horizon Cloud Administration Console for an automated pod deployment and connection to Horizon Cloud. For some types of pods, even though they cannot be automatically deployed and configured, you can still connect Horizon Cloud to those pods that already exist. Then you can use the Administration Console with the cloud-connected pods after they are connected. Horizon Cloud Control Plane VMware hosts the Horizon Cloud control plane in the cloud. This cloud service enables the central orchestration and management of virtual desktops, remote desktop sessions, and remote applications for your users. The cloud service also manages your pods. The pods are physically located in your provided capacity environments. When you log in to the cloud service, you can see all of your pods and perform management activities across them, regardless of where they are physically located. VMware is responsible for hosting the service and providing feature updates and enhancements for a software-as-a-service experience. VMware, Inc. 10