نظرة بعمق

Horizon View Desktop Sessions & Application Advanced Load Balancing

2020-08-06T08:29:00.004+02:00

In this article, I am going to discuss in details the proper ways for load balancing your published (Desktop Sessions) and (Applications). So, I assume that you have installed and configured the RDSH role and the farms has been created. Not only this, but also have entitled users for (Desktop Sessions) and (Applications). So, I am directly going to demonstrate the approach which is based on (CPU utilization) or (Memory consumption) rather that the number of available sessions in each individual host (Server).

I will start by enabling the (Horizon Script Feature) in the RDSH server. The required script file for either CPU utilization or Memory consumption-based load balancing, can be found after installing (Horizon Agent) in the RDSH server in the following path: (C:\Program Files\VMware\VMware View\Agent\scripts)

Eventually, I will configure the system registry to run the required script.

01- Through web browser, navigate to (Horizon Connection Server) console URL

02- From the right panel, click on (Dashboard)

03- From (System Health) panel, expand (RDS Farms) -> click on your RDSH server. You will be redirected to the following window:

• You will notice that (Max number of connections) is (150), and this means that your RDSH server will not accept any more (Desktop) or (Application) sessions after reaching 150 concurrent sessions whatever the physical/virtual server load status at this point.

• You will notice that (Server load) is (Load not reported), and this means that your RDSH server is not configured for and load balancing method.

04- Navigate to (RDSH) server.

05- Install (Horizon Agent).

06- Navigate to: (C:\Program Files\VMware\VMware View\Agent\scripts)

• You can’t use the two listed scripts in the same time.

• Use (cpuutilisation) for RDSH-based CPU load balancing.

• Use (memoryutilisation) for RDSH-based CPU load balancing.

07- Open (Services) as an Administrator then, navigate to (VMware Horizon View Script Host):

08- Right click (VMware Horizon View Script Host) then choose Properties:

09- From (General) tap, navigate to (Startup type) -> (Automatic)

10- Click (Apply) then, click (Start) to start the service. Finally click (Ok).

Now we have started (VMware Horizon View Script Host) service, the next step is the choosing of the proper script that will be passed to (Horizon Agent) then (Horizon Agent) will pass it to (Horizon Connection Server).

11- Open (Registry Editor) as an Administrator then, navigate to the following path: (Computer\HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware VDM\ScriptEvents\RdshLoad)

12- From the left panel, right click and select (New) -> (String Value):

13- Give the value a new name based on the type of script you chose:

• Name it (CPU) if you chose (cpuutilisation) script for RDSH-based CPU load balancing.

• Name it (memoryutilisation) if you chose (memoryutilisation) script for RDSH-based CPU load balancing.

14- Right click the (String Value) you have created then, click (Modify)

15- In (Value data), enter the proper path for selected script:

• If you chose (cpuutilisation) script for RDSH-based CPU load balancing, type: cscript.exe “C:\Program Files\VMware\VMware View\Agent\scripts\cpuutilisation.vbs”

• If you chose (memoryutilisation) script for RDSH-based CPU load balancing, type: cscript.exe “C:\Program Files\VMware\VMware View\Agent\scripts\memoryutilisation.vbs”

16- Click (Ok).

17- Again, open (Services) as an Administrator then, navigate to (VMware Horizon View Agent) service:

18- Right click (VMware Horizon View Agent) service then, select (Restart):

19- Now, navigate to (Horizon Connection Server) console URL.

20- From the right panel, click on (Dashboard).

21- From (System Health) panel, expand (RDS Farms) -> click on your RDSH server. You will be redirected to the following window:

• If you have already chose (cpuutilisation) script for RDSH-based CPU load balancing then, the result will be:

• You will notice that (Server load) is (Light load, new sessions okay), so that is based on the CPU cycle as the Horizon View is looking at the amount of CPU utilization and decide if it has enough capacity to host additional sessions or not.

• If you have already chose (memoryutilisation) script for RDSH-based CPU load balancing, the result will be:

• You will notice that (Server load) is (Heavy load, new sessions avoided), which basically means that we have got few sessions running on that host and based on the memory utilization, it calculated that it won’t take any new sessions.

Want to download this blog as a PDF document, click the link below:

https://drive.google.com/file/d/1jKRkxfQOq2lX1H_0y7f1hkIzXVpcqvcX/view

Abd El-Rahman Oreiby

Senior Data Center Engineer

Al Thuraya Security Egypt

www.abdelrahmanoreiby.weebly.com

Horizon View Installation & Configuration - Part 12 - VMware Horizon 7 Port Mapping

2020-08-06T07:46:00.002+02:00

Want to download this blog as a PDF document, click the link below:

https://drive.google.com/file/d/10xnYctZ6K1NQxokYnfavXxojY-XFr-et/view

Abd El-Rahman Oreiby

Senior Data Center Engineer

Al Thuraya Security Egypt

www.abdelrahmanoreiby.weebly.com

Horizon View Installation & Configuration - Part 11 - Bind a New TLS Certificate to the Port Used by View Composer

2020-08-06T07:41:00.001+02:00

If you configure a new TLS certificate after you install View Composer, you must run the SviConfig ReplaceCertificate utility to replace the certificate that is bound to the port used by View Composer. This utility unbinds the existing certificate and binds the new certificate to the port.

About this task

If you install the new certificate on the Windows Server computer before you install View Composer, you do not have to run the SviConfig ReplaceCertificate utility. When you run the View Composer installer, you can select a certificate signed by a CA instead of the default, self-signed certificate. During the installation, the selected certificate is bound to the port used by View Composer.

If you intend to replace an existing certificate or the default, self-signed certificate with a new certificate, you must use the SviConfig ReplaceCertificate utility.

Prerequisites

Verify that the new certificate was imported into the Windows local computer certificate store on the Windows Server computer on which View Composer is installed.

Procedure

1- Stop the View Composer service.

2- Open a command prompt on the Windows Server host where View Composer is installed.

3- Navigate to the SviConfig executable file.

The file is located with the View Composer application. The default path is

C:\Program Files (x86)VMwareVMware View Composersviconfig.exe.

4- Type the SviConfig ReplaceCertificate command.

For example

sviconfig -operation=ReplaceCertificate -delete=false/true

*Where -delete is a required parameter that operates on the certificate that is being replaced. You must specify either -delete=true to delete the old certificate from the Windows local computer certificate store or -delete=false to keep the old certificate in the Windows certificate store.

The utility displays a numbered list of TLS certificates that are available in the Windows local computer certificate store.

5- To select a certificate, type the number of a certificate and press Enter.

6- Restart the View Composer service to make your changes take effect.

Want to download this blog as a PDF document, click the link below:
https://drive.google.com/file/d/1tdFSOwNSHTjGC3jvynSNyiSOs7c5Fv16/view

Abd El-Rahman Oreiby

Senior Data Center Engineer

Al Thuraya Security Egypt

www.abdelrahmanoreiby.weebly.com

Horizon View Installation & Configuration - Part 10 - Configuring View Connection Server SSL Certificate

2020-08-06T07:34:00.000+02:00

VMware Horizon View Connection Server SSL Certificate (auto-signed) isn't valid and you find yourself with a nice error when you open the VMware view administration web console. It says that the certificate is untrusted and that you have to install a valid (not a self-signed) SSL on this server.

So, you'll have a valid certificate. You have two options:

1. Commercial certificate

2. Self-signed certificate with Microsoft certification authority, which you can add as a role to one of your VMs in your domain.

VMware recommends using valid SSL certificates issued by a valid Certificate Authority (CA) like a public CA such as GoDaddy, Verisign, etc. When you plan your View deployment, you should know if you'll be using any non-domain joined devices and (or) if there will be some mobile devices. If there will be, you have to make sure that all the non-domain PCs you use to connect to your View desktops did the import of the CA Root certificate into the Trusted Root Certification Authorities store.

Using SAN certificate (Subject alternative names) might also be the way to go if you planning large View deployment with more than one connection server.

Screenshot from the Dashboard without an option to accept the default self-signed certificate for Horizon View Connection Server.

Create Certificate Template with Active Directory Certificate Services. (AD CS)

First, install the role and reboot the server. In my case I'm using Windows Server 2012 AD CS, but you can also use W 2008 or 2003 depending on your environment.

Launch the AD CS console and right click the “Certificate Templates” > and then Manage > to bring up the second console called “Certificate Templates. Check the screenshot below.

Once done click the Duplicate Template on a Web server template. We're doing this to obtain an option to request web server certificate in addition to the only one default option – computer. You should also:

• create a security group (I called mine view-servers) in your AD and put your View connection server in this group. Add this
group to the Security Tab on the properties of the new template and give this group a Write and Enroll permission, in
addition to the default read permission.

• As a compatibility, I've selected 2003

• Allow private key to be exported

• Add client authentication to the list

• 50 years of validity

• 4096 as an encryption

Then, expand the base certificate console, click the menu Actions > New > Certificate Template to issue.

• Now go to your View connection server > launch new mmc and add/remove new snap-in for local computer account.

• local computer

• Launch the console and select Certificates > Request new certificate

Then follow the assistant, click on the More Information is required to enroll for this certificate…and enter the common name that you want to use.

• Enter the DNS details

• General tab needs to have “vdm” as a friendly name

Click enroll…And check the view admin dashboard for results…

Then go and export the created certificate from the Personal > certificates folder.

Save the file with some name with *.cer extension.

Once you have the file, you'll need then to import the certificate into a Trusted Root certificate store:

· Don’t forget to import the certificate you have created and the Root CA of your domain to every pc or mobile device you want to secure its connection with Horizon View Connection Server.

· Don’t forget to delete the original self-signed certificate created by the Horizon View Connection Server.

Want to download this blog as a PDF document, click the link below:

https://drive.google.com/file/d/1DOCom_SskcMIXiKoOOnlA9TjzX9-5Pwp/view

Abd El-Rahman Oreiby

Senior Data Center Engineer

Al Thuraya Security Egypt