The administrator can take two actions to make the golden image show up in the Golden Image

selection window. First, they can login to the vSphere Client, select the Golden Image virtual

machine and create a snapshot. This will make the golden image available in the selection window.

Second, they can login to the vSphere Client, select the Golden Image virtual machine and convert it

to a template. This will also make the golden image available in the selection window.

A golden image is a virtual machine that contains the operating system, applications, and settings

that are required for an instant clone desktop pool. To create an instant clone desktop pool, the

administrator must select a golden image and a snapshot from the vSphere inventory. The snapshot

must be taken after installing and configuring the Horizon Agent on the golden image1. If there is no

snapshot or no template available, the golden image will not show up in the selection window.

The other options are not correct for this scenario:

Login to the vSphere Client, select the Golden Image virtual machine and delete all snapshots. This

option is not correct because deleting all snapshots will not make the golden image show up in the

selection window. In fact, it will prevent the administrator from creating an instant clone desktop

pool, as a snapshot is required for instant cloning2.

Refresh the Select Golden Image view and select the Golden Image. This option is not correct

because refreshing the view will not change the availability of the golden image in the selection

window. The administrator must create a snapshot or a template of the golden image before it can

be selected.

Login to the vSphere Client, select the Golden Image virtual machine and clone it to a new virtual

machine. This option is not correct because cloning the golden image to a new virtual machine will

not make it show up in the selection window. The administrator must still create a snapshot or a

template of the cloned virtual machine before it can be selected.

Reference:

Preparing a Golden Image Virtual Machine for Instant-Clones

Snapshot vmdk files of the golden image used to publish Instant clone …

Create an Automated Instant-Clone Desktop Pool

Instant Clone Desktop Pools

[VMware Horizon 8.x Professional]

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/VMWARE_2v0-51.23/page_9_img_2.jpg

SAML -> Connects the client to Workspace ONE Access

Certificate Authority -> Issues certificates for vrm and Enrollment Server

Connection Server -> Connects vrm to Active Directory

Enrollment Server -> Connects Workspace ONE Access to vrm

You can find more information about the Simple True 5SO Architecture in the VMware Horizon 8.x

Professional source documents or study guide1. This architecture is a simplified version of the True

SSO Architecture, which allows users to log in to their virtual desktops and applications without

entering credentials multiple times. The Simple True 5SO Architecture uses Workspace ONE Access

as the identity provider, which authenticates users with SAML and issues SAML assertions. The

Enrollment Server then uses the SAML assertions to request short-lived certificates from the

Certificate Authority, which are used to authenticate users to the Connection Server. The Connection

Server then connects users to their virtual desktops and applications through vrm, which is

integrated with Active Directory2.

Reference:

VMware Horizon 8.x Professional

Simple True SSO Architecture

The URL Content Redirection feature allows administrators to configure specific URLs to open on the

client machine or in a remote desktop or published application. This can help reduce the risk of users

downloading malware to the corporate network, as well as improve the user experience and

performance of certain web applications.

To meet the requirements of the scenario, the administrator needs to enable the URL Content

Redirection feature in Horizon Agent when installing or upgrading it on the instant-clone desktops.

This will allow Horizon Agent to send or receive URLs from Horizon Client, depending on the

redirection direction. The administrator also needs to configure group policy settings to indicate how

Horizon Agent redirects the URL. Specifically, the administrator needs to enable agent-to-client

redirection, which means that Horizon Agent sends the URL to Horizon Client, which opens the

default application for the protocol in the URL on the client machine. The administrator also needs to

specify which URLs are redirected from a remote desktop to a client, and which URLs are not

redirected. In this case, the administrator needs to configure a whitelist of intranet websites that are

allowed to open inside the virtual desktop, and a blacklist of all other websites that are automatically

redirected to a browser on the client machine.

The other options are not relevant or sufficient for meeting the requirements. Disabling the Allow

External Website feature in Horizon Agent will prevent users from accessing any external websites

from their virtual desktops, which might not be desirable or practical. Enabling secure website

settings in the Global Settings Security menu will not affect how URLs are redirected, but only how

secure connections are established between Horizon components. Enabling the URL Content

Redirection feature on the desktop pool settings will not work unless it is also enabled in Horizon

Agent and configured with group policy settings. Reference: Configuring URL Content Redirection and

[VMware Horizon 8.x Professional Course]

One of the possible reasons that the administrator is not seeing the printers within his Horizon

Desktop session is that printing is disabled in the Horizon Desktop Pool. Printing is a feature that

allows users to print from a remote desktop to any local or network printer available on their client

device. Printing can be enabled or disabled for each desktop pool by using the VMware Integrated

Printing feature.

VMware Integrated Printing is a feature that supports client printer redirection, location-based

printing, and persistent print settings. Client printer redirection enables users to print from a remote

desktop to any local or network printer available on their client device. Location-based printing

enables users to print to network printers that are physically near their client device. Persistent print

settings enable users to retain their print settings across sessions.

To enable or disable printing for a desktop pool, the administrator needs to follow these steps:

In Horizon Console, select Inventory > Desktops.

Select the desktop pool and click Edit.

In the Edit Desktop Pool dialog box, select the VMware Integrated Printing tab.

Select or clear the Enable VMware Integrated Printing check box.

Click OK.

If printing is disabled for a desktop pool, users will not see any printers within their Horizon Desktop

session, even if they have installed the VMware Integrated Printing feature in the Horizon Agent and

the Horizon Client. Therefore, to resolve this issue, the administrator needs to enable printing for the

desktop pool by selecting the Enable VMware Integrated Printing check box.

The other options are not likely to be the reason that the administrator is not seeing the printers

within his Horizon Desktop session:

Port TCP 9427 is disabled: This port is used by the VMware Integrated Printing feature for

communication between the Horizon Agent and the Horizon Client. If this port is disabled, users

might experience printing errors or delays, but they should still see the printers within their Horizon

Desktop session.

The VMware Integrated Printing feature is not installed in the Horizon Client: This feature is installed

by default in the Horizon Client for Windows, Mac, Linux, Chrome, and HTML Access. If this feature is

not installed in the Horizon Client, users might not be able to print from their remote desktops, but

they should still see the printers within their Horizon Desktop session.

Port TCP 32111 is disabled: This port is used by ThinPrint for communication between the Horizon

Agent and the ThinPrint Client. ThinPrint is a legacy printing feature that has been replaced by

VMware Integrated Printing. If this port is disabled, users might experience printing errors or delays

with ThinPrint, but they should still see the printers within their Horizon Desktop session if they use

VMware Integrated Printing.

Reference: Configuring VMware Integrated Printing, Enable or Disable Printing for a Desktop Pool,

and [VMware Horizon 8.x Professional Course]

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/VMWARE_2v0-51.23/page_73_img_1.jpg

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/VMWARE_2v0-51.23/page_22_img_1.jpg

To monitor the advanced metrics of desktop sessions in Horizon Console, you need to use the

Horizon Help Desk Tool. This is a web application that you can use to get the status of Horizon 8 user

sessions and to perform troubleshooting and maintenance operations1. You can also view

performance details for a virtual or published desktop session that uses the PCoIP or VMware Blast

display protocol2.

To access the Horizon Help Desk Tool, you need to click on the Monitoring tab on the left side of the

Horizon Console. Then, you need to select Help Desk from the drop-down menu. This will open the

Horizon Help Desk Tool in a new browser tab. You can then search for a user, machine, or pool and

view the session details. You can also click on More to see the advanced metrics such as latency,

bandwidth, protocol, and frame rate1.

In a load balanced Horizon POD with three Connection Servers, there are 450 active Blast sessions

connected. If one of these Connection Servers runs into an unplanned outage, only the active

sessions from the failed Connection Server are disconnected, because HTTPS Secure Tunnel is

disabled. This means that the other two Connection Servers can still handle the remaining sessions

without interruption.

The HTTPS Secure Tunnel is a feature that allows Horizon Client devices to establish secure

connections to virtual desktops and applications through the Connection Server. When this feature is

enabled, all the display protocol traffic is tunneled through the Connection Server, which acts as a

proxy between the client and the desktop. This increases the security and simplifies the network

configuration, but also adds some overhead and dependency on the Connection Server availability1.

When this feature is disabled, the Horizon Client devices connect directly to the desktops using their

IP addresses or hostnames, bypassing the Connection Server. This reduces the load and dependency

on the Connection Server, but also requires more network configuration and firewall rules to allow

direct access to the desktops2.

The Blast Secure Gateway is a similar feature that allows Horizon Client devices to establish secure

connections to virtual desktops and applications using the Blast Extreme protocol through the

Connection Server. When this feature is enabled, the Blast Extreme traffic is tunneled through the

Connection Server, which acts as a gateway between the client and the desktop. When this feature is

disabled, the Horizon Client devices connect directly to the desktops using Blast Extreme3.

In this scenario, both HTTPS Secure Tunnel and Blast Secure Gateway are disabled, which means that

the Horizon Client devices connect directly to the desktops using Blast Extreme. Therefore, if one of

the Connection Servers fails, only the sessions that were authenticated by that Connection Server are

affected. The other sessions can continue without interruption, as long as they can reach their

desktops directly4.

The other options are not correct for this scenario:

All 450 active sessions are disconnected, and have to re-connect again by the end-user. This would be

true if HTTPS Secure Tunnel or Blast Secure Gateway were enabled, and all the display protocol traffic

was tunneled through the Connection Server. In that case, any failure of a Connection Server would

disconnect all the sessions that were using it as a proxy5.

All active sessions will stay connected, because HTTPS Secure Tunnel and Blast Secure Gateway are

disabled. This would be true if there was no dependency on the Connection Server after

authentication. However, even with HTTPS Secure Tunnel and Blast Secure Gateway disabled, there

is still some communication between the Horizon Client and the Connection Server for session

management and heartbeat monitoring. If a Connection Server fails, these communications are lost

and the sessions are terminated.

All 450 active session are logged off immediately. This would be true if there was a global setting in

Horizon Console to log off users when a Connection Server fails. However, there is no such setting in

Horizon Console. The default behavior is to disconnect users when a Connection Server fails, not log

them off.

Reference:

Configuring HTTPS Secure Tunnel

Configuring Network Ports for Direct Connections

Configuring Blast Secure Gateway

Load Balancing Across Multiple Pods

Horizon 7: Monitoring health of Horizon Connection Server using Load Balancer

[Horizon 7 Pods]

[Global Settings for Client Sessions in Horizon Console]

[VMware Horizon Architecture Planning]

VMware vCenter Server is the central management component for ESXi servers, allowing

administrators to manage multiple ESXi hosts and virtual machines (VMs) from a single console. It

provides essential management capabilities, including resource allocation, performance monitoring,

and centralized access control, making it the cornerstone for managing a VMware virtualized

infrastructure.

On a VMware vCenter managed virtual machine, the VMware Horizon Agent knows which

Connection Server it should register with during the Instant Clone pool creation process by querying

VMware Tools for a Guestlnfo Variable during the cloning process. The Guestlnfo Variable is a custom

property that is set on the parent virtual machine and contains the FQDN of the Connection Server.

When the parent virtual machine is cloned, the Guestlnfo Variable is copied to the clone and read by

the Horizon Agent. The Horizon Agent then registers with the Connection Server specified in the

Guestlnfo Variable12.

The other options are not correct for this scenario:

Administrator provides this information in the “Add Pool” creation wizard. This option is not correct

because the administrator does not need to provide the Connection Server information in the “Add

Pool” creation wizard. The administrator only needs to select the vCenter Server, data center, cluster,

resource pool, datastore, network, and snapshot of the parent virtual machine. The Connection

Server information is already embedded in the parent virtual machine as a Guestlnfo Variable3.

Horizon Agent retrieves this information from an DNS SRV record. This option is not correct because

the Horizon Agent does not use DNS SRV records to find the Connection Server during the Instant

Clone pool creation process. DNS SRV records are used by Horizon Client devices to discover

Connection Servers when they connect to a Horizon environment. DNS SRV records are optional and

can be configured by the administrator to simplify client connections4.

Administrator provides this information in the Horizon Agent Installation Wizard on the master

image. This option is not correct because the administrator does not need to provide the Connection

Server information in the Horizon Agent Installation Wizard on the master image. The administrator

only needs to select the features and options that are required for the desktop pool, such as VMware

Horizon Instant Clone Agent, VMware Dynamic Environment Manager, VMware App Volumes, and so

on. The Connection Server information is set on the master image after it is converted to a parent

virtual machine by using a PowerShell script5.

Reference:

Instant Clones: How Does It Work?

Instant Clone Domain Administrator Account

Create an Automated Instant-Clone Desktop Pool

Configuring DNS Service Records for Horizon Connection Server

Install Horizon Agent on a Virtual Machine

[VMware Horizon 8.x Professional]

[VMware Horizon Architecture Planning]

Global Entitlements in VMware Horizon allow for the aggregation of resources across multiple pods

and sites into a single entitlement. This feature is particularly beneficial when publishing applications

that are hosted across different pods, as it ensures that users see only one icon for the application,

regardless of which pod it is hosted on, simplifying the user experience and administration of

applications in a multi-pod Horizon environment.