Workspace. User Guide (Administrators) Date

Transcription

1 Date

2 Contents Contents 1 Introduction Concepts Software Client Mobile Terminal Infrastructure Server AD Management Server Desktop Regions and AZs Project Application Scenarios Service Process and Function Overview Accessing and Using How to Access Packages Monitoring Metrics Related Services User Permissions Getting Started Logging In to the Management Console Applying for the Service Creating Desktops Logging In to a Desktop Using an SC Logging In to a Desktop Using an SC (Using a Proxy for Internet Access) Logging In to a Desktop Using a Browser Logging In to a Desktop Using a Mobile Terminal (Android) Logging In to a Desktop Using a Mobile Terminal (ios) Operation Guide (Administrators) Overview Managing Desktops Managing Users Viewing User Login Records ii

3 Contents 3.5 Managing Policies Restoring Infrastructure Server Data Changing the Service Subnet Changing the Internet Access Port Changing the Password of a Domain Administrator (Optional) Configuring the WSUS Canceling Operation Guide (End Users) Introduction to Introduction to Terminals Risky Operations Failure When Connecting to Desktops HDPDeviceHelper Peripheral Assistant FAQs (Administrators) What Is? What Are the Features and Advantages of? What Is the Process of Using? What Are Packages? How Is Charged? How Do End Users Access the Internet? How Do I Install Applications on the Desktop? What Resources Do I Need to Prepare Before Applying for? What Should I Do If I Fail to Apply for? How Is Connected to Enterprise Intranets? How Do I Interconnect with Microsoft AD? What Should I Do If I Fail to Apply for by Interconnecting with Microsoft AD? How Do I Check the Network Status of Desktops? What Are the Network Requirements for Accessing the Desktop? FAQs (End Users) What Devices Can Be Used to Log In to? What Are the Precautions for Using? What OSs Can Run on? Can I Upgrade OSs by Myself? How Do I Install Applications on the Desktop? What Software Is Compatible with? How Does Manage Peripherals? Does Support Personalized Settings? Can Data in Be Saved for a Long Time? How Do I Use a Local Printer for Printing? How Do I Use a Network Printer for Printing? What Should I Do If the Desktop Cannot Be Connected? iii

4 Contents 6.13 How Do I Log In to the Desktop for Maintenance Using VNC? What Should I Do If the Desktop Freezes When Using? How Do I Check the Network Status of Desktops? How Do I Change the Login Password? How Do I Change the Login Password (Mobile Client)? What Should I Do If I Forget the Password? What Should I Do If the Account Is Locked? How Do I Partition a Hard Disk Larger than 2 TB?...75 A Change History iv

5 1 Introduction 1 Introduction 1.1 Concepts Concept is a cloud computing-based desktop service that outperforms personal computers (PCs) and the conventional Virtual Desktop Infrastructure (VDI) solution. provides the same configurations (including vcpus, memory, and disks) as those of PCs and Windows OSs. Its familiarity ensures that you can use like using your own PCs. Different from the conventional local VDI solution, does not require high investment or a long deployment period. can automatically handle heavy deployment tasks and provide hosting services. supports access from multiple devices, including computers running Windows OSs, ipads, iphones, and Android smart devices (For details, see Software Client, Mobile Terminal). With, you can save and obtain files, and use applications anytime and anywhere, implementing mobile office. Procedure After you apply for, a secure and exclusive infrastructure server (For details, see Infrastructure Server) will be deployed and a dedicated elastic IP address used for accessing will be allocated to you. You can create an active directory (AD) domain (For details, see AD Management Server) on the cloud or use your local Microsoft AD domain when you apply for the service. With, you can effortlessly create and configure desktops (For details, see Desktop). provides packages of multiple types and supports disk configurations, ensuring secure and simple user operations. After you apply for the service and desktops are successfully created, the system will notify the end users by . Principle

6 1 Introduction Figure 1-1 illustrates basic principles of. Figure 1-1 Basic principles of Software Client Mobile Terminal A software client (SC) runs on local PCs running Windows or Mac OSs and is used for logging in to and using. A mobile terminal is a mobile device used for logging in to and using, including ipads, iphones, and Android smart devices Infrastructure Server An infrastructure server is automatically created when you apply for and runs components such as desktop management. Two infrastructure servers occupy two quotas, including two instances, eight cores, and 32 GB memory AD Management Server Desktop The active directory (AD) management server, an infrastructure component where the AD service is deployed, provides directory service functions for centralized organization management and network resource access. You can create an AD domain on the cloud or use your local Microsoft AD domain when you apply for the service. A desktop is a virtual computer system where desktop agent software is installed and that can interact with desktop management components. deposits all desktops in the data center for unified management. End users can access the desktop by using SCs, browsers, or mobile terminals to obtain complete PC-like user experience

7 1 Introduction Regions and AZs Project A region is a geographic area where is located. services in the same region can communicate with each other over an intranet, but those in different regions cannot. Public cloud data centers are deployed worldwide in places such as North America, Europe, and Asia. is therefore available in different regions. For example, applications can be designed to meet user requirements in specific regions or comply with local laws or regulations. Each region contains many availability zones (AZs) where power and networks are physically isolated. AZs in the same region can communicate with each other over an intranet. Each AZ provides cost-effective and low-latency network connections that are unaffected by faults that may occur in other AZs. Using deployed in an independent AZ protects your applications against failures in a single place. Projects are used to group and isolate OpenStack resources (computing resources, storage resources, and network resources). A project can be a department or a project team. Multiple projects can be created for one account. 1.2 Application Scenarios Use of conventional PC desktops or the local VDI solution requires high investment and features difficult and complicated deployment and management. For, neither early investment nor continuous infrastructure management is required. You can apply for a complete set of cloud desktop computing services, such as computation and persistent storage, with certain fees, providing secure desktop experience with various access options for your users in simple and cost-effective ways. can be applied to mainstream industries including government and public utilities, telecommunications, energy, finance, transportation, medical care, education, broadcasting, media, and manufacturing. It is applicable to diversified scenarios, such as common office, security office, branch office, and public terminal (call center, business hall, and training classroom). Mobile office scenario Users can log in remotely to anytime and anywhere. is applicable for employees who are on business trips frequently and need to work in many locations. Short-term use scenario and necessary application system services can be configured for short-term employees of enterprises. After the short-term employees leave, their services can be stopped. Security office automation (OA) scenario can provide enterprises with office solutions that comply with the enterprises' security standards. Permission to access physical devices can be controlled and data is not locally stored, thereby improving the security of enterprise data. Branch office scenario

8 1 Introduction is applicable for employees who work in branches and external employees. They can log in to to access applications on the headquarters network. Data is not locally stored. 1.3 Service Process and Function Overview provides two different operation pages for administrators and end users respectively. Administrators apply for the service, create desktops, manage desktops and users on the management console. End users log in to and use desktops on the web page. Figure 1-2 shows the processes for applying and creating a desktop. Figure 1-2 Operation process for administrators Figure 1-3 shows the process for logging in to and using a desktop. Figure 1-3 Operation process for end users

9 1 Introduction Table 1-1 describes the functions provided by. Table 1-1 Function list Role Function Description Administrator End user Self-service service application Self-service desktop creation User login record query LiteAD authentication Customer AD diversification Policy management End user notification Windows 7 desktop experience Windows 10 desktop experience Multi-device access The administrator can apply for the service online in self-service mode. The administrator can create desktops online in self-service mode. User login information can be recorded, including login time and device types. The Linux-based AD can be used to implement username and password authentication. Existing Microsoft ADs of enterprises can be interconnected. The administrator can configure policies to manage devices such as printers and USB devices. The administrator can send notification s to new users who obtain desktops. The Windows 7 desktop experience based on the Windows Server 2008 R2 64-bit OS is provided. The Windows 10 desktop experience based on the Windows Server 2016 OS is provided. End users can access desktops by using PCs running Windows or Mac OSs and Android or ios mobile phones or tablets. 1.4 Accessing and Using How to Access The public cloud provides a web-based service management platform. Users can access by using a management console. For details about how to log in to the management console, see Logging In to the Management Console. You need to enable ports listed in Table 1-2 on the enterprise firewall so that end users can log in to the desktops properly

10 1 Introduction Table 1-2 Internet access ports Port Protocol Description 443 TCP Used by the end user to access the web login page TCP Used by the end user to access the desktop. By default, port 443 and port 8443 are used. If you want to change the ports, see Changing the Internet Access Port. Figure 1-4 shows how an end user accesses through a specified port. Figure 1-4 Accessing Packages Packages resources are packaged for leasing. Packages shown in Table 1-3 are for reference only. The actual package prevails. Table 1-3 General Category General Instance workspace.c2.large.w indows workspace.c2.xlarge.wi ndows workspace.c2.2xlarg e.windows vcpu Memory (GB) System Disk (GB) Data Disk (GB) 80 to 32, to 32, to 32,768 0, 100 to 32,768 0, 100 to 32,768 0, 100 to 32,

11 1 Introduction Guest OS Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience The data disk configuration policies are as follows: No data disk is configured. Configure a data disk based on actual requirements. The disk capacity ranges from 100 GB to 32,768 GB Monitoring Metrics Table 1-4 describes monitoring metrics. Table 1-4 monitoring metrics Metric Description Value Range Monitored Object CPU usage Measures the CPU usage of a monitored object (unit: %). 0% to 100% Infrastructure server Memory usage Measures the memory usage of a monitored object (unit: %). 0% to 100% Infrastructure server Disk usage Measures the disk usage of a monitored object (unit: %). 0% to 100% Infrastructure server IOPS Measures the number of I/O operations per second on a monitored object. 0 counts Infrastructure server Network input throughput Measures incoming network traffic of a monitored object per second (unit: bytes/s). 0 bytes/s Infrastructure server Network output throughput Measures outgoing network traffic of a monitored object per second (unit: bytes/s). 0 bytes/s Infrastructure server Related Services ECS

12 1 Introduction Elastic Cloud Server (ECS) is a computing server that consists of CPUs, memory, images, and Elastic Volume Service (EVS) disks, and supports on-demand allocation and elastic scaling. The service invokes ECS interfaces to create desktops. IMS Image Management Service (IMS) provides a simple and convenient self-service management function. In, desktops are created based on IMS. ELB Elastic Load Balance (ELB) is a service that automatically distributes access traffic to multiple ECSs to balance their service loads. It enables you to achieve greater levels of fault tolerance in your applications and expand application service capabilities. ELB is the access entry of from the Internet. VPC Virtual Private Cloud (VPC) provides virtual networks similar to conventional networks and advanced network services, such as elastic IP addresses, security groups, and virtual private networks (VPNs). The VPC service implements network isolation in logical mode and provides secure and isolated network environments for. DirectConnect Direct Connect (DirectConnect) is a service that allows you to establish a dedicated network connection from your data center to the cloud platform. With DirectConnect, potential network delays when is used are reduced, which provides a highperformance system to satisfy user experience. IAM Identity and Access Management (IAM) is a Web service. The administrator can apply this service to manage users and user rights. Only after an account is created through IAM can the administrator use related resources of. NAT gateway User Permissions The NAT gateway provides the Network Address Translation (NAT) service for desktops in a VPC so that multiple desktops can share an EIP to access the Internet. Public cloud provides two types of user permissions by default: user management and resource management. User management refers to the management of users, user groups, and user group rights. Resource management refers to the control operations that can be performed by users on cloud service resources. For further details, see Permissions

13 2 Getting Started 2 Getting Started 2.1 Logging In to the Management Console Scenario Procedure Log in to the management console. Step 1 Use the administrator account to log in to the console home. Step 2 Click in the upper-left corner of the management console and select Region and Project. Step 3 On Homepage, locate Enterprise Application and select. The management console is displayed. ----End 2.2 Applying for the Service Scenario Prerequisites Apply for the service. After you apply for, a secure and exclusive infrastructure will be deployed and a dedicated elastic IP address used for accessing will be allocated to you. The AD is a necessary component used for managing users and desktops. You can create an AD on the cloud or use an existing AD. After you apply for the service, you can create desktops. When applying for, if the existing enterprise AD domain is used, refer to How Do I Interconnect with Microsoft AD? to enable related ports on the AD server and prepare the following data:

14 2 Getting Started Domain name Domain administrator's account and password Active domain controller IP address (Optional) Standby domain controller IP address Active DNS server IP address (Optional) Standby DNS server IP address Procedure Step 1 Step 2 Log in to the management console. On the Dashboard page, click Apply for. The Apply for page is displayed. Step 3 Select an AZ based on actual conditions. An availability zone (AZ) is a physical region where resources use independent power supplies and networks. AZs are physically isolated but interconnected through an internal network, improving HA of applications. Step 4 Click View VPC to create a VPC and a subnet. For details about how to create a VPC, see the Virtual Private Cloud User Guide. You are advised to use 16-bit subnet gateways during VPC creation. After you apply for the service, do not modify the VPC configuration. reserves the /16 network segment for the NIC on the management plane. Use other network segments when creating subnets in VPCs. Step 5 Click to refresh the VPC drop-down list. Step 6 Configure the VPC. Select the VPC and Subnet created in Step 4. You can select multiple subnets to support more desktops. Use the subnet that is created in Step 4 and dedicated to. Do not use the subnet dedicated to other services. Step 7 Configure the AD domain. Check whether your enterprise has an AD domain. If yes, go to Step 9. If no, go to Step 8. Step 8 Create an AD domain. Set the Domain Name, Domain Administrator Account, Domain Administrator Password, and Confirm Password parameters of the new AD domain. After an AD domain is created, go to Step

15 2 Getting Started To ensure system security, you need to change the password periodically. You are advised to change the password every three months. Step 9 Connect to the existing domain. Set the Domain Name, Domain Administrator Account, Domain Administrator Password, Primary Domain Controller IP Address, Standby Domain Controller IP Address, Active DNS IP Address, and Standby DNS IP Address parameters of the existing domain. supports only AD servers running Windows Server 2008 or later. When you use an existing AD domain, ensure that the related ports of the firewall are enabled. For details, see How Do I Interconnect with Microsoft AD?. Step 10 Specify the network access mode. By default, Internet access is selected. You can select multiple options. If the network quality does not meet requirements, you can select DirectConnect access. For details about the network quality requirements, see What Are the Network Requirements for Accessing the Desktop?. The DirectConnect access mode provides the load balancing capability. Therefore, enterprises do not need to deploy third-party load balancers before access addresses. Step 11 Click Apply Now. The service application is complete. ----End The application process takes about 40 minutes. The system creates ManagerSecurityGroup and UserSecurityGroup security groups in the VPC during the application. ManagerSecurityGroup is used for management components, and UserSecurityGroup is used for user desktops. By default, only desktops in the UserSecurityGroup security group can access each other. If you want to access a desktop in the security group from an external desktop, choose VPC > Security Groups to modify the configurations. 2.3 Creating Desktops Scenario Select and create related packages and assign desktops to end users after applying for the service. After the administrator creates desktops, end users will be informed by that desktops are provisioned

16 2 Getting Started The following describes the concepts of Username, Computer Name, and Desktop Name and explains the relationships among them. Username is set by the administrator on the desktop creation console. It is used for logging in to the desktop. A username can be associated with an address only once. Computer Name is the name or number of the Windows OS installed on a desktop. Microsoft limits the maximum length of a computer name to 15 characters. Desktop Name is created by automatically. It consists of a username and two digits. For example, if the administrator sets Test as the username, the name of the first desktop is Test01 and that of the second desktop is Test02. Desktop Name is the same as Computer Name. Therefore, a desktop name can only contain a maximum of 15 characters. If a username consists of more than 13 characters, the leftmost 13 characters of the username and two digits are used to create the desktop name. Procedure Step 1 Step 2 Log in to the management console. On the Dashboard or Desktop page, click Create Desktop. The Create Desktop page is displayed. Step 3 Select an AZ based on actual conditions. An availability zone (AZ) is a physical region where resources use independent power supplies and networks. AZs are physically isolated but interconnected through an internal network. If you create a desktop for the first time, you are advised to use the default value, that is, the optimal AZ recommended by the system. If you do not create a desktop for the first time, you are advised to create desktops in different AZs to improve application availability. Step 4 Step 5 Select the proper Specifications based on site requirements. Type. Specifications. Select the proper Image Type and OS based on site requirements. For details about the creation and maintenance of private images, see the Private Image Management Guide. Step 6 Configure disks based on the actual requirements. Table 2-1 provides disk configuration details

17 2 Getting Started Table 2-1 Disk configuration Category Description Disk Type Configuration Range (GB) System Disk Mandatory. Only one system disk can be configured based on the actual requirements. Common I/O: type of disks that use SATA storage. Ultra-high I/O: type of disks that use SSD storage. 80 to 32,768 Data Disk Optional. A maximum of 10 data disks can be configured based on the actual requirements. Common I/O: type of disks that use SATA storage. Ultra-high I/O: type of disks that use SSD storage. 100 to 32,768 Step 7 Step 8 Step 9 Select a Service Subnet based on actual conditions. Check whether the user's existing AD domain is used in. If yes, go to Step 9. If no, go to Step 10. Set the OUs on the existing AD server. Enter a maximum of 5 levels and separate levels from each other using a slash (/). Only letters, digits, spaces (not before or after a slash), and special characters including are allowed, for example, ab/cd/ef. Step 10 Assign desktops. You can manually add or batch import users. In a scenario where the existing AD domain is used, you need to create users on the AD server before assigning desktops. Manual input Set Username used for logging in to and used for receiving the notification . Select a user group from the drop-down list of User Group. You can grant different levels of access permission to users based on site requirements. The following describes the user group permission: Administrators: Administrator group. Administrators have complete access to the desktop and can make any desired changes except for forbidden operations. Users: Standard user group. Users in this group can use most software and change system settings that do not affect other users. You can click Add Desktop to add other desktops as required. A maximum of 10 desktops can be added each time. Each desktop belongs to one user only. Batch import. A maximum of 50 desktops can be added each time. Click Download Template. In the Excel template, enter values for columns A (Username), B ( ), and C (User Group) respectively

18 2 Getting Started Save the settings and close the Excel template. Upload the file. Step 11 Send notification s. By default, the system automatically sends notification s to users after desktops are created. In a scenario where the existing AD domain is used, you can select or deselect Send Notification based on site requirements. Step 12 Click Create Now. The Confirm Specifications page is displayed. Step 13 Step 14 Check whether the value of Resource Details is correct. Click Submit. Desktops are created successfully. ----End 2.4 Logging In to a Desktop Using an SC Scenario Download, install, and configure an SC, and then log in to from the login address in the notification using the SC. Prerequisites When you access the Internet using a proxy, log in to your desktop by following the instructions in Logging In to a Desktop Using an SC (Using a Proxy for Internet Access). Required software has been downloaded and installed. For details, see Table2 Software packages. Table 2-2 Software packages Software Package AccessClient.m si How to Obtain AccessClient.msi Procedure Step 1 Step 2 After the SC is installed, double-click the CloudClient icon on the desktop to start the SC. In the Address Manager window, click Add. In the Edit Server Info window that is displayed, set Server Name to a customized name and set Server Address to the address obtained from the notification

19 2 Getting Started The Edit Server Info window is displayed automatically upon your first login to the desktop. Step 3 Click Ok to save the configuration information, as shown in Figure 2-1. Figure 2-1 Edit Server Info Step 4 Step 5 Click Launch to go to the desktop login page. On the desktop login page, enter your domain account and password, and click Login to go to the desktop list page. Step 6 On the desktop list page, click to log in to the desktop, as shown in Figure 2-2. Figure 2-2 Desktop list ----End 2.5 Logging In to a Desktop Using an SC (Using a Proxy for Internet Access) Scenario Log in to a desktop using an SC when a proxy is used for Internet access

20 2 Getting Started Prerequisites Required software has been downloaded and installed. For details, see Table2 Software packages. Table 2-3 Software packages Software Package AccessClient.msi How to Obtain AccessClient.msi Procedure Step 1 Step 2 After the software client is installed, double-click the CloudClient icon on the desktop to start the SC. In the Address Manager window, click Add. The Edit Server Info window is displayed. Figure 2-3 Edit Server Info Step 3 Step 4 Step 5 Set Server Name to a customized name and set Server Address to the address obtained from the notification . Click Ok. On the Address Manager page, select the newly added server address and click Launch. Step 6 Tap in the upper-right corner. The Settings dialog box is displayed. Step 7 On the Network tab page, select Enable HTTP Proxy

21 2 Getting Started Figure 2-4 Enabling HTTP proxy Step 8 Step 9 Step 10 Step 11 Click Yes. Enter the value for Host, Port, User Name, and Password of the proxy server obtained from the administrator. Click Ok. On the desktop login page, enter your domain account and password, and click Login to go to the desktop list page. Step 12 On the desktop list page, click to log in to the desktop, as shown in Figure 2-5. Figure 2-5 Desktop list ----End

22 2 Getting Started 2.6 Logging In to a Desktop Using a Browser Scenario Log in to a desktop using a browser. Use Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, Internet Explorer 11, and Mozilla Firefox 14 or later to log in to desktops. When you use a proxy for Internet access, you cannot log in to your desktop using a browser. Instead, you can log in to your desktop following the instructions in Logging In to a Desktop Using an SC (Using a Proxy for Internet Access). Procedure A Windows PC is used as an example in the following steps. The specific operation steps may be different on different OSs. Step 1 Open the browser, enter the desktop login address obtained from the notification in the address box, and press Enter. The window for logging in to the desktop is displayed. If a dialog box indicating a plug-in running request is displayed in the browser, enable the plug-in to avoid any effect on proper login and use. Step 2 Enter your domain account and password, and click Login, as shown in Figure 2-6. Figure 2-6 Login window Step 3 Download the client plug-in upon the first login, as shown in Figure

23 2 Getting Started Figure 2-7 Download the client plug-in Step 4 On the desktop list page, click to log in to the desktop, as shown in Figure 2-8. Figure 2-8 Desktop list ----End 2.7 Logging In to a Desktop Using a Mobile Terminal (Android) Scenario FusionAccess is an application installed on a mobile terminal and used for accessing and using desktops. If you need to use desktops to work at home or during your trips, you can download FusionAccess to your Android device and use it to access and use desktops

24 2 Getting Started Procedure Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Open the application store (Google Play Store) on your Android mobile terminal. Search for FusionAccess. Download and install the FusionAccess desktop client software. After the FusionAccess software is installed, open the software on your Android mobile terminal. Tap Add Account. On the Add page that is displayed, set Label to customized description, set Address and User Name to the address and username obtained from the notification , and set Password to the new password. Tap save in the upper-right corner to save the configuration. Figure 2-9 Configuration

25 2 Getting Started Step 8 On the home page of the FusionAccess software, tap the Label you set to log in to the desktop. The following figure shows the functions of the shortcut menus on the desktop. Figure 2-10 Desktop ----End 2.8 Logging In to a Desktop Using a Mobile Terminal (ios) Scenario Procedure FusionAccess is an application installed on a mobile terminal and used for accessing and using desktops. If you need to use desktops to work at home or during your trips, you can download FusionAccess to your ios devices and use it to access and use desktops. Step 1 Step 2 Step 3 Open App Store on your ios mobile terminal. Search for FusionAccess. Download and install the FusionAccess desktop client software

26 2 Getting Started Step 4 Step 5 After the FusionAccess software is installed, open the software on your ios mobile terminal. Tap New Account. Step 6 Tap in the upper-right corner. The New Account page is displayed. Step 7 Step 8 Set Description to customized description, set Address and User Name to the address and username obtained from the notification , and set Password to the new password. Tap Save in the upper-right corner to save the configuration

27 2 Getting Started Figure 2-11 Configuration Step 9 On the home page of the FusionAccess software, tap the desktop description you set to log in to the desktop. The following figure shows the functions of the shortcut menus on the desktop

28 2 Getting Started Figure 2-12 Desktop ----End

29 3 Operation Guide (Administrators) 3 Operation Guide (Administrators) 3.1 Overview Configuration Information After applying for the service, view statistics information about, including the configuration information, desktop status, and number of online users on the Dashboard page. Step 1 Step 2 Log in to the management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Configuration Information area, view network configurations and AD domain configurations. Desktop Status ----End Step 1 Step 2 Log in to the management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Status area, displays the Login Status and Running Status of the desktop in pie charts. Table 3-1 describes the meaning of each status. Table 3-1 Desktop status Category Status Description Login Status In use Indicates that a user has successfully logged in to the desktop and is using the desktop

30 3 Operation Guide (Administrators) Category Status Description Running Status Unregistered Ready Disconnected Running Stopped Faulty Indicates that the desktop is stopped or faulty. A desktop automatically registers with the infrastructure server after being started up. Indicates that the desktop has been registered with and connected to the infrastructure server and is waiting for the user to log in. Indicates that the desktop is disconnected from the terminal because the user closes the window of the terminal or the network connection between the terminal and the desktop is interrupted. Indicates that the desktop runs properly. Indicates that the desktop is stopped. Indicates that the desktop is faulty. You can restart the desktop or contact technical support engineers to rectify the fault. ----End Number of Online Users Step 1 Step 2 Log in to the management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Online Users area, view the number of online users by day, week, or month. ----End 3.2 Managing Desktops Scenario Procedure Start, stop, restart, or delete a desktop, or add disks to a desktop. Step 1 Step 2 Log in to the management console. Click Desktop. The Desktop page is displayed. Step 3 In the upper-right corner of the desktop list, select Assigned user, enter a keyword, and click

31 3 Operation Guide (Administrators) Step 4 Select a desktop, and click Start/Stop/Restart/Delete/Add Disk in the upper-left corner of the desktop list or in the Operation column. When performing the Stop Desktop operation, determine whether to select Forcibly stop based on site requirements. When performing the Restart Desktop operation, determine whether to select Forcibly restart based on site requirements. When performing the Delete Desktop operation, determine whether to select Delete the user based on site requirements. You can add disks (data disks) to the desktop whose status is Running and user group is Administrators only. Each desktop can have a maximum of 10 data disks. Step 5 Confirm the displayed information. ----End 3.3 Managing Users Scenario View the number of desktops owned by a user, change the address, export data, reset the password, unlock the account, send the notification or delete the account for a created user. Procedure If the enterprise uses an existing AD domain, the password reset and account unlocking functions are not supported. Changing an address You can change an address if the address provided by a user is incorrect or cannot receive s. Step 1 Step 2 Log in to the management console. Click User. The User Management page is displayed. Step 3 In the row that contains the user whose address you want to change and click Modify. The Modify User Information dialog box is displayed. Step 4 Step 5 In the Address text box, enter the new address. Click OK. The user receives an address change notification. ----End Exporting data You can batch export user data, including the username, address, and the number of desktops

32 3 Operation Guide (Administrators) Step 1 Step 2 Log in to the management console. Click User. The User Management page is displayed. Step 3 Click Export Account. The system exports user information to a local computer. ----End Resetting a password You can reset the password of a user when the user loses or forgets the login password. Password resetting is risky. After being reset, the original password cannot be used. Confirm that the operation is necessary. Step 1 Step 2 Log in to the management console. Click User. The User Management page is displayed. Step 3 In the row that contains the user whose password needs to be reset, click More > Reset Password. The dialog box for password resetting is displayed. Step 4 Click OK. The password resetting link will be sent to the user's address automatically by the system. The validity period of the password resetting link in the is 24 hours. Reset the password in a timely manner. ----End Unlocking an account You can unlock the account for a user when the user's account is locked because the user enters an incorrect password consecutively. Step 1 Step 2 Log in to the management console. Click User. The User Management page is displayed. Step 3 In the row that contains the user whose account needs to be unlocked, click More > Unlock. The dialog box for account unlocking is displayed

33 3 Operation Guide (Administrators) Step 4 Click OK. ----End Sending a notification You can send a notification when the user already has a desktop and the for notifying the user of the desktop creation needs to be sent again. Step 1 Step 2 Log in to the management console. Click User. The User Management page is displayed. Step 3 In the row that contains the user to whom the notification needs to be sent, click More > Resend Notification . The dialog box for sending the is displayed. Step 4 Click OK. ----End Deleting an account You can delete a specific account as required. You cannot delete a user if the user has desktops. Step 1 Step 2 Log in to the management console. Click User. The User page is displayed. Step 3 In the row that contains the user whose account needs to be deleted, click More > Delete (If the enterprise uses an existing AD domain, click Delete). The dialog box for user information deletion is displayed. Step 4 Click OK. ----End 3.4 Viewing User Login Records Scenario Procedure View user login records to obtain the desktop running status and user login status. This helps troubleshooting and system maintenance. Step 1 Step 2 Log in to the management console. Click User Login Record. The User Login Record page is displayed

34 3 Operation Guide (Administrators) Step 3 View user login records, including Desktop Name, Desktop IP Address, Login User, Terminal IP Address, Terminal System Type, Connection Start Time, Connection End Time, and Failure Cause. ----End 3.5 Managing Policies Scenario Configure policies such as USB Port Redirection, Printer Redirection, File Redirection, and Clipboard Redirection to control the permission on data transmission and peripheral access between user terminals and. Procedure Step 1 Step 2 Log in to the management console. Click Policy. The Policy page is displayed. Step 3 On the Policy page, click the following button to enable or disable a policy. Table 3-2 describes the policies. indicates that the policy is enabled. indicates that the policy is disabled. Table 3-2 Policy management Policy Type Policy Parameter Policy Description USB port redirection Printer redirection Graphics devices (such as scanners) Video devices (such as cameras) Print devices (such as printers) Storage devices (such as USB flash drives) Smartcard devices (such as Ukeys) Sync Client Default Printer Users can use USB graphics devices by using USB port redirection on desktops. Users can use USB video devices by using USB port redirection on desktops. Users can use USB print devices by using USB port redirection on desktops. Users can use USB storage devices by using USB port redirection on desktops. Users can use smartcard devices by using USB port redirection on desktops. Users can use printers by using printer redirection (a policy of device redirection) on desktops

35 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Universal printer driver File redirection Clipboard redirection HDP Plus Display level Default HDP XPSDrv Driver Universal Printing PCL 5 Universal Printing PCL 6 Universal Printing PS Fixed Drive (such as local disks) Removable drive (such as USB flash drives) CD/DVD-ROM drives Network Drive Server to client Client to server Enable Bidirection Disable Enable Disable (default) Smoothness first (default) When Default is selected, Universal Printing PS will be loaded if printer redirection is enabled on Linux clients, and HDP XPSDrv Driver will be loaded if printer redirection is enabled on Windows clients. NOTICE To use the printer service, you need to ensure that all end users use SCs running the same OS to log in to. Redirects client fixed drives. Redirects client removable drives, such as USB flash drives and removable hard disks. Redirects client CD-ROM drives. Redirects client network drives. After the redirection is enabled, end users can copy data on desktops and paste the data on clients. However, data copied on clients cannot be pasted on desktops. That is, the one-way clipboard function from the server to the client is supported. After the redirection is enabled, end users can copy data on clients and paste the data on desktops. However, data copied on desktops cannot be pasted on clients. That is, the one-way clipboard function from the client to the server is supported. After the redirection is enabled, end users can copy data on clients and paste the data on desktops, and data copied on desktops can also be pasted on clients. That is, the two-way clipboard function between the client and the server is supported. Disables the clipboard redirection. This option only applies to video editing scenarios. Balances display quality and bandwidth requirement. The recommended bandwidth is 20,000 kbit/s

36 3 Operation Guide (Administrators) Policy Type Policy Parameter Policy Description Advanced policies Image quality first Bandwidth Frame Rate Video Frame Rate Smoothing Factor Lossy Compression Quality Provides best display quality but requires highest bandwidth. The recommended bandwidth is 25,000 kbit/s. For details about how to set video image quality and smoothness, see Table 3-3. Table 3-3 Advanced policies Policy Name Default Value Range Description Bandwidth (kbit/s) This policy is available only when the HDP Plus policy is disabled. Smoothness first: 20,000 Quality first: 25, to 25,000 Specifies the data code stream limit. Increasing this value improves user experience but consumes more bandwidth resources. For this reason, if the network bandwidth is insufficient, increasing this value compromises the smoothness. The default value is recommended. Frame Rate (fps) This policy is available only when the HDP Plus policy is disabled. Smoothness first: 25 Quality first: to 30 Specifies the frame rate in non-video scenarios. Increasing this value improves image smoothness but consumes more bandwidth resources. For this reason, if the network bandwidth is insufficient, increasing this value compromises the smoothness. The default value is recommended

37 3 Operation Guide (Administrators) Policy Name Default Value Range Description Video Frame Rate (fps) This policy is available only when the HDP Plus policy is disabled. Smoothing Factor This policy is available only when the HDP Plus policy is disabled. Lossy Compression Quality Smoothness first: 30 Quality first: 50 Smoothness first: 60 Quality first: 60 Smoothness first: 85 Quality first: to 50 Specifies the video frame rate. Increasing this value improves image smoothness but consumes more bandwidth resources. For this reason, if the network bandwidth is insufficient, increasing this value compromises the smoothness. The default value is recommended. 0 to 60 Specifies the static image quality. Decreasing this value improves image quality but consumes more bandwidth resources, and compromises the smoothness. 70 to 90 Specifies the static natural image quality. Increasing this value improves image quality but consumes more bandwidth resources, and compromises the smoothness. Step 4 Click Save to save the configured policy information. An end user must relog in to the desktop for the new policy to take effect. ----End 3.6 Restoring Infrastructure Server Data Scenario If a system fault occurs, use data that is automatically backed up to restore the infrastructure servers

38 3 Operation Guide (Administrators) After you restore the data of infrastructure servers: The desktop data and user data generated after the backup point in time are not stored. If the desktop data or user data is incorrect, follow the instructions or contact technical support engineers to rectify the fault. Enabled or disabled policies may be restored to the state before the backup point in time. If this happens, configure the policies again. For details, see Managing Policies. An end user cannot use the password set after the backup point in time to log in to the desktop. Inform the end user to use the password set before the backup point in time to log in to the desktop or reset the password. Procedure Step 1 Step 2 Log in to the management console. Click Infrastructure. The Infrastructure page is displayed. Step 3 Click Restore. The Restore page is displayed. Step 4 Step 5 Choose the time point when you want to restore the data of infrastructure servers from the Backup Time Point drop-down list. Select I understand the impact and want to continue and click OK. Disk data is restored to the last backup point in time. ----End 3.7 Changing the Service Subnet Scenario Procedure On the management console, change the service subnet based on the plan. Step 1 Step 2 Log in to the management console. Click Dashboard. The Dashboard page is displayed. Step 3 Step 4 Step 5 In the Network area, click Modify next to Service Subnet. Select a desired service subnet based on your planned subnet information. Click OK. ----End

39 3 Operation Guide (Administrators) 3.8 Changing the Internet Access Port Scenario Procedure On the management console, change the Internet access port based on the plan. Step 1 Step 2 Log in to the management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Network area, click Modify next to Internet Access Port. The Internet access port changing dialog box is displayed. Step 4 Step 5 Change the HTTPS access port or Access Gateway (AG) port based on the plan. The port ID can be 80 or 443, or ranges from 1024 to 65,535. Click OK. ----End 3.9 Changing the Password of a Domain Administrator Scenario The password of a domain administrator needs to be changed periodically to ensure system security. You are advised to change the password every three months. Change the password of a domain administrator on the management console. Procedure If the enterprise uses an existing AD domain, the period for changing the password of the domain administrator depends on the preset password policy. Change the domain administrator password on the AD server first, and then perform the following operations. Step 1 Step 2 Log in to the management console. Click Dashboard. The Dashboard page is displayed. Step 3 Click Modify in the lower right corner of AD Domain. The Modify Password dialog box is displayed. Step 4 Set Old Password, New Password, and Confirm New Password, and click OK. ----End

40 3 Operation Guide (Administrators) 3.10 (Optional) Configuring the WSUS Scenario Procedure Configure a group policy on your AD server to use the Windows Server Update Services (WSUS) to update patches in the following scenarios: The service connects to the existing AD domain of your enterprise. Your enterprise uses an AD server running a Windows OS and has a WSUS server. Windows Server 2012 R2 is used as an example in the following steps. The specific operation steps may be different on different OSs. Step 1 Log in to the AD server using a domain administrator account. Step 2 On the task bar, click. Step 3 Choose Administrative Tools > Group Policy Management > Forest: Domain name > Domains > Domain name > First OU > First GPO. When you unfold Group Policy Management, the system automatically loads related policy information, which takes about 2 minutes. The first OU indicates the first OU created during software installation, and the first GPO indicates the first GPO added to the first OU. Step 4 Right-click the first GPO and choose Edit from the shortcut menu. The Group Policy Management Editor window is displayed. Step 5 In the navigation tree, choose Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update. Information about the Windows update is displayed in the right pane. When you unfold Policies in the navigation tree, the system automatically loads related policy information, which takes about 2 minutes. Step 6 In the right pane, double-click Configure Automatic Updates. The Configure Automatic Updates dialog box is displayed, as shown in Figure

41 3 Operation Guide (Administrators) Figure 3-1 Configure Automatic Updates Step 7 Step 8 Select Enabled in the Configure Automatic Updates area, and set the following parameters based on the actual situation: Configure automatic updating Scheduled install day Scheduled install time Click OK. The Configure Automatic Updates dialog box is closed. Step 9 In the right pane, double-click Specify intranet Microsoft update service location. The Specify intranet Microsoft updates service location dialog box is displayed. Step 10 Step 11 Select Enabled in the Specify intranet Microsoft updates service location area, and set the following parameters: Set Set the intranet update service for detecting updates to the service IP address of the patch server. Set Set the intranet statistics server to the service IP address of the patch server. Click OK. The Specify intranet Microsoft updates service location dialog box is closed

42 3 Operation Guide (Administrators) Step 12 Set the update policies for other groups. For details, see Step 1 to Step 11. When setting update policies, set different patch update time for different groups. You are advised to set a one-day interval for the patch update time of the groups. You are not allowed to set the same patch update time for all groups. Step 13 Close the Server Manager window. ----End 3.11 Canceling Scenario Procedure If is no longer needed, delete the user desktops and perform the following steps to cancel. Step 1 Step 2 Log in to the management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Configuration Information area, click Cancel. The Cancel dialog box is displayed. Step 4 Click OK. ----End

43 4 Operation Guide (End Users) 4 Operation Guide (End Users) 4.1 Introduction to is a public cloud service that employs cloud computing technology to provide users with Windows desktops and applications of PCs as cloud services. Storing applications on the cloud ensures service reliability. With, all applications and services are processed in the data center, ensuring service reliability and performance. The stable running of applications reduces costs on the management and maintenance of office environments. A seamless switchover enables mobile office. Traditionally, users can only use dedicated devices to access their desktops. supports access from multiple devices, including computers running Windows OSs, ipads, iphones, and Android smart devices. With, you can save and obtain files, and use applications anytime and anywhere, implementing mobile office. 4.2 Introduction to Terminals In, services are offered and used by cloud terminals. Widely used terminals are SCs and mobile terminals. SC: After installing cloud client software on PCs, you can use the PCs to access desktops, which reuses PCs. Mobile terminal: Android and ios terminals can be used to access desktops, achieving mobile office anytime and anywhere. 4.3 Risky Operations desktops provide on-demand services based on network resources and work depending on OSs and network configurations in desktops. This section describes some risky operations on desktops

44 4 Operation Guide (End Users) Risky Operations (Processes and Services) 1. Change the default service and startup options in the system configuration. Figure 4-1 shows the Services and Startup options. Figure 4-1 Services and startup 2. Disable HDP services shown in Figure 4-2. Figure 4-2 HDP services 3. Uninstall programs shown in Figure

45 4 Operation Guide (End Users) Figure 4-3 Programs 4. End the LOCAL SERVICE, NETWORK SERVICE, or SYSTEM processes in Task Manager. Figure 4-4 shows the processes that cannot be ended. Figure 4-4 Task Manager Risky Operations (Network) 1. Disable NICs, and disable or modify network configurations, as shown in Figure

46 4 Operation Guide (End Users) Figure 4-5 Local connection Risky Operations (Others) 2. Run the script or command for modifying a route, such as route DELETE *. 3. Delete ports 28511, 28512, 28521, and from Windows firewall exception options. 4. Enable software or tools, such as the IPsec, that can restrict network traffic. 1. Delete files or folders in C:\Program Files\Huawei listed in Figure 4-6. Figure 4-6 Folders 2. Enable the sleep function on desktops. The sleep function is disabled for desktops by default, as shown in Figure 4-7. Figure 4-7 Sleep function 3. Modify the configuration file of the HDP client (AccessAgent). 4. Run Rabbit Magic or Wopti Utilities to clean or optimize the registry

47 4 Operation Guide (End Users) 5. Install a customized screensaver with complex transformation functions, which consumes system resources and causes a delay in desktop access. 4.4 Failure When Connecting to Desktops During the use of desktops, desktops may fail to be connected due to misoperations. If this happens, you can click problem. to restart the desktops to resolve the If desktops cannot be restarted or you cannot log in to the desktops after they are restarted, click to forcibly restart the desktops. Data that is not saved may be lost after the desktops are forcibly restarted. Therefore, exercise caution when forcibly restarting desktops. 4.5 HDPDeviceHelper Peripheral Assistant If you encounter peripheral configuration problems when using, you can use HDPDeviceHelper. Choose Start > Huawei vdesk. Start HDPDeviceHelper and configure peripherals following the instructions. Figure 4-8 vdesk

48 5 FAQs (Administrators) 5 FAQs (Administrators) 5.1 What Is? is a cloud computing-based desktop service that outperforms personal computers (PCs) and the conventional VDI solution. provides the same configurations (including vcpus, memory, and disks) as those of PCs and Windows OSs. Its familiarity ensures that you can use like using your own PCs. Different from the conventional local VDI solution, does not require high investment or a long deployment period. can automatically handle heavy deployment tasks and provide hosting services. supports access from multiple devices, including computers running Windows and Mac OSs, as well as ipads, iphones, and Android smart devices. With, you can save and obtain files, and use applications anytime and anywhere, implementing mobile office. 5.2 What Are the Features and Advantages of? A web-based management console is provided for you to flexibly enable and disable that works out of the box. provides the following features and advantages: can be provisioned and deployed quickly whereas deploying conventional private desktop clouds takes several days. Administrators can manage hundreds of desktops at the same time using the web page. Multiple desktop package specifications are available for you to choose the most appropriate one (vcpus, memory, system disks, and data disks). The password can be reset if a user forgets it. Encrypted remote access, isolated user resources, and network and peripheral security control are used to ensure high security of data access

49 5 FAQs (Administrators) 5.3 What Is the Process of Using? Administrators only need to apply for and create desktops before using desktops, as shown in Figure 5-1. End users can use desktops after completing basic configurations on clients, as shown in Figure 5-2. Figure 5-1 use process on servers Figure 5-2 use process on clients 5.4 What Are Packages? Packages resources are packaged for leasing. Packages shown in Table 5-1 are for reference only. The actual package prevails. Table 5-1 General Category General Instance workspace.c2.large.w indows workspace.c2.xlarge.wi ndows workspace.c2.2xlarg e.windows

50 5 FAQs (Administrators) vcpu Memory (GB) System Disk (GB) Data Disk (GB) 80 to 32, to 32, to 32,768 0, 100 to 32,768 0, 100 to 32,768 0, 100 to 32,768 Guest OS Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience Windows Server 2008 R2 64-bit with Windows 7 experience Windows Server 2016 with Windows 10 experience The data disk configuration policies are as follows: No data disk is configured. Configure a data disk based on actual requirements. The disk capacity ranges from 100 GB to 32,768 GB. 5.5 How Is Charged? supports the pay-per-use charging mode. is charged based on the usage of the following resources: vcpu, and memory System disk and data disk 5.6 How Do End Users Access the Internet? The administrator can enable user desktops to access the Internet as follows: using NAT gateway using SNAT using a proxy server Method 1: using NAT gateway The NAT gateway provides the Network Address Translation (NAT) service for desktops in a VPC so that multiple desktops can share an EIP to access the Internet. For detailed operations, see the NAT Gateway User Guide

51 5 FAQs (Administrators) After configuring the NAT gateway, you need to set the number of interface metrics on the user desktop. 1. Log in to the desktop. 2. Go to Network and Sharing Center. 3. In the View your active networks area, click Local Area Connection 2 or Ethernet 2. The Local Area Connection 2 Status dialog box or the Ethernet 2 Status dialog box is displayed. 4. Click Properties. The Local Area Connection 2 Properties dialog box or the Ethernet 2 Properties dialog box is displayed. 5. Click Advanced. Method 2: using SNAT The Advanced TCP/IP Settings dialog box is displayed. 6. Deselect Automatic metric, and set Interface metric to Click OK in sequence to save the settings and close the dialog boxes. 8. Click Close to close the Local Area Connection 2 Status dialog box or the Ethernet 2 Status dialog box. Based on the SNAT service provided by the public cloud, within the specified bandwidth, desktops without EIPs can access the Internet. In this way, end users can download software updates via the Internet. Currently, desktops are allowed to access the Internet, but cannot be accessed from the Internet. The bandwidth is shared by all desktops. Basic principle: ECSs assigned with public EIPs are used as SNAT routers or gateways of desktops in the same subnet or VPC, thereby enabling desktops to access the Internet. Different versions of CentOS have different network configuration methods. The following Internet solution is provided by CentOS6.5 as an example. Creating a SNAT server 1. Create an ECS with an EIP as the SNAT server. The ECS is in the same VPC with the desktops, runs on CentOS, and has one NIC. The following uses CentOS 6.5 as an example. Setting the NIC and security group rule of the SNAT server 1. Log in to the management console. 2. On the page that is displayed, choose Computing > Elastic Cloud Server. 3. On the displayed page, locate the target ECS in the ECS list and click the ECS name to switch to the page showing ECS details. 4. Click the NIC tab and disable the source/destination check function. 5. Select Security Group, and add an inbound Any rule for UserSecurityGroup

52 5 FAQs (Administrators) Configuring routing information 1. Log in to the management console. 2. In the navigation pane on the left, choose Virtual Private Cloud. 3. On the Virtual Private Cloud page, locate the VPC to which a route is to be added and click the VPC name. 4. On the Route Table tab, click Add Route. 5. Set route information on the displayed page. Destination: indicates the destination network segment. The value can be a network segment of subnets in the VPC. The default value is /0. The destination of each route must be unique. Next Hop: indicates the IP address of the next hop. Set it to a private IP address or a floating private IP address in a VPC. 6. Click OK. If Next Hop is set to a floating private IP address, the floating private IP addresses in the VPC cannot have EIPs bound. Otherwise, the route will not take effect. Configuring the SNAT server 1. On the ECS console, use the remote login function to log in to the ECS on which SNAT is to be configured. 2. Run the following command and enter the password of user root to switch to user root: su - root 3. Run the following command to check whether the ECS can successfully connect to the Internet: ping The ECS can access the Internet if the following information is displayed: [root@localhost ~]# ping PING (xxx.xxx.xxx.xxx) 56(84) bytes of data. 64 bytes from xxx.xxx.xxx.xxx: icmp_seq=1 ttl=51 time=9.34 ms 64 bytes from xxx.xxx.xxx.xxx: icmp_seq=2 ttl=51 time=9.11 ms 64 bytes from xxx.xxx.xxx.xxx: icmp_seq=3 ttl=51 time=8.99 ms 4. Run the following command to check whether IP forwarding of the Linux OS is enabled: cat /proc/sys/net/ipv4/ip_forward In the command output, 1 indicates enabled, and 0 indicates disabled. The default value is 0. If IP forwarding in Linux is enabled, go to 8. If IP forwarding in Linux is disabled, go to Run the following command to edit the /etc/sysctl.conf file. Press I to enter the edit mode and set net.ipv4.ip_forward to 1. vi /etc/sysctl.conf 6. Press Esc, type :wq, and press Enter. Save the settings and exit the vi editor. 7. Run the following command to make the change take effect: sysctl -p /etc/sysctl.conf 8. Run the following command to configure the NAT conversion rule:

53 5 FAQs (Administrators) iptables -t nat -A POSTROUTING -o eth0 -s VPC or subnet segment where desktops reside/mask bits -j SNAT --to internal IP address of the SNAT server For example, if the VPC network segment is , the mask bits is 24, and the internal IP address of the SNAT server is , run the following command: iptables -t nat -A POSTROUTING -o eth0 -s /24 -j SNAT --to Run the following command to save the configuration: service iptables save 10. Run the following command to check whether the operation is successful: iptables -t nat --list The operation is successful if the information shown in Figure 5-3 (for example, /24) is displayed. Figure 5-3 Verifying configuration 11. Run the following command to edit the rc.local file: vi /etc/rc.d/rc.local 12. Add the following content to the end of the file: echo `/sbin/iptables-restore /etc/sysconfig/iptables` >>/etc/rc.d/rc.local 13. Press Esc, type :wq, and press Enter. Save the settings and exit the vi editor. 14. Run the following command to modify the ifcfg-eth0 file: vi /etc/sysconfig/network-scripts/ifcfg-eth0 15. Add the following content to the end of the file: DNS= Press Esc, type :wq, and press Enter. Save the settings and exit the vi editor. 17. Run the following command to restart the NIC: service network restart Configuring the user desktop 1. Go to Network and Sharing Center. 2. In the View your active networks area, click Local Area Connection 2 or Ethernet 2. The Local Area Connection 2 Status dialog box or the Ethernet 2 Status dialog box is displayed. 3. Click Properties

54 5 FAQs (Administrators) The Local Area Connection 2 Properties dialog box or the Ethernet 2 Properties dialog box is displayed. 4. Double-click Internet Protocol Version 4 (TCP/IPv4). The Internet Protocol Version 4 (TCP/IPv4) Properties dialog box is displayed. 5. Select Use the following DNS server addresses, and set the DNS server address to Click Advanced. The Advanced TCP/IP Settings dialog box is displayed. 7. Deselect Automatic metric, and set Interface metric to Click OK in sequence to save the settings and close the dialog boxes. 9. Click Close to close the Local Area Connection 2 Status dialog box or the Ethernet 2 Status dialog box. 10. In the View your active networks area, click Local Area Connection or Ethernet. The Local Area Connection Status dialog box or the Ethernet Status dialog box is displayed. 11. Click Details. The Network Connection Details dialog box is displayed. 12. Record the IPv4 address, for example, Open the cmd window and run the following command to add a route: route add mask Gateway of the primary NIC p The first two segments of Gateway of the primary NIC are the same as those of the IP address recorded in 12, and the last two segments are 0 and 1 respectively. Method 3: using a proxy server For example, if the IPv4 address is , the gateway of the primary NIC is Run the following command to add a route: route add mask p Creating a proxy server 1. Ceate a proxy server that runs, for example, CentOS. The proxy server must reside on a subnet different from the one where resides in the same VPC. For details about how to configure the ECS, see the Elastic Cloud Server User Guide. 2. Configure an elastic IP address for the proxy server to access the Internet. Installing squid The following operations use Cent OS 6.6 as an example. 1. Log in to the proxy server as user root. 2. Run the following command to check whether squid is installed: rpm -qa grep squid If it is installed, go to

55 5 FAQs (Administrators) If it is not installed, go to Run the following command to install squid: yum -y install squid 4. Run the following command to edit the squid.conf configuration file: vi /etc/squid/squid.conf 5. Check whether SSH is used for connection. If SSH is used, go to 6. If SSH is not used, go to Press I to enter the edit mode and add the following content in a blank row. aclsafe_ports port Use # to comment out http_access deny CONNECT!SSL_ports. 8. Press Esc to exit the edit mode. Type :wq and press Enter. Save configurations and exit the vi editor. 9. Run the following command to restart the squid service. service squid restart Configuring security group rules 1. Configure security group rules to ensure that the extranet cannot access any port of the proxy server and the user desktop can access only the proxy port of the proxy server. For details about how to configure security group policies, see the Virtual Private Cloud User Guide. Configuring the user's browser 1. Open the proxy server setting page of the browser. 2. Set the IP address and the port of the proxy server to the IP address and the monitoring port configured in 1, respectively. 5.7 How Do I Install Applications on the Desktop? If an end user needs to install applications on the desktop, the administrator can use the following methods to assist the end user in the installation: Method 1: using file redirection 1. Choose File redirection > Fixed Drive (such as local disks) to enable the policy. For details, see Managing Policies. 2. The end user downloads required applications to the local PC. 3. The end user copies the applications from the local PC to the desktop and installs them. Method 2: using USB redirection 1. Choose USB port redirection > Storage devices (such as USB flash drives) to enable the policy. For details, see Managing Policies. 2. The end user copies the applications from the USB flash drive to the desktop and installs them. Method 3: using the Internet

56 5 FAQs (Administrators) 1. Enable the Internet access permission for the end user. For details, see How Do End Users Access the Internet?. 2. The end user downloads the applications from the Internet to the desktop and installs them. Method 4: using private images Create the desktop where the required applications are installed for the end user. For details, see Creating Desktops. Method 5: using Microsoft AD pushing Use Microsoft AD to push the applications to the desktop of the end user. For details, see How to use Group Policy to remotely install software in Windows Server What Resources Do I Need to Prepare Before Applying for? You need to enable ports listed in Table 5-2 on the enterprise firewall so that end users can log in to the desktops properly. Table 5-2 Internet access ports Port Protocol Description 443 TCP Used by the end user to access the web login page TCP Used by the end user to access the desktop. By default, port 443 and port 8443 are used. If you want to change the ports, see Changing the Internet Access Port. 5.9 What Should I Do If I Fail to Apply for? Scenario Procedure If you are unable to access after the initial application is complete, retry the application, or cancel and reapply again. Step 1 Step 2 Log in to the management console. Click Dashboard. The Dashboard page is displayed. Step 3 In the Configuration Information area, click Retry. The Retry Apply for dialog box is displayed

57 5 FAQs (Administrators) Step 4 Click OK. ----End You can click Cancel in the Configuration Information area to cancel and apply for again How Is Connected to Enterprise Intranets? desktops can communicate with PCs in the enterprise intranet using the VPN or DirectConnect method. VPN: Figure 5-4 shows how to use VPN to connect desktops to PCs in the enterprise intranet. Figure 5-4 Connecting to an enterprise intranet using a VPN DirectConnect: Contact technical support engineers. reserves the /16 network segment for the NIC on the management plane. Do not use this network segment on the enterprise intranet in case the route conflict occurs How Do I Interconnect with Microsoft AD? You can deploy Microsoft AD in the intranet of the enterprise DC or in the VPC where resides. The following describes how to interconnect with Microsoft AD in two deployment scenarios. After interconnecting with Microsoft AD, configure DNS forwarding on the DNS to allow to access the Internet. Ensure that the network where resides is communicating correctly with that where Microsoft AD resides

58 5 FAQs (Administrators) Procedure Scenario 1: Microsoft AD is deployed in the intranet of the customer's DC. Figure 5-5 Microsoft AD deployed in the intranet of the customer's DC Step 1 Step 2 Use DirectConnect or IPsec VPN to connect the customer's DC to the VPC. For details about the configuration, see the Direct Connect User Guide or VPN User Guide. If a firewall is deployed between Microsoft AD and, enable the following ports on the firewall for to connect to Microsoft AD, as shown in Table 5-3: Table 5-3 Port list Role Port Protocol Description AD 135 TCP Remote Procedure Call (RPC) protocol This port is used by the Lightweight Directory Access Protocol (LDAP), Distributed File System (DFS), and Distributed File System Replication (DFSR). 137 UDP NetBIOS name resolution This port is used by the network login service. 138 UDP NetBIOS data gram service 139 TCP NetBIOS-SSN service This port is used by services, such as the DFS and network login service. This port is used for network basic input and output. 445 TCP NetBIOS-SSN service 49,152-65,535 TCP RPC dynamic port 49,152-65,535 UDP RPC dynamic port This port is used for network basic input and output. 88 TCP Kerberos key distribution center service

59 5 FAQs (Administrators) Role Port Protocol Description 88 UDP Kerberos key distribution center service 123 UDP Port used by the NTP service 389 UDP LDAP server 389 TCP LDAP server 464 TCP Kerberos authentication protocol 464 UDP Kerberos authentication protocol 500 UDP isakmp 593 TCP RPC over HTTP 636 TCP LDAP SSL 3268 TCP LDAP global catalog server 3269 TCP LDAP global catalog server 4500 UDP IPsec NAT-T 5355 UDP llmnr 9389 TCP Active Directory Web service DNS 53 TCP DNS server 53 UDP DNS server Step 3 Step 4 After the configuration, verify the interconnection and ensure that the networks and ports are working correctly. For details, see Verification. Log in to your DNS server, configure the DNS reverse lookup function in the DNS Manager, and add the first subnet segment that is selected in the subnet list during application to the IP address segment for reverse lookup. ----End Scenario 2: Microsoft AD is deployed in a subnet and the VPC where resides is deployed in another subnet

60 5 FAQs (Administrators) Figure 5-6 Microsoft AD deployed in a subnet and the VPC where resides deployed in another subnet In this scenario, you must add security group rules for Microsoft AD to enable some ports of Microsoft AD for so that can connect to Microsoft AD. Step 1 Step 2 Create a security group, add an inbound rule, and configure the parameters as follows: Protocol: ANY Source IP Address: IP Address IP Address: Enter the subnet where resides. Apply the security group to AD server instances so that can communicate correctly with Microsoft AD. If you want to minimize the number of enabled ports and protocols, you can add multiple inbound rules to the security group. For details about the ports that need to be enabled, see Table 5-3. Step 3 Step 4 After the configuration, verify the interconnection and ensure that the networks and ports are working correctly. For details, see Verification. Log in to your DNS server, configure the DNS reverse lookup function in the DNS Manager, and add the first subnet segment that is selected in the subnet list during application to the IP address segment for reverse lookup. ----End Verification Step 1 Check the firewall or security group settings of the AD server and ensure that ports 49,152 to 65,535 have been enabled. For details about the requirements on AD server ports, see Active Directory and Active Directory Domain Services Port Requirements. Step 2 Create a Windows OS instance in the VPC where the user desktop resides using the ECS service and add the instance to the existing domain

61 5 FAQs (Administrators) For details about how to configure and operate ECS, see the Elastic Cloud Server User Guide. Step 3 Log in to the Windows instance using the RDP client tool (such as mstsc) or VNC. The remaining steps are performed on this Windows instance. Step 4 Step 5 Step 6 Download ADTest.zip and unzip the test application. In the blank area of the directory where ADTest.exe resides, hold down Shift, right-click, and choose Open command windows here. In Command Prompt, enter the following command to check the AD server connectivity: ADTest.exe -file ADTest.cfg -ip AD IP address -domain AD domain name -user domain administrator account Command example: ADTest.exe -file ADTest.cfg -ip domain abc.com -user vdsadmin Step 7 Check whether SUCCEED is displayed in all test results. If FAILED is displayed, check the AD server configuration or firewall ports following the instructions. ----End Configure DNS forwarding. The following uses Windows Server 2012 as an example. Step 1 Log in to the DNS server as the administrator. Step 2 On the task bar, click. The Server Manager window is displayed. Step 3 Step 4 In the navigation pane on the left, click DNS. In the SERVER area, right-click server name and choose DNS Manager. The DNS Manager window is displayed. Step 5 Step 6 Step 7 Unfold DNS, right-click computer name, and choose Properties from the shortcut menu. On the Advanced tab page, deselect Disable recursion (also disable forwarders), and click Apply. On the Forwarders tab page, click Edit, enter the IP address of the default DNS server of the public cloud, and click OK. ----End You can view the IP address of the default DNS server of the public cloud on the page for creating the VPC

62 5 FAQs (Administrators) 5.12 What Should I Do If I Fail to Apply for by Interconnecting with Microsoft AD? Scenario Procedure If you fail to apply for by interconnecting with Microsoft AD and a message is displayed stating "Failed to configure an infrastructure component(85%)", you can rectify the fault as follows: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 In the AD Domain area of the Dashboard page, check whether the domain information is correct. Click Modify to modify incorrect domain configurations. Click Retry to reapply for the service. If you use Scenario 1: Microsoft AD is deployed in the intranet of the customer's DC in section How Do I Interconnect with Microsoft AD? and use DirectConnect for connections, log in to the AD server and ping the IP address of DirectConnect. If the ping fails, check whether the network where the AD server resides as well as the VPC network and subnet ports used for applying for are normal. Check the AD server connectivity. For details, see the Verification area in section How Do I Interconnect with Microsoft AD?. Click Retry to reapply for the service. If the fault persists, contact technical support engineers. ----End 5.13 How Do I Check the Network Status of Desktops? Procedure Perform the following operations to check the network status of desktops and determine the network segment where the fault occurs. Step 1 Step 2 Log in to the desktop. Move the cursor to the upper area of the desktop. The floating window is displayed, as shown in Figure 5-7. Figure 5-7 Floating window Step 3 Click Network. The Connection Status dialog box is displayed

63 5 FAQs (Administrators) When the network connection is good, the network indicator is steady green. When the network connection is poor, the network indicator is steady yellow. When the network connection is bad, the network indicator is steady red. Step 4 On the Connection Status page, check Round-Trip Time. Figure 5-8 shows the network connection status. Figure 5-8 Network connection status Step 5 Step 6 Click Start. In the Search programs and files text box, type cmd, and press Enter. In the command-line interface, run the following command to check the network connectivity between the desktop and the terminal: ping Internet access address of the desktop The Internet access address of the desktop can be found in the desktop provisioning notification . Information similar to the following is displayed: Step 7 Determine the network segment where the fault occurs based on the results in Step 4 and Step 6. If the network latency in Step 4 and Step 6 is large, the public network is faulty

64 5 FAQs (Administrators) If the network latency in Step 4 is large but that in Step 6 is small, the internal network of is faulty. ----End 5.14 What Are the Network Requirements for Accessing the Desktop? Table 5-4 lists the network requirements for accessing the desktop. If the network requirements cannot be met, you are advised to use DirectConnect access. Table 5-4 Network requirements Items Average bandwidth Network Requirement 300 kbps/instance Peak 5 Mbps/instance Packet loss rate 0.01% Round -trip delay Jitter 30 ms 10 ms

65 6 FAQs (End Users) 6 FAQs (End Users) 6.1 What Devices Can Be Used to Log In to? You can log in to using SCs, browsers, Android terminals, and ios terminals. 6.2 What Are the Precautions for Using? desktops provide on-demand services based on network resources and work depending on OSs and network configurations in desktops. This section describes some risky operations on desktops. These operations do not need to be adjusted. If special modification is required, contact the administrator for confirmation. Risky Operations (Processes and Services) 1. Change the default service and startup options in the system configuration. Figure 6-1 shows the Services and Startup options

66 6 FAQs (End Users) Figure 6-1 Services and startup 2. Disable HDP services shown in Figure 6-2. Figure 6-2 HDP services 3. Uninstall programs shown in Figure

67 6 FAQs (End Users) Figure 6-3 Programs 4. End the LOCAL SERVICE, NETWORK SERVICE, or SYSTEM processes in Task Manager. Figure 6-4 shows the processes that cannot be ended. Figure 6-4 Task Manager Risky Operations (Network) 1. Disable NICs, and disable or modify network configurations, as shown in Figure

68 6 FAQs (End Users) Figure 6-5 Local connection Risky Operations (Others) 2. Run the script or command for modifying a route, such as route DELETE *. 3. Delete ports 28511, 28512, 28521, and from Windows firewall exception options. 4. Enable software or tools, such as the IPsec, that can restrict network traffic. 1. Delete files or folders in C:\Program Files\Huawei listed in Figure 6-6. Figure 6-6 Folders 2. Enable the sleep function on desktops. The sleep function is disabled for desktops by default, as shown in Figure 6-7. Figure 6-7 Sleep function 3. Modify the configuration file of the HDP client (AccessAgent). 4. Run Rabbit Magic or Wopti Utilities to clean or optimize the registry

69 6 FAQs (End Users) 5. Install a customized screensaver with complex transformation functions, which consumes system resources and causes a delay in desktop access. 6.3 What OSs Can Run on? runs Windows Server 2008 R2 or Windows Server 2016 and delivers the Windows 7 or Windows 10 desktop environment. 6.4 Can I Upgrade OSs by Myself? must use OSs provided by the public cloud or OSs made based on the OSs provided by public cloud. You are not allowed to upgrade an OS but can install OS patches. 6.5 How Do I Install Applications on the Desktop? By default, end users are configured as local administrators and can install applications. Administrators can modify the settings to prevent end users from installing applications. An end user can install applications on the desktop using the following methods: The administrator must enable necessary policies and perform required configurations before the following methods are used. Method 1: using file copy 1. Download required applications to the local PC. 2. Copy the applications from the local PC to the desktop and install them. Method 2: using USB flash drive copy Copy the applications from the USB flash drive to the desktop and install them. Method 3: using the Internet Download the applications from the Internet to the desktop and install them. Method 4: using private images Contact the administrator to create the required desktop. Method 5: using application pushing Contact the administrator to push the required applications to your desktop and install them. 6.6 What Software Is Compatible with? Software that works with must be compatible with Windows Server 2008 R2 or Windows Server

70 6 FAQs (End Users) 6.7 How Does Manage Peripherals? If you encounter peripheral configuration problems when using, you can use HDPDeviceHelper. Choose Start > Huawei vdesk. Start HDPDeviceHelper and configure peripherals following the instructions. Figure 6-8 vdesk 6.8 Does Support Personalized Settings? By default, after logging in to, end users can personalize items, such as wallpapers, icons, and shortcuts for OSs. The settings will be retained until the next modification. Administrators can use policies, such as USB Redirection, Printer Redirection, File Redirection, and Clipboard Redirection to control data transmission and peripheral access permission between end users and. Installing a customized screensaver with complex transformation functions consumes system resources and causes a delay in desktop access

71 6 FAQs (End Users) 6.9 Can Data in Be Saved for a Long Time? Yes. End users use desktops separated from other end users. Applications, documents, settings, and other data can be saved for a long time How Do I Use a Local Printer for Printing? If you have configured a local printer, the printer will be selected by default. If no printer is configured, you need to configure one. Then select the local printer from the printing menu and click Print How Do I Use a Network Printer for Printing? Any printer that resides in the same network as and is supported by Windows can be added as a network printer. After a network printer is added, you can select the printer in applications for printing What Should I Do If the Desktop Cannot Be Connected? During the use of desktops, desktops may fail to be connected due to misoperations. If this happens, you can click problem. to restart the desktops to resolve the If desktops cannot be restarted or you cannot log in to the desktops after they are restarted, click to forcibly restart the desktops. Data that is not saved may be lost after the desktops are forcibly restarted. Therefore, exercise caution when forcibly restarting desktops How Do I Log In to the Desktop for Maintenance Using VNC? If you cannot log in to your desktop normally, you can log in to the desktop for maintenance using VNC. This function does not apply to scenarios where DirectConnect is used to access desktops. The procedure is as follows: 1. Log in to the desktop and enter the desktop list page. 2. Click, as shown in Figure 6-9. The VNC self-help console is displayed

72 6 FAQs (End Users) If a black screen occurs, click Send CtrlAltDel in the upper-right corner of the window. Figure 6-9 Self-help console 6.14 What Should I Do If the Desktop Freezes When Using? If a fault such as desktop freezing or slow response occurs when you use a desktop, rectify the fault by performing operations provided in this section

73 6 FAQs (End Users) Figure 6-10 Fault locating Method 1: Stopping Unnecessary Processes 1. On the desktop, open Task Manager. The following figure shows the Task Manager window

74 6 FAQs (End Users) Figure 6-11 Windows Task Manager 2. View the processes that consume massive CPU and memory resources. 3. Save user documents. 4. Stop the processes that consume massive CPU and memory resources. Do not stop the processes mandatory for desktop operating. For details, see What Are the Precautions for Using?. Method 2: Restarting the Desktop 1. Save user documents. 2. Choose Start > Restart or click to restart the desktop, as shown in the following figure. If desktops cannot be restarted or you cannot log in to the desktops after they are restarted, click to forcibly restart the desktops. Data that is not saved may be lost after the desktops are forcibly restarted. Therefore, exercise caution when forcibly restarting desktops

75 6 FAQs (End Users) Figure 6-12 Self-help console 3. On the login page that is displayed, enter the user domain account and password. 4. In the desktop list, click to go to the desktop How Do I Check the Network Status of Desktops? Perform the following operations to check the network status of desktops and determine the network segment where the fault occurs. Procedure Step 1 Step 2 Log in to the desktop. Move the cursor to the upper area of the desktop. The floating window is displayed, as shown in Figure Figure 6-13 Floating window Step 3 Click Network. The Connection Status dialog box is displayed. When the network connection is good, the network indicator is steady green. When the network connection is poor, the network indicator is steady yellow. When the network connection is bad, the network indicator is steady red. Step 4 On the Connection Status page, check Round-Trip Time. Figure 6-14 shows the network connection status

76 6 FAQs (End Users) Figure 6-14 Network connection status Step 5 Step 6 Click Start. In the Search programs and files text box, type cmd, and press Enter. In the command-line interface, run the following command to check the network connectivity between the desktop and the terminal: ping Internet access address of the desktop The Internet access address of the desktop can be found in the desktop provisioning notification . Information similar to the following is displayed: Step 7 Determine the network segment where the fault occurs based on the results in Step 4 and Step 6. If the network latency in Step 4 and Step 6 is large, the public network is faulty. If the network latency in Step 4 is large but that in Step 6 is small, the internal network of is faulty. ----End 6.16 How Do I Change the Login Password? The passwords of accounts in the system must be changed periodically. The recommended interval is three months. The minimum validity period of a password is two days

77 6 FAQs (End Users) You can perform the following steps to change the login password on the WI (desktop login page). Step 1 Use the original domain account and password to log in. The desktop list page is displayed. Step 2 On the desktop list page, click. Then click. Step 3 Step 4 Enter Old Password, New Password, and Confirm Password. Click OK. ----End 6.17 How Do I Change the Login Password (Mobile Client)? The passwords of accounts in the system must be changed periodically. The recommended interval is three months. The minimum validity period of a password is two days. You can perform the following steps to change the login password on the WI (desktop login page) through the FusionAccess client on a mobile terminal. Step 1 Open the FusionAccess client on the mobile terminal to go to the desktop login page. You must configure the desktop login address upon your initial login. Step 2 Step 3 Enter the username and password, and click Login. The VM list is displayed. Step 4 Click in the upper right corner and click Change Password. Step 5 The Change Password page is displayed. Step 6 Enter Old Password, New Password, and Confirm Password, as shown in Figure

78 6 FAQs (End Users) Figure 6-15 Change Password Step 7 Step 8 Choose Modify Password. The password is changed successfully. ----End 6.18 What Should I Do If I Forget the Password? If you lose or forget the login password, contact the administrator. After the administrator processing, the password resetting link will be sent to your address by the system. You can click the link to reset the password. The validity period of the password resetting link in the is 24 hours. Reset the password in a timely manner What Should I Do If the Account Is Locked? Your account will be locked if you enter an incorrect password consecutively. If this happens, contact the administrator to unlock the account

79 6 FAQs (End Users) 6.20 How Do I Partition a Hard Disk Larger than 2 TB? Symptom Solution The default maximum storage space of the Windows data disk is 2 TB. If the purchased space is greater than 2 TB, the remaining space cannot be formatted. That is, the disk whose partition size is greater than 2 TB cannot be used. Before performing the following operations, ensure that the disk data to be formatted is cleared. Step 1 Right-click Computer on the desktop and choose Manage from the shortcut menu. The Server Manage window is displayed. Click Disk Management on the left. The disk management page is displayed, as shown in the following figure. Step 2 Step 3 If the disk to be formatted is DataDisk(D:), right-click DataDisk(D:) and choose Delete volume from the shortcut menu. After deleting the volume, right-click the block to which Disk 1 belongs and choose Convertto GPT Disk from the shortcut menu. The following figure shows the converted table: