VMware Horizon FLEX Administration Guide

Transcription

1 VMwre Horizon FLEX Administrtion Guide Horizon FLEX 1.6 This doument supports the version of eh produt listed nd supports ll susequent versions until the doument is repled y new edition. To hek for more reent editions of this doument, see EN

2 VMwre Horizon FLEX Administrtion Guide You n find the most up-to-dte tehnil doumenttion on the VMwre We site t: The VMwre We site lso provides the ltest produt updtes. If you hve omments out this doumenttion, sumit your feedk to: dofeedk@vmwre.om Copyright 2014, 2015 VMwre, In. All rights reserved. Copyright nd trdemrk informtion. VMwre, In Hillview Ave. Plo Alto, CA VMwre, In.

3 Contents VMwre Horizon FLEX Administrtion Guide 5 1 Introduing Horizon FLEX 7 Horizon FLEX Components 7 Aout Mirge 8 Horizon FLEX Arhiteture 8 Horizon FLEX System Requirements 10 Horizon FLEX Server System Requirements 10 Horizon FLEX Network Requirements 11 Supported Host nd Guest Operting Systems 12 2 Instlling Horizon FLEX 13 Horizon FLEX Instlltion Overview 13 Instlling nd Configuring Mirge Components for Horizon FLEX 14 Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges 15 Set Up Certifite for the Horizon FLEX Server y Using OpenSSL 15 Configure the IIS SSL Server Certifite for the Horizon FLEX Server 16 Configure Ative Diretory Settings 16 Test the Horizon FLEX Admin Console Connetion 17 Instlling the Horizon FLEX Client for End Users 18 Crete Mss Deployment Pkge to Instll Fusion Pro 18 Provide Worksttion Plyer Instlltion Pkge to End Users 18 Run n Unttended Worksttion Plyer Instlltion 19 3 Setting Up Certifites for Horizon FLEX Virtul Mhines 21 Creting Trusted Certifites List 21 Aout the PEM Formt 22 Creting PEM-Formt Certifites 22 Crete nd Import the Trusted Certifites List File 23 Updting Certifites on the Server 24 Using Self-Signed Certifites 24 Instll Self-Signed Certifite on Windows Computer 24 Instll Self-Signed Certifite on M 25 Using Internl CA Certifites 27 Instll n Internl Root CA Certifite on Windows Computer 27 Instll n Internl Root CA Certifite on M 28 4 Creting nd Deploying Horizon FLEX Virtul Mhines 31 Horizon FLEX Virtul Mhine Deployment Overview 31 Crete Soure Virtul Mhine in Fusion Pro 32 Crete Soure Virtul Mhine in Worksttion Pro (Not inluded in Horizon FLEX ) 33 VMwre, In. 3

4 VMwre Horizon FLEX Administrtion Guide Instll the Mirge Client In Soure Virtul Mhine 35 Prepre Soure Virtul Mhine to Join n Ative Diretory Domin 36 Compress Soure Virtul Mhine Pkge 37 Register Soure Virtul Mhine with the Horizon FLEX Poliy Server 37 Creting Poliies nd Entitlements 38 Configure Generl Poliy for Horizon FLEX Imge 39 Configure USB Devie Poliy for Horizon FLEX Imge 40 Configure Custom USB Devie Poliy for Horizon FLEX Imge 41 Updte Poliy for Deployed Horizon FLEX Imge 42 Entitle Horizon FLEX Imge 43 Crete Virtul Mhine Nme Pttern 45 Crete URI to Deploy Horizon FLEX Virtul Mhine 46 5 Mnging Horizon FLEX Virtul Mhines 47 Mnge Horizon FLEX Virtul Mhines 47 6 Mintining the Horizon FLEX System 49 Upgrde from Previous Horizon FLEX Versions 49 Horizon FLEX System Logs 50 Index 51 4 VMwre, In.

5 VMwre Horizon FLEX Administrtion Guide The VMwre Horizon FLEX Administrtion Guide desries how to instll nd dminister VMwre Horizon FLEX. Intended Audiene This informtion is intended for nyone who wnts to instll Horizon FLEX. The informtion is written for experiened Windows system dministrtors who re fmilir with virtul mhine tehnology. VMwre, In. 5

6 VMwre Horizon FLEX Administrtion Guide 6 VMwre, In.

7 Introduing Horizon FLEX 1 Horizon FLEX is poliy-sed, ontinerized desktop solution tht enles IT dministrtors to rete, seure, nd mnge lol desktops for end users. End users work within restrited virtul mhine, lled Horizon FLEX virtul mhine, on their own omputers. Beuse Horizon FLEX virtul mhines re stored lolly, on end-user omputers, orporte pplitions re essile to offline users. This hpter inludes the following topis: Horizon FLEX Components, on pge 7 Horizon FLEX Arhiteture, on pge 8 Horizon FLEX System Requirements, on pge 10 Horizon FLEX Server System Requirements, on pge 10 Horizon FLEX Network Requirements, on pge 11 Supported Host nd Guest Operting Systems, on pge 12 Horizon FLEX Components Horizon FLEX is omintion of VMwre omponents, inluding Mirge, Fusion Pro, nd Worksttion Plyer. VMwre Mirge for Horizon FLEX Horizon FLEX Poliy Server Horizon FLEX Admin Console The Mirge Server tht is used y Horizon FLEX. The server provides Horizon FLEX virtul mhine mngement. You n mnge, k up, nd pth virtul mhines y using the Mirge for Horizon FLEX lyering tehnology. Use of Mirge for Horizon FLEX is optionl. You n lso use other imge mngement tools to mnge Horizon FLEX virtul mhines. The stndrd Mirge server with n extension tht inludes Horizon FLEXspeifi funtionlity. The Horizon FLEX Poliy Server is tivted fter you pply the Horizon FLEX liense to Mirge for Horizon FLEX. The We mngement user interfe for the Horizon FLEX Poliy Server. The Horizon FLEX Admin Console is loted in the Mirge We Mnger omponent. You use the Horizon FLEX Admin Console to perform virtul mhine mngement tsks, inluding the following: Mnge n inventory of virtul mhines Browse list of users nd groups in the Ative Diretory servie Entitle users nd groups to one or more virtul mhines Speify virtul mhine poliies for given entitlement VMwre, In. 7

8 VMwre Horizon FLEX Administrtion Guide Prevent users from essing virtul mhines y using remote lok Exmine virtul mhine detils nd sttus t ny time Horizon FLEX Client Horizon FLEX Virtul Mhine The lient softwre tht end users use to downlod the Horizon FLEX virtul mhines to their lol omputers. The lients inlude VMwre Fusion Pro Pro for M omputers nd VMwre Worksttion Plyer for Windows omputers. Fusion Pro nd Worksttion Plyer re inluded in the Horizon FLEX pkge. One liense key is provided for oth Fusion Pro nd Worksttion Plyer. The virtul mhine tht end users run on their own omputers. You use Fusion Pro to rete soure virtul mhines for Horizon FLEX virtul mhines. Fusion Pro is inluded in the Horizon FLEX pkge. A Horizon FLEX server n support up to 1,000 users. NOTE You n lso use VMwre Worksttion Pro to rete soure virtul mhines. Worksttion Pro is not inluded in the Horizon FLEX pkge. Aout Mirge Mirge is integrl to the opertion nd use of Horizon FLEX virtul mhines. Horizon FLEX uses suset of the fetures ville in Mirge: Mirge Server Mirge Mngement Server Mirge We Mnger Mirge Mngement Console This doument does not desrie ll of the informtion pertining to Mirge. For omplete informtion out Mirge, see the Mirge doumenttion t Horizon FLEX Arhiteture A typil Horizon FLEX deployment inludes the Horizon FLEX server, file server, n HTTPS proxy, red-only domin ontroller (RODC), nd offsite nd onsite end-user systems. Figure 1-1 shows the reltionships etween the mjor omponents of Horizon FLEX deployment 8 VMwre, In.

9 Chpter 1 Introduing Horizon FLEX Figure 1 1. Smple Horizon FLEX Deployment Without Mirge Horizon FLEX Server Mirge Mngement Console Mirge Mngement Server File Server HTTPS Proxy Offsite Users RODC DMZ Onsite Users Horizon FLEX Server The Horizon FLEX server is omposed of the Horizon FLEX Admin Console nd the Horizon FLEX Poliy Server. The Horizon FLEX server provides the following funtionlity. Assigns Horizon FLEX virtul mhines to users nd groups from diretory servie Mintins reord of Horizon FLEX virtul mhines in use y individul users Provides seurity ertifite mngement to ensure the seure nd trusted ommunition etween the deployed Horizon FLEX virtul mhines nd the Horizon FLEX server. Enfores poliy settings to the lient Enles modifition of poliy settings for given user nd Horizon FLEX virtul mhine omintion Monitors Horizon FLEX virtul mhine sttus The Mirge Mngement Console is the grphil user interfe used for slle mintenne, mngement, nd monitoring of deployed endpoints. The Mirge We Mnger mirrors Mirge Mngement Console funtionlity. By defult, port 7443 is used y the Horizon FLEX Poliy Server for externl ess, nd port 8443 is used y the Mirge Mngement Server to ommunite with the Horizon FLEX Poliy Server. You must onfigure your firewll poliies to llow the required ports. For omplete list of ports used y Mirge, see the Mirge doumenttion t File Server A file server stores the TAR files tht ontin the soure virtul mhine files for Horizon FLEX virtul mhines. The file server n e on ny server tht lient user n ess without entering redentils. The file server is loted inside the DMZ in this exmple ut tht is not required. VMwre, In. 9

10 VMwre Horizon FLEX Administrtion Guide HTTPS Proxy RODC An HTTPS proxy enles offsite end-user systems to reh the Mirge Mngement Console nd get poliy updtes. An RODC enles offie end-user systems to log in to their Horizon FLEX virtul mhines nd join the Ative Diretory domin for the first oot up of the VM. An RODC is required only if you re llowing outside users to log in without using VPN. The RODC is inside the DMZ. Lod Blning Horizon FLEX supports lod lning using multiple poliy servers. Set up n tive/pssive Windows server set for fult tolerne for your Horizon FLEX topology. Horizon FLEX System Requirements Eh produt in the Horizon FLEX pkge hs ertin system requirements. Horizon FLEX Server nd Mirge Server Requirements Mirge for Horizon FLEX Horizon FLEX Client for M Horizon FLEX Client for Windows Worksttion Pro For more informtion, see Horizon FLEX Server System Requirements, on pge 10. The system requirements for Horizon FLEX 1.6 re the sme s for Mirge 5.5. See the Mirge doumenttion t Horizon FLEX 1.6 uses Fusion Pro 8.0 s the lient softwre for M lients. Horizon FLEX 1.6 is not omptile with erlier versions of Fusion Pro. For Fusion Pro hrdwre nd softwre requirements, see the VMwre Horizon FLEX Client User Guide. Horizon FLEX 1.6 uses Worksttion Plyer 12.0 s the lient softwre for Windows lients. Horizon FLEX 1.6 is not omptile with erlier versions of Plyer Pro. For Worksttion Plyer hrdwre nd softwre requirements, see the VMwre Horizon FLEX Client User Guide. You n use Worksttion Pro 12.0 to rete nd open soure virtul mhine, ut Worksttion Pro nnot downlod Horizon FLEX virtul mhine. Worksttion Pro is not inluded in the Horizon FLEX instlltion pkge. For Worksttion Pro hrdwre nd softwre requirements, see the Worksttion Pro doumenttion t Horizon FLEX Server System Requirements The Horizon FLEX environment inludes system requirements for oth the Horizon FLEX server nd the Mirge server. Horizon FLEX Server System Requirements Minimum CPU: 1 Qud-Core Proessor or 2 vcpu 10 VMwre, In.

11 Chpter 1 Introduing Horizon FLEX 2.26 GHz Intel ore speed or equivlent Minimum RAM: 512 MB with 4 GB reommended Minimum disk spe: 10 GB+, 40 GB+ reommended Windows 2008 R2, Windows 2012 or lter.net nd lter IIS 7.0+ with II6 Mngement Comptiility, with ASP nd ASP.NET Ative Diretory: Administrtor ount with permissions to dd omputer ojets to the domin SQL 2008 Express or SQL Server 2008 (required for Mirge instlltion) HTTP file shre or IIS virtul diretory with ville spe for soure virtul mhines Firewll ports for the Horizon FLEX Admin Console IIS nd Horizon FLEX We App defult ports: HTTP , HTTPS (Clls direted to the HTTP port re redireted to the HTTPS port.) Mirge Mngement Server listens to Windows Communition Foundtion (WCF) requests on the following port: HTTP A ertifite is required for the Horizon FLEX Server if using SSL. Mirge Server Requirements Minimum CPU: 4 vcpu with 8 vcpu reommended Minimum RAM: 8 GB with 16 GB reommended 146 GB free disk spe Windows 2008 R2, Windows 2012 or lter.net nd lter Horizon FLEX Network Requirements Horizon FLEX enles end users to run orporte pplitions even when they re disonneted from the network. Horizon FLEX virtul mhines re stored lolly for omplete desktop experiene tht does not require network onnetion. A network onnetion is required etween the Horizon FLEX Poliy Server nd the Horizon FLEX Client in the following irumstnes: For the initil downlod of the Horizon FLEX virtul mhine to the user's lol omputer. To register Horizon FLEX virtul mhine tht ws provided on USB devie or deployed on the user's lol omputer. To reeive Horizon FLEX virtul mhine restrition nd poliy updtes. When you register soure virtul mhine for Horizon FLEX virtul mhine, you speify downlod lotion URL for virtul mhine pkge. The downlod folder must e essile to end user omputers for end users to downlod virtul mhines. VMwre, In. 11

12 VMwre Horizon FLEX Administrtion Guide Supported Host nd Guest Operting Systems The lol omputer on whih end users use the Horizon FLEX Client must hve supported host operting system. A Horizon FLEX virtul mhine must use supported guest operting system. Supported Host Operting Systems Your end users n run the Horizon FLEX Client nd ess their Horizon FLEX virtul mhine y using physil omputer tht hs one of the following operting systems. Tle 1 1. Supported Host Operting Systems Horizon FLEX Client Supported Operting Systems Worksttion Plyer Windows 7 Windows 8.1 Enterprise Windows Server 2012 R2 Windows 8 Windows 8.1 Pro Windows 10 NOTE Worksttion Plyer supports only 64-it operting systems. Fusion Pro M OS X M OS X M OS X 10.9 Supported Guest Operting Systems A Horizon FLEX virtul mhine n ontin one of the following guest operting systems. Windows 10 Windows 8.1 Windows 7 Windows XP Windows Server 2012 R2 Uuntu VMwre, In.

13 Instlling Horizon FLEX 2 The Horizon FLEX instlltion involves instlling the Horizon FLEX server nd lient omponents, reting folders to store Horizon FLEX virtul mhines, prepring Ative Diretory, setting up ertifites, nd reting nd deploying Horizon FLEX virtul mhines. This hpter inludes the following topis: Horizon FLEX Instlltion Overview, on pge 13 Instlling nd Configuring Mirge Components for Horizon FLEX, on pge 14 Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge 15 Set Up Certifite for the Horizon FLEX Server y Using OpenSSL, on pge 15 Configure the IIS SSL Server Certifite for the Horizon FLEX Server, on pge 16 Configure Ative Diretory Settings, on pge 16 Test the Horizon FLEX Admin Console Connetion, on pge 17 Instlling the Horizon FLEX Client for End Users, on pge 18 Horizon FLEX Instlltion Overview Horizon FLEX is omintion of VMwre omponents, inluding Mirge, Fusion Pro, nd Worksttion Plyer. The Horizon FLEX instlltion involves instlling eh of these omponents nd performing dditionl Horizon FLEX-speifi tsks. For suessful Horizon FLEX deployment, you must understnd the sequene of required tsks. Before you instll Horizon FLEX, verify tht it meets ll of the hrdwre nd softwre requirements, tht you hve vlid lienses, nd tht you hve downloded the Horizon FLEX omponent instllers from the VMwre Horizon FLEX produt downlod pge. You instll the Horizon FLEX y performing these steps: 1 Instll the Mirge system. See Instlling nd Configuring Mirge Components for Horizon FLEX, on pge Set up ertifites for Horizon FLEX virtul mhines. See Chpter 3, Setting Up Certifites for Horizon FLEX Virtul Mhines, on pge Crete downlod folder for storing your Horizon FLEX virtul mhine pkges. See Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge Add virtul diretory in IIS for your Horizon FLEX virtul mhine downlod folder nd edit the site indings. VMwre, In. 13

14 VMwre Horizon FLEX Administrtion Guide See Configure the IIS SSL Server Certifite for the Horizon FLEX Server, on pge (Optionl) Configure Horizon FLEX to synhronize entities in only seleted Ative Diretory orgniztionl unit (OU). See Configure Ative Diretory Settings, on pge Test the onnetion to the Horizon FLEX Admin Console. See Test the Horizon FLEX Admin Console Connetion, on pge Instll Horizon FLEX Client on eh end-user host, or instrut end users to instll Horizon FLEX Client on their own omputers. See Instlling the Horizon FLEX Client for End Users, on pge Crete nd deploy Horizon FLEX virtul mhines. See Chpter 4, Creting nd Deploying Horizon FLEX Virtul Mhines, on pge 31. Instlling nd Configuring Mirge Components for Horizon FLEX The first Horizon FLEX instlltion step is to instll nd onfigure the Mirge system. The Horizon FLEX pkge inludes the following omponents: VMwre Mirge for Horizon FLEX (the Mirge Core Softwre) Mirge PowerCLI for Windows Mirge Gtewy Appline Softwre Downlod the instlltion files from the Horizon FLEX Server produt downlod pge. The Mirge deployment involves the instlltion of the following omponents. 1 Mirge Mngement Server 2 Mirge Server 3 Mirge Mngement Console 4 Mirge We mnger To instll nd onfigure the Mirge system, follow the instlltion instrutions in the Mirge doumenttion t When you instll the Mirge system, you must selet ertin options for the Horizon FLEX server to operte orretly. The Mirge Server nd Mirge onsole re only required if you re instlling the Mirge lient in the soure virtul mhines. If pling the virtul mhine imges on the sme system s the Horizon FLEX Server, ple the imges in the IIS "Defult We" server. The We Mngement Server nd the Mirge Mngement Server n e instlled on the sme server, ut instlling them on different servers improves slility. The SQL server should e instlled on seprte server from the We Mngement Server nd the Mirge Mngement Server. During Mirge server instlltion, hoose SSL for the Mirge server trnsport. SSL is required to use the Mirge Gtewy feture for externl ess nd mngement of Horizon FLEX systems. Before onfiguring the Mirge Server for SSL, you must instll the server SSL ertifite. Before you instll the Mirge We Mnger, verify tht.net Frmework is instlled on the server. The Mirge Mngement Server must run s user who hs Ative Diretory red permissions. If you pln to join Horizon FLEX virtul mhines to n Ative Diretory domin, the Mirge Mngement Server must run s user who hs domin join permissions. 14 VMwre, In.

15 Chpter 2 Instlling Horizon FLEX Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges During the Horizon FLEX virtul mhine deployment proess, you ompress your soure virtul mhine pkges into TAR (.tr) formt so tht end users n esily downlod their Horizon FLEX virtul mhines. You must rete downlod folder for storing these TAR files. 1 Crete the downlod folder on the Horizon FLEX server or on nother server. The downlod folder does not need to e on the Horizon FLEX server, ut the files it ontins must e downlodle without ny uthentition hllenge. If you rete the downlod folder on the sme IIS server s the Horizon FLEX server, you n rete the folder under the defult IIS doument root folder of the Defult We site. Do not rete the downlod folder under the VMwre Mirge Mngement We site. 2 Assign permissions to the downlod folder so tht users n downlod the files tht it ontins. 3 (Optionl) Shre the downlod folder with n dministrtive group, suh s Horizon FLEX Admins. This n e n dministrtive group for users to mnge Horizon FLEX deployments. This step n mke it esier to register your soure virtul mhines with the Horizon FLEX Poliy Server. Wht to do next See Configure the IIS SSL Server Certifite for the Horizon FLEX Server, on pge 16. Set Up Certifite for the Horizon FLEX Server y Using OpenSSL You n rete self-signed ertifite for the Horizon FLEX server y using OpenSSL. Prerequisites The OpenSSL onfigurtion file is reted on the Mirge Gtewy Server. See the Mirge doumenttion t 1 At the OpenSSL ommnd prompt, rete ertifite: $ openssl req -new -dys expirtion time -x509 -newkey rs: keyout key filenme -outertifite filenme -nodes expirtion time represents the numer of dys tht the ertifite should e vlid, key filenme represents the filenme for the key, nd ertifite filenme represents the new ertifite nme. A self-signed ertifite nd privte key re generted. The ertifite uses 2048-it RSA key nd does not protet the key with pssphrse. 2 When prompted, enter the ountry nme, stte nme, lolity, orgniztion nme, nd orgniztionl unit nme. 3 In the Common Nme text ox, enter the host nme of the Horizon FLEX server to e proteted. This text ox must e ompleted. 4 Enter the emil ddress. The self-signed ertifite nd ssoited privte key re generted. VMwre, In. 15

16 VMwre Horizon FLEX Administrtion Guide 5 If the privte key must e in.pfx formt, enter the following ommnd y using the ertifite nme nd key filenme generted in the previous steps: $ openssl pks12 -export -outoutput pfx filenme -inkey key filenme -in ertifite nme A new pssword-proteted.pfx file is generted tht n e deployed on ny devie tht requires.pfx ertifites insted of PEM ertifites. Configure the IIS SSL Server Certifite for the Horizon FLEX Server You must onfigure the IIS SSL server ertifite for the Horizon FLEX server to set the ertifite hin from the Horizon FLEX server to the Horizon FLEX virtul mhines. Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge Components for Horizon FLEX, on pge 14. Instll the Server SSL Certifite on the Mirge server. See the Mirge doumenttion t Configure ertifite uthentition for your Horizon FLEX virtul mhines. See Chpter 3, Setting Up Certifites for Horizon FLEX Virtul Mhines, on pge 21. Crete downlod folder for your Horizon FLEX virtul mhine pkges. See Crete Downlod Folder for Horizon FLEX Virtul Mhine Pkges, on pge Open IIS Mnger. 2 Nvigte to VMwre Mirge Mngement We Site nd selet the file lotion for the downlod folder. 3 Right-lik the folder lotion nd selet Add Virtul Diretory. 4 Type nme in the Alis text ox, rowse to the folder tht you reted to ontin the Horizon FLEX virtul mhine pkges, nd lik OK. 5 Nvigte to the root node, the onnetion node defined for the Mirge server. 6 On the Mirge Home pge under IIS, doule lik Server Certifites. The IIS SSL server ertifites window opens. 7 Clik Import in the right olumn. This step imports the reted SSL ertifite nd ssigns key to identify the ertifite. 8 Selet VMwre Mirge Mngement We Site nd lik Edit Bindings in the right olumn. 9 Set the HTTPS port to use your Horizon FLEX server ertifite nd lik OK. Configure Ative Diretory Settings When you entitle Horizon FLEX virtul mhine, you dd users nd groups from your existing Ative Diretory infrstruture to the entitlement. By defult, Horizon FLEX synhronizes your entire Ative Diretory infrstruture with the Horizon FLEX dtse. You n optionlly onfigure Horizon FLEX to synhronize only speifi orgniztion unit (OU). Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge Components for Horizon FLEX, on pge VMwre, In.

17 Chpter 2 Instlling Horizon FLEX 1 Strt the Horizon FLEX Admin Console. In We rowser, enter where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Enter the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 2 In the Horizon FLEX Admin Console, lik the Generl System Settings ion nd lik Ative Diretory Settings. 3 Type the OU to synhronize in the Orgniztionl Unit text ox. As you egin to type in the text ox, the ville OUs in your Ative Diretory infrstruture pper in drop-down menu nd you n selet the pproprite OU. 4 Clik OK to sve the OU setting. The Horizon FLEX server vlidtes the OU to verify tht it exists nd is essile. The Horizon FLEX server synhronizes the Ative Diretory entities tht elong only to the OU tht you seleted, inluding entities tht elong to ny hild OUs of the seleted OU. Any time you onfigure new OU, the Horizon FLEX server deletes the previously synhronized entities from the dtse nd strts new full synhroniztion proess. You n onfigure the poliy for lient virtul mhines so tht the power-on pssword mthes the user's Ative Diretory pssword fter first strtup. See Configure Generl Poliy for Horizon FLEX Imge, on pge 39. Test the Horizon FLEX Admin Console Connetion You n verify your Horizon FLEX deployment y testing the Horizon FLEX Admin Console onnetion. Prerequisites Instll Mirge for Horizon FLEX. See Instlling nd Configuring Mirge Components for Horizon FLEX, on pge 14. Configure ertifite uthentition. See Chpter 3, Setting Up Certifites for Horizon FLEX Virtul Mhines, on pge Strt the Horizon FLEX Admin Console. In We rowser, enter where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Enter the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 2 Verify tht the Horizon FLEX Admin Console pge ppers orretly. The Imges, Poliies, Entitlements, nd Virtul Mhines uttons should e visile in the left nvigtion pnel. VMwre, In. 17

18 VMwre Horizon FLEX Administrtion Guide Instlling the Horizon FLEX Client for End Users End users must hve the Horizon FLEX Client softwre instlled on their lol omputers efore they n downlod the Horizon FLEX virtul mhines. Supported lients inluded in the Horizon FLEX pkge re Fusion Pro for M OS X mhines nd Worksttion Plyer for Windows mhines. You n rete mss deployment to instll the Horizon FLEX Client on mny systems t one time, or you n instrut end users to otin the Horizon FLEX Client from the VMwre We site nd instll it themselves. You n lso run n unttended Worksttion Plyer instlltion on multiple Windows mhines. Crete Mss Deployment Pkge to Instll Fusion Pro You n rete Fusion Pro mss deployment pkge to instll Fusion Pro on ny numer of end-user Ms. You n use stndrd pkge deployment tools, inluding Apple Remote Desktop Admin, to deploy the mss deployment pkge. When you onfigure the mss deployment pkge, speify your Horizon FLEX liense key in the [Volume Liense] setion of the Deploy.ini file nd ple opy of the Fusion Pro pplition in the 00Fusion_Deployment_Items folder. You n use the optionl onnetatstrtupurl prmeter in the [Lotions] setion of the Deploy.ini file to speify user nme nd the host nme of your Horizon FLEX server, for exmple: onnetatstrtupurl = vmwre-rvm://johndoe@yourflexserver.om:7443 If no virtul mhines re instlled on the user's M when the user lunhes Fusion Pro, the Connet dilog ox opens nd the Server nd Usernme text oxes re prepopulted with the host nme nd user nme tht you speified in the onnetatstrtupurl prmeter. For step-y-step informtion out reting mss deployment pkge, see the VMwre knowledge se rtile t Provide Worksttion Plyer Instlltion Pkge to End Users You n instll Worksttion Plyer on end user mhines using ommnd line nd speify the Horizon FLEX server onnetion settings y using uniform resoure identifier (URI). When instlltion of Worksttion Plyer is omplete, the end user is prompted to onnet to server nd downlod Horizon FLEX virtul mhine. Prerequisites Give the end user pssword for the server nd the Worksttion Plyer liense key for use with Horizon FLEX. u Construt URI to rete ustomized Worksttion Plyer instlltion nd deployment pkge. The ommnd line hs the following struture: VMwre-plyer-x.x.x-xxxxxxx.exe /v PLAYER_RVM_URI="vmwre-rvm://usernme@myserver.om:7443" Speify the version nd uild numer of the Worksttion Plyer.exe file. usernme is the user's login nme nd myserver.om is the host nme of the server. You must inlude vmwre-rvm:// nd :7443 in the server ddress. Do not inlude http or https in the server ddress. 18 VMwre, In.

19 Chpter 2 Instlling Horizon FLEX Run n Unttended Worksttion Plyer Instlltion You n use the unttended instlltion feture of the Mirosoft Windows Instller (MSI) to instll Worksttion Plyer on severl Windows hosts without hving to respond to wizrd prompts. This feture is onvenient in lrge enterprise. Prerequisites Verify tht the host system meets the host system requirements. Verify tht the host omputer hs version 2.0 or lter of the MSI runtime engine. This version of the instller is ville in versions of Windows eginning with Windows XP nd is ville from Mirosoft. See the Mirosoft We site for more informtion. 1 Log in to the host system s the dministrtor user or s user who is memer of the lol Administrtors group. If you log in to the domin, the domin ount must lso e lol dministrtor. 2 Extrt the dministrtive instlltion imge from the Worksttion Plyer setup file. The setup filenme is similr to VMwre-plyer-xxxx-xxxx.exe, where xxxx-xxxx is the version nd uild numer. For exmple: setup.exe /s /e instll_temp_pth 3 Enter the instlltion ommnd on one line. These exmples show options tht you n dd to the ommnd. VMwre-plyer-full-x.x.x-xxxxxx.exe /s /pss /v/qn REBOOT=RellySuppress "EULAS_AGREED=1 INSTALLDIR=""pth_to_progrm_diretory"" ADDLOCAL=ALL SERIALNUMBER=""xxxxx-xxxxx-xxxxx-xxxxxxxxxx"" " VMwre-plyer-full-x.x.x-xxxxxx.exe /s /v/qn EULAS_AGREED=1 SERIALNUMBER="xxxxx-xxxxx-xxxxxxxxxx-xxxxx" VMwre-plyer-full-x.x.x-xxxxxx.exe /s /v/qn PLAYER_RVM_URI= vmwrervm://usernme@myserver.om:7443 You n use the optionl INSTALLDIR property to speify file pth for the instlltion tht is different from the defult lotion. NOTE The quottion mrks round the file pth re importnt. All the MSI rguments re pssed with the /v option. The outer quottion mrks group the MSI rguments nd the inner quottion mrks put quottion mrk in tht rgument. You n use the optionl REMOVE property to skip the instlltion of ertin fetures. Worksttion Plyer Unttended Instlltion Properties When you perform n unttended instlltion of Worksttion Plyer, you n ustomize the instlltion y speifying instlltion properties in the instlltion ommnd. To speify n instlltion property in the instlltion ommnd, use the formt Property property= "vlue". A vlue of 1 mens true nd vlue of 0 mens flse. VMwre, In. 19

20 VMwre Horizon FLEX Administrtion Guide Tle 2 1. Instlltion Properties Property Desription Defult Vlue AUTHD_PORT AUTOSOFTWAREUPDATE DATACOLLECTION DESKTOP SHORTCUT EULAS_AGREED INSTALL_DIR KEEP_LICENSE KEEP_SETTINGFILES PLAYER_RVM_URI SERIALNUMBER SIMPLIFIEDUI SOFTWAREUPDATEURL STARTMENU_SHORTCUT SUPPORTURL Speifies whih port the "VMwre Authoriztion Servie" ommunites through. Enles utomti upgrdes for Worksttion Plyer when new uild eomes ville. Sends user experiene informtion to VMwre. Adds shortut on the desktop when Worksttion Plyer is instlled. Allows you to silently ept the produt EULA's. Set to 1 to omplete the instlltion or upgrde. Instll Worksttion Plyer in diretory tht is different from the defult Worksttion Plyer lotion. Speifies whether to keep or remove liense keys when Worksttion Plyer is instlled. Speifies whether to keep or remove settings files when Worksttion Plyer is uninstlled. Speifies the uniform resoure identifier (URI) for the Horizon FLEX server. Lets you enter the liense key when Worksttion Plyer is instlled. Enter the liense key with hyphens, for exmple xxxxx-xxxxx-xxxxx-xxxxxxxxxx. Turn on or off ertin UI fetures of Worksttion Plyer. Speifies ustom URL for mnging softwre updtes (seprte from vmwre.om). Adds Strt menu item when Worksttion Plyer is instlled. Set support URL or emil lis speifilly for your users to ontt with produt issues through the Worksttion Plyer Help menu C:\Progrm Files (86)\VMwre\VMwre Plyer 1 1 VMwre-plyer-full-x.x.xxxxxxx.exe /s /v/qn PLAYER_RVM_URI= vmwrervm://usernme@myserver.om: VMwre, In.

21 Setting Up Certifites for 3 Horizon FLEX Virtul Mhines Before you rete nd deploy Horizon FLEX virtul mhines, you must set up ertifites to ensure tht end users n suessfully downlod nd use their virtul mhines. VMwre reommends tht you use ertifite tht is issued y ertifite uthority (CA), suh s Entrust or Go Dddy, or third-prty ertifite, on your Horizon FLEX server. If you re using self-signed ertifite or ertifite from n internl CA insted of generlly trusted ertifite, you must tke steps to ensure tht the ertifite is trusted on ll end-user omputers tht will downlod nd use Horizon FLEX virtul mhines. For informtion out setting up ertifites in Mirge for the Horizon FLEX Server, see the Mirge doumenttion t This hpter inludes the following topis: Creting Trusted Certifites List, on pge 21 Using Self-Signed Certifites, on pge 24 Using Internl CA Certifites, on pge 27 Creting Trusted Certifites List You n rete list of trusted ertifites for Horizon FLEX virtul mhines nd import the list to the Horizon FLEX Poliy Server. When you use trusted ertifites list, you do not need to instll ertifites on end-user hosts. Using list of trusted ertifites n prevent mliious users from reting their own self-signed ertifites for the sme hostnme nd dding those ertifites to their host's list of trusted ertifites. When you onfigure the Horizon FLEX Poliy Server to use trusted ertifites list, the lient host ignores the host's list of ertifites nd uses the trusted ertifites list to verify server onnetions insted. If the lient host nnot verify ertifite y using the trusted ertifites list, the server onnetion fils. If the trusted ertifites list is empty in the soure virtul mhine, Worksttion Plyer nd Fusion Pro uthentite ginst the host's list of trusted ertifites. To rete the trusted ertifites list, you export eh ertifite to seprte file nd then ontente ll of the files into single file. You use the Horizon FLEX Admin Console to import the ontented ertifites file to the Horizon FLEX Poliy Server. You must export ertifites in Privy Enhned Mil (PEM) formt. On Windows systems, the PEM ertifite enoding is lled Bse-64 enoded X.509 (.CER). Only PEM-enoded ertifites re supported. No other ertifite formt (DER, Serilized Certifite Store/SST, PKCS #12/PFX, PKCS #7/P7B) is epted. VMwre, In. 21

22 VMwre Horizon FLEX Administrtion Guide Aout the PEM Formt The PEM formt is stndrd ertifite formt tht is Bse64 enoded. An exmple of PEM-formt ertifite is s follows: -----BEGIN CERTIFICATE----- MIIDojCCAwugAwIBAgIJAMLM0CJRzPyzMA0GCSqGSI3DQEBBQUAMIGTMQswCQYD VQQGEwJVUzETMBEGA1UECBMKQ2FsWZvm5pYTESMBAGA1UEBxMJUGFsyBBHRv MS8wLQYDVQQKEyZWTXdhmUsIEluYy4gLSBX3Jr3RhdGlviBTU0wgVGVzdGlu ZzEqMCgGA1UEAxMhV29y3N0YXRp24gQ2VydGlmWNhdGUgQXV0G9yXR5MB4X DTExMDxNTAyMjY0OFoXDTE1MDxNDAyMjY0OFowgZMxCzAJBgNVBAYTAlVTMRMw EQYDVQQIEwpDYWxpZm9ymlhMRIwEAYDVQQHEwlQYWxvIEFsdG8xLzAtBgNVBAoT JlZNd2FyZSwgSW5jLiAtIFdvmtzdGF0W9uIFNTTCBUZXN0W5nMSowKAYDVQQD EyFX3Jr3RhdGlviBDZXJ0WZpY2F0ZSBBdXRo3JpdHkwgZ8wDQYJKoZIhvN AQEBBQADgY0AMIGJAoGBAL/tBlngiEkCK7ssCBe8lZ30FlIHmpECmwEm3AID1C0 ln+ldrt2ammqiknxbpxgbgyrnrnnshrzp1xxr/wl22ayt7nx+p/xsh2srd GGCTN/wh/ArirTLCjRwY55lAAH9xwzortRYR84IBJQpHzxopTSI9o4ZVIqx AgMBAAGjgfswgfgwHQYDVR0OBBYEFMoT527dtvlgR1EzYK4EnQHS6T2ZMIHIBgNV HSMEgAwg2AFMoT527dtvlgR1EzYK4EnQHS6T2ZoYGZpIGWMIGTMQswCQYDVQQG EwJVUzETMBEGA1UECBMKQ2FsWZvm5pYTESMBAGA1UEBxMJUGFsyBBHRvMS8w LQYDVQQKEyZWTXdhmUsIEluYy4gLSBX3Jr3RhdGlviBTU0wgVGVzdGluZzEq MCgGA1UEAxMhV29y3N0YXRp24gQ2VydGlmWNhdGUgQXV0G9yXR5ggkAwszQ IlHM/LMwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQBoiwDWGWXzI+j 0gG/7BNzpNHzR1RGAF4nB9JrnCYWvB313kgYDMHogfiAoQhsu/py/OYBYVRjjFJ YVTJ7DVl/3Gpk3+tdJfEmqIz76PVWfWTnhuJEMYrMM4W06B/K2s24kZtXQ h84fytvcg/l6tp5swgei4vwgrfxga== -----END CERTIFICATE----- When you rete trusted ertifites list, you ontente multiple PEM-formt ertifites into single file. Line endings re uto-deteted. The following exmple shows the formt of ontented ertifites list tht ontins two ertifites BEGIN CERTIFICATE----- <se64 ontent here> -----END CERTIFICATE BEGIN CERTIFICATE----- <se64 ontent here> -----END CERTIFICATE----- Creting PEM-Formt Certifites You n rete PEM-formt ertifites y downloding the ertifite from the CA's We site or y exporting the ertifites from host system. For exmple, you n downlod ertifites for Verisign from the Symnte We site t Export PEM-Formt Certifite From M You n export PEM-formt ertifite from M. Prerequisites Beome fmilir with how to use Keyhin Aess on M. For more informtion, see the Apple Support We site t 22 VMwre, In.

23 Chpter 3 Setting Up Certifites for Horizon FLEX Virtul Mhines 1 On the M, open Keyhin Aess. 2 From the sider, selet System Roots. 3 Lote the ertifite to export. 4 Selet File > Export Items. 5 Selet lotion to sve the ertifite nd selet the Privy Enhned Mil (.pem) file formt. Export PEM-Formt Certifite From Windows System You n export PEM-formt ertifite from Windows system. On Windows, the PEM ertifite enoding is lled Bse-64 enoded X.509 (.CER). Prerequisites Beome fmilir with how to use Certifite Mnger on Windows system. For more informtion, see the Mirosoft TehNet We site t 1 On the Windows system, open Certifite Mnger (ertmgr.exe). 2 Right-lik the ertifite to export nd selet All Tsks > Export. 3 Selet options in the Certifite Export Wizrd. Selet Bse-64 enoded X.509 (.CER) for the file export formt. For the ertifite to work with Horizon FLEX, you must hoose this option. Provide lotion to sve the ertifite nd file nme. Review the settings you seleted nd lik Finish. The ertifite file is sved to the lotion you indited. Crete nd Import the Trusted Certifites List File After you export your PEM-formt ertifites, you must onstrut the trusted ertifite list nd import the ertifites list file to the Horizon FLEX Poliy Server. Prerequisites Export eh ertifite in PEM formt. See Creting PEM-Formt Certifites, on pge To rete the trusted ertifites list file, ontente eh PEM-formt ertifite file into single file. You n use the t ommnd, or you n opy nd pste the ontents of the ertifite files into text file. You n sfely edit Bse64 ontent in text editor. For exmple: $ t myert1.pem myert2.pem myert3.pem > list.pem 2 Strt the Horizon FLEX Admin Console. In We rowser, enter where WeMngerServer is the DNS nme or IP ddress of the host where the Mirge We Mnger is instlled. Enter the user nme nd pssword of domin ount tht hs ess to Mirge. Clik Login. 3 In the Horizon FLEX Admin Console, lik the Generl System Settings ion nd selet Certifites. VMwre, In. 23

24 VMwre Horizon FLEX Administrtion Guide 4 Clik Import, rowse to the trusted ertifites list file, nd lik Open to import the file. Updting Certifites on the Server When ertifite expires, nd new ertifite hs n expirtion dte tht is set fr into the future, you n dd the new ertifite s seond ertifite to the trusted ertifites list in the Horizon FLEX Poliy Server. Adding the new ertifite to the trusted ertifites list enles ll Horizon FLEX virtul mhines to downlod the new ertifite. Then, when the ertifite swith ours, ll of the Horizon FLEX virtul mhines tht reeived the new list of ertifites n onnet to the Horizon FLEX server nd you n remove the old trusted ertifite from the poliy file. If you hnge the server ertifite fter the Horizon FLEX virtul mhines hve lredy een registered nd run, then your end users need to verify tht the hnged ertifite is trusted y Fusion Pro or Worksttion Plyer. If the new server ertifite is self-signed, the Horizon FLEX lient does not report the instne sttus orretly to the Horizon FLEX server. The end user should open the Horizon FLEX virtul mhine nd lik Connet to onnet to the server. If the end user reeives the Invlid seurity ertifite error messge, the end user should onfirm with you to verify the ertifite is vlid nd if so, selet the Alwys trust this host with this ertifite hek ox nd lik Connet Anywy. Using Self-Signed Certifites If you do not onfigure the self-signed ertifite into the soure virtul mhine eing prepred, you must instll the ertifite on eh end-user host for Horizon FLEX virtul mhines to funtion orretly. If the list of ertifites is empty in the poliy file, Worksttion Plyer nd Fusion Pro will fll k to uthentiting ginst the host's list of trusted ertifites. If you inlude the self-signed ertifite of soure virtul mhine on the Horizon FLEX Poliy Server, nd you onfigure or instll the self-signed ertifite for the Horizon FLEX Client (either in the soure virtul mhine's poliy file or in the host's list of trusted ertifites), you do not need to instll the ertifite on end-user hosts when ertifite updtes re required, for exmple, when ertifite expires. For informtion out onfiguring ertifites into soure virtul mhine, see Crete Soure Virtul Mhine in Fusion Pro, on pge 32. For informtion out reting trusted ertifites list nd importing it to the Horizon FLEX Poliy Server, see Creting Trusted Certifites List, on pge 21. For informtion out updting ertifites, see Updting Certifites on the Server, on pge 24. Instll Self-Signed Certifite on Windows Computer To instll self-signed ertifite on Windows host, you export the ertifite from your Horizon FLEX server nd import it to the Windows omputer. Prerequisites Beome fmilir with how to instll nd use the MMC Certifites snp-in on Windows system. For more informtion, go to the Windows TehNet We site t Instll Windows IIS. 24 VMwre, In.

25 Chpter 3 Setting Up Certifites for Horizon FLEX Virtul Mhines 1 Export the self-signed ertifite from your Horizon FLEX server. d On the Horizon FLEX server, strt MMC (mm.exe), dd the Certifites snp-in for omputer ount, nd mnge ertifites for the lol omputer. Selet File > Add/Remove Snp-in. Clik the Certifites snp-in nd lik Add. On the Certifites snp-in disply, selet Computer ount nd lik Next. This setting is required y the Horizon FLEX server. e f g Selet Lol Computer nd lik Finish nd then OK. In the left nvigtion pne, expnd Certifites (Lol Computer). Right-lik on Trusted Root Certifition Authorities nd selet All Tsks > Import. The Certifite Import Wizrd opens. h i j Clik Next. Browse for the root ertifite file nd lik Next. Selet Ple ll ertifites in the following store: Trusted Root Certifition Authorities nd lik Next, then lik Finish. k Right-lik on Intermedite Root Certifition Authorities nd selet All Tsks > Import. l m n o p q The Certifite Import Wizrd opens. Browse for the root ertifite file nd lik Next. Selet Ple ll ertifites in the following store: Intermedite Root Certifition Authorities nd lik Next, then lik Finish. Repet steps m. nd n. for eh intermedite ertifite to e instlled. Nvigte to Trusted Root Certifition Authorities > Certifites. Selet nd export the self-signed ertifite. Export the ertifite in DER-enoded inry X.509 (.CER) formt. 2 Copy the self-signed ertifite to the lient Windows omputer. 3 Import the self-signed ertifite to the lient Windows omputer. On the Windows omputer, strt MMC (mm.exe). Add the Certifites snp-in for the omputer ount nd mnge ertifites for the lol omputer. Import the self-signed ertifite into Trusted Root Certifition Authorities > Certifites. The self-signed ertifite is now trusted for ll users. Instll Self-Signed Certifite on M To instll self-signed ertifite on M host, you export the ertifite from your Horizon FLEX server nd import it to the M. Prerequisites Beome fmilir with how to instll nd use the MMC Certifites snp-in on Windows system. For more informtion, go to the Windows TehNet We site t VMwre, In. 25

26 VMwre Horizon FLEX Administrtion Guide Beome fmilir with how to use Keyhin Aess on M. For more informtion, go to the Apple Support We site t Instll Windows IIS. 1 Export the self-signed ertifite from your Horizon FLEX server. d On the Horizon FLEX server, strt MMC (mm.exe), dd the Certifites snp-in for omputer ount, nd mnge ertifites for the lol omputer. Selet File > Add/Remove Snp-in. Clik the Certifites snp-in nd lik Add. On the Certifites snp-in disply, selet Computer ount nd lik Next. This setting is required y the Horizon FLEX server. e f g Selet Lol Computer nd lik Finish nd then OK. In the left nvigtion pne, expnd Certifites (Lol Computer). Right-lik on Trusted Root Certifition Authorities nd selet All Tsks > Import. The Certifite Import Wizrd opens. h i j Clik Next. Browse for the root ertifite file nd lik Next. Selet Ple ll ertifites in the following store: Trusted Root Certifition Authorities nd lik Next, then lik Finish. k Right-lik on Intermedite Root Certifition Authorities nd selet All Tsks > Import. l m n o p q The Certifite Import Wizrd opens. Browse for the root ertifite file nd lik Next. Selet Ple ll ertifites in the following store: Intermedite Root Certifition Authorities nd lik Next, then lik Finish. Repet steps m. nd n. for eh intermedite ertifite to e instlled. Nvigte to Trusted Root Certifition Authorities > Certifites. Selet nd export the self-signed ertifite. Export the ertifite in DER-enoded inry X.509 (.CER) formt. 2 Copy the self-signed ertifite to the M. 3 Import the self-signed ertifite on the M. Doule-lik the self-signed ertifite to open it in Keyhin Aess. The self-signed ertifite ppers in login. Copy the self-signed ertifite to System. You must opy the ertifite to System to ensure tht it is trusted y ll users nd lol system proesses, inluding the virtul mhine (vmwre-vmx) proesses in Fusion Pro. Open the self-signed ertifite in System, expnd Trust, selet Use System Defult, nd sve your hnges. 26 VMwre, In.

27 Chpter 3 Setting Up Certifites for Horizon FLEX Virtul Mhines d e Reopen the self-signed ertifite in System, expnd Trust, selet Alwys Trust, nd sve your hnges. Delete the self-signed ertifite from login. Using Internl CA Certifites If you use ertifite from n internl CA insted of from ommeril CA suh s Entrust or Go Dddy, nd you do not onfigure the ertifite into the soure virtul mhine eing prepred, you must instll the root CA ertifite on eh end-user host for Horizon FLEX virtul mhines to funtion orretly. NOTE Beuse the server ertifite is signed y the root CA, you do not need to import the server ertifite to end-user hosts. If the list of ertifites is empty in the poliy file, Worksttion Plyer nd Fusion Pro will fll k to uthentiting ginst the host's list of trusted ertifites. If you inlude the internl CA ertifite of soure virtul mhine on the Horizon FLEX Poliy Server, nd you onfigure or instll the ertifite for the Horizon FLEX Client (either in the soure virtul mhine's poliy file or in the host's list of trusted ertifites), you do not need to instll the root CA ertifite on enduser hosts when ertifite updtes re required, for exmple, when ertifite expires. For informtion out onfiguring ertifites into soure virtul mhine, see Crete Soure Virtul Mhine in Fusion Pro, on pge 32. For informtion out reting trusted ertifites list nd importing it to the Horizon FLEX Poliy Server, see Creting Trusted Certifites List, on pge 21. For informtion out updting ertifites, see Updting Certifites on the Server, on pge 24. Instll n Internl Root CA Certifite on Windows Computer To instll n internl root CA ertifite on Windows host, you export the ertifite from your Horizon FLEX server nd import it to the Windows omputer. Prerequisites Beome fmilir with how to instll nd use the MMC Certifites snp-in on Windows system. For more informtion, go to the Windows TehNet We site t Otin nd instll n internl CA ertifite. You n use the Windows MMC Certifites snp-in to request ertifite. Instll Windows IIS. 1 Export the root CA ertifite from your Horizon FLEX server. d On the Horizon FLEX server, strt MMC (mm.exe), dd the Certifites snp-in for omputer ount, nd mnge ertifites for the lol omputer. Selet File > Add/Remove Snp-in. Clik the Certifites snp-in nd lik Add. On the Certifites snp-in disply, selet Computer ount nd lik Next. This setting is required y the Horizon FLEX server. e f Selet Lol Computer nd lik Finish nd then OK. In the left nvigtion pne, expnd Certifites (Lol Computer). VMwre, In. 27

28 VMwre Horizon FLEX Administrtion Guide g Right-lik on Trusted Root Certifition Authorities nd selet All Tsks > Import. The Certifite Import Wizrd opens. h i j k l m n o p q Clik Next. Browse for the root ertifite file nd lik Next. Selet Ple ll ertifites in the following store: Trusted Root Certifition Authorities nd lik Next, then lik Finish. Right-lik on Intermedite Root Certifition Authorities nd selet All Tsks > Import. The Certifite Import Wizrd opens. Browse for the root ertifite file nd lik Next. Selet Ple ll ertifites in the following store: Intermedite Root Certifition Authorities nd lik Next, then lik Finish. Repet steps m. nd n. for eh intermedite ertifite to e instlled. Nvigte to Trusted Root Certifition Authorities > Certifites. Selet nd export the root CA ertifite. Export the ertifite in DER-enoded inry X.509 (.CER) formt. 2 Copy the root CA ertifite to the Windows omputer. 3 Import the root CA ertifite to the Windows omputer. On the Windows omputer, strt MMC (mm.exe). Add the Certifites snp-in for the omputer ount nd mnge ertifites for the lol omputer. Import the root CA ertifite into Trusted Root Certifition Authorities > Certifites. The root CA ertifite is now trusted for ll users. Instll n Internl Root CA Certifite on M To instll n internl root CA ertifite on M host, you export the ertifite from your Horizon FLEX server nd import it to the M. Prerequisites Beome fmilir with how to instll nd use the MMC Certifites snp-in on Windows system. For more informtion, go to the Windows TehNet We site t Beome fmilir with how to use Keyhin Aess on M. For more informtion, go to the Apple Support We site t Instll Windows IIS. 1 Export the root CA ertifite from your Horizon FLEX server. On the Horizon FLEX server, strt MMC (mm.exe), dd the Certifites snp-in for omputer ount, nd mnge ertifites for the lol omputer. Selet File > Add/Remove Snp-in. Clik the Certifites snp-in nd lik Add. 28 VMwre, In.

29 Chpter 3 Setting Up Certifites for Horizon FLEX Virtul Mhines d On the Certifites snp-in disply, selet Computer ount nd lik Next. This setting is required y the Horizon FLEX server. e f g Selet Lol Computer nd lik Finish nd then OK. In the left nvigtion pne, expnd Certifites (Lol Computer). Right-lik on Trusted Root Certifition Authorities nd selet All Tsks > Import. The Certifite Import Wizrd opens. h i j k l m n o p q Clik Next. Browse for the root ertifite file nd lik Next. Selet Ple ll ertifites in the following store: Trusted Root Certifition Authorities nd lik Next, then lik Finish. Right-lik on Intermedite Root Certifition Authorities nd selet All Tsks > Import. The Certifite Import Wizrd opens. Browse for the root ertifite file nd lik Next. Selet Ple ll ertifites in the following store: Intermedite Root Certifition Authorities nd lik Next, then lik Finish. Repet steps m. nd n. for eh intermedite ertifite to e instlled. Nvigte to Trusted Root Certifition Authorities > Certifites. Selet nd export the root CA ertifite. Export the ertifite in DER-enoded inry X.509 (.CER) formt. 2 Copy the root CA ertifite to the M. 3 Import the root CA ertifite on the M. Doule-lik the root CA ertifite to open it in Keyhin Aess. The root CA ertifite ppers in login. Copy the root CA ertifite to System. You must opy the ertifite to System to ensure tht it is trusted y ll users nd lol system proesses, inluding the virtul mhine (.vmx) proesses in Fusion. d e Open the root CA ertifite, expnd Trust, selet Use System Defults, nd sve your hnges. Reopen the root CA ertifite, expnd Trust, selet Alwys Trust, nd sve your hnges. Delete the root CA ertifite from login. VMwre, In. 29