:::: MENU ::::


  • Dec 13 / 2021
  • 0
9.x, DaaS, Uncategorized, VMware

Workaround instructions to address CVE-202144228 in Horizon DaaS 9.0.x and 9.1.x

VMware has released new a critical security advisory, VMSA-2021-0028. This advisory is for multiple VMware products that use the popular open-source log4j Java logging component, which was discovered to have a critical vulnerability in it (CVE-2021-44228)

This needs your immediate attention, not just at the VMware product level, but also for all other software in your environment. The log4j component is used by many vendors and software packages. For more information about the VMware products please visit https://www.vmware.com/security/advisories/VMSA-2021-0028.html

For Horizon DaaS 9.0.x and Horizon DaaS 9.1.x. a workaround is provided in the form of a hotfix. The hotfix should be applied to remediate the CVE-2021-44228.

Continue Reading
  • Sep 07 / 2021
  • 1
NSX-T, VMware

Load Balancing UAG’s with NSX-T

Unified Access Gateway for end-user computing products and services needs high availability for Workspace ONE and VMware Horizon on-prem deployments. Unified Access Gateway appliances work with standard third-party load balancing solutions that are configured for HTTPS and also has an out-of-the-box High Availability solution. The out-of-the-box HA solution will reduce complexity and lower your TCO but it comes with the following limitations.

  • IPv4 is supported for floating Virtual IP address. IPv6 is not supported. 
  • Only TCP high availability is supported. 
  • UDP high availability is not supported. 
  • With the VMware Horizon use case, only XML API traffic to Horizon Connection Server uses high availability. High availability is not used to distribute load for the protocol (display) traffic such as Blast, PCoIP, RDP. Therefore, the individual IP addresses of Unified Access Gateway nodes must also be accessible to VMware Horizon clients in addition to the Virtual IP address.

To overcome some of the limitations you can use NSX-T Data Center logical load balancer as a load balancing solution in front of the UAG’s.

In this blog post, I would like to show you how to configure a load balancer for UAG’s in NSX-T in front of a Horizon environment.

Continue Reading
  • Jun 29 / 2021
  • 1
9.x, DaaS, EUC, Horizon, vExpert, VMware

Domain-Join account Horizon DaaS 9.x

For Horizon DaaS the Tenant environment needs 2 types of domain service accounts. A domain bind account that is used to perform lookups in your AD domain and a domain join account that is used for joining computer accounts to the domain and performing Sysprep operations.

The domain bind account is rather simpel. Just create a normal user account, provide a password and if the CISO allows you, set the password to never expire.

The domain join account is a little bit different. If you you want to do it quick and dirty you can make the account domain admin and set the password to never expire and you’re done. This however is not recommended. So we need to do delegation of control on the OU where the computer accounts will be created. The following “allow” permissions are needed for Horizon DaaS 9.1 tenants:

Continue Reading
  • Feb 11 / 2021
  • 0
DaaS, Horizon, Rundeck, VMware

Replacing the Horizon Version Manager and Horizon Air Link appliances

With the release of Horizon DaaS 9, VMware introduced two new appliances the Horizon Version Manager (HVM) and the Horizon Air Link (HAL). The HVM is the automation appliance, based on Rundeck automation. The HAL is the resource manager for the management appliances. With the release of a new version of Horizon DaaS 9, these two appliances must be replaced if a new version is available. Because VMware is always innovating they are adding new features, scripts, and codebases to every new version it would be advised that if you are in the process of installing a new version of Horizon DaaS to make sure you are using the correct version. Check if an updated version of the HVM and HAL is available at my VMware.

Below I will explain how to replace the appliances and assign it to the Horizon DaaS environment.

Continue Reading
  • Jan 22 / 2021
  • 0
DaaS, Instant-Clone, vSphere

Instant-Clone Clean-up

An instant-clone desktop pool is an automated desktop pool created from a golden image using the vmFork technology (called instant clone API) in vCenter Server.

Instant clone technology replaces View Composer linked clone as the process for creating non-persistent desktops in Horizon. In addition to using the instant clone API from vCenter Server, Horizon also creates several types of internal VMs (Internal Template, Replica VM, and Parent VM) to manage these clones in a more scalable way.

Sometimes it happens that when an Instant-Clone desktop and image is removed the internal VMs are not removed completely. From Horizon 7.11 and newer VMware introduced a tool called IcCleanup.cmd which is located in the C:\Program Files\VMware\VMware View\Server\tools\bin directory. This utility can be used to unprotect and delete some or all of the internal VMs created by instant clones. Below I will explain how to use the utility to delete some of the internal VMs left behind.

Instant-Clone Smart Provisioning

With latest major version of VMware Horizon, VMware introduced Instant-Clone Smart Provisioning. Horizon automatically chooses to provision instant clones directly from the replicaVM without creating any parentVM. This is a big advantage with the older Instant-Clone.

Continue Reading
  • Oct 26 / 2020
  • 1
9.0.1, DaaS

Horizon DaaS 9.0.1 upgrade

This week Horizon DaaS 9.0.1 hotfix has been released. With this release, Horizon DaaS is a step closer to aligning with Horizon Cloud 20.2.0. The hotfix is available for download on My VMware. This version includes the following:

  • Enhanced installation functionality, including new automation for domain bind and compute assignment.
  • Support for Horizon Agent Installer (HAI) 20.3.
    • Adds Horizon Agent 7.13 capabilities.
    • Microsoft Teams plug-in support.
  • Security fixes for issues found in Horizon DaaS 9.0.0.
  • Deleting a virtual machine with a canceled pool expansion task failed.
  • Power operations are not supported for utility VMs.
  • Daylight Saving Time issue on Utilization Report.
  • Triple nesting in AD groups is not handled properly.
  • The API desktopmanagersbydatacenter is taking too long to respond.
  • Tenant desktop capacity quota edit failure.
  • Compute resource edit failure.

Full release notes can be found here: Horizon DaaS 9.0.x Release Notes

In this post I will explain how to install this hotfix using the HVM (Horizon Version Manager) appliance.

Continue Reading
  • May 27 / 2020
  • 1
Verify, VMware, Workspace ONE

Adding VMware Verify to VMware Workspace ONE Access

My colleague Arno Meijroos wrote a nice blog on “How to integrate Horizon DaaS 9.0 with Workspace ONE Access“. In extent on his blog, I want to explain how to add Vmware Verify for two-factor authentication (2FA).

VMware Verify

You can use the Verify app to secure login to VMware Workspace ONE and other apps. The Verify app is available for iOS, Android, and Chrome. It uses modern mobile push tokens, where users get a push notification on their mobile device that they can simply accept or deny. When the user’s device does not have cellular reception, such as in airplane mode when traveling, the user can open the Verify app and use a one-time passcode (aka soft token). Also a one-time passcode via SMS is available.

Continue Reading
  • Jan 14 / 2020
  • 0
CIS, Microsoft, Performance Testing, Uncategorized

Impact of CIS Benchmarks on performance

During a VMWare Horizon Cloud project, the customer had the following wishes. The workspace needed fast and secure. Security is almost always at the expense of performance.

Because the customer wanted us to align with the CIS Level 1 benchmark for the Windows OS. We wanted to see what kind of impact the CIS benchmark had on the performance. In order to make de impact visible, we did a performance test with Login VSI.

Continue Reading