Workspace. User Guide (Administrators) Issue 04 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 Issue 04 Date HUAWEI TECHNOLOGIES CO., LTD.

2 Copyright Huawei Technologies Co., Ltd All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. i

3 Contents Contents 1 Introduction Concepts Workspace Software Client Thin Client Mobile Terminal Infrastructure Server AD Management Server Desktop Regions and AZs Project Application Scenarios Service Process and Function Overview Accessing and Using Workspace How to Access Workspace Workspace Packages Workspace Monitoring Metrics Related Services User Permissions Getting Started Logging In to the Workspace Management Console Applying for the Workspace Service Creating Workspace Desktops Logging In to a Desktop Using an SC Logging In to a Desktop Using an SC (Using a Proxy for Internet Access) Logging In to a Desktop Using a Browser Logging In to a Desktop Using a TC Logging In to a Desktop Using a Mobile Terminal (Android) Logging In to a Desktop Using a Mobile Terminal (ios) Operation Guide (Administrators) Overview Managing Desktops Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. ii

4 Contents 3.3 Managing Desktop Pools Managing Users Managing User Group Viewing User Login Records Managing Policies Managing Policy Group Restoring Infrastructure Server Data Changing the Internet Access Address Changing the Service Subnet Changing the Internet Access Port Configuring Two-Factor Authentication Changing the Password of a Domain Administrator (Optional) Configuring the WSUS Canceling Workspace Operation Guide (End Users) Introduction to Workspace Introduction to Terminals Risky Operations Failure When Connecting to Desktops Dual-Screen Display Configuration HDPDeviceHelper Peripheral Assistant FAQs (Administrators) What Is Workspace? What Are the Features and Advantages of Workspace? What Is the Process of Using Workspace? What Are Workspace Packages? How Is Workspace Charged? Do I Need to Purchase TCs? How Do End Users Access the Internet? How Do I Install Applications on the Desktop? What Resources Do I Need to Prepare Before Applying for Workspace? What Should I Do If I Fail to Apply for Workspace? How Is Workspace Connected to Enterprise Intranets? How Do I Interconnect Workspace with Microsoft AD? What Should I Do If I Fail to Apply for Workspace by Interconnecting with Microsoft AD? How Do I Check the Network Status of Desktops? What Are the Network Requirements for Accessing the Desktop? FAQs (End Users) What Devices Can Be Used to Log In to Workspace? What Are the Precautions for Using Workspace? What OSs Can Run on Workspace? Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. iii

5 Contents 6.4 Can I Upgrade OSs by Myself? How Do I Install Applications on the Desktop? What Software Is Compatible with Workspace? How Does Workspace Manage Peripherals? Does Workspace Support Personalized Settings? Can Data in Workspace Be Saved for a Long Time? How Do I Use a Local Printer for Printing? How Do I Use a Network Printer for Printing? What Should I Do If the Desktop Cannot Be Connected? How Do I Log In to the Desktop for Maintenance Using VNC? What Should I Do If the Desktop Freezes When Using Workspace? How Do I Check the Network Status of Desktops? How Do I Change the Login Password? How Do I Change the Login Password (Mobile Client)? What Should I Do If I Forget the Password? What Should I Do If the Account Is Locked? Does Workspace Support Dual-Screen Display? What Should I Do If I Fail to Log In to the GPU Desktop Using an SC? A Change History Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. iv

6 1 Introduction 1 Introduction 1.1 Concepts Workspace Concept Workspace is a cloud computing-based desktop service that outperforms personal computers (PCs) and the conventional Virtual Desktop Infrastructure (VDI) solution. Workspace provides the same configurations (including vcpus, GPUs, memory, and disks) as those of PCs and Windows OSs. Its familiarity ensures that you can use Workspace like using your own PCs. Different from the conventional local VDI solution, Workspace does not require high investment or a long deployment period. Workspace can automatically handle heavy deployment tasks and provide hosting services. Workspace supports access from multiple devices, including computers running Windows OSs, ipads, iphones, and Android smart devices (For details, see Software Client, Mobile Terminal). With Workspace, you can save and obtain files, and use applications anytime and anywhere, implementing mobile office. Procedure After you apply for Workspace, a secure and exclusive Workspace infrastructure server (For details, see Infrastructure Server) will be deployed and a dedicated elastic IP address used for accessing Workspace will be allocated to you. You can create an active directory (AD) domain (For details, see AD Management Server) on the cloud or use your local Microsoft AD domain when you apply for the Workspace service. With Workspace, you can effortlessly create and configure desktops (For details, see Desktop). Workspace provides packages of multiple types and supports disk configurations, ensuring secure and simple user operations. After you apply for the Workspace service and desktops are successfully created, the system will notify the end users by . Principle Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 1

7 1 Introduction Figure 1-1 illustrates basic principles of Workspace. Figure 1-1 Basic principles of Workspace Software Client Thin Client Mobile Terminal A software client (SC) runs on local PCs running Windows or Mac OSs and is used for logging in to and using Workspace. A thin client (TC) is a PC-standard-compliant computer that uses an embedded processor and small-sized flash memory and runs a simplified OS. It is used to access Workspace. The TC sends whatever entered by the mouse and keyboard to the backend server for processing and then the backend server returns the processing result to the display connecting to the TC. TCs of various models provide different performance, peripheral ports, and operation portals. The variety of TCs meets the requirements of different scenarios, such as common office, high security, and high-performance graphics design. A mobile terminal is a mobile device used for logging in to and using Workspace, including ipads, iphones, and Android smart devices Infrastructure Server An infrastructure server is automatically created when you apply for Workspace and runs components such as desktop management. Two infrastructure servers occupy two quotas, including two instances, eight cores, and 32 GB memory AD Management Server The active directory (AD) management server, an infrastructure component where the AD service is deployed, provides directory service functions for centralized organization management and network resource access. You can create an AD domain on the cloud or use your local Microsoft AD domain when you apply for the Workspace service. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 2

8 1 Introduction Desktop Regions and AZs Project A desktop is a virtual computer system where desktop agent software is installed and that can interact with desktop management components. Workspace deposits all desktops in the data center for unified management. End users can access the desktop by using SCs, browsers, TCs, or mobile terminals to obtain complete PClike user experience. Desktops can be classified into the following types based on the assignment mode: Dedicated desktop: Each user exclusively uses a desktop. Shared desktop: In time-based reuse mode, each desktop can be used by only one user at a time. Pooled desktop: Multiple desktops form a desktop pool for multiple users to use. Each user can use any idle desktop in the desktop pool. A region is a geographic area where Workspace is located. Workspace services in the same region can communicate with each other over an intranet, but those in different regions cannot. Public cloud data centers are deployed worldwide in places such as North America, Europe, and Asia. Workspace is therefore available in different regions. For example, applications can be designed to meet user requirements in specific regions or comply with local laws or regulations. Each region contains many availability zones (AZs) where power and networks are physically isolated. AZs in the same region can communicate with each other over an intranet. Each AZ provides cost-effective and low-latency network connections that are unaffected by faults that may occur in other AZs. Using Workspace deployed in an independent AZ protects your applications against failures in a single place. Projects are used to group and isolate OpenStack resources (computing resources, storage resources, and network resources). A project can be a department or a project team. Multiple projects can be created for one account. 1.2 Application Scenarios Use of conventional PC desktops or the local VDI solution requires high investment and features difficult and complicated deployment and management. For Workspace, neither early investment nor continuous infrastructure management is required. You can apply for a complete set of cloud desktop computing services, such as computation and persistent storage, with certain fees, providing secure desktop experience with various access options for your users in simple and cost-effective ways. Workspace can be applied to mainstream industries including government and public utilities, telecommunications, energy, finance, transportation, medical care, education, broadcasting, media, and manufacturing. It is applicable to diversified scenarios, such as common office, security office, branch office, and public terminal (call center, business hall, and training classroom). Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 3

9 1 Introduction Mobile office scenario Users can log in remotely to Workspace anytime and anywhere. Workspace is applicable for employees who are on business trips frequently and need to work in many locations. Short-term use scenario Workspace and necessary application system services can be configured for short-term employees of enterprises. After the short-term employees leave, their services can be stopped. Security office automation (OA) scenario Workspace can provide enterprises with office solutions that comply with the enterprises' security standards. Permission to access physical devices can be controlled and data is not locally stored, thereby improving the security of enterprise data. Branch office scenario Workspace is applicable for employees who work in branches and external employees. They can log in to Workspace to access applications on the headquarters network. Data is not locally stored. High-definition (HD) graphics processing scenario Workspace provides 2D and 3D graphics processing capabilities for end users and supports multiple high-performance graphics software such as Computer Aided Design (CAD) and Geographic Information System (GIS), 3D game software, and omnimedia video editing software. Workspace can meet the high-performance graphics processing requirements of customers from multiple industries (including engineering, manufacturing, oil, automobile, medical care, game, and media). 1.3 Service Process and Function Overview Workspace provides two different operation pages for administrators and end users respectively. Administrators apply for the Workspace service, create desktops, manage desktops and users on the Workspace management console. End users log in to and use desktops on the web page. Figure 1-2 shows the processes for applying Workspace and creating a Workspace desktop. Figure 1-2 Operation process for administrators Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 4

10 1 Introduction Figure 1-3 shows the process for logging in to and using a desktop. Figure 1-3 Operation process for end users Table 1-1 describes the functions provided by Workspace. Table 1-1 Function list Role Function Description Administrator Self-service service application Self-service desktop creation User login record query LiteAD authentication Customer AD diversification Shared desktop Pooled desktop Policy management The administrator can apply for the Workspace service online in self-service mode. The administrator can create Workspace desktops online in self-service mode. User login information can be recorded, including login time and device types. The Linux-based AD can be used to implement username and password authentication. Existing Microsoft ADs of enterprises can be interconnected. In time-based reuse mode, each desktop can be used by only one user at a time. Multiple desktops form a desktop pool for multiple users to use. Each user can use any idle desktop in the desktop pool. The administrator can configure policies to manage devices such as printers and USB devices. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 5

11 1 Introduction Role Function Description End user End user notification Windows 7 desktop experience Windows 10 desktop experience Multi-device access The administrator can send notification s to new users who obtain desktops. The Windows 7 desktop experience based on the Windows Server 2008 R2 64-bit OS is provided. The Windows 10 desktop experience based on the Windows Server 2016 OS is provided. End users can access desktops by using PCs running Windows or Mac OSs and Android or ios mobile phones or tablets. 1.4 Accessing and Using Workspace How to Access Workspace The public cloud provides a web-based service management platform. Users can access Workspace by using a management console. For details about how to log in to the Workspace management console, see Logging In to the Workspace Management Console. You need to enable ports listed in Table 1-2 on the enterprise firewall so that end users can log in to the desktops properly. Table 1-2 Internet access ports Port Protocol Description 443 TCP Used by the end user to access the web login page TCP Used by the end user to access the desktop. NOTE By default, port 443 and port 8443 are used. If you want to change the ports, see Changing the Internet Access Port. Figure 1-4 shows how an end user accesses Workspace through a specified port. Figure 1-4 Accessing Workspace Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 6

12 1 Introduction Workspace Packages Workspace Packages Workspace resources are packaged for leasing. Packages shown in Table 1-3 and Table 1-4 are for reference only. The actual package prevails. Table 1-3 Workspace General Category Workspace General Instance workspace.c2.large.w indows workspace.c2.xlarge.wi ndows workspace.c2.2xlarg e.windows vcpu Memory (GB) System Disk (GB) Data Disk (GB) 80 to 32, to 32, to 32,768 0, 100 to 32,768 0, 100 to 32,768 0, 100 to 32,768 Guest OS Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Number of GPUs GPU Type GPU RAM (GB) Table 1-4 Workspace GPU Category Workspace GPU Instance workspace.g1.xlarge. windows workspace.g1.2xlarge.w indows workspace.g2.2xlarg e.windows vcpu Memory (GB) System Disk (GB) 80 to 32, to 32,768 80~32768 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 7

13 1 Introduction Data Disk (GB) 0, 100 to 32,768 0, 100 to 32,768 0, 100~32768 Guest OS Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2016 with Windows 10 experience Number of GPUs GPU Type M60-1Q M60-1Q M60 GPU RAM (GB) NOTE The data disk configuration policies are as follows: No data disk is configured. Configure a data disk based on actual requirements. The disk capacity ranges from 100 GB to 32,768 GB Workspace Monitoring Metrics Table 1-5 describes Workspace monitoring metrics. Table 1-5 Workspace monitoring metrics Metric Description Value Range Monitored Object CPU usage Measures the CPU usage of a monitored object (unit: %). 0% to 100% Infrastructure server Memory usage Measures the memory usage of a monitored object (unit: %). 0% to 100% Infrastructure server Disk usage Measures the disk usage of a monitored object (unit: %). 0% to 100% Infrastructure server IOPS Measures the number of I/O operations per second on a monitored object. 0 counts Infrastructure server Network input throughput Measures incoming network traffic of a monitored object per second (unit: bytes/s). 0 bytes/s Infrastructure server Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 8

14 1 Introduction Metric Description Value Range Monitored Object Network output throughput Measures outgoing network traffic of a monitored object per second (unit: bytes/s). 0 bytes/s Infrastructure server Related Services ECS Elastic Cloud Server (ECS) is a computing server that consists of CPUs, memory, images, and Elastic Volume Service (EVS) disks, and supports on-demand allocation and elastic scaling. The Workspace service invokes ECS interfaces to create desktops. IMS Image Management Service (IMS) provides a simple and convenient self-service management function. In Workspace, desktops are created based on IMS. ELB Elastic Load Balance (ELB) is a service that automatically distributes access traffic to multiple ECSs to balance their service loads. It enables you to achieve greater levels of fault tolerance in your applications and expand application service capabilities. ELB is the access entry of Workspace from the Internet. VPC Virtual Private Cloud (VPC) provides virtual networks similar to conventional networks and advanced network services, such as elastic IP addresses, security groups, and virtual private networks (VPNs). The VPC service implements network isolation in logical mode and provides secure and isolated network environments for Workspace. DirectConnect Direct Connect (DirectConnect) is a service that allows you to establish a dedicated network connection from your data center to the cloud platform. With DirectConnect, potential network delays when Workspace is used are reduced, which provides a highperformance system to satisfy user experience. IAM User Permissions Identity and Access Management (IAM) is a Web service. The administrator can apply this service to manage users and user rights. Only after an account is created through IAM can the administrator use related resources of Workspace. Public cloud provides two types of user permissions by default: user management and resource management. User management refers to the management of users, user groups, and user group rights. Resource management refers to the control operations that can be performed by users on cloud service resources. For further details, see Permissions. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 9

15 2 Getting Started 2 Getting Started 2.1 Logging In to the Workspace Management Console Scenario Procedure Log in to the Workspace management console. Step 1 Use the administrator account to log in to the console home. Step 2 Click in the upper-left corner of the management console and select Region and Project. Step 3 On Homepage, locate Enterprise Application and select Workspace. The Workspace management console is displayed. ----End 2.2 Applying for the Workspace Service Scenario Prerequisites Apply for the Workspace service. After you apply for Workspace, a secure and exclusive Workspace infrastructure will be deployed and a dedicated elastic IP address used for accessing Workspace will be allocated to you. The AD is a necessary component used for managing users and desktops. You can create an AD on the cloud or use an existing AD. After you apply for the Workspace service, you can create Workspace desktops. When applying for Workspace, if the existing enterprise AD domain is used, refer to How Do I Interconnect Workspace with Microsoft AD? to enable related ports on the AD server and prepare the following data: Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 10

16 2 Getting Started Domain name Domain administrator's account and password Active domain controller IP address (Optional) Standby domain controller IP address Active DNS server IP address (Optional) Standby DNS server IP address Procedure Step 1 Step 2 Log in to the Workspace management console. On the Dashboard page, click Apply for Workspace. The Apply for Workspace page is displayed. Step 3 Select an AZ based on actual conditions. NOTE An availability zone (AZ) is a physical region where resources use independent power supplies and networks. AZs are physically isolated but interconnected through an internal network, improving HA of applications. Step 4 Click View VPC to create a VPC and a subnet. For details about how to create a VPC, see the Virtual Private Cloud User Guide. NOTE You are advised to use 16-bit subnet gateways during VPC creation. After you apply for the Workspace service, do not modify the VPC configuration. Workspace reserves the /16 network segment for the NIC on the management plane. Use other network segments when creating subnets in VPCs. Step 5 Click to refresh the VPC drop-down list. Step 6 Configure the VPC. NOTE You can select multiple subnets to support more desktops. Use the subnet that is created in Step 4 and dedicated to Workspace. Do not use the subnet dedicated to other services. Step 7 Configure the AD domain. Check whether your enterprise has an AD domain. If yes, go to Step 9. If no, go to Step 8. Step 8 Create an AD domain. Set the Domain Name, Domain Administrator Account, Domain Administrator Password, and Confirm Password parameters of the new AD domain. After an AD domain is created, go to Step 10. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 11

17 2 Getting Started NOTE To ensure system security, you need to change the password periodically. You are advised to change the password every three months. Step 9 Connect to the existing domain. Set the Domain Name, Domain Administrator Account, Domain Administrator Password, Primary Domain Controller IP Address, Standby Domain Controller IP Address, Active DNS IP Address, and Standby DNS IP Address parameters of the existing domain. NOTE Workspace supports only AD servers running Windows Server 2008 or later. When you use an existing AD domain, ensure that the related ports of the firewall are enabled. For details, see How Do I Interconnect Workspace with Microsoft AD?. Step 10 Specify the network access mode. By default, Internet access is selected. You can select multiple options. If the network quality does not meet requirements, you can select DirectConnect access. For details about the network quality requirements, see What Are the Network Requirements for Accessing the Desktop?. If GPU desktops are required, you must select DirectConnect access. NOTE The DirectConnect access mode provides the load balancing capability. Therefore, enterprises do not need to deploy third-party load balancers before access addresses. Step 11 Click Apply Now. The Workspace service application is complete. NOTE ----End The application process takes about 40 minutes. The system creates WorkspaceManagerSecurityGroup and WorkspaceUserSecurityGroup security groups in the VPC during the application. WorkspaceManagerSecurityGroup is used for management components, and WorkspaceUserSecurityGroup is used for user desktops. By default, only desktops in the WorkspaceUserSecurityGroup security group can access each other. If you want to access a desktop in the security group from an external desktop, choose VPC > Security Groups to modify the configurations. 2.3 Creating Workspace Desktops Scenario Select and create related packages and assign desktops to end users after applying for the Workspace service. After the administrator creates desktops, end users will be informed by that Workspace desktops are provisioned. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 12

18 2 Getting Started NOTE The following describes the concepts of Username, Computer Name, and Desktop Name and explains the relationships among them. Username is set by the administrator on the desktop creation console. It is used for logging in to the desktop. A username can be associated with an address only once. Computer Name is the name or number of the Windows OS installed on a desktop. Microsoft limits the maximum length of a computer name to 15 characters. Desktop Name is created by Workspace automatically. It consists of a username and two digits. For example, if the administrator sets Test as the username, the name of the first desktop is Test01 and that of the second desktop is Test02. Desktop Name is the same as Computer Name. Therefore, a desktop name can only contain a maximum of 15 characters. If a username consists of more than 13 characters, the leftmost 13 characters of the username and two digits are used to create the desktop name. Procedure Step 1 Step 2 Log in to the Workspace management console. On the Dashboard or Desktop page, click Create Desktop. The Create Desktop page is displayed. Step 3 Select a Desktop Type based on actual conditions. For details about desktop types, see Desktop. If you select Dedicated desktop or Shared desktop, go to Step 7. If you select Pooled desktop, go to Step 4. Step 4 Step 5 Step 6 Step 7 Check whether a desktop pool exists. If yes, go to Step 6. If no, go to Step 5. Set Desktop Pool to Create, and input Desktop Pool Name as required. Set Desktop Pool to Exist, and select a desktop pool from the drop-down list box of Desktop Pool Name. Select an AZ based on actual conditions. An availability zone (AZ) is a physical region where resources use independent power supplies and networks. AZs are physically isolated but interconnected through an internal network. If you create a desktop for the first time, you are advised to use the default value, that is, the optimal AZ recommended by the system. If you do not create a desktop for the first time, you are advised to create desktops in different AZs to improve application availability. Step 8 Step 9 Step 10 Select the Type based on site requirements. Select the proper Specifications based on site requirements. Select the proper Image Type and OS based on site requirements. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 13

19 2 Getting Started NOTE For details about the creation and maintenance of private images, see the Workspace Private Image Management Guide. If the private images of the GPU type are required, select GPU optimized in Type in Step 8. Step 11 Configure disks based on the actual requirements. Table 2-1 provides disk configuration details. Table 2-1 Disk configuration Category Description Disk Type Configuration Range (GB) System Disk Mandatory. Only one system disk can be configured based on the actual requirements. Common I/O: type of disks that use SATA storage. Ultra-high I/O: type of disks that use SSD storage. 80 to 32,768 Data Disk Optional. A maximum of 10 data disks can be configured based on the actual requirements. Common I/O: type of disks that use SATA storage. Ultra-high I/O: type of disks that use SSD storage. 100 to 32,768 Step 12 Step 13 Step 14 Select a Service Subnet based on actual conditions. Check whether the user's existing AD domain is used in Workspace. If yes, go to Step 14. If no, go to Step 15. Set the OUs on the existing AD server. Enter a maximum of 5 levels and separate levels from each other using a slash (/). Only letters, digits, spaces (not before or after a slash), and special characters including are allowed, for example, ab/cd/ef. Step 15 Assign desktops. You can manually add or batch import users. In a scenario where the existing AD domain is used, you need to create users on the AD server before assigning desktops. Manual input Set Username used for logging in to Workspace and used for receiving the notification . Select a user group from the drop-down list of User Group. You can grant different levels of access permission to users based on site requirements. The following describes the user group permission: Administrators: Administrator group. Administrators have complete access to the desktop and can make any desired changes except for forbidden operations. Users: Standard user group. Users in this group can use most software and change system settings that do not affect other users. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 14

20 2 Getting Started NOTE You can click Add Desktop to add other desktops as required. A maximum of 10 desktops can be added each time. Each desktop belongs to one user only. Batch import. A maximum of 50 desktops can be added each time. Click Download Template. In the Excel template, enter values for columns A (Username), B ( ), and C (User Group) respectively. Save the settings and close the Excel template. Upload the file. Step 16 Send notification s. By default, the system automatically sends notification s to users after desktops are created. In a scenario where the existing AD domain is used, you can select or deselect Send Notification based on site requirements. Step 17 Click Create Now. The Confirm Specifications page is displayed. Step 18 Step 19 Check whether the value of Resource Details is correct. Click Submit. Desktops are created successfully. ----End 2.4 Logging In to a Desktop Using an SC Scenario Download, install, and configure an SC, and then log in to Workspace from the login address in the notification using the SC. NOTE When you access the Internet using a proxy, log in to your desktop by following the instructions in Logging In to a Desktop Using an SC (Using a Proxy for Internet Access). Prerequisites Required software has been downloaded and installed. For details, see Table 2-2. Table 2-2 Software packages Software Package AccessClient. msi How to Obtain Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 15

21 2 Getting Started Procedure Step 1 Step 2 After the SC is installed, double-click the CloudClient icon on the desktop to start the SC. In the Address Manager window, click Add. In the Edit Server Info window that is displayed, set Server Name to a customized name and set Server Address to the address obtained from the notification . NOTE The Edit Server Info window is displayed automatically upon your first login to the desktop. Step 3 Click Ok to save the configuration information, as shown in Figure 2-1. Figure 2-1 Edit Server Info Step 4 Step 5 Click Launch to go to the desktop login page. On the desktop login page, enter your domain account and password, and click Login to go to the desktop list page. Step 6 On the desktop list page, click to log in to the desktop, as shown in Figure 2-2. Figure 2-2 Desktop list ----End Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 16

22 2 Getting Started 2.5 Logging In to a Desktop Using an SC (Using a Proxy for Internet Access) Scenario Prerequisites Log in to a Workspace desktop using an SC when a proxy is used for Internet access. Required software has been downloaded and installed. For details, see Table 2-3. Table 2-3 Software packages Software Package AccessClient. msi How to Obtain Procedure Step 1 Step 2 After the software client is installed, double-click the CloudClient icon on the desktop to start the SC. In the Address Manager window, click Add. The Edit Server Info window is displayed. Figure 2-3 Edit Server Info Step 3 Set Server Name to a customized name and set Server Address to the address obtained from the notification . Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 17

23 2 Getting Started Step 4 Step 5 Click Ok. On the Address Manager page, select the newly added server address and click Launch. Step 6 Tap in the upper-right corner. The Settings dialog box is displayed. Step 7 On the Network tab page, select Enable HTTP Proxy. Figure 2-4 Enabling HTTP proxy Step 8 Step 9 Step 10 Step 11 Click Yes. Enter the value for Host, Port, User Name, and Password of the proxy server obtained from the administrator. Click Ok. On the desktop login page, enter your domain account and password, and click Login to go to the desktop list page. Step 12 On the desktop list page, click to log in to the desktop, as shown in Figure 2-5. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 18

24 2 Getting Started Figure 2-5 Desktop list ----End 2.6 Logging In to a Desktop Using a Browser Scenario Log in to a Workspace desktop using a browser. Use Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, Internet Explorer 11, and Mozilla Firefox 14 or later to log in to desktops. Procedure NOTE When you use a proxy for Internet access, you cannot log in to your desktop using a browser. Instead, you can log in to your desktop following the instructions in Logging In to a Desktop Using an SC (Using a Proxy for Internet Access). NOTE A Windows PC is used as an example in the following steps. The specific operation steps may be different on different OSs. Step 1 Open the browser, enter the desktop login address obtained from the notification in the address box, and press Enter. The window for logging in to the desktop is displayed. If a dialog box indicating a plug-in running request is displayed in the browser, enable the plug-in to avoid any effect on proper login and use. Step 2 Enter your domain account and password, and click Login, as shown in Figure 2-6. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 19

25 2 Getting Started Figure 2-6 Login window Step 3 Download the client plug-in upon the first login, as shown in Figure 2-7. Figure 2-7 Download the client plug-in Step 4 On the desktop list page, click to log in to the desktop, as shown in Figure 2-8. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 20

26 2 Getting Started Figure 2-8 Desktop list ----End 2.7 Logging In to a Desktop Using a TC Scenario Procedure Log in to a Workspace desktop using a TC. Step 1 Step 2 Step 3 Step 4 Connect all cables and power on the TC. Click Start, and choose Control Center. In Control Center, select Cloud Client. Click Add. In the Edit Server Info window that is displayed, set Server Name to a customized name and set Server Address to the address obtained from the notification . Step 5 Step 6 Step 7 Click Ok to save the configuration information. Click Launch to go to the desktop login page. On the desktop login page, enter your domain account and password, and click Login to go to the desktop list page. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 21

27 2 Getting Started Step 8 On the desktop list page, click to log in to the desktop. ----End 2.8 Logging In to a Desktop Using a Mobile Terminal (Android) Scenario Procedure FusionAccess is an application installed on a mobile terminal and used for accessing and using Workspace desktops. If you need to use Workspace desktops to work at home or during your trips, you can download FusionAccess to your Android device and use it to access and use Workspace desktops. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Open the application store (Google Play Store) on your Android mobile terminal. Search for FusionAccess. Download and install the FusionAccess desktop client software. After the FusionAccess software is installed, open the software on your Android mobile terminal. Tap Add Account. On the Add page that is displayed, set Label to customized description, set Address and User Name to the address and username obtained from the notification , and set Password to the new password. Tap save in the upper-right corner to save the configuration. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 22

28 2 Getting Started Figure 2-9 Configuration Step 8 On the home page of the FusionAccess software, tap the Label you set to log in to the desktop. The following figure shows the functions of the shortcut menus on the desktop. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 23

29 2 Getting Started Figure 2-10 Desktop ----End 2.9 Logging In to a Desktop Using a Mobile Terminal (ios) Scenario Procedure FusionAccess is an application installed on a mobile terminal and used for accessing and using Workspace desktops. If you need to use Workspace desktops to work at home or during your trips, you can download FusionAccess to your ios devices and use it to access and use Workspace desktops. Step 1 Step 2 Step 3 Step 4 Step 5 Open App Store on your ios mobile terminal. Search for FusionAccess. Download and install the FusionAccess desktop client software. After the FusionAccess software is installed, open the software on your ios mobile terminal. Tap New Account. Step 6 Tap in the upper-right corner. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 24

30 2 Getting Started The New Account page is displayed. Step 7 Step 8 Set Description to customized description, set Address and User Name to the address and username obtained from the notification , and set Password to the new password. Tap Save in the upper-right corner to save the configuration. Figure 2-11 Configuration Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 25

31 2 Getting Started Step 9 On the home page of the FusionAccess software, tap the desktop description you set to log in to the desktop. The following figure shows the functions of the shortcut menus on the desktop. Figure 2-12 Desktop ----End Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 26

32 3 Operation Guide (Administrators) 3 Operation Guide (Administrators) 3.1 Overview Configuration Information After applying for the Workspace service, view statistics information about Workspace, including the configuration information, desktop status, and number of online users on the Dashboard page. Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Configuration Information area, view Workspace network configurations and AD domain configurations. Desktop Status ----End Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Status area, Workspace displays the Login Status and Running Status of the desktop in pie charts. Table 3-1 describes the meaning of each status. Table 3-1 Desktop status Category Status Description Login Status In use Indicates that a user has successfully logged in to the desktop and is using the desktop. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 27

33 3 Operation Guide (Administrators) Category Status Description Running Status Unregistered Ready Disconnected Running Stopped Faulty Indicates that the desktop is stopped or faulty. A desktop automatically registers with the infrastructure server after being started up. Indicates that the desktop has been registered with and connected to the infrastructure server and is waiting for the user to log in. Indicates that the desktop is disconnected from the terminal because the user closes the window of the terminal or the network connection between the terminal and the desktop is interrupted. Indicates that the desktop runs properly. Indicates that the desktop is stopped. Indicates that the desktop is faulty. You can restart the desktop or contact technical support engineers to rectify the fault. ----End Number of Online Users Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Online Users area, view the number of online users by day, week, or month. ----End 3.2 Managing Desktops Scenario Procedure Start, stop, restart, or delete a desktop, add disks to a desktop, manage users, or change desktop specifications. Step 1 Step 2 Log in to the Workspace management console. Click Desktop. The Desktop page is displayed. Step 3 In the upper-right corner of the desktop list, select Assigned user, enter a keyword, and click. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 28

34 3 Operation Guide (Administrators) Step 4 Select a desktop, and click Start/Stop/Restart/Delete/Add Disk/Manage User/Modify Specifications in the upper-left corner of the desktop list or in the Operation column. NOTE When performing the Stop Desktop operation, determine whether to select Forcibly stop based on site requirements. When performing the Restart Desktop operation, determine whether to select Forcibly restart based on site requirements. When performing the Delete Desktop operation, determine whether to select Delete the user based on site requirements. You can add disks (data disks) to the desktop whose status is Running and user group is Administrators only. Each desktop can have a maximum of 10 data disks. You can add or delete users only on the desktop whose Desktop Type is Shared desktop. Each shared desktop requires at least one user. A maximum of five users are allowed. You can change specifications for desktops whose status is Stopped only and can only make them more advanced. Step 5 Confirm the displayed information. ----End 3.3 Managing Desktop Pools Scenario Procedure Create, edit, or delete a desktop pool, or view the number of desktops in a created desktop pool. Creating a desktop pool Step 1 Step 2 Log in to the Workspace management console. Click Desktop Pool Management. The Desktop Pool Management page is displayed. Step 3 Click Create Desktop Pool. The Create Desktop Pool dialog box is displayed. Step 4 Step 5 Step 6 Input Desktop Pool Name. Click Display Advanced Options, and set Peak time (weekdays), Peak time (hours), Prestarted in peak time, Prestarted in off-peak time, or Automatic restoration after shutdown as required. Click OK. ----End Editing a desktop group Step 1 Log in to the Workspace management console. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 29

35 3 Operation Guide (Administrators) Step 2 Click Desktop Pool Management. The Desktop Pool Management page is displayed. Step 3 Locate the row that contains the desktop pool you want to edit and click Edit. The Modify Desktop Pool dialog box is displayed. Step 4 Step 5 Click Display Advanced Options, and modify Desktop Pool Name, Peak time (weekdays), or Peak time (hours) as required. Click OK. ----End Deleting a desktop group Step 1 Step 2 Log in to the Workspace management console. Click Desktop Pool Management. The Desktop Pool Management page is displayed. Step 3 Locate the row that contains the desktop pool you want to delete and click Delete. The Delete dialog box is displayed. Step 4 Click OK. ----End 3.4 Managing Users Scenario Create a user, view the number of desktops owned by a user, change the address, export data, reset the password, unlock the account, send the notification or delete the account for a created user. Procedure NOTE If the enterprise uses an existing AD domain, the password reset and account unlocking functions are not supported. Creating a user Step 1 Step 2 Log in to the Workspace management console. Click User and Group Management. The User Management page is displayed. Step 3 Click Create User. The Create User dialog box is displayed. Step 4 Set Username and Address. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 30

36 3 Operation Guide (Administrators) Step 5 Step 6 Click Advanced Settings, enter Description if necessary, and select User Group. Click OK. ----End Changing an address You can change an address if the address provided by a user is incorrect or cannot receive s. Step 1 Step 2 Log in to the Workspace management console. Click User and Group Management. The User Management page is displayed. Step 3 Locate the row that contains the user whose address you want to change and click Modify. The Modify User Information dialog box is displayed. Step 4 Step 5 In the Address text box, enter the new address. Click OK. The user receives an address change notification. ----End Modifying other settings Step 1 Step 2 Log in to the Workspace management console. Click User and Group Management. The User Management page is displayed. Step 3 Locate the row that contains the user whose settings you want to modify and click Modify. The Modify User Information dialog box is displayed. Step 4 Step 5 Step 6 Click Advanced Settings. Modify the settings of Description, Option, Validity Period, or User Group of a user as required. Click OK. ----End Exporting data You can batch export user data, including the username, address, and the number of desktops. Step 1 Step 2 Log in to the Workspace management console. Click User and Group Management. The User Management page is displayed. Step 3 Click Export Account. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 31

37 3 Operation Guide (Administrators) The system exports user information to a local computer. ----End Resetting a password You can reset the password of a user when the user loses or forgets the login password. Password resetting is risky. After being reset, the original password cannot be used. Confirm that the operation is necessary. Step 1 Step 2 Log in to the Workspace management console. Click User and Group Management. The User Management page is displayed. Step 3 In the row that contains the user whose password needs to be reset, click More > Reset Password. The Reset Password dialog box is displayed. Step 4 Click OK. The password resetting link will be sent to the user's address automatically by the system. The validity period of the password resetting link in the is 24 hours. Reset the password in a timely manner. ----End Unlocking an account You can unlock the account for a user when the user's account is locked because the user enters an incorrect password consecutively. Step 1 Step 2 Log in to the Workspace management console. Click User and Group Management. The User Management page is displayed. Step 3 In the row that contains the user whose account needs to be unlocked, click More > Unlock. The dialog box for account unlocking is displayed. Step 4 Click OK. ----End Sending a notification You can send a notification when the user already has a desktop and the for notifying the user of the desktop creation needs to be sent again. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 32

38 3 Operation Guide (Administrators) Step 1 Step 2 Log in to the Workspace management console. Click User and Group Management. The User Management page is displayed. Step 3 In the row that contains the user to whom the notification needs to be sent, click More > Resend Notification . The dialog box for sending the is displayed. Step 4 Click OK. ----End Deleting an account You can delete a specific account as required. You cannot delete a user if the user has desktops. Step 1 Step 2 Log in to the Workspace management console. Click User and Group Management. The User Management page is displayed. Step 3 In the row that contains the user whose account needs to be deleted, click More > Delete (If the enterprise uses an existing AD domain, click Delete). The dialog box for user information deletion is displayed. Step 4 Click OK. ----End 3.5 Managing User Group Scenario Procedure Create, modify, or delete a user group, or add users to or delete users from each group. Creating a user group Step 1 Step 2 Log in to the Workspace management console. Click User and Group Management > Group. The Group Management page is displayed. Step 3 Click Create Group. The Create Group dialog box is displayed. Step 4 Step 5 Set parameters on the page, for example, Group Name. Click OK. Modifying a user group Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 33

39 3 Operation Guide (Administrators) Group Name cannot be modified. Only Address and Description can be modified. Step 6 Step 7 Log in to the Workspace management console. Click User and Group Management > Group. The Group Management page is displayed. Step 8 Locate the row that contains the user group whose settings you want to modify and click Modify. The Modify Group dialog box is displayed. Step 9 Step 10 Modify the settings of Address or Description as required. Click OK. Deleting a user group Step 11 Step 12 Log in to the Workspace management console. Click User and Group Management > Group. The Group Management page is displayed. Step 13 Locate the row that contains the user group you want to delete and click Delete. The Warning dialog box is displayed. Step 14 Click OK. Managing users Step 15 Step 16 Log in to the Workspace management console. Click User and Group Management > Group. The Group Management page is displayed. Step 17 Locate the row that contains the user group in which the users you want to manage and click Manage User. The Manage User dialog box is displayed. Step 18 Select Available Users and click to add the user to the user group. Select Selected Users and click to remove the user from the user group. Step 19 Click OK. ----End 3.6 Viewing User Login Records Scenario View user login records to obtain the desktop running status and user login status. This helps troubleshooting and system maintenance. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 34

40 3 Operation Guide (Administrators) Procedure Step 1 Step 2 Step 3 Log in to the Workspace management console. Click User Login Record. The User Login Record page is displayed. View user login records, including Desktop Name, Desktop IP Address, Login User, Terminal IP Address, Terminal System Type, Connection Start Time, Connection End Time, and Failure Cause. ----End 3.7 Managing Policies Scenario Procedure Configure policies such as USB Port Redirection, Printer Redirection, File Redirection, and Clipboard Redirection to control the permission on data transmission and peripheral access between user terminals and Workspace. Step 1 Step 2 Log in to the Workspace management console. Click Policy. The Policy page is displayed. Step 3 On the Policy page, click the following button to enable or disable a policy. Table 3-2 describes the policies. indicates that the policy is enabled. indicates that the policy is disabled. Table 3-2 Policy management Policy Type Policy Parameter Policy Description USB port redirection Graphics devices (such as scanners) Video devices (such as cameras) Print devices (such as printers) Storage devices (such as USB flash drives) Smartcard devices (such as Ukeys) Users can use USB graphics devices by using USB port redirection on desktops. Users can use USB video devices by using USB port redirection on desktops. Users can use USB print devices by using USB port redirection on desktops. Users can use USB storage devices by using USB port redirection on desktops. Users can use smartcard devices by using USB port redirection on desktops. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 35

41 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Printer redirection Universal printer driver File redirection Clipboard redirection HDP Plus Sync Client Default Printer Default HDP XPSDrv Driver Universal Printing PCL 5 Universal Printing PCL 6 Universal Printing PS Fixed Drive (such as local disks) Removable drive (such as USB flash drives) CD/DVD-ROM drives Network Drive Server to client Client to server Enable Bidirection Disable Enable Disable (default) Users can use printers by using printer redirection (a policy of device redirection) on desktops. When Default is selected, Universal Printing PS will be loaded if printer redirection is enabled on Linux clients, and HDP XPSDrv Driver will be loaded if printer redirection is enabled on Windows clients. NOTICE To use the printer service, you need to ensure that all end users use SCs running the same OS to log in to Workspace. Redirects client fixed drives. Redirects client removable drives, such as USB flash drives and removable hard disks. Redirects client CD-ROM drives. Redirects client network drives. After the redirection is enabled, end users can copy data on desktops and paste the data on clients. However, data copied on clients cannot be pasted on desktops. That is, the one-way clipboard function from the server to the client is supported. After the redirection is enabled, end users can copy data on clients and paste the data on desktops. However, data copied on desktops cannot be pasted on clients. That is, the one-way clipboard function from the client to the server is supported. After the redirection is enabled, end users can copy data on clients and paste the data on desktops, and data copied on desktops can also be pasted on clients. That is, the two-way clipboard function between the client and the server is supported. Disables the clipboard redirection. This option only applies to video editing scenarios. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 36

42 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Display level Advanced policies Smoothness first (default) Image quality first Bandwidth Frame Rate Video Frame Rate Smoothing Factor Lossy Compression Quality Balances display quality and bandwidth requirement. The recommended bandwidth is 20,000 kbit/s. Provides best display quality but requires highest bandwidth. The recommended bandwidth is 25,000 kbit/s. For details about how to set video image quality and smoothness, see Table 3-3. Table 3-3 Advanced policies Policy Name Default Value Range Description Bandwidth (kbit/s) This policy is available only when the HDP Plus policy is disabled. Smoothness first: 20,000 Quality first: 25, to 25,000 Specifies the data code stream limit. Increasing this value improves user experience but consumes more bandwidth resources. For this reason, if the network bandwidth is insufficient, increasing this value compromises the smoothness. The default value is recommended. Frame Rate (fps) This policy is available only when the HDP Plus policy is disabled. Smoothness first: 25 Quality first: to 30 Specifies the frame rate in non-video scenarios. Increasing this value improves image smoothness but consumes more bandwidth resources. For this reason, if the network bandwidth is insufficient, increasing this value compromises the smoothness. The default value is recommended. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 37

43 3 Operation Guide (Administrators) Policy Name Default Value Range Description Video Frame Rate (fps) This policy is available only when the HDP Plus policy is disabled. Smoothing Factor This policy is available only when the HDP Plus policy is disabled. Lossy Compression Quality Smoothness first: 30 Quality first: 50 Smoothness first: 60 Quality first: 60 Smoothness first: 85 Quality first: to 50 Specifies the video frame rate. Increasing this value improves image smoothness but consumes more bandwidth resources. For this reason, if the network bandwidth is insufficient, increasing this value compromises the smoothness. The default value is recommended. 0 to 60 Specifies the static image quality. Decreasing this value improves image quality but consumes more bandwidth resources, and compromises the smoothness. 70 to 90 Specifies the static natural image quality. Increasing this value improves image quality but consumes more bandwidth resources, and compromises the smoothness. Step 4 Click Save to save the configured policy information. An end user must relog in to the desktop for the new policy to take effect. ----End 3.8 Managing Policy Group Scenario Create policy groups to customize and plan a group of policies from the following perspectives: Peripherals Audio Client Display Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 38

44 3 Operation Guide (Administrators) Files&Clipboard Session Bandwidth Watermark Keyboard&Mouse Audio and Video Bypass Personalized Data Mgmt Procedure Creating Managing Policy Group Step 1 Step 2 Log in to the Workspace management console. Click Policy. The Policy page is displayed. Step 3 Step 4 Click Advanced View. Click Create. The Create Policy Group page is displayed. Step 5 Step 6 Step 7 Set Policy Group Name. Click Next. Set the peripherals policies. Table 3-4 shows the peripherals policies. indicates that the policy is enabled. indicates that the policy is disabled. Table 3-4 Peripherals policies Policy Type Policy Parameter Policy Description Recommended Value USB Port Redirection USB Port Redirection Users can use USB devices by setting the USB port redirection mode on desktops. Graphics Devices (such as scanners) Users can use USB graphics devices by setting the USB port redirection mode on desktops. Enabled Video Devices (such as cameras) Users can use USB video devices by setting the USB port redirection mode on desktops. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 39

45 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Print Devices (such as printers) Storage Devices (such as USB flash drives) Wireless Devices (such as bluetooth) Network Devices (such as wireless NIC) Smart Card (such as Ukey) Remove Smart Card To Disconnect Session Other USB Devices Users can use USB print devices by setting the USB port redirection mode on desktops. Users can use USB storage devices by setting the USB port redirection mode on desktops. Users can use wireless devices by setting the USB port redirection mode on desktops. Users can use network devices by setting the USB port redirection mode on desktops. Users can use smart cards by setting the USB port redirection mode on desktops. Users can remove smart cards to disconnect user sessions. Users can use other USB devices (excluding graphics devices, video devices, printers, storage devices, and smart cards) connected to TCs by using USB port redirection. Enabled Enabled Enabled Enabled Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 40

46 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value USB Port Redirection Customization Policy Users can customize USB policies using the ID or CLASS customization policy. Use vertical bars ( ) to separate multiple policies and store them in a configuration file as complete strings. The string can contain a maximum of 1024 character, excluding invalid characters, such as "!@#$%^&*()>? and spaces. Format example: Customized ID policy format: ID:VID:PID:isShare: iscompress NOTE PID fuzzy match format(for peripherals with the same VID): ID:VID:FFFF:isShare: iscompress Customized class policy format: CLASS:DeviceClass: DeviceSubClass:Devi ceprotocol:interface Class:InterfaceSubCl ass:interfaceprotocol : isshare:iscompress USBKEY policy format: USBKEY:VID:PID ADV policy format: ADV:VID:PID:isSele ctconfig:isresetinter face:isselectinterface :isrevert ID:147E:2016:1:0 CLASS: 08:06:50:08:06:50:1 :0 USBKEY:147E: 2016 ADV:78e:79f: 1:1:1:1 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 41

47 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value USB Redirection Mode This policy sets the USB redirection mode only for Linux TC. Common mode: The client USB driver is implemented based on the user mode driver. Classical mode: The client USB driver is implemented based on a kernel mode driver. Classical mode Device Redirection Printer Redirection Users can use printers connected to TCs by setting printer redirection (a policy of device redirection). Print Data Compression Mode Enabled: Print Data Compression Mode is enabled. : Print Data Compression Mode is disabled. Synchronize Client Default Printer Enabled: Synchronize Client Default Printer is enabled. : Synchronize Client Default Printer is disabled. Enabled Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 42

48 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Universal Printer Driver Session Printer Default HDP XPSDrv Driver Universal Printing PCL 5 Universal Printing PCL 6 Universal Printing PS When Default is selected, Universal Printing PS will be loaded if printer redirection is enabled on Linux clients, and HDP XPSDrv Driver will be loaded if printer redirection is enabled on Windows clients. NOTICE To use the printer service, you need to ensure that all end users use SCs running the same OS to log in to Workspace. Enabled: After the session printer is enabled and customized policy is configured, a network sharing printer is automatically created in the session. : The session printer is disabled. Default Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 43

49 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Session Printer Customization Policy Users can customize session printer policies by configuring the IP address, printer name, printer model, default printer, settings, and location. Configuration items are separated by semicolons (;), and multiple policies are separated by vertical bars ( ) and form a character string to save to the configuration file. The string can contain a maximum of 1024 characters, excluding illegal characters, such as "!@#$%^&*()>?. IP address: Printer server IP address, for example, This parameter is mandatory. Printer name: Printer name, for example, EPSON TM-T88IV Receipt. This parameter is mandatory. Printer model: Printer driver model, for example, EPSON TM- T88IV ReceiptSC4. This parameter is mandatory. Default printer: If the value is 0, the printer is not a default printer; if the value is 1, the printer is used as a default printer. This parameter is mandatory. Settings: If the value is 0, the printer is not a network shared printer; ;EPSO N TM-T88IV Receipt;EPSON TM-T88IV ReceiptSC4;1;0;IP: Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 44

50 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value if the value is 1, the printer is used as a network port printer. This parameter is mandatory. Location: Printer location matching. Partial matching and full matching of client IP addresses, MAC addresses, and TC host names are supported at present, for example, full matching of IP: and partial matching of IP: , partial matching of MAC:00- ac, and full matching of HOSTNAME:huaweivdesktop. If location matching is not required, set the parameter to 0. Camera Redirection Users can use cameras connected to TCs by setting camera redirection (a policy of device redirection). Camera Frame Rate(fps) Camera Maximum Width(pixel) Camera Maximum Height(pixel) Camera Data Compression Mode Value range: 1 to Value range: 1 to Value range: 1 to H.264 H.264 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 45

51 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value TWAIN Redirection Image Compression Level PC/SC Smart Card Redirection Remove Smart Card To Disconnect Session HID(Human Interface Device) Redirection HID Redirection Customization Policy Users can use TWAIN devices connected to TCs by setting TWAIN device redirection (a policy of device redirection) on desktops. NOTE The TWAIN device driver must be installed on TCs. This policy is used to define the compression level for TWAIN device redirection. none low (highest speed) medium (medium speed) lossless(lossless compression) low-loss(low-loss compression) mediumloss(medium-loss compression) high-loss(high-loss compression) Users can use smart cards connected to TCs by setting PC/SC smart card redirection (a policy of device redirection) on desktops. Users can remove smart cards to disconnect user sessions. Users can use human interface device redirection on desktops. Users can use human interface devices (HIDs) by customizing HID redirection. medium (medium speed) - Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 46

52 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Serial Port Redirection Serial Port Redirection Users can use serial port devices connected to TCs by setting serial port redirection on desktops. Auto Connect Client Serial Ports When users log in to desktops, serial ports on TCs are automatically enable to prevent the serial ports from being used by other local programs. LPT Redirection LPT Redirection When users log in to desktops, serial ports on TCs cannot be automatically enabled to prevent the serial ports from being used by other local programs. Step 8 Set the audio policies. Table 3-5 shows the audio policies. Table 3-5 Audio policies Policy Type Policy Parameter Policy Description Recommended Value Audio Redirection Audio Redirection The applications on desktops can use audio devices on terminals to record and play audios. Enabled Play Volume The policy is used to set the audio broadcasting volume. Do Not Set Volume Play Volume Ratio The policy is used to set the audio broadcasting volume by ratio. It is a volume optimization policy. Do Not Set Volume Ratio Record Volume The policy is used to set the audio recording volume. The audio recording volume is set to 100 by default, indicating the original sound volume value (optimal in voice call scenarios). 100 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 47

53 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Record Volume Ratio The policy is used to set the audio recording volume by ratio. It is a volume optimization policy. Do Not Set Volume Ratio Audio Transmission Mode Reliable Transmission: Audio data is transmitted through the Transmission Control Protocol (TCP). This mode is recommended for local area networks (LANs) especially. Real Time Transmission: Audio data is transmitted through the Real-Time Transport Protocol (RTP). This mode is not recommended. Reliable Transmission Play Redirection Play Redirection This option takes effect after the audio redirection is enabled. It controls the broadcasting switch separately. Enabled: End users can play broadcasting normally after the broadcasting redirection is enabled. : After the broadcasting redirection is disabled, the system has no sound when end users play broadcasting. Enabled Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 48

54 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Play Classification LossLess: The audio quality is the best, but the bandwidth occupation is the highest. This scenario is recommended when the network bandwidth is sufficient and the network is stable and reliable. In generally, this scenario is not recommended. Speech Call: The best voice call processing capability can be provided and the bandwidth occupation is the lowest, but the music processing capability is common. Customers who focus on voice calls can select this scenario. Music Play: The best music processing capability can be provided and the bandwidth occupation is medium, but the voice call processing capability is common. Customers who focus on music or entertainment can select this scenario. Automatic Identification: It can detect users' behaviors (voice call or music playing). The accuracy rate exceeds 90%. The system will switch to the best algorithm based on users' behaviors. Music Play Play Quality The broadcasting quality is used together with the broadcasting scenario. In the same broadcasting scenario, the broadcasting quality can be adjusted and has three levels: high, medium, and low. Middle Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 49

55 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Play Denoising This function is used in special broadcasting environments. Before using the function, you need to perform verification tests. This function is not recommended for nonprofessional audio personnel. Denoising Play AGC This function is used in special broadcasting environments. Before using the function, you need to perform verification tests. This function is not recommended for nonprofessional audio personnel. AGC Play CRC This is a retained item. This function can be used when real-time transmission is selected. CRC Play Device Mode Play Device In Shared Mode: In this mode, audio devices have strong compatibility and support multiple instances. Play Device In Exclusive Mode: The audio device only uses the Huawei Desktop Protocol (HDP) protocol as the audio protocol. Play Device In Shared Mode Play Delay Threshold When the specific volume of audio data exists in the broadcasting buffer, mute detection is started to control the latency threshold. This policy is the latency optimization policy. When the policy is modified, related tests need to be performed. 240 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 50

56 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Play Amplitude Threshold This is a retained item. When the audio waveform amplitude is lower than the preset threshold, the audio is mute. This item is a policy item mapped with the broadcasting latency threshold function Play Prefill Data Before music is played, a small amount of data is prefilled to improve interruptions caused by network jitter. Do Not Prefill Data Record Redirection Record Redirection This option takes effect after the audio redirection is enabled. Independent control recording switch. Enabled: End users can make recording normally after the recording redirection is enabled. : After the recording redirection is disabled, the system has no sound when end users make recording. Enabled Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 51

57 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Record Classification LossLess: The audio quality is the best, but the bandwidth occupation is the highest. This scenario is recommended when the network bandwidth is sufficient and the network is stable and reliable. Speech Call: The best voice call processing capability can be provided and the bandwidth occupation is the lowest, but the music processing capability is common. Recording is generally voice recording. Music Record: This is a retained item. Music playing is rare in this recording scenario. Automatic Identification: This is a retained item. This scenario is the same as the voice call scenario currently. Speech Call Record Quality The recording quality is used together with the recording scenario. In the same recording scenario, the recording quality can be adjusted and has three levels: high, medium, and low. Middle Record Denoising You can enable this function as required because high-level noise reduction will have negative impacts. In the voice call scenario, the background noise can be reduced. The larger the negative number is, the higher the noise reduction level is. -25 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 52

58 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Record AGC This function is used in special recording environments. Before using the function, you need to perform verification tests. This function is not recommended for nonprofessional audio personnel. AGC Record CRC This is a retained item. This function can be used when real-time transmission is selected. CRC Record Device Mode Record Device In Shared Mode: In this mode, audio devices have strong compatibility and support multiple instances. Record Device In Exclusive Mode: The audio device only uses the HDP protocol as the audio protocol. This mode is not recommended generally. Record Device In Shared Mode Record Delay Threshold When the specific volume of audio data exists in the recording buffer, mute detection is started to control the latency threshold. This policy is the latency optimization policy. When the policy is modified, related tests need to be performed. 200 Record Amplitude Threshold This is a retained item. When the audio waveform amplitude is lower than the preset threshold, the audio is mute. This item is a policy item mapped with the recording latency threshold function Step 9 Set the client policies. Table 3-6 shows the display policies. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 53

59 3 Operation Guide (Administrators) Table 3-6 Client policies Policy Parameter Policy Description Recommended Value Automatic Reconnection Interval (Unit: s) Session Persistence Time (Unit: s) Shut down the local monitor automatically after the screen is locked Wait time of automatic monitor shutdown (Unit: s) Period before the next connection attempt after the client is disconnected. The value is an integer ranging from 1 to 50. Maximum automatic reconnection attempts after the client is disconnected. The value is an integer ranging from 0 to 180. Enabled: If this function is enabled, the monitor is automatically shut down when the wait time of automatic monitor shutdown is due after the screen is locked and no keyboard or mouse operation is performed. NOTE It doesn't work with nested login. : The function is disabled. Waiting time before automatic screen shutdown after the desktop screen is locked. The value ranges from 10 to Step 10 Set the display policies. Table 3-7 shows the display policies. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 54

60 3 Operation Guide (Administrators) Table 3-7 Display policies Policy Type Policy Parameter Policy Description Recommended Value Display Display Policy Grade LEVEL1: applies to network bandwidth lower than 512 Kbit/s. It can be used only for light-load office scenarios, such as browsing text documents. The display quality of this grade is low. LEVEL2: applies to network bandwidth lower than 1 Mbit/s. It can be used only for light-load office scenarios, such as browsing text documents and static images. The display quality of this grade is better than that of Grade 1. LEVEL3: applies to network bandwidth lower than 4 Mbit/s. It can be used for medium-load office scenarios, such as browsing documents, images, and dynamic web pages. LEVEL4: applies to network bandwidth lower than 20 Mbit/s. It can be used to play standard definition (SD) and high definition (HD) videos. This grade balances the display quality and bandwidth requirement. LEVEL5: applies to network bandwidth higher than 20 Mbit/s. This grade delivers the optimal video playback effect. LEVEL4 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 55

61 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Display Frame Rate(fps) Frame rate in non-video scenarios. Increasing this value improves image and operation smoothness but consumes more network bandwidth and CPU resources. The value ranges from 1 to Video Frame Rate(fps) Frame rate in video scenarios. Increasing this value improves video playback smoothness but consumes more network bandwidth and CPU resources. For GPU desktops, increasing this value increases the GPU workload during video playback. The value ranges from 1 to 60. NOTE This parameter is unavailable after the HDP Plus or Rendering Acceleration parameter is enabled. 30 Bandwidth Maximum bandwidth for a single user during peak hours. The value ranges from 256 to NOTE This parameter is unavailable after the HDP Plus or Rendering Acceleration parameter is enabled Image Compression Parameters Min. Capacity for Image Cache (MB) Minimum capacity for image cache, expressed in MB. Increasing this value reduces required bandwidth but consumes more client memory resources. If the parameter is set to a value smaller than 50, the cache function is disabled. The value ranges from 0 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 56

62 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Lossy Compression Recognition Threshold Threshold for recognizing image complexity. Decreasing this value increases image quality but consumes more network bandwidth resources. The value ranges from 0 to 255. NOTE This parameter can be used to adjust the quality of static images only. 60 Lossless Compression Mode Lossless image compression algorithm. You can select Basic Compression or Deep Compression. When you compress the same picture, basic compression features a low compression ratio and CPU usage. NOTE This parameter is unavailable after the HDP Plus or Rendering Acceleration parameter is enabled. Basic Compression Deep Compression Level Image compression algorithm. This parameter is available after deep compression is used. A higher compression level means a higher compression ratio and CPU usage but lower bandwidth usage. Grade 0 indicates a copy operation and no compression is involved. This level consumes the least CPU resources but the most bandwidth resources. NOTE This parameter is unavailable after the HDP Plus or Rendering Acceleration parameter is enabled. Compression grade 0 Lossy Compression Quality Image quality after lossy compression. Increasing this value improves image quality. 85 Color Enhancement for Office Work The color enhancement for office work. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 57

63 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Video Compression Parameters Quality/Bandwidth First Video compression mode. 0 indicates quality first, and 1 indicates bandwidth first. Quality First: preferentially compresses videos with fixed quality. If you select Quality First, the values of parameters Average Video Quality, Lowest Video Quality, Highest Video Quality, and Peak Video Bit Rate take effect. Bandwidth First: preferentially compresses videos at a constant bit rate. If you select Bandwidth First, the values of parameters Average Video Bit Rate and Peak Video Bit Rate take effect. Quality First Average Video Bit Rate (Kbps) The video compression algorithm parameter, expressed in Kbps. Increasing this value in Bandwidth First mode improves display quality. The value ranges from 256 to NOTE After HDP Plus is enabled for GPU desktops, the Average Video Bit Rate and Peak Video Bit Rate cannot be lower than Otherwise, the bit rate limit becomes invalid Peak Video Bit Rate (Kbps) Video compression algorithm parameter, expressed in Kbps. Increasing this value improves display quality. The value ranges from 256 to NOTE After HDP Plus is enabled for GPU desktops, the Average Video Bit Rate and Peak Video Bit Rate cannot be lower than Otherwise, the bit rate limit becomes invalid Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 58

64 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Average Video Quality Average quality coefficient of videos. In Quality First mode, increasing this value decreases display quality. The value ranges from 5 to Lowest Video Quality Lower limit of video quality. In Quality First mode, increasing this value decreases display quality. The value ranges from 5 to Highest Video Quality Upper limit of video quality. In Quality First mode, increasing this value decreases display quality. The value ranges from 1 to GOP Size Video compression algorithm parameter. Decreasing this value improves video quality but consumes more bandwidth resources. It is recommended that this value be 1 to 2 times the video frame rate. The value ranges from 0 to Encoding Preset Video compression algorithm parameter. A smaller value means a faster encoding speed and better smoothness but poorer image quality and higher bandwidth usage. Preset 1 HDP Plus Enable: enables HDP Plus GPU acceleration. Disable: disables HDP Plus GPU acceleration. Rendering Acceleration Video Optimization Enable: enables rendering acceleration to improve smoothness. Disable: disables rendering acceleration. Enable: enables video optimization to improve smoothness. Disable: disables video optimization. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 59

65 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value GPU Color Optimization Video Recognition Threshold Frame Rate Statistical Length Image Quality Threshold Refresh Frequency Threshold Threshold of Exiting Video Area Min. Video Width Min. Video Length Threshold of the Single-Frame Natural Image Block Percentage Number of Cyclical Natural Images Enable: enables GPU color optimization to increase color reproduction in video/ office hybrid scenarios. Disable: disables GPU color optimization. Number of frames required when you enter or switch a video. It is easier to enter or exit a video as the value increases. The value ranges from 0 to 500. Number of statistical frames during the video detection phase. It is easier to enter a video as the value decreases. The value ranges from 2 to 100. It is easier to enter a video as the value decreases. The value ranges from 0 to 100. It is easier to enter a video as the value decreases. The value ranges from 1 to 100. It is easier to exit a video as the value decreases. The value ranges from 0 to 100. It is easier to enter a video as the value decreases. The value ranges from 0 to It is easier to enter a video as the value decreases. The value ranges from 0 to It is easier to enter a video as the value decreases. The value ranges from to 1. It is easier to enter a video as the value decreases. The value ranges from 0 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 60

66 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Threshold of the Non-Natural Image Area Percentage Number of Non-Natural Images It is more difficult to exit a video as the value increases. The value ranges from to 1. It is more difficult to exit a video as the value increases. The value ranges from 0 to Adaptive Bitrate Control Adaptive Bitrate Control Enable: enables adaptive bitrate control. Disable: disables adaptive bitrate control. Expected Average Network Latency (ms) The adaptive bitrate control latency threshold. If the latency exceeds the threshold, display quality decreases. If the latency is lower than the threshold, display quality increases. The value ranges from 1 to Network Latency Threshold 1 (ms) Adaptive bitrate control threshold 1. The value ranges from 1 to Network Latency Threshold 2 (ms) Adaptive bitrate control threshold 2. The value ranges from 1 to Min. Dynamic Frame Rate (fps) Sefault minimum dynamic frame rate. The value ranges from 1 to Min. Dynamic Frame Rate Lv1 (fps) Minimum dynamic frame rate level 1. The value ranges from 1 to Min. Dynamic Frame Rate Lv2 (fps) Minimum dynamic frame rate level 2. The value ranges from 1 to Adaptive Bandwidth Lower Limit (Kbps) Lower bandwidth limit of adaptive bitrate control. If the value decreases, the minimum bandwidth allowed by adaptive bitrate control decreases accordingly. The value ranges from 100 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 61

67 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Adaptive Lossy Compression Quality Lower Limit Lower limit of JPEG compression QoS, namely, the poorest JPEG quality allowed by adaptive bitrate control. The quality deteriorates as the value decreases. The value ranges from 1 to Adaptive Lossy Compression Quality Upper Limit Upper limit of JPEG compression QoS, namely, the best JPEG quality allowed by adaptive bitrate control. The quality deteriorates as the value decreases. The value ranges from 1 to Adaptive Lossy Compression Quality Increase Limit Increase limit of JPEG compression QoS, namely, the maximum JPEG quality increase allowed by adaptive bitrate control each time. JPEG quality improves faster as the value increases. The value ranges from 1 to Adaptive Lossy Compression Quality Decrease Limit Decrease limit of JPEG compression QoS, namely, the maximum JPEG quality decrease allowed by adaptive bitrate control each time. JPEG quality deteriorates faster as the value increases. The value ranges from 1 to Adaptive Video Average Quality Lower Limit Lower limit of the average video compression quality, namely, the best average video quality allowed by adaptive bitrate control. Video quality improves as the value decreases. The value ranges from 5 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 62

68 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Adaptive Video Average Quality Upper Limit Upper limit of the average video compression quality, namely, the poorest average video quality allowed by adaptive bitrate control. Video quality improves as the value decreases. The value ranges from 5 to Adaptive Video Average Quality Increase Limit Increase limit of average video compression quality, namely, the maximum video quality increase allowed by adaptive bitrate control each time. Video quality deteriorates faster as the value increases. The value ranges from 1 to Adaptive Video Average Quality Decrease Limit Decrease limit of average video compression quality, namely, the maximum video quality decrease allowed by adaptive bitrate control each time. Video quality improves faster as the value increases. The value ranges from 1 to Adaptive Video Min. Quality Lower Limit Lower limit of the poorest video compression quality. This parameter pairs with Adaptive Video Average Quality Lower Limit. Video quality improves as the value decreases. The value ranges from 5 to Adaptive Video Min. Quality Upper Limit Upper limit of the poorest video compression quality. This parameter pairs with Adaptive Video Average Quality Upper Limit. Video quality improves as the value decreases. The value ranges from 5 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 63

69 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Adaptive Video Min. Quality Increase Limit Increase limit of the poorest video compression quality, namely, the maximum video quality increase allowed by adaptive bitrate control each time. Video quality deteriorates faster as the value increases. The value ranges from 1 to Adaptive Video Min. Quality Decrease Limit Decrease limit of the poorest video compression quality, namely, the maximum video quality decrease allowed by adaptive bitrate control each time. Video quality improves faster as the value increases. The value ranges from 1 to Duplicate Display Duplicate Display Enable: After duplicate display is enabled, you can use duplicate display application tray or invoke duplicate display interface to initiate duplicate display on the desktop. Disable: After duplicate display is disabled, you cannot initiate duplicate display on the desktop. Default Mapping Order After duplicate display is enabled, a screen is displayed on the terminal according to the mapping priority. 1,2,3,4 Duplicate Display Mode One-to-One: initiates the duplicate display request to one terminal. One-to-Many: initiates the duplicate display request to multiple terminals. One-to-One Step 11 Set the file and Clipboard policies. Table 3-8 shows the file and Clipboard policies. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 64

70 3 Operation Guide (Administrators) Table 3-8 File and Clipboard policies Policy Type Policy Parameter Policy Description Recommended Value File Redirection File Redirection READ ONLY: Only reads the redirected client files. READ AND WRITE: Reads and writes the redirected client files. Disable: Redirecting client files is disabled. Fluid Control Switch Enabled: Fluid control switch is enabled. : Fluid control switch is disabled. Good Network Latency(ms) Threshold of Good network latency. Value range: 1 to Normal Network Latency(ms) Threshold of Normal network latency. Value range: 1 to Poor Network Latency(ms) Threshold of Poor network latency. Value range: 1 to Reducing Step(KB) Step of reducing the transmission speed. Value range: 1 to Slow Increasing Step(KB) Slow step of increasing the transmission speed. Value range: 1 to Quick Increasing Step(KB) Quick step of increasing the transmission speed. Value range: 1 to Start Speed(KB/s) Initial transmission speed. Value range: 1 to Test Block Size(KB) Block size of speed testing. Value range: 64 to Test Time Gap(ms) Gap of testing. Value range: 1000 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 65

71 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Compression Switch Enabled: Compression switch is enabled. : Compression switch is disabled. Compression Threshold(Byte) Minimum Compression Rate Value range: 0 to Value range: 0 to File Size Supported by Linux Enabled: File size supported by Linux is enabled. : File size supported by Linux is disabled. File Size Threshold Supported by Linux(MB) Value range: 0 to Linux Root Directory Mount Switch Linux File System Mount Path Linux Fixed Drive File System Format Linux Removable Drive File System Format Linux CD-ROM Drive File System Format Linux Network Drive File System Format Enabled: Linux root directory is mounted. : Linux root directory is not mounted. The maximum length is 256 characters, expressed in UTF-8 string format. The maximum length is 256 characters, expressed in UTF-8 string format. The maximum length is 256 characters, expressed in UTF-8 string format. The maximum length is 256 characters, expressed in UTF-8 string format. The maximum length is 256 characters, expressed in UTF-8 string format. \media \Volumes \swdb\mnt \home - vfat ntfs msdos fuseblk cd9660 iso9660 udf smbfs afpfs cifs Path Separator Single ASCII character. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 66

72 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Client Fixed Driver (such as local disk) Enabled: Redirect client local partitions. : Redirect client local partitions. NOTE When File Redirection is disabled, this function is disabled. Client Removable Driver (such as USB flash drives) Enabled: Redirect client removable drivers, such as USB and removable hard disks. : Redirect client removable drivers, such as USB and removable hard disks. NOTE When File Redirection is disabled, this function is disabled. Client Disc Driver Enabled: Redirect client disc drivers. : Redirect client disc drivers. NOTE When File Redirection is disabled, this function is disabled. Client Network Driver Enabled: Redirect client network drivers. : Redirect client network drivers. NOTE When File Redirection is disabled, this function is disabled. Send File In Virtual Machine to Client Enabled: Allow Sending File In Virtual Machine to Client. : No Sending File In Virtual Machine to Client. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 67

73 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Read Write Speed(Kbps) When the File Redirection and Send File In Virtual Machine to Client are disabled, this function is disabled. 0 means no speed limit, the other is to set the read and write speed. The default minimum speed is 32Kbps. When the speed is less than 32Kbps, use the default minimum value. 0 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 68

74 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Clipboard Redirection Clipboard Redirection Server to client: Enable the clipboard function from servers to clients: After this function is enabled, end users can copy data on desktops and paste the data on clients, but cannot copy data from clients to desktops. This function is the unidirectional clipboard function from servers to the clients. Client to server: Enable the clipboard function from clients to servers: After this function is enabled, end users can copy data on clients and paste the data on desktops, but cannot copy data from desktops to clients. This function is the unidirectional clipboard function from clients to the servers. Enable bidirection: Enable the bidirectional clipboard function: After this function is enabled, end users can copy data on clients and paste the data on desktops, or copy data from desktops to clients. This function is the directional clipboard function between clients and servers. : Redirect clipboard is disabled. Clipboard Rich Text Redirection Enabled: The function of clipboard rich text redirection is enabled. : The function of clipboard rich text redirection is disabled. Enabled Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 69

75 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Clipboard File Redirection Enabled: The function of clipboard file redirection is enabled. : The function of clipboard file redirection is disabled. Enabled Step 12 Set the session policies. Table 3-9 shows the session policies. Table 3-9 Session policies Policy Parameter Policy Description Recommended Value Automatic screen lock Screen lock waiting time (minute) Enabled: After the automatic screen lock function is enabled, a desktop will automatically lock the screen if no keyboard and mouse operation is performed when the screen lock waiting time is due. : The automatic screen lock function is disabled. Wait time for screen automatic lock. The value ranges from 3 to minutes. The default value is 10 minutes. 10 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 70

76 3 Operation Guide (Administrators) Policy Parameter Policy Description Recommended Value Automatic disconnection or logout Disconnection or logout waiting time (minute) Automatic logout after disconnection Waiting time for automatic logout after disconnection (minute) Automatic disconnection: After the automatic screen lock function is enabled and the automatic disconnection is enabled as well, a desktop will automatically disconnect if no keyboard and mouse operation is performed when the disconnection or logout waiting time is due. Automatic logout: After the automatic screen lock function is enabled and the automatic logout is enabled as well, a desktop will automatically log out if no keyboard and mouse operation is performed when the disconnection or logout waiting time is due. : The automatic disconnection and logout function is disabled. Wait time for desktop automatic disconnection or logout. The value ranges from 1 to minutes. Enable: Automatic logout after disconnection function is enabled. When the waiting time is due, a disconnected desktop will automatically log out. Disable: Automatic logout after disconnection function is disabled. Waiting time for automatic logout after a desktop is disconnected. The value ranges from 3 to 1440 minutes Step 13 Set the bandwidth policies. Table 3-10 shows the bandwidth policies. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 71

77 3 Operation Guide (Administrators) Table 3-10 Bandwidth policies Policy Type Policy Parameter Policy Description Recommended Value Total Bandwidth Control Total Bandwidth Control Enabled: The total bandwidth control function is enabled. : The total bandwidth control function is disabled. Total Bandwidth Control Value(Kbps) The value ranges from to Display Bandwidth Control Display Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. Display Bandwidth Control Value(Kbps) The value ranges from 500 to Display Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. Display Bandwidth Percentage Control Value(%) The value ranges from 0 to MultiMedia Bandwidth Control MultiMedia Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. MultiMedia Bandwidth Control Value(Kbps) The value ranges from 5000 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 72

78 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value MultiMedia Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. MultiMedia Bandwidth Percentage Control Value(%) The value ranges from 0 to USB Bandwidth Control USB Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. USB Bandwidth Control Value(Kbps) The value ranges from 1000 to USB Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. USB Bandwidth Percentage Control Value(%) The value ranges from 0 to PCSC Bandwidth Control PCSC Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. PCSC Bandwidth Control Value(Kbps) The value ranges from 1000 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 73

79 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value PCSC Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. PCSC Bandwidth Percentage Control Value(%) The value ranges from 0 to TWAIN Bandwidth Control TWAIN Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. TWAIN Bandwidth Control Value(Kbps) The value ranges from 2000 to TWAIN Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. TWAIN Bandwidth Percentage Control Value(%) The value ranges from 0 to Printer Bandwidth Control Printer Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. Printer Bandwidth Control Value(Kbps) The value ranges from 1000 to Printer Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 74

80 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Printer Bandwidth Percentage Control Value(%) The value ranges from 0 to COM Bandwidth Control COM Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. COM Bandwidth Control Value(Kbps) The value ranges from 500 to COM Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. COM Bandwidth Percentage Control Value(%) The value ranges from 0 to File Redirection Bandwidth Control File Redirection Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. File Redirection Bandwidth Control Value(Kbps) The value ranges from 500 to File Redirection Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. File Redirection Bandwidth Percentage Control Value(%) The value ranges from 0 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 75

81 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Clipboard Bandwidth Control Clipboard Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. Clipboard Bandwidth Control Value(Kbps) The value ranges from 100 to Clipboard Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. Clipboard Bandwidth Percentage Control Value(%) The value ranges from 0 to Secure Channel Bandwidth Control Secure Channel Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. Secure Channel Bandwidth Control Value(Kbps) The value ranges from 500 to Secure Channel Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. Secure Channel Bandwidth Percentage Control Value(%) The value ranges from 0 to Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 76

82 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Flash Bandwidth Control Flash Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. Flash Bandwidth Control Value(Kbps) The value ranges from 1000 to Flash Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. Flash Bandwidth Percentage Control Value(%) The value ranges from 0 to Camera Bandwidth Control Camera Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. Camera Bandwidth Control Value(Kbps) The value ranges from 0 to Camera Bandwidth Percentage Control Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. Camera Bandwidth Percentage Control Value(%) The value ranges from 0 to Virtual Channel Bandwidth Control Virtual Channel Bandwidth Control Enabled: The bandwidth control function is enabled. : The bandwidth control function is disabled. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 77

83 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Virtual Channel Bandwidth Control Value(Kbps) Virtual Channel Bandwidth Percentage Control Virtual Channel Bandwidth Percentage Control Value(%) The value ranges from 500 to Enabled: The bandwidth percentage control function is enabled. : The bandwidth percentage control function is disabled. The value ranges from 0 to Step 14 Set the watermark policies. Table 3-11 shows the watermark policies. indicates that the policy is enabled. indicates that the policy is disabled. Table 3-11 Watermark policies Policy Parameter Policy Description Recommended Value Watermark Show Style Color Opacity(%) Number Enable: If the function is enabled, the watermark will be displayed on the screen after a user accesses a desktop. Disable: The function is disabled. Fixed position: The watermark is displayed in a fixed position on the screen. Random motion: The watermark moves randomly on the screen every 2 seconds. When the main switch is enabled, you can edit the color. The value ranges from 0 to means completely transparent and 100 means completely opaque. The number of watermarks. When the Display Mode is set to Fixed position, you can configure this item. The value ranges from 1 to 7. Random motion #2a2a2a - - Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 78

84 3 Operation Guide (Administrators) Policy Parameter Policy Description Recommended Value Custom The content can contain only digits, uppercase letters, lowercase letters, Chinese character, and some special characters, and cannot exceed 45 characters. After you customize the content, the desktop screen displays the watermark "Customized content Login username desktop time." For example, if the customized content is set to CopyRight, the watermark is CopyRight administrator Wed Jan 06 01:01: Step 15 Set the keyboard and mouse policies. Table 3-12 shows the keyboard and mouse policies. Table 3-12 Keyboard and mouse policies Policy Parameter Policy Description Recommended Value VM Mouse Feedback VM Mouse Simulation Mode VM External Cursor Feedback Windows Client Keyboard Mode Windows Client Mouse Mode Special Keyboard Adapt Mouse Feedback Force Mouse Feedback Disable Mouse Feedback Absolute Position Simulate Relative Position Simulate Enable: The function of desktop external cursor feedback is enabled. Disable: The function of desktop external cursor feedback is disabled. Windows Client Keyboard Global Mode Windows Client Keyboard Window Mode Windows Client Mouse Global Mode Windows Client Mouse Window Mode Enable: The function of special keyboard is enabled. Disable: The function of special keyboard is disabled. Adapt Mouse Feedback Absolute Position Simulate Windows Client Keyboard Global Mode Windows Client Mouse Window Mode Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 79

85 3 Operation Guide (Administrators) Step 16 Set the audio and video bypass policies. Table 3-13 shows the audio and video bypass policies. indicates that the policy is enabled. indicates that the policy is disabled. Table 3-13 Audio and video bypass policies Policy Parameter Policy Description Recommended Value Audio and Video Bypass Software Path Enable: The function of common audio and video policy is enabled. Disable: The function of common audio and video policy is disabled. This policy is used to configure the path and start parameters for software that uses common audio and video policies. Use semicolons (;) to separate multiple software paths. If a path includes spaces, use double quotation marks ("") to quote the path. C:\Windows \System32\notepad.exe hello.txt;"c:\program Files (x86)\notepad++.exe" hello.txt; Step 17 Set the personalized data management policies. Table 3-14 shows the personalized data management policies. indicates that the policy is enabled. indicates that the policy is disabled. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 80

86 3 Operation Guide (Administrators) Table 3-14 Personalized data management policies Policy Type Policy Parameter Policy Description Recommended Value Path for Managing Personalized Data Path for Managing Personalized Data Path for storing the roamed files. If User Data Roaming Switch or User Folder Redirection Switch is enabled, this value cannot be empty. NOTE The shared directory must be Everyone permission. \ \ \Roami ng User Data Roaming User Data Roaming Switch Enable: roams the user's personalized data and configured files (folders) to the configured network location. The network location for storing the roamed files is required for enabling this function. Disable: The function of user data roaming policy is disabled. Local Path of Roamed Files (Folders) The path of the files or folders to be roamed in the user configuration files. Only the files and folders under the AppData directory are supported. Wildcard characters are supported. If you want to add multiple paths, separate them from each other using semicolons (;). AppData \Local;AppData \LocalLow Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 81

87 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value User Folder Redirection User Folder Redirection Switch Enable: enables this function stores user data to a directory on the network instead of a local host. A separate directory needs to be configured for redirection. Disable: The function of user folder redirection policy is disabled. NOTE If roaming and redirection are configured for the same directory, user folder redirection is implemented preferentially. Configuration File Processing Delete User Configuration File upon Session Logoff Enable: The locally stored user configuration file is automatically deleted upon user logout. Disable: The locally stored user configuration file is not deleted upon user logout. Network Drive Mapping Network Drive Mapping Switch Enable: The function of network drive mapping is enabled. Disable: The function of network drive mapping is disabled. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 82

88 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Recommended Value Network Drive Mapping Path Drive Letter This policy configures a valid network drive path, which is used to automatically mount to the user's desktop. Both public and private network drives can be mapped. If a private network drive is mapped, a user's directory is generated in the shared path and the user is granted the exclusive rights of the directory. For example: Public Network Drive:\ \ \Na sdisk Private Network Drive\:\ \ \Na sdisk\%username %. NOTE The shared directory must be Everyone permission. The default is empty. The available drive letter is automatically selected when the default value of drive letter is empty. - - Step 18 Step 19 Step 20 Click Next. Set Object type as required, and select objects. Click Finish. The policy group is created. Managing Policy Group Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 83

89 3 Operation Guide (Administrators) Step 21 In the policy group list, adjust the priority of policy groups, or edit or delete policy groups. NOTE Click in the Priority column to set the priority of policy groups. Click Edit in the Operation column to edit a policy group. Click Delete in the Operation column to delete a manually created policy group. The Default policy group cannot be deleted. Synchronizing Policies to the HDC Step 22 Click Publish all policies to HDC in the upper-right corner of the Advanced View page. If Synchronize policy to HDC successfully. is displayed, the operation is successful. ----End 3.9 Restoring Infrastructure Server Data Scenario If a system fault occurs, use data that is automatically backed up to restore the infrastructure servers. After you restore the data of infrastructure servers: The desktop data and user data generated after the backup point in time are not stored. If the desktop data or user data is incorrect, follow the instructions or contact technical support engineers to rectify the fault. Enabled or disabled policies may be restored to the state before the backup point in time. If this happens, configure the policies again. For details, see Managing Policies. An end user cannot use the password set after the backup point in time to log in to the desktop. Inform the end user to use the password set before the backup point in time to log in to the desktop or reset the password. Procedure Step 1 Step 2 Log in to the Workspace management console. Click Infrastructure. The Infrastructure page is displayed. Step 3 Click Restore. The Restore page is displayed. Step 4 Step 5 Choose the time point when you want to restore the data of infrastructure servers from the Backup Time Point drop-down list. Select I understand the impact and want to continue and click OK. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 84

90 3 Operation Guide (Administrators) Disk data is restored to the last backup point in time. ----End 3.10 Changing the Internet Access Address Scenario On the Workspace management console, change your domain name. Prerequisites NOTE You can change the Internet access address only once. The unified domain name suffix of Workspace cannot be changed. Table 3-15 lists the data to be prepared for this task. Table 3-15 Data to be prepared Type Description Example Value Domain name The domain name must meet the following conditions: Contains 8 to 50 characters. Supports lowercase letters, digits, and hyphens (-). testuser_01 Procedure Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 Click Modify next to Internet Access Address. The Change Internet Access Address dialog box is displayed. Step 4 Set Domain Name and click OK. ----End 3.11 Changing the Service Subnet Scenario On the Workspace management console, change the service subnet based on the plan. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 85

91 3 Operation Guide (Administrators) Procedure Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 Step 4 Step 5 In the Network area, click Modify next to Service Subnet. Select a desired service subnet based on your planned subnet information. Click OK. ----End 3.12 Changing the Internet Access Port Scenario Procedure On the Workspace management console, change the Internet access port based on the plan. Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Network area, click Modify next to Internet Access Port. The Internet access port changing dialog box is displayed. Step 4 Step 5 Change the HTTPS access port or Access Gateway (AG) port based on the plan. The port ID can be 80 or 443, or ranges from 1024 to 65,535. Click OK. ----End 3.13 Configuring Two-Factor Authentication Scenario Two-factor authentication indicates the Domain account + Dynamic password authentication. In the scenario where Workspace is connected to an existing AD server, you can enable twofactor authentication as required to enhance system security. NOTE Two-factor authentication only applies to the scenario where dynamic password authentication using the customer's Radius authentication server based on the standard Radius protocol is required. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 86

92 3 Operation Guide (Administrators) Procedure Enabling dual-factor authentication Step 1 Step 2 Step 3 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Click Modify next to Two-factor authentication. The Two-factor authentication dialog box is displayed. Step 4 Click to enable two-factor authentication and set the following parameters. Table 3-16 Parameters to be configured Parameter Description Example Value Radius server address Port Shared secret code Confirm shared secret code Authentication type The Radius server is a twofactor authentication server used for dynamic password authentication based on the Radius protocol. Indicates the IP address of the Radius server. Indicates the port used for communication between the Radius server and the Web login page of end users. Indicates the password used for authentication between the Radius server and client. Enter the shared password again. Indicates the password authentication protocol Default: Only PAP is supported. Server timeout(in seconds) 1 to 999. Max retries 1 to 999. Configure it based on latencies of the Web login page of end users and Radius server. Indicates the maximum number of retries upon connection failure between the Web login page of end users and Radius server. Recommended value: 10 Recommended value: 2 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 87

93 3 Operation Guide (Administrators) Step 5 Click OK. Two-factor authentication is enabled. ----End Disabling dual-factor authentication Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 Click Modify next to Two-factor authentication. The Two-factor authentication dialog box is displayed. Step 4 Click to disable two-factor authentication. Step 5 Click OK. Two-factor authentication is disabled. ----End 3.14 Changing the Password of a Domain Administrator Scenario The password of a domain administrator needs to be changed periodically to ensure system security. You are advised to change the password every three months. Change the password of a domain administrator on the Workspace management console. NOTE If the enterprise uses an existing AD domain, the period for changing the password of the domain administrator depends on the preset password policy. Change the domain administrator password on the AD server first, and then perform the following operations. Procedure Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 Click Modify in the lower right corner of AD Domain. The Modify Password dialog box is displayed. Step 4 Set Old Password, New Password, and Confirm New Password, and click OK. ----End Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 88

94 3 Operation Guide (Administrators) 3.15 (Optional) Configuring the WSUS Scenario Procedure Configure a group policy on your AD server to use the Windows Server Update Services (WSUS) to update patches in the following scenarios: The Workspace service connects to the existing AD domain of your enterprise. Your enterprise uses an AD server running a Windows OS and has a WSUS server. NOTE Windows Server 2012 R2 is used as an example in the following steps. The specific operation steps may be different on different OSs. Step 1 Log in to the AD server using a domain administrator account. Step 2 On the task bar, click. Step 3 Choose Administrative Tools > Group Policy Management > Forest: Domain name > Domains > Domain name > First OU > First GPO. NOTE When you unfold Group Policy Management, the system automatically loads related policy information, which takes about 2 minutes. The first OU indicates the first OU created during software installation, and the first GPO indicates the first GPO added to the first OU. Step 4 Right-click the first GPO and choose Edit from the shortcut menu. The Group Policy Management Editor window is displayed. Step 5 In the navigation tree, choose Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update. Information about the Windows update is displayed in the right pane. NOTE When you unfold Policies in the navigation tree, the system automatically loads related policy information, which takes about 2 minutes. Step 6 In the right pane, double-click Configure Automatic Updates. The Configure Automatic Updates dialog box is displayed, as shown in Figure 3-1. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 89

95 3 Operation Guide (Administrators) Figure 3-1 Configure Automatic Updates Step 7 Step 8 Select Enabled in the Configure Automatic Updates area, and set the following parameters based on the actual situation: Configure automatic updating Scheduled install day Scheduled install time Click OK. The Configure Automatic Updates dialog box is closed. Step 9 In the right pane, double-click Specify intranet Microsoft update service location. The Specify intranet Microsoft updates service location dialog box is displayed. Step 10 Step 11 Select Enabled in the Specify intranet Microsoft updates service location area, and set the following parameters: Set Set the intranet update service for detecting updates to the service IP address of the patch server. Set Set the intranet statistics server to the service IP address of the patch server. Click OK. The Specify intranet Microsoft updates service location dialog box is closed. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 90

96 3 Operation Guide (Administrators) Step 12 Set the update policies for other groups. For details, see Step 1 to Step 11. When setting update policies, set different patch update time for different groups. You are advised to set a one-day interval for the patch update time of the groups. You are not allowed to set the same patch update time for all groups. Step 13 Close the Server Manager window. ----End 3.16 Canceling Workspace Scenario Procedure If Workspace is no longer needed, delete the user desktops and perform the following steps to cancel Workspace. Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Configuration Information area, click Cancel Workspace. The Cancel Workspace dialog box is displayed. Step 4 Click OK. ----End Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 91

97 4 Operation Guide (End Users) 4 Operation Guide (End Users) 4.1 Introduction to Workspace Workspace is a public cloud service that employs cloud computing technology to provide users with Windows desktops and applications of PCs as cloud services. Storing applications on the cloud ensures service reliability. With Workspace, all applications and services are processed in the data center, ensuring service reliability and performance. The stable running of applications reduces costs on the management and maintenance of office environments. A seamless switchover enables mobile office. Traditionally, users can only use dedicated devices to access their desktops. Workspace supports access from multiple devices, including computers running Windows OSs, ipads, iphones, and Android smart devices. With Workspace, you can save and obtain files, and use applications anytime and anywhere, implementing mobile office. 4.2 Introduction to Terminals In Workspace, services are offered and used by cloud terminals. Widely used terminals are SCs, TCs and mobile terminals. SC: After installing cloud client software on PCs, you can use the PCs to access desktops, which reuses PCs. TC: A thin client (TC) is a PC-standard-compliant computer that uses an embedded processor and small-sized flash memory and runs a simplified OS. It is used to access Workspace. Mobile terminal: Android and ios terminals can be used to access desktops, achieving mobile office anytime and anywhere. 4.3 Risky Operations Workspace desktops provide on-demand services based on network resources and work depending on OSs and network configurations in desktops. This section describes some risky operations on desktops. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 92

98 4 Operation Guide (End Users) Risky Operations (Processes and Services) 1. Change the default service and startup options in the system configuration. Figure 4-1 shows the Services and Startup options. Figure 4-1 Services and startup 2. Disable HDP services shown in Figure 4-2. Figure 4-2 HDP services 3. Uninstall programs shown in Figure 4-3. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 93

99 4 Operation Guide (End Users) Figure 4-3 Programs 4. End the LOCAL SERVICE, NETWORK SERVICE, or SYSTEM processes in Task Manager. Figure 4-4 shows the processes that cannot be ended. Figure 4-4 Task Manager Risky Operations (Network) 1. Disable NICs, and disable or modify network configurations, as shown in Figure 4-5. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 94

100 4 Operation Guide (End Users) Figure 4-5 Local connection Risky Operations (Others) 2. Run the script or command for modifying a route, such as route DELETE *. 3. Delete ports 28511, 28512, 28521, and from Windows firewall exception options. 4. Enable software or tools, such as the IPsec, that can restrict network traffic. 1. Delete files or folders in C:\Program Files\Huawei listed in Figure 4-6. Figure 4-6 Folders 2. Enable the sleep function on desktops. The sleep function is disabled for desktops by default, as shown in Figure 4-7. Figure 4-7 Sleep function 3. Modify the configuration file of the HDP client (AccessAgent). 4. Run Rabbit Magic or Wopti Utilities to clean or optimize the registry. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 95

101 4 Operation Guide (End Users) 5. Install a customized screensaver with complex transformation functions, which consumes system resources and causes a delay in desktop access. 4.4 Failure When Connecting to Desktops During the use of Workspace desktops, desktops may fail to be connected due to misoperations. If this happens, you can click problem. to restart the desktops to resolve the NOTE If desktops cannot be restarted or you cannot log in to the desktops after they are restarted, click to forcibly restart the desktops. Data that is not saved may be lost after the desktops are forcibly restarted. Therefore, exercise caution when forcibly restarting desktops. 4.5 Dual-Screen Display Configuration When accessing Workspace desktops using TCs, perform the following operations to configure dual-screen display. Prerequisites Table 4-1 lists the materials required for configuring dual-screen display. Table 4-1 Materials required for configuring dual-screen display Item Quantit y Image (Example) Description TC 1 - Monitor/Converter 2 Typically, a monitor provides a DVI-D port and a VGA port. If two monitors have only VGA ports in some special cases, a DVI-D-to- VGA converter is required. DVI-I one-to-two cable 1 Converts DVI-I signals to DVI-D and VGA signals. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 96

102 4 Operation Guide (End Users) Item Quantit y Image (Example) Description DVI-D-to-DVI-D cable 1 - VGA-to-VGA cable 1 - Procedure Dual-Screen Connection Step 1 Connect a TC to monitors based on the monitor type. If the monitors provide DVI and VGA ports, go to Step 2. If the monitors provide VGA ports only, go to Step 3. Step 2 Connect the TC to the monitors, as shown in Figure 4-8. Figure 4-8 Dual-screen connection Step 3 Connect the TC to the monitors, as shown in Figure 4-9. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 97

103 4 Operation Guide (End Users) Figure 4-9 Dual-screen connection ----End TC Setting Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Power on the TC. Perform the following operation based on the TC type. Linux TC: Perform Step 3 to Step 7. Windows TC: Perform Step 8to Step 10 Click Start, and choose Control Center. Double-click Display. Select Optimum settings. Select the display mode based on site requirements. Duplicate Extend Select the main monitor based on site requirements. DVI VGA The task is completed. Right-click on the desktop and choose Screen Resolution. Set Multiple displays based on site requirements. Duplicate these displays Extend these displays NOTE Only Extend these displays can be selected when two desktops and dual-screen display are used. Step 10 Click OK. ----End Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 98

104 4 Operation Guide (End Users) Client Setting Step 1 Step 2 Step 3 Step 4 Step 5 Perform the following operation based on the dual-screen display scenario. If a desktop and two screens are used, go to Step 2. If two desktops and two screens are used, go to Step 6. Log in to the desktop using the client. Click Settings. Select Open Multiple Monitor (The configuration will take effect after reconnect). Click Close. The task is completed. Step 6 Step 7 Step 8 Step 9 Log in to a desktop using the client. Click Settings. Deselect Open Multiple Monitor (The configuration will take effect after reconnect). Click Close. Step 10 Log in to the other desktop and repeat Step 6 to Step 9. Step 11 Drag the two desktops to different screens to achieve dual-screen display. ----End Others 4.6 HDPDeviceHelper Peripheral Assistant If you encounter peripheral configuration problems when using Workspace, you can use HDPDeviceHelper. Choose Start > Huawei vdesk. Start HDPDeviceHelper and configure peripherals following the instructions. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 99

105 4 Operation Guide (End Users) Figure 4-10 vdesk Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 100

106 5 FAQs (Administrators) 5 FAQs (Administrators) 5.1 What Is Workspace? Workspace is a cloud computing-based desktop service that outperforms personal computers (PCs) and the conventional VDI solution. Workspace provides the same configurations (including vcpus, GPUs, memory, and disks) as those of PCs and Windows OSs. Its familiarity ensures that you can use Workspace like using your own PCs. Different from the conventional local VDI solution, Workspace does not require high investment or a long deployment period. Workspace can automatically handle heavy deployment tasks and provide hosting services. Workspace supports access from multiple devices, including computers running Windows and Mac OSs, as well as ipads, iphones, and Android smart devices. With Workspace, you can save and obtain files, and use applications anytime and anywhere, implementing mobile office. 5.2 What Are the Features and Advantages of Workspace? A web-based management console is provided for you to flexibly enable and disable Workspace that works out of the box. Workspace provides the following features and advantages: Workspace can be provisioned and deployed quickly whereas deploying conventional private desktop clouds takes several days. Administrators can manage hundreds of desktops at the same time using the web page. Multiple desktop package specifications are available for you to choose the most appropriate one (vcpus, GPUs, memory, system disks, and data disks). The password can be reset if a user forgets it. Encrypted remote access, isolated user resources, and network and peripheral security control are used to ensure high security of data access. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 101

107 5 FAQs (Administrators) 5.3 What Is the Process of Using Workspace? Administrators only need to apply for Workspace and create desktops before using desktops, as shown in Figure 5-1. End users can use desktops after completing basic configurations on clients, as shown in Figure 5-2. Figure 5-1 Workspace use process on servers Figure 5-2 Workspace use process on clients 5.4 What Are Workspace Packages? Workspace Packages Workspace resources are packaged for leasing. Packages shown in Table 5-1 and Table 5-2 are for reference only. The actual package prevails. Table 5-1 Workspace General Category Workspace General Instance workspace.c2.large.w indows workspace.c2.xlarge.wi ndows workspace.c2.2xlarg e.windows vcpu Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 102

108 5 FAQs (Administrators) Memory (GB) System Disk (GB) Data Disk (GB) 80 to 32, to 32, to 32,768 0, 100 to 32,768 0, 100 to 32,768 0, 100 to 32,768 Guest OS Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Number of GPUs GPU Type GPU RAM (GB) Table 5-2 Workspace GPU Category Workspace GPU Instance workspace.g1.xlarge. windows workspace.g1.2xlarge.w indows workspace.g2.2xlarg e.windows vcpu Memory (GB) System Disk (GB) Data Disk (GB) 80 to 32, to 32,768 80~ , 100 to 32,768 0, 100 to 32,768 0, 100~32768 Guest OS Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2016 with Windows 10 experience Number of GPUs Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 103

109 5 FAQs (Administrators) GPU Type M60-1Q M60-1Q M60 GPU RAM (GB) NOTE The data disk configuration policies are as follows: No data disk is configured. Configure a data disk based on actual requirements. The disk capacity ranges from 100 GB to 32,768 GB. 5.5 How Is Workspace Charged? Workspace supports the pay-per-use charging mode. Workspace is charged based on the usage of the following resources: vcpu, memory, and GPU System disk and data disk 5.6 Do I Need to Purchase TCs? You are advised to log in to the desktop using an SC or purchase a TC for login. You can use Huawei FusionCloud Compatibility Check Assistant > FusionAccess > Compatible Terminal List to query TC models that are compatible with Workspace. You can contact the local TC vendor or agent to purchase the TC. 5.7 How Do End Users Access the Internet? Method 1: using SNAT The administrator can configure source network address translation (SNAT) or create a proxy server for user desktops to access the Internet. Based on the SNAT service provided by the public cloud, within the specified bandwidth, Workspace desktops without EIPs can access the Internet. In this way, end users can download software updates via the Internet. Currently, Workspace desktops are allowed to access the Internet, but cannot be accessed from the Internet. The bandwidth is shared by all Workspace desktops. Basic principle: ECSs assigned with public EIPs are used as SNAT routers or gateways of Workspace desktops in the same subnet or VPC, thereby enabling Workspace desktops to access the Internet. Different versions of CentOS have different network configuration methods. The following Internet solution is provided by CentOS6.5 as an example. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 104

110 5 FAQs (Administrators) Creating a SNAT server 1. Create an ECS with an EIP as the SNAT server. The ECS is in the same VPC with the Workspace desktops, runs on CentOS, and has one NIC. The following uses CentOS 6.5 as an example. Setting the NIC and security group rule of the SNAT server 1. Log in to the management console. 2. On the page that is displayed, choose Computing > Elastic Cloud Server. 3. On the displayed page, locate the target ECS in the ECS list and click the ECS name to switch to the page showing ECS details. 4. Click the NIC tab and disable the source/destination check function. 5. Select Security Group, and add an inbound Any rule for WorkspaceUserSecurityGroup. Configuring routing information 1. Log in to the management console. 2. In the navigation pane on the left, choose Virtual Private Cloud. 3. In the navigation pane on the left, select a VPC to which a route is to be added and click Route Table. 4. On the Route Table page, click Add Route. 5. Set route information on the displayed page. Destination: indicates the destination network segment. The value can be a network segment of subnets in the VPC. The default value is /0. The destination of each route must be unique. Next Hop: indicates the IP address of the next hop. Set it to a private IP address or a floating private IP address in a VPC. NOTE 6. Click OK. If Next Hop is set to a floating private IP address, the floating private IP addresses in the VPC cannot have EIPs bound. Otherwise, the route will not take effect. Configuring the SNAT server 1. On the ECS console, use the remote login function to log in to the ECS on which SNAT is to be configured. 2. Run the following command and enter the password of user root to switch to user root: su - root 3. Run the following command to check whether the ECS can successfully connect to the Internet: ping The ECS can access the Internet if the following information is displayed: [root@localhost ~]# ping PING (xxx.xxx.xxx.xxx) 56(84) bytes of data. 64 bytes from xxx.xxx.xxx.xxx: icmp_seq=1 ttl=51 time=9.34 ms 64 bytes from xxx.xxx.xxx.xxx: icmp_seq=2 ttl=51 time=9.11 ms 64 bytes from xxx.xxx.xxx.xxx: icmp_seq=3 ttl=51 time=8.99 ms 4. Run the following command to check whether IP forwarding of the Linux OS is enabled: cat /proc/sys/net/ipv4/ip_forward Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 105

111 5 FAQs (Administrators) In the command output, 1 indicates enabled, and 0 indicates disabled. The default value is 0. If IP forwarding in Linux is enabled, go to 8. If IP forwarding in Linux is disabled, go to Run the following command to edit the /etc/sysctl.conf file. Press I to enter the edit mode and set net.ipv4.ip_forward to 1. vi /etc/sysctl.conf 6. Press Esc, type :wq, and press Enter. Save the settings and exit the vi editor. 7. Run the following command to make the change take effect: sysctl -p /etc/sysctl.conf 8. Run the following command to configure the NAT conversion rule: iptables -t nat -A POSTROUTING -o eth0 -s VPC or subnet segment where Workspace desktops reside/mask bits -j SNAT --to internal IP address of the SNAT server For example, if the VPC network segment is , the mask bits is 24, and the internal IP address of the SNAT server is , run the following command: iptables -t nat -A POSTROUTING -o eth0 -s /24 -j SNAT --to Run the following command to save the configuration: service iptables save 10. Run the following command to check whether the operation is successful: iptables -t nat --list The operation is successful if the information shown in Figure 5-3 (for example, /24) is displayed. Figure 5-3 Verifying configuration 11. Run the following command to edit the rc.local file: vi /etc/rc.d/rc.local 12. Add the following content to the end of the file: echo `/sbin/iptables-restore /etc/sysconfig/iptables` >>/etc/rc.d/rc.local 13. Press Esc, type :wq, and press Enter. Save the settings and exit the vi editor. 14. Run the following command to modify the ifcfg-eth0 file: vi /etc/sysconfig/network-scripts/ifcfg-eth0 Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 106

112 5 FAQs (Administrators) 15. Add the following content to the end of the file: DNS= Press Esc, type :wq, and press Enter. Save the settings and exit the vi editor. 17. Run the following command to restart the NIC: service network restart Configuring the user desktop 1. Go to Network and Sharing Center. 2. In the View your active networks area, click Local Area Connection 2 or Ethernet 2. The Local Area Connection 2 Status dialog box or the Ethernet 2 Status dialog box is displayed. 3. Click Properties. The Local Area Connection 2 Properties dialog box or the Ethernet 2 Properties dialog box is displayed. 4. Double-click Internet Protocol Version 4 (TCP/IPv4). The Internet Protocol Version 4 (TCP/IPv4) Properties dialog box is displayed. 5. Select Use the following DNS server addresses, and set the DNS server address to Click Advanced. The Advanced TCP/IP Settings dialog box is displayed. 7. Deselect Automatic metric, and set Interface metric to Click OK in sequence to save the settings and close the dialog boxes. 9. Click Close to close the Local Area Connection 2 Status dialog box or the Ethernet 2 Status dialog box. 10. In the View your active networks area, click Local Area Connection or Ethernet. The Local Area Connection Status dialog box or the Ethernet Status dialog box is displayed. 11. Click Details. The Network Connection Details dialog box is displayed. 12. Record the IPv4 address, for example, Open the cmd window and run the following command to add a route: route add mask Gateway of the primary NIC p The first two segments of Gateway of the primary NIC are the same as those of the IP address recorded in 12, and the last two segments are 0 and 1 respectively. NOTE Method 2: using a proxy server For example, if the IPv4 address is , the gateway of the primary NIC is Run the following command to add a route: route add mask p Creating a proxy server 1. Create a proxy server that runs, for example, CentOS. The proxy server must reside on a subnet different from the one where Workspace resides in the same VPC. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 107

113 5 FAQs (Administrators) NOTE For details about how to configure the ECS, see the Elastic Cloud Server User Guide. 2. Configure an elastic IP address for the proxy server to access the Internet. Installing squid NOTE The following operations use Cent OS 6.6 as an example. 1. Log in to the proxy server as user root. 2. Run the following command to check whether squid is installed: rpm -qa grep squid If it is installed, go to 4. If it is not installed, go to Run the following command to install squid: yum -y install squid 4. Run the following command to edit the squid.conf configuration file: vi /etc/squid/squid.conf 5. Check whether SSH is used for connection. If SSH is used, go to 6. If SSH is not used, go to Press I to enter the edit mode and add the following content in a blank row. aclsafe_ports port Use # to comment out http_access deny CONNECT!SSL_ports. 8. Press Esc to exit the edit mode. Type :wq and press Enter. Save configurations and exit the vi editor. 9. Run the following command to restart the squid service. service squid restart Configuring security group rules 1. Configure security group rules to ensure that the extranet cannot access any port of the proxy server and the user desktop can access only the proxy port of the proxy server. NOTE For details about how to configure security group policies, see the Elastic Cloud Server User Guide. Configuring the user's browser 1. Open the proxy server setting page of the browser. 2. Set the IP address and the port of the proxy server to the IP address and the monitoring port configured in 1, respectively. 5.8 How Do I Install Applications on the Desktop? If an end user needs to install applications on the desktop, the administrator can use the following methods to assist the end user in the installation: Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 108

114 5 FAQs (Administrators) Method 1: using file redirection 1. Choose File redirection > Fixed Drive (such as local disks) to enable the policy. For details, see Managing Policies. 2. The end user downloads required applications to the local PC. 3. The end user copies the applications from the local PC to the desktop and installs them. Method 2: using USB redirection 1. Choose USB port redirection > Storage devices (such as USB flash drives) to enable the policy. For details, see Managing Policies. 2. The end user copies the applications from the USB flash drive to the desktop and installs them. Method 3: using the Internet 1. Enable the Internet access permission for the end user. For details, see How Do End Users Access the Internet?. 2. The end user downloads the applications from the Internet to the desktop and installs them. Method 4: using private images Create the desktop where the required applications are installed for the end user. For details, see Creating Workspace Desktops. Method 5: using Microsoft AD pushing Use Microsoft AD to push the applications to the desktop of the end user. For details, see How to use Group Policy to remotely install software in Windows Server What Resources Do I Need to Prepare Before Applying for Workspace? You need to enable ports listed in Table 5-3 on the enterprise firewall so that end users can log in to the desktops properly. Table 5-3 Internet access ports Port Protocol Description 443 TCP Used by the end user to access the web login page TCP Used by the end user to access the desktop. NOTE By default, port 443 and port 8443 are used. If you want to change the ports, see Changing the Internet Access Port. In GPU desktop scenarios, prepare DirectConnect resources. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 109

115 5 FAQs (Administrators) 5.10 What Should I Do If I Fail to Apply for Workspace? Scenario Procedure If you are unable to access Workspace after the initial application is complete, retry the application, or cancel Workspace and reapply again. Step 1 Step 2 Log in to the Workspace management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Configuration Information area, click Retry. The Retry Apply for Workspace dialog box is displayed. Step 4 Click OK. NOTE ----End You can click Cancel Workspace in the Configuration Information area to cancel Workspace and apply for Workspace again How Is Workspace Connected to Enterprise Intranets? Workspace desktops can communicate with PCs in the enterprise intranet using the VPN or DirectConnect method. VPN: Figure 5-4 shows how to use VPN to connect Workspace desktops to PCs in the enterprise intranet. Figure 5-4 Connecting Workspace to an enterprise intranet using a VPN Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 110

116 5 FAQs (Administrators) DirectConnect: Contact technical support engineers. NOTE Workspace reserves the /16 network segment for the NIC on the management plane. Do not use this network segment on the enterprise intranet in case the route conflict occurs How Do I Interconnect Workspace with Microsoft AD? You can deploy Microsoft AD in the intranet of the enterprise DC or in the VPC where Workspace resides. The following describes how to interconnect Workspace with Microsoft AD in two deployment scenarios. After interconnecting Workspace with Microsoft AD, configure DNS forwarding on the DNS to allow Workspace to access the Internet. NOTE Ensure that the network where Workspace resides is communicating correctly with that where Microsoft AD resides. Procedure Scenario 1: Microsoft AD is deployed in the intranet of the customer's DC. Figure 5-5 Microsoft AD deployed in the intranet of the customer's DC Step 1 Step 2 Use DirectConnect or IPsec VPN to connect the customer's DC to the VPC. For details about the configuration, see the VPN User Guide. If a firewall is deployed between Microsoft AD and Workspace, enable the following ports on the firewall for Workspace to connect to Microsoft AD, as shown in Table 5-4: Table 5-4 Port list Role Port Protocol Description AD 135 TCP Remote Procedure Call (RPC) protocol This port is used by the Lightweight Directory Access Protocol (LDAP), Distributed File System (DFS), and Distributed File System Replication (DFSR). Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 111

117 5 FAQs (Administrators) Role Port Protocol Description 137 UDP NetBIOS name resolution This port is used by the network login service. 138 UDP NetBIOS data gram service 139 TCP NetBIOS-SSN service This port is used by services, such as the DFS and network login service. This port is used for network basic input and output. 445 TCP NetBIOS-SSN service 49,152-65,535 TCP RPC dynamic port 49,152-65,535 UDP RPC dynamic port This port is used for network basic input and output. 88 TCP Kerberos key distribution center service 88 UDP Kerberos key distribution center service 123 UDP Port used by the NTP service 389 UDP LDAP server 389 TCP LDAP server 464 TCP Kerberos authentication protocol 464 UDP Kerberos authentication protocol 500 UDP isakmp 593 TCP RPC over HTTP 636 TCP LDAP SSL 3268 TCP LDAP global catalog server 3269 TCP LDAP global catalog server 4500 UDP IPsec NAT-T 5355 UDP llmnr 9389 TCP Active Directory Web service DNS 53 TCP DNS server 53 UDP DNS server Step 3 After the configuration, verify the interconnection and ensure that the networks and ports are working correctly. For details, see Verification. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 112

118 5 FAQs (Administrators) Step 4 Log in to your DNS server, configure the DNS reverse lookup function in the DNS Manager, and add the first subnet segment that is selected in the subnet list during Workspace application to the IP address segment for reverse lookup. ----End Scenario 2: Microsoft AD is deployed in a subnet and the VPC where Workspace resides is deployed in another subnet. Figure 5-6 Microsoft AD deployed in a subnet and the VPC where Workspace resides deployed in another subnet In this scenario, you must add security group rules for Microsoft AD to enable some ports of Microsoft AD for Workspace so that Workspace can connect to Microsoft AD. Step 1 Step 2 Create a security group, add an inbound rule, and configure the parameters as follows: Protocol: ANY Source IP Address: IP Address IP Address: Enter the subnet where Workspace resides. Apply the security group to AD server instances so that Workspace can communicate correctly with Microsoft AD. NOTE If you want to minimize the number of enabled ports and protocols, you can add multiple inbound rules to the security group. For details about the ports that need to be enabled, see Table 5-4. Step 3 Step 4 After the configuration, verify the interconnection and ensure that the networks and ports are working correctly. For details, see Verification. Log in to your DNS server, configure the DNS reverse lookup function in the DNS Manager, and add the first subnet segment that is selected in the subnet list during Workspace application to the IP address segment for reverse lookup. ----End Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 113

119 5 FAQs (Administrators) Verification Step 1 Check the firewall or security group settings of the AD server and ensure that ports 49,152 to 65,535 have been enabled. NOTE For details about the requirements on AD server ports, see Active Directory and Active Directory Domain Services Port Requirements. Step 2 Create a Windows OS instance in the VPC where the user desktop resides using the ECS service and add the instance to the existing domain. NOTE For details about how to configure and operate ECS, see the Elastic Cloud Server User Guide. Step 3 Log in to the Windows instance using the RDP client tool (such as mstsc) or VNC. The remaining steps are performed on this Windows instance. Step 4 Step 5 Step 6 Download ADTest.zip and unzip the test application. In the blank area of the directory where ADTest.exe resides, hold down Shift, right-click, and choose Open command windows here. In Command Prompt, enter the following command to check the AD server connectivity: ADTest.exe -file ADTest.cfg -ip AD IP address -domain AD domain name -user domain administrator account Command example: ADTest.exe -file ADTest.cfg -ip domain abc.com -user vdsadmin Step 7 Check whether SUCCEED is displayed in all test results. If FAILED is displayed, check the AD server configuration or firewall ports following the instructions. ----End Configure DNS forwarding. NOTE The following uses Windows Server 2012 as an example. Step 1 Log in to the DNS server as the administrator. Step 2 On the task bar, click. The Server Manager window is displayed. Step 3 Step 4 In the navigation pane on the left, click DNS. In the SERVER area, right-click server name and choose DNS Manager. The DNS Manager window is displayed. Step 5 Step 6 Unfold DNS, right-click computer name, and choose Properties from the shortcut menu. On the Advanced tab page, deselect Disable recursion (also disable forwarders), and click Apply. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 114

120 5 FAQs (Administrators) Step 7 On the Forwarders tab page, click Edit, enter the IP address of the default DNS server of the public cloud, and click OK. NOTE ----End You can view the IP address of the default DNS server of the public cloud on the page for creating the VPC What Should I Do If I Fail to Apply for Workspace by Interconnecting with Microsoft AD? Scenario Procedure If you fail to apply for Workspace by interconnecting with Microsoft AD and a message is displayed stating "Failed to configure an infrastructure component(85%)", you can rectify the fault as follows: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 In the AD Domain area of the Dashboard page, check whether the domain information is correct. Click Modify to modify incorrect domain configurations. Click Retry to reapply for the service. If you use Scenario 1: Microsoft AD is deployed in the intranet of the customer's DC in section How Do I Interconnect Workspace with Microsoft AD? and use DirectConnect for connections, log in to the AD server and ping the IP address of DirectConnect. If the ping fails, check whether the network where the AD server resides as well as the VPC network and subnet ports used for applying for Workspace are normal. Check the AD server connectivity. For details, see the Verification area in section How Do I Interconnect Workspace with Microsoft AD?. Click Retry to reapply for the service. If the fault persists, contact technical support engineers. ----End 5.14 How Do I Check the Network Status of Desktops? Procedure Perform the following operations to check the network status of desktops and determine the network segment where the fault occurs. Step 1 Step 2 Log in to the desktop. Move the cursor to the upper area of the desktop. The floating window is displayed, as shown in Figure 5-7. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 115

121 5 FAQs (Administrators) Figure 5-7 Floating window Step 3 Click Network. The Connection Status dialog box is displayed. NOTE Step 4 When the network connection is good, the network indicator is steady green. When the network connection is poor, the network indicator is steady yellow. When the network connection is bad, the network indicator is steady red. On the Connection Status page, check Round-Trip Time. Figure 5-8 shows the network connection status. Figure 5-8 Network connection status Step 5 Step 6 Click Start. In the Search programs and files text box, type cmd, and press Enter. In the command-line interface, run the following command to check the network connectivity between the desktop and the terminal: ping Internet access address of the desktop NOTE The Internet access address of the desktop can be found in the desktop provisioning notification . Information similar to the following is displayed: Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 116

122 5 FAQs (Administrators) Step 7 Determine the network segment where the fault occurs based on the results in Step 4 and Step 6. If the network latency in Step 4 and Step 6 is large, the public network is faulty. If the network latency in Step 4 is large but that in Step 6 is small, the internal network of Workspace is faulty. ----End 5.15 What Are the Network Requirements for Accessing the Desktop? Table 5-5 lists the network requirements for accessing the desktop. If the network requirements cannot be met, you are advised to use DirectConnect access. Table 5-5 Network requirements Desktop Type Common desktop GPU desktop Network Requirement Average bandwidth: 300 kbps/ instance; Peak 5 Mbps/ instance. Packet loss rate 0.01% Round -trip delay 30 ms Jitter 10 ms Average bandwidth: 20 Mbps/ instance. Packet loss rate 0.01% Round -trip delay 30 ms Jitter 10 ms These values are for reference only and may be more stringent depending on the application scenario. Must be used in conjunction with the Direct Connect service. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 117

123 6 FAQs (End Users) 6 FAQs (End Users) 6.1 What Devices Can Be Used to Log In to Workspace? You can log in to Workspace using TCs, SCs, browsers, Android terminals, and ios terminals. 6.2 What Are the Precautions for Using Workspace? Workspace desktops provide on-demand services based on network resources and work depending on OSs and network configurations in desktops. This section describes some risky operations on desktops. These operations do not need to be adjusted. If special modification is required, contact the administrator for confirmation. Risky Operations (Processes and Services) 1. Change the default service and startup options in the system configuration. Figure 6-1 shows the Services and Startup options. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 118

124 6 FAQs (End Users) Figure 6-1 Services and startup 2. Disable HDP services shown in Figure 6-2. Figure 6-2 HDP services 3. Uninstall programs shown in Figure 6-3. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 119

125 6 FAQs (End Users) Figure 6-3 Programs 4. End the LOCAL SERVICE, NETWORK SERVICE, or SYSTEM processes in Task Manager. Figure 6-4 shows the processes that cannot be ended. Figure 6-4 Task Manager Risky Operations (Network) 1. Disable NICs, and disable or modify network configurations, as shown in Figure 6-5. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 120

126 6 FAQs (End Users) Figure 6-5 Local connection Risky Operations (Others) 2. Run the script or command for modifying a route, such as route DELETE *. 3. Delete ports 28511, 28512, 28521, and from Windows firewall exception options. 4. Enable software or tools, such as the IPsec, that can restrict network traffic. 1. Delete files or folders in C:\Program Files\Huawei listed in Figure 6-6. Figure 6-6 Folders 2. Enable the sleep function on desktops. The sleep function is disabled for desktops by default, as shown in Figure 6-7. Figure 6-7 Sleep function 3. Modify the configuration file of the HDP client (AccessAgent). 4. Run Rabbit Magic or Wopti Utilities to clean or optimize the registry. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 121

127 6 FAQs (End Users) 5. Install a customized screensaver with complex transformation functions, which consumes system resources and causes a delay in desktop access. 6.3 What OSs Can Run on Workspace? Workspace runs Windows Server 2008 R2 or Windows Server 2016 and delivers the Windows 7 or Windows 10 desktop environment. 6.4 Can I Upgrade OSs by Myself? Workspace must use OSs provided by the public cloud or OSs made based on the OSs provided by public cloud. You are not allowed to upgrade an OS but can install OS patches. 6.5 How Do I Install Applications on the Desktop? By default, end users are configured as local administrators and can install applications. Administrators can modify the settings to prevent end users from installing applications. An end user can install applications on the desktop using the following methods: NOTE The administrator must enable necessary policies and perform required configurations before the following methods are used. Method 1: using file copy 1. Download required applications to the local PC. 2. Copy the applications from the local PC to the desktop and install them. Method 2: using USB flash drive copy Copy the applications from the USB flash drive to the desktop and install them. Method 3: using the Internet Download the applications from the Internet to the desktop and install them. Method 4: using private images Contact the administrator to create the required desktop. Method 5: using application pushing Contact the administrator to push the required applications to your desktop and install them. 6.6 What Software Is Compatible with Workspace? Software that works with Workspace must be compatible with Windows Server 2008 R2 or Windows Server Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 122

128 6 FAQs (End Users) 6.7 How Does Workspace Manage Peripherals? If you encounter peripheral configuration problems when using Workspace, you can use HDPDeviceHelper. Choose Start > Huawei vdesk. Start HDPDeviceHelper and configure peripherals following the instructions. Figure 6-8 vdesk 6.8 Does Workspace Support Personalized Settings? By default, after logging in to Workspace, end users can personalize items, such as wallpapers, icons, and shortcuts for OSs. The settings will be retained until the next modification. Administrators can use policies, such as USB Redirection, Printer Redirection, File Redirection, and Clipboard Redirection to control data transmission and peripheral access permission between end users and Workspace. Installing a customized screensaver with complex transformation functions consumes system resources and causes a delay in desktop access. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 123

129 6 FAQs (End Users) 6.9 Can Data in Workspace Be Saved for a Long Time? Yes. End users use Workspace desktops separated from other end users. Applications, documents, settings, and other data can be saved for a long time How Do I Use a Local Printer for Printing? If you have configured a local printer, the printer will be selected by default. If no printer is configured, you need to configure one. Then select the local printer from the printing menu and click Print How Do I Use a Network Printer for Printing? Any printer that resides in the same network as Workspace and is supported by Windows can be added as a network printer. After a network printer is added, you can select the printer in applications for printing What Should I Do If the Desktop Cannot Be Connected? During the use of Workspace desktops, desktops may fail to be connected due to misoperations. If this happens, you can click problem. to restart the desktops to resolve the NOTE If desktops cannot be restarted or you cannot log in to the desktops after they are restarted, click to forcibly restart the desktops. Data that is not saved may be lost after the desktops are forcibly restarted. Therefore, exercise caution when forcibly restarting desktops How Do I Log In to the Desktop for Maintenance Using VNC? If you cannot log in to your desktop normally, you can log in to the desktop for maintenance using VNC. NOTE This function does not apply to scenarios where DirectConnect is used to access desktops. The procedure is as follows: 1. Log in to the desktop and enter the desktop list page. 2. Click, as shown in Figure 6-9. The VNC self-help console is displayed. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 124

130 6 FAQs (End Users) NOTE If a black screen occurs, click Send CtrlAltDel in the upper-right corner of the window. Figure 6-9 Self-help console 6.14 What Should I Do If the Desktop Freezes When Using Workspace? If a fault such as desktop freezing or slow response occurs when you use a Workspace desktop, rectify the fault by performing operations provided in this section. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 125

131 6 FAQs (End Users) Figure 6-10 Fault locating Method 1: Stopping Unnecessary Processes 1. On the desktop, open Task Manager. The following figure shows the Task Manager window. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 126

132 6 FAQs (End Users) Figure 6-11 Windows Task Manager 2. View the processes that consume massive CPU and memory resources. 3. Save user documents. 4. Stop the processes that consume massive CPU and memory resources. Do not stop the processes mandatory for desktop operating. For details, see What Are the Precautions for Using Workspace?. Method 2: Restarting the Desktop 1. Save user documents. 2. Choose Start > Restart or click to restart the desktop, as shown in the following figure. NOTE If desktops cannot be restarted or you cannot log in to the desktops after they are restarted, click to forcibly restart the desktops. Data that is not saved may be lost after the desktops are forcibly restarted. Therefore, exercise caution when forcibly restarting desktops. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 127

133 6 FAQs (End Users) Figure 6-12 Self-help console 3. On the login page that is displayed, enter the user domain account and password. 4. In the desktop list, click to go to the desktop How Do I Check the Network Status of Desktops? Perform the following operations to check the network status of desktops and determine the network segment where the fault occurs. Procedure Step 1 Step 2 Log in to the desktop. Move the cursor to the upper area of the desktop. The floating window is displayed, as shown in Figure Figure 6-13 Floating window Step 3 Click Network. The Connection Status dialog box is displayed. NOTE When the network connection is good, the network indicator is steady green. When the network connection is poor, the network indicator is steady yellow. When the network connection is bad, the network indicator is steady red. Step 4 On the Connection Status page, check Round-Trip Time. Figure 6-14 shows the network connection status. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 128

134 6 FAQs (End Users) Figure 6-14 Network connection status Step 5 Step 6 Click Start. In the Search programs and files text box, type cmd, and press Enter. In the command-line interface, run the following command to check the network connectivity between the desktop and the terminal: ping Internet access address of the desktop NOTE The Internet access address of the desktop can be found in the desktop provisioning notification . Information similar to the following is displayed: Step 7 Determine the network segment where the fault occurs based on the results in Step 4 and Step 6. If the network latency in Step 4 and Step 6 is large, the public network is faulty. If the network latency in Step 4 is large but that in Step 6 is small, the internal network of Workspace is faulty. ----End 6.16 How Do I Change the Login Password? The passwords of accounts in the system must be changed periodically. The recommended interval is three months. The minimum validity period of a password is two days. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 129

135 6 FAQs (End Users) You can perform the following steps to change the login password on the WI (desktop login page). Step 1 Use the original domain account and password to log in. The desktop list page is displayed. Step 2 On the desktop list page, click. Then click. Step 3 Step 4 Enter Old Password, New Password, and Confirm Password. Click OK. ----End 6.17 How Do I Change the Login Password (Mobile Client)? The passwords of accounts in the system must be changed periodically. The recommended interval is three months. The minimum validity period of a password is two days. You can perform the following steps to change the login password on the WI (desktop login page) through the FusionAccess client on a mobile terminal. Step 1 Open the FusionAccess client on the mobile terminal to go to the desktop login page. NOTE You must configure the desktop login address upon your initial login. Step 2 Step 3 Enter the username and password, and click Login. The VM list is displayed. Step 4 Click in the upper right corner and click Change Password. Step 5 The Change Password page is displayed. Step 6 Enter Old Password, New Password, and Confirm Password, as shown in Figure Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 130

136 6 FAQs (End Users) Figure 6-15 Change Password Step 7 Step 8 Choose Modify Password. The password is changed successfully. ----End 6.18 What Should I Do If I Forget the Password? If you lose or forget the login password, contact the administrator. After the administrator processing, the password resetting link will be sent to your address by the system. You can click the link to reset the password. The validity period of the password resetting link in the is 24 hours. Reset the password in a timely manner What Should I Do If the Account Is Locked? Your account will be locked if you enter an incorrect password consecutively. If this happens, contact the administrator to unlock the account. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 131

137 6 FAQs (End Users) 6.20 Does Workspace Support Dual-Screen Display? Prerequisites When accessing Workspace desktops using TCs, perform the following operations to configure dual-screen display. Table 6-1 lists the materials required for configuring dual-screen display. Table 6-1 Materials required for configuring dual-screen display Item Quantity Image (Example) Description TC 1 - Monitor/Converter 2 Typically, a monitor provides a DVI-D port and a VGA port. If two monitors have only VGA ports in some special cases, a DVI-D-to-VGA converter is required. DVI-I one-to-two cable 1 Converts DVI-I signals to DVI-D and VGA signals. DVI-D-to-DVI-D cable 1 - VGA-to-VGA cable 1 - Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 132

138 6 FAQs (End Users) Procedure Dual-Screen Connection Step 1 Connect a TC to monitors based on the monitor type. If the monitors provide DVI and VGA ports, go to Step 2. If the monitors provide VGA ports only, go to Step 3. Step 2 Connect the TC to the monitors, as shown in Figure Figure 6-16 Dual-screen connection Step 3 Connect the TC to the monitors, as shown in Figure Figure 6-17 Dual-screen connection ----End TC Setting Step 1 Power on the TC. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 133

139 6 FAQs (End Users) Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Perform the following operation based on the TC type. Linux TC: Perform Step 3 to Step 7. Windows TC: Perform Step 8 to Step 10 Click Start, and choose Control Center. Double-click Display. Select Optimum settings. Select the display mode based on site requirements. Duplicate Extend Select the main monitor based on site requirements. DVI VGA The task is completed. Right-click on the desktop and choose Screen Resolution. Set Multiple displays based on site requirements. Duplicate these displays Extend these displays NOTE Only Extend these displays can be selected when two desktops and dual-screen display are used. Step 10 Click OK. ----End Client Setting Step 1 Step 2 Step 3 Step 4 Step 5 Perform the following operation based on the dual-screen display scenario. If a desktop and two screens are used, go to Step 2. If two desktops and two screens are used, go to Step 6. Log in to the desktop using the client. Click Settings. Select Open Multiple Monitor (The configuration will take effect after reconnect). Click Close. The task is completed. Step 6 Step 7 Step 8 Step 9 Log in to a desktop using the client. Click Settings. Deselect Open Multiple Monitor (The configuration will take effect after reconnect). Click Close. Step 10 Log in to the other desktop and repeat Step 6 to Step 9. Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 134

140 6 FAQs (End Users) Step 11 Drag the two desktops to different screens to achieve dual-screen display. ----End Others 6.21 What Should I Do If I Fail to Log In to the GPU Desktop Using an SC? If your PC desktop is configured with a non-standard screen resolution, login to the GPU desktop using an SC may fail. You can perform the following steps to solve the problem. Procedure NOTE Examples of standard screen resolutions: 1920 x 1080 and 1680 x 1050 Step 1 Step 2 Step 3 Set a standard screen resolution, such as 1920 x 1080 or 1680 x 1050, for your PC desktop. Delete the SetCLientToTop.txt file in C:\PermanenceDataPath. Log in to the GPU desktop again using an SC. ----End Issue 04 ( ) Copyright Huawei Technologies Co., Ltd. 135