Solution

  • Horizon

Type

  • Document

Level

  • Intermediate

Category

  • Operational Tutorial

Product

  • Horizon 7
  • Horizon Apps
  • Horizon Cloud Service

OS/Platform

  • Windows 10

Phase

  • Deploy

Use-Case

  • App & Access Management
  • Modern Management
  • Windows Delivery

Creating an Optimized Windows Image for a VMware Horizon Virtual Desktop

VMware Horizon 7 VMware Horizon Cloud Service

Introduction

Overview

Considerations you must take into account when creating a Windows system image are much different if you plan to deploy virtual desktops rather than physical desktops:

  • Physical desktops – Resource usage on a physical machine impacts only the user who is using that machine. The operating system on a physical machine determines whether or not resources are available. One-time actions impact the user only the first time they are performed because the machine is never refreshed. For example, a user typically gets a new user profile the first time they log on, and they continue to use that same profile with all subsequent logons.
  • Virtual desktops – In contrast, in a virtual environment, the guest operating system behaves as if it has exclusive access to the CPU cores, but in reality the cores are shared between 2 to 8 virtual machines. When using nonpersistent VMs or user profiles, the actions that are intended to run only once could run every time a user logs on.

Therefore, with virtual desktops, one-time system actions must be configured in the base image, and one-time user actions must be configured in the default user profile. In addition, to reach a higher consolidation ratio, increasing the number of VMs hosted on a single VMware vSphere® host, VMware recommends turning off features that are not needed.

JMP Next-Generation Desktop and Application Delivery Platform

JMP (pronounced jump), which stands for Just-in-Time Management Platform, represents capabilities in VMware Horizon® 7 Enterprise Edition that deliver Just-in-Time Desktops and Apps in a flexible, fast, and personalized manner. JMP is composed of the following VMware technologies:

•VMware Instant Clone Technology for fast desktop and RDSH provisioning

VMware App Volumes™ for real-time application delivery

VMware Dynamic Environment Manager™ for contextual policy management

JMP allows components of a desktop or RDSH server to be decoupled and managed independently in a centralized manner, yet reconstituted on demand to deliver a personalized user workspace when needed. JMP is supported with both on-premises and cloud-based Horizon deployments, providing a unified and consistent management platform regardless of your deployment topology. The JMP approach provides several key benefits, including simplified desktop and RDSH image management, faster delivery and maintenance of applications, and elimination of the need to manage “full persistent” desktops.

Note: Installing the components of JMP is required only if you want to use that functionality. Similarly, installing the Horizon Agent is required only if you plan to use the image for VMware Horizon desktop or application pools.

Purpose of This Guide

Creating an Optimized Windows Image for a Virtual Desktop provides step-by-step procedures for creating optimized images. These procedures include creating a VM, installing and configuring a Windows operating system, optimizing the OS, and installing the various VMware agents required for desktop pool deployment.

Important: The procedures in this guide are sequential and build on one another, so make sure to complete each procedure in each chapter before moving on to the next.

Intended Audience

This guide is intended for IT administrators and product evaluators who are familiar with VMware vSphere and VMware vCenter Server®.  Familiarity with networking and storage in a virtual environment, Active Directory, identity management, and directory services is  assumed. Knowledge of other technologies, such as Horizon 7 is also helpful.

Advantages of an Optimized Image

Optimizing the master image is well worth the time and effort involved. Savings are returned on a variety of fronts.

Initial Deployment Time Savings

By trimming the image, you can reduce the amount of required disk space by up to 80 percent, which translates to a significant reduction in the time it takes to create desktop pools (up to 3 times faster).

By default, Windows generates native images and performs disk cleanup actions after being idle for 10 minutes, which can use a full core for up to an hour. When deploying a large pool, this means that the cluster might not be usable for up to an hour after deployment. With image optimization, however, this process could be reduced to 30 seconds.

User Logon Time Savings

When a user logs on, the portion of logon time devoted to creating a standard user profile can take up to 30 seconds, but when optimized, this portion of logon time could be reduced to 2.5–8.5 seconds.

Host Memory Savings

A default deployment can use up to 2 GB of active memory, but with optimization, memory requirements can be reduced significantly (up to 50 percent).

Host CPU Savings

An optimized deployment can reduce CPU usage by up to 40 percent, allowing for up to a 40-percent increase in VM density on the physical vSphere host.

Storage and IOPS Savings

Because of the earlier-mentioned disk-space savings, you realize cache-usage improvements as well. Disabling unneeded features and compressing the OS files means a larger portion can fit in the cache, which can reduce the amount of IOPS required by up to 250 percent.

Tested Operating Systems

The following operating systems have been tested using the procedures included in this guide. The table shows the example sizing and login duration that we achieved in our testing.

Only 64-bit operating systems where tested, but any 32-bit operating system that has a corresponding 64-bit version listed should work in the same way. All operating systems were tested with all updates available as of January 2020. For a complete list of supported Windows 10 operating systems, see the VMware knowledge-base article Supported versions of Windows 10 on Horizon Agent Including All VDI Clones (Full Clones, Instant Clones, and Linked Clones on Horizon 7) (2149393).

Note: Most screenshots in this guide are from Windows 10 1803. If you have a different OS version, some screens might look slightly different, but in general they are quite similar.

ImportantUse an OS version that has a Microsoft Windows volume license key using the Key Management Service (KMS). KMS treats each activated clone as a computer with a newly issued license. In a production environment, you must activate Windows. In an evaluation environment, you can create the VM and log in without activating Windows.

Operating System Version Build Edition Architecture Used Space New Profile Creation Duration
Windows 10 1607 14393.3443 (2020-01-14) LTSB* x64 5.14 GB 6 S
Windows 10 1709 16299.1625 (2020-01-14) Education x64 5.08 GB 4.5 S
Windows 10 1709 16299.1625 (2020-01-14) Enterprise x64 5.65 GB 4.5 S
Windows 10 1803 17134.1246 (2020-01-14) Education x64 5.20 GB 6.5 S
Windows 10 1803 17134.1246 (2020-01-14) Enterprise x64 5.21 GB 6.5 S
Windows 10 1809** 17763.973 (2020-01-14) Education x64 5.44 GB 7 S
Windows 10 1809** 17763.973 (2020-01-14) Enterprise x64 5.36 GB 7 S
Windows 10 1809** 17763.973 (2020-01-14) LTSC* x64 5.02 GB 4.5 S
Windows 10 1809** 17763.973 (2020-01-14) Professional x64 5.51 GB 7 S
Windows 10 1903** 18362.592 (2020-01-14) Education x64 4.95 GB 9.5 S
Windows 10 1903** 18362.592 (2020-01-14) Enterprise x64 5.12 GB 9.5 S
Windows 10 1903** 18362.592 (2020-01-14) Professional x64 5.01 GB 9.5 S
Windows 10 1909** 18363.592 (2020-01-14) Education x64 4.95 GB 9.5 S
Windows 10 1909** 18363.592 (2020-01-14) Enterprise x64 5.95 GB 9.5 S
Windows 10 1909** 18363.592 (2020-01-14) Professional x64 5.02 GB 9.5 S
Windows Server 2016 1607 14393.3443 (2020-01-14) Datacenter x64 7.69 GB 3.5 S
Windows Server 2016 1607 14393.3443 (2020-01-14) Standard x64 7.72 GB 3.5 S
Windows Server 2019 1809** 17763.973 (2020-01-14) Datacenter x64 5.97 GB 3.5 S
Windows Server 2019 1809** 17763.973 (2020-01-14) Standard x64 5.96 GB 3.5S

* LTSB means long-term servicing branch. LTSC means long-term servicing channel. This edition receives only security updates but no feature updates. OS upgrades are released only once every three years or so. This edition does not include Edge or any Microsoft Store (Universal Windows Platform, or UWP) apps, or Cortana, the voice-activated digital assistant. This edition is meant for specialized systems that perform a single important task—such as PCs that control medical equipment, point-of-sale systems, and ATMs.

** For 1809+ vSphere 6.5/6.7 U3 or higher is recommended as there are known problems with earlier versions of vSphere.

Infrastructure Prerequisites

Before you can perform the procedures in this guide, you must have the following infrastructure components installed and configured:

  • VMware vSphere and vCenter Server. We used vSphere 6.7 U3 and vCenter Server 6.7 U3 in our testing. For information and installation instructions, see the VMware vSphere documentation.
  • VMware ESXi™ host or hosts configured in the vCenter Server instance.
  • An authentication infrastructure that includes Active Directory, DNS, and DHCP.
  • If you intend to use VMware App Volumes™, you must have the host name or IP address of the server on which App Volumes Manager is installed or will be installed. You will enter this information when you install the App Volumes Agent on the master VM image.

If you plan to create Horizon 7 desktop pools, ideally at this point you would also have Horizon 7 Connection Server installed and configured. We used Horizon 7 version 7.11. For installation instructions, see the Horizon 7 Installation guide.

Initial VM Creation

Create a Virtual Machine

Each desktop pool or RDSH server farm uses a master virtual machine (VM), which serves as the model for the deployed virtual desktops. You use VMware vSphere® Web Client to create the master VM.

Prerequisites

Before you complete this procedure, you will need the following:

  • Windows  ISO file – You must have uploaded an ISO file to a vSphere datastore. The ISO file must contain a supported version of the Windows operating system. You will point to this file when completing the New Virtual Machine wizard. For a list of the operating systems we tested, see Tested Operating Systems. For a complete list of supported Windows 10 operating systems, see the VMware knowledge-base article Supported versions of Windows 10 on Horizon Agent Including All VDI Clones (Full Clones, Instant Clones, and Linked Clones on Horizon 7) (2149393).

    Important: Use an OS version that has a Microsoft Windows volume license key using the Key Management Service (KMS). KMS treats each activated clone as a computer with a newly issued license. In a production environment, you must activate Windows. In an evaluation environment, you can create the VM and log in without activating Windows.
  • User account – When you log in to vSphere Web Client, the account you use must have the privileges required to create a VM. See the "Prerequisites" section of the product documentation topic Create a Virtual Machine with the New Virtual Machine Wizard.

1. Start the New Virtual Machine Wizard in the vSphere Web Client

  1. In vSphere Web Client, right-click a data center, cluster, host, or VM folder.
  2. Select New Virtual Machine.

2. Select the New Virtual Machine Creation Type

  1. Select Create a new virtual machine.
  2. Click NEXT.

3. Select a VM Name and Folder

  1. Provide a name in the Virtual machine name field.
  2. Select a location.
  3. Click NEXT.

4. Select a Cluster or Host

  1. Select a cluster or host as the compute resource.
  2. Click NEXT.

5. Select a Datastore for the VM

  1. Select a datastore or datastore cluster where you would like to store the VM.
  2. Click NEXT.

6. Select the vSphere Compatibility Level

  1. Select the lowest version of ESXi that this VM would be deployed to.
    Tip: See Hardware Features Available with Virtual Machine Compatibility Settings.
  2. Click NEXT.

7. Select the Windows Version and Architecture

  1. Select the Guest OS Version with the correct architecture (32- or 64-bit) and, when required, enable VBS. (Choose Microsoft Windows Server 2016 when deploying Server 2019)
  2. Click NEXT.

8. Specify Virtual Hardware Settings

  1. Select 2 CPUs. (This should be tested and adjusted to real production values later.)
  2. Select 2.5 GB of memory. (This should be tested and adjusted to real production values later.)
  3. Expand the Memory section.
  4. Select Reserve all guest memory (All locked).
  5. Choose an appropriate hard disk size.
  6. Scroll down if necessary.
  7. From the VM Network list, select the appropriate network.
  8. Expand New Network.
  9. Select VMXNET3.
  10. Select Datastore ISO File and browse to the Windows ISO file.
  11. Select Connect.
  12. Delete the New USB Controller.
  13. Expand the Video card section.
  14. Select the maximum Number of Displays that will be used.
  15. Use the following table to determine which number to enter in the Total amount of video memory field.

Note: The table that follows describes the small amount of RAM on the ESXi host that is required for video overhead in addition to system memory. This VRAM size requirement depends in on the display resolution and number of monitors configured for end users.

Display Resolution Standard Width, in Pixels Height, in Pixels 1-Monitor Overhead 2-Monitor Overhead 3-Monitor Overhead 4-Monitor Overhead
VGA 640 480 1.20 MB 3.20 MB 4.80 MB 5.60 MB
WXGA 1280 800 4.00 MB 12.50 MB 18.75 MB 25.00 MB
1080p 1920 1080 8.00 MB 25.40 MB 38.00 MB 50.60 MB
WQXGA 2560 1600 16.00 MB 60.00 MB 84.80 MB 109.60 MB
UHD (4K) 3840 2160 32.00 MB 78.00 MB 124.00 MB Not supported

Important: You are not yet finished with the Customize Hardware wizard page. Now that you have edited the virtual hardware settings, you can configure the VM options.

9. Specify VM Options

  1. Click the VM Options tab.
  2. Expand the Advanced section.
  3. Click EDIT CONFIGURATION.

Note: In the next step, you are going to disable the hotplug feature. With hotplug enabled, NICs and SCSI controllers appear as removable devices, and the Safely Remove Hardware option for the virtual hardware appears in the Windows System Tray (notification area). To prevent this option from appearing, you will disable the capability.

9.1. Disable the Ability to Add and Remove Virtual Hardware While the VM Is Running

  1. Click ADD CONFIGURATION PARAMS.
  2. For Name, type devices.hotplug, and for Value, type false.
  3. Click OK. You are returned to the Customize Hardware > VM Options tab of the wizard.
  4. Click NEXT on the wizard page.

10. Complete the Wizard

Click FINISH.

Install Windows

After you boot the VM, installation of the Windows OS begins automatically. You will accept most of the default settings and specify that you are doing a new installation rather than an update.

1. Open a Remote Console for the VM

  1. Select the newly created Windows VM in the inventory list.
  2. Launch a console for the VM by clicking either Launch Web Console or  Lauch Remote Console.
    Note: To launch a remote console, you must have downloaded and installed the VMware Remote Console. If necessary, you can click the "i" button to download and install it.

2. Power on the VM

Click the play icon.

3. Boot the VM from the Virtual CD

Press a key on your keyboard.

4. Select Settings for Your Region

  1. Select the correct regional options.
  2. Click Next.

5. Begin Installing Windows

Click Install now.

6. Select the Edition

This screen is only shown for an ISO that contains multiple editions.

  1. Select the Windows edition.

    Important: For Windows Server 2016/2019, select either of the following "Desktop Experience" editions:
    • Windows Server 2016 Standard (Desktop Experience)
    • Windows Server 2016 Datacenter (Desktop Experience)
    • Windows Server 2019 Standard (Desktop Experience)
    • Windows Server 2019 Datacenter (Desktop Experience)
  2. Click Next.

7. Accept the License Agreement

  1. Select the I accept the license terms check box.
  2. Click Next.

8. Select the Custom Installation

Select Custom: Install Windows only (advanced).

9. Use the Default Location

Click Next.

10. Monitor Installation Progress

Wait for Windows to be installed.

11. Enter Audit Mode by Pressing CTRL+SHIFT+F3

After the Windows operating system is installed, you need to enter audit mode.

The screen at which you enter audit mode depends on which Windows operating system you are using. For example, some operating systems will automatically log in to Windows after a restart operation, while others will prompt for user credentials.  If prompted, use Administrator for the user name and leave the password field blank.

When you are prompted with Let's start with a region or to Get going fast, or Personalize, or Customize Settings, or Setup Windows, press CTRL+SHIFT+F3 to switch to audit mode.

Note: Different Windows operating systems provide different prompts after the initial installation. The following screenshot shows the prompt after you install Windows 10 1803. You would press CTRL+SHIFT+F3 to switch to audit mode in Windows 10 1803 when you see this prompt.

The following screenshot shows the prompt after you install Windows Server 2016. You would press CTRL+SHIFT+F3 to switch to audit mode in Windows Server 2016 when you see this prompt.

Install VMware Tools

VMware Tools is a set of services and modules that enable several features in VMware products for better management of, and seamless user interactions with, guests operating systems.

For example, VMware Tools can run scripts that automate OS operations and can synchronize the time in the guest operating system with the time on the vSphere host. You must install VMware Tools in VMs used for desktop and application pools.

1. Use vSphere Web Client to Mount the VMware Tools Virtual DVD Drive

  1. Select the VM in the inventory list.
  2. Click Install VMware Tools, and click MOUNT when prompted. The VMware Tools installer is mounted to the virtual D: drive of the VM.

Alternatively, you can select the VM and select ACTIONS > Guest OS > Install VMware Tools.

2. Open a Command Prompt and Install VMware Tools

Go back to the console for the VM, and in the guest operating system, open a command prompt and run the following command:

d:\setup64.exe /s /v" /qb REBOOT=R ADDLOCAL=ALL REMOVE=Hgfs,SVGA,VSS,AppDefense,NetworkIntrospection"

This command uses the REMOVE option to remove the following modules:

  • Hgfs is the module for VMware shared folder drivers, which is not used with Horizon.
  • (Conditional) SVGA is the VMware SVGA driver, but a newer version will be installed by the Horizon Agent.
    Important: If this VM is to be used without installing the Horizon Agent, do not remove the SVGA module.
  • VSS is a driver used for Virtual Shadow Copies, which is not used with Horizon.
  • AppDefense is a driver/service used for AppDefense integrity monitoring, which is not used with Horizon.
  • (Conditional) NetworkIntrospection is a driver that sends network events to VMware NSX.
    Important: If you use NSX, do not remove the NetworkIntrospection module.

Install .Net Framework 3.5

Open a command prompt and run the following command:

DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:D:\sources\sxs

Install any required component that leverages Windows Update, such as C++ runtimes, Office, and so on.

Configure Windows Server Systems for VDI or RDSH

Complete this procedure if you are working with Windows Server 2016 or Windows Server 2019.

1. Enable Adobe Flash Player to Run

The command-line command you use varies slightly, depending on the operating system.

1.1. Enable Adobe Flash Player on Windows Server 2016

For Windows Server 2016, open a command prompt and enter the following command to enable Adobe Flash Player run.

Note: To display the command in this document, we had to add a line break after Packages\, but you should enter the command all on one line:

dism /online /add-package /packagepath:"C:\Windows\servicing\Packages\
Adobe-Flash-For-Windows-Package~31bf3856ad364e35~amd64~~10.0.14393.0.mum"

1.2. Enable Adobe Flash Player on Windows Server 2019

For Windows Server 2019, open a command prompt and enter the following command to enable Adobe Flash Player run.

Note: To display the command in this document, we had to add a line break after Packages\, but you should enter the command all on one line:

dism /online /add-package /packagepath:"C:\Windows\servicing\Packages\
Adobe-Flash-For-Windows-Package~31bf3856ad364e35~amd64~~10.0.17763.1.mum"

2. For Servers Used as a Remote Desktop Session Host, Install the RDS Role and RDSH Service

Follow this procedure if you are not planning to use the server as a single-user VDI machine, but are instead planning to use it as an RDSH server, to create published applications and published desktops. You will log in to the Windows Server OS, open Server Manager from the start menu, and complete the following steps.

2.1. Start the Add Roles and Features Wizard

  1. Select Dashboard.
  2. Click Add roles and features.
  3. In the wizard, for Installation Type, use the default selection, which is Role-based or feature-based installation.
  4. Follow the prompts to the Server Roles page.

2.2. Install the Remote Desktop Services Role for RDSH Servers

  1. Select Remote Desktop Services on the Server Roles page.
  2. Click Next, and click Next on the pages that follow until you come to the Role Services page.

2.3. Add the Remote Desktop Session Host

Select the check box for the Remote Desktop Session Host service, and confirm that you want to add the applicable management tools, before clicking Next.

2.4. Complete the Wizard

Follow the rest of the prompts, click Install on the Confirmation page, and close Server Manager.

Update Windows

Install the latest Windows OS updates.

1. Select the Update & Security Settings in Windows Settings

Press Windows Key+I, to open Windows Settings, and click Update & Security.

 

2. Select Check for Updates

Note: For non-LTSB Windows 10 versions, click Advanced options first and select Defer feature upgrades so that new features are not downloaded and installed. When a new feature upgrade has been available for more than 365 days, Microsoft offers wushowhidediag.cab, which allows you to hide the upgrade. Deferring feature upgrades does not affect security updates.

Click Check for updates and wait for the updates to be installed.

3. Restart the VM

Click Restart now. Run Windows Update again until no more updates are available and no restarts are required.

Installating Virtual Desktop Agents and Applications

Install Horizon Agent

If you plan to create VMware Horizon desktop or application pools, you must install Horizon Agent on the master VM so that VMware Horizon servers can communicate with and manage the desktops that you deploy. The Horizon Agent also communicates with VMware Horizon® Client™ on end users' computers to provide features such as connection monitoring, virtual printing, access to the local file system, and access to locally connected USB devices.

Prerequisites for Installing Horizon Agent

To perform this procedure, you need the following:

Important: If you install Horizon Agent on a Windows Server machine on which the Remote Desktop Services (RDS) role is not installed, the wizard will prompt you to Install VMware Horizon Agent in 'desktop mode'.

Selecting this option configures the Windows Server machine as a single-user virtual desktop rather than as an RDS host. If you intend the machine to function as an RDS host, cancel the Horizon Agent installation, install the RDS role on the machine, and restart the Horizon Agent installation.

1. Start the Horizon Agent Wizard

Log in to the OS of the master VM as an Administrator, and double-click the installer file to start the wizard, and click Next on the Welcome page.

2. Accept the License Agreement

Select I accept the terms in the license agreement, and click Next.

3. Select Whether to Use IPv4 or IPv6

Select the protocol, and click Next.

The environment must be either IPv6 only or IPv4 only. Horizon 7 does not support a mixed IPv6 and IPv4 environment.

4. Enable the USB Redirection Feature

Enable the USB Redirection feature, and click Next.

You can later control use of the feature by setting group policies or by using Horizon Smart Policies for granular control. For example, you can set a condition for the Smart Policy so that users can access USB devices only when connecting from inside the corporate network.

5. Disable Installation of the View Composer Agent

Because the View Composer Agent cannot be installed if you plan to install the Instant Clone Agent, disable the VMware Horizon View Composer Agent, and click Next.

6. Enable Installation of the Instant Clone Agent

Enable the VMware Horizon Instant Clone Agent, and click Next.

Instant Clone Technology enables single-image management with automation capabilities. You can rapidly create instant-clone desktop pools and automated RDSH server farms that contain thousands of VMs.

Note: Even though you install this feature, you can still use this master image to create full-clone desktop pools in addition to instant-clone desktop pools.

7. Disable the Persona Management Feature

Because the Persona Management feature cannot be installed if you plan to install the Instant Clone Agent, disable the VMware Horizon Persona Management feature, and click Next.

Note: For some operating systems, this component might not appear in the list.

8. Enable the Performance Tracker

Enable installation of the Horizon Performance Tracker, as well as any other features you might require, and click Next.

VMware Horizon Performance Tracker is a utility that runs in a remote desktop or RDSH server and monitors the performance of the display protocol and system resource usage.

Note: For a description of each of the features in the list, see Horizon Agent Custom Setup Options.

9. Enable the Remote Desktop Capability

If the Remote Desktop Protocol page appears, select Enable the Remote Desktop capability on this computer, and click Next.

This wizard page might not appear if you have already enabled this feature in Windows Firewall.

If you select the Do not enable the Remote Desktop capability on this computer option, you can manually enable the remote desktop feature later and configure the firewall exceptions.

10. Click Install

Now that all the correct components are configured to be installed, click Install.

11. Click Finish When Installation Is Complete

Click Finish to close the installer.

12. Restart the VM

When prompted to restart, click Yes.

Install the Dynamic Environment Manager Agent

Dynamic Environment Manager (formerly called User Environment Manager) provides profile management by capturing user settings for the operating system and applications. Unlike traditional application profile management solutions, Dynamic Environment Manager captures only the settings that the administrator specifies. This reduces login and logout time because less data needs to be loaded. User data is managed through folder redirection.

FlexEngine, the Dynamic Environment Manager agent component, applies the policies that the IT administrator creates with the Dynamic Environment Manager Management Console. To install this component, you run the same VMware Dynamic Environment Manager Setup wizard that you run to install the management console.

Note: Installing the Dynamic Environment Manager Agent is an optional step. Install this agent only if you plan to use this functionality.

Prerequisites for FlexEngine Installation

To perform this exercise, you need the following:

  • User account – When you log in to the OS to run the installer, the account you use must have administrative privileges.
  • Installer – If necessary, you can download the installer from the VMware Downloads page. The installer is an architecture-specific (x86 or x64) MSI file. You must download the file and copy it to the system where it will run or to a location accessible to the system.
  • Internet access – The installation process includes a certificate revocation check to verify the digital signature of the MSI file. This check requires Internet access.
  • VM with supported Windows OS – The machine must be running a supported Windows version. For a list of the systems we tested, see Tested Operating Systems. For a complete list of supported Windows 10 operating systems, see the VMware knowledge-base article Supported versions of Windows 10 on Horizon Agent Including All VDI Clones (Full Clones, Instant Clones, and Linked Clones on Horizon 7) (2149393).

Note: When you install the Dynamic Environment Manager agent on a VM where Horizon Agent is already installed, you are not required to specify a Dynamic Environment Manager license file. However, you are required to have purchased Dynamic Environment Manager. This component is included with Horizon 7 Enterprise Edition.

Running the Installer

To use the Dynamic Environment Manager wizard to install the agent, double-click the installer file and follow the prompts to perform a Typical Setup type of installation. The typical setup installs the VMware UEM FlexEngine agent component, along with the optional components: Application Migration and Self-Support.

Note: Because you are installing the Dynamic Environment Manager agent on a VM where Horizon Agent is already installed, you are not required to specify a Dynamic Environment Manager license file.

The product documentation for this procedure can be found in the Installing and Configuring VMware Dynamic Environment Manager guide.

Install the App Volumes Agent

App Volumes delivers applications that are not in the master VM image. Application containers, called AppStacks, are assigned to a user, group, OU, or machine and mounted each time the user logs in to a desktop. With this strategy, user changes can persist between sessions.

App Volumes can also provide user-writable volumes, which allow users to install their own applications and have those applications follow the user as they connect to different virtual desktops.

You install the App Volumes Agent on the master VM so that the App Volumes Manager can communicate with the desktops you deploy and attach the correct applications when a user logs in.

Note: Installing the App Volumes Agent is an optional step. Install this agent only if you plan to use this functionality.

Prerequisites for Installing the App Volumes Agent

To perform this exercise, you need the following:

  • User account – When you log in to the OS of the master image to run the installer, the account you use must have local administrative privileges.
  • Installer – App Volumes is included with Horizon 7 Enterprise Edition, available from the Download VMware Horizon page. The App Volumes installer is distributed as an ISO file. You can mount the ISO on the machine where you want to create the App Volumes component, or you can also extract the ISO contents to a shared folder. This option allows you to install each component without mounting the ISO each time.
  • VM with supported Windows OS – The machine must be running a supported Windows version. For a list of the systems we tested, see Tested Operating Systems. For a complete list of supported Windows 10 operating systems, see the VMware knowledge-base article Supported versions of Windows 10 on Horizon Agent Including All VDI Clones (Full Clones, Instant Clones, and Linked Clones on Horizon 7) (2149393).
  • App Volumes Manager server information – During agent installation, you will be prompted to enter the host name or IP address and port number of the App Volumes Manager that this agent will communicate with.

Running the Installer

To use the App Volumes Agent installation wizard to install the agent, double-click the installer file and follow the prompts.

Note: On the Server Configuration page, ensure that Disable Certificate Validation with App Volumes Manager is not selected.

The product documentation for this procedure can be found in the VMware App Volumes Installation Guide.

Install Applications in the Base Image

Although our primary application-delivery mechanism is App Volumes, it might be desirable to install select applications in the master VM so that all clones get those applications in their base disk.

Many applications have integrated auto-update functionality. Install these applications and update them to the latest version, and then turn off or disable the auto-update functionality to prevent the clones from updating individually.

Running the OS Optimization Tool to Optimize, Generalize, and Finalize the OS

Introduction to the OSOT

The VMware OS Optimization Tool (OSOT) fling helps optimize Windows 7/8/10 and Windows Server 2008 R2/2012/2016/2019 systems for use with Horizon 7. The OSOT includes customizable templates to enable or disable Windows system services and features, according to VMware recommendations and best practices, across multiple systems. Because most Windows system services are enabled by default, the OSOT can be used to easily disable unnecessary services and features to improve performance.

This release of the OSOT also includes the ability to run commonly used Windows tools for image creation and optimization, including the Native Image Generator (Ngen.exe), NTFS Compression (compact.exe), and Deployment Image Servicing Management (DISM.exe). These tools can now be run from the new Finalize tab of the OSOT.

Note: This version of this document does not include instructions for using Windows mandatory profiles. For more information, see the Changelog section of this guide, and see the blog post Announcing an Update to Creating an Optimized Windows Image for a VMware Horizon Virtual Desktop.

Analyze and Optimize the OS Using Customizable Templates

In this procedure, you download the OSOT, check for template updates, analyze the list of recommended optimizations, and select and apply those optimizations.

1. Download the OS Optimization Tool

VMware OS Optimization Tool | VMware Flings

Go to the VMware OS Optimization Tool page to download the zip file, extract the files to a non-profile location (for example c:\OSOT), and start the executable (VMwareOSOptimizationTool.exe).

2. Check for Updates to the Template

  1. To check for updates to the template for your Windows version, select the Public Templates tab.
  2. Select Update Only.
  3. If there is an update, click Update.
  1. Select the Analyze tab.
  2. Click Analyze.

4. Select Common Options

  1. Click Common Options.
  2. Click the Background tab.
  3. Select Set default background to solid color.
  4. Select a color.
  5. Click OK.

5. Select the Optimizations to Apply

  1. Select the appropriate optimizations from the extensive list. For most VDI environments, use the default selection. For Windows Server 2016 and Windows Server 2019, select Internet Explorer Enhanced Security.
  2. Click Optimize.
  3. Monitor the optimization results, and when the process is complete, close the VMware OS Optimization Tool, restart the VM, and launch the VMware OS Optimization Tool again.

Use the OSOT Generalize Tab to Run Sysprep

Generalizing a Windows image means removing computer-specific information so that the image can be deployed throughout an enterprise. Use the Generalize tab of the OSOT to run the system preparation tool (Sysprep) with a supplied and editable unattend.xml answer file.

1. Edit the Sysprep Answer File

  1. In the OSOT, click  the Generalize tab.
  2. Change the TimeZone and Locales values when needed.
  3. Click Generalize.

2. Click OK to Reboot

Click OK. After the VM has restarted, launch the OSOT again and analyze and optimize again as sysprep sets a few optimizations back to default.

Important: For Windows Server 2016 and Windows Server 2019, after restarting the machine, perform the following procedure:

  1. To log in, click on Administrator.
  2. When prompted to change the password, leave the password empty and login again.

Use the OSOT Finalize Tab to Perform Final Cleanup Tasks

The OSOT can now perform the following tasks, which you were previously required to do manually:

  • Clear KMS settings
  • Release the IP address
  • Delete unnecessary files

In this version of this document, we were able to remove the instructions for doing these tasks manually.

With the OSOT, you can now also use the Finalize tab to run the following tools:

  • Native Image Generator (Ngen.exe) - Improves the performance of managed applications.
  • NTFS Compression (compact.exe) - Save space on the Windows image by running the operating system and other system files from compressed files. This strategy reduces the number of IOPS required for storage with cache and has a negligible impact on the CPU.
  • Deployment Image Servicing Management (DISM.exe) - Cleans unused files from the Side by Side component store.

In this version of this document, we were able to remove the instructions for running these tools manually.

Execute Final Cleanup Tasks

  1. In the OSOT, click  the Finalize tab.
  2. Click  Execute.
  3. When all steps are completed, click OK .

Optimizing the Virtual Hard Disk

Zero-Out the Virtual Hard Disk

Running the Secure Delete tool with the -z option zeros-out free disk space.

1. Download and Run SDelete

Download the Sysinternal SDelete Tool and run the following command from a command prompt:

  • For 64-bit operating systems: sdelete64 -z c:
  • For 32-bit operating systems: sdelete.exe -z c:

Note: This command overwrites all empty disk space with zeroes so that we can shrink the VMDK (virtual machine disk file) later.

2. Shutdown

Run the following command:

shutdown /s /t 0 /c "Image Ready"

shutdown /s /t 0 /c "Image Ready" shuts down the local computer, with 0 seconds between the time the command is given and the time the shutdown occurs, and leaves the comment "Image Ready."

Remove Virtual Hardware Devices That You Do Not Plan to Use

Because we no longer need the virtual CD/DVD drive, we can remove that. Likewise, we can remove the SATA controller.

1. Open the Edit Settings Dialog Box

In the vSphere Web Client, right-click the VM and select Edit Settings.

2. Remove the CD/DVD Drive

  1. To remove the virtual CD/DVD drive from the VM, click the X that appears when you hover your pointer over CD/DVD drive 1 row.
  2. Click OK and edit the VM again.

3. Remove the SATA Controller

  1. To remove the virtual SATA controller from the VM, click the X that appears when you hover your pointer over the SATA Controller 0 row.
  2. Click OK.

Export the VM to Adjust Disk Size

If you used the same settings as shown in Specify Virtual Hardware Settings when you created the master VM, your VM has 40 GB of disk space. The storage usage of the VM can amount to the size of the disk as specified plus the amount of RAM.

Using the export/import process described in this section, we can select the thin-disk option and shrink the size of the VM according to the number of zeroes written during the procedure Zero-Out the Virtual Hard Disk.

1. Export to OVF (Open Virtualization Format)

  1. Using vSphere Web Client, right-click the VM in the inventory list, and select Template.
  2. Select Export OVF Template.
  3. In the Export OVF Template dialog box, select Enable advanced options.
  4. Select Include extra configuration.
  5. Click OK.

2. Delete the VM

Right-click the VM in the inventory list, and select Delete from Disk.

3. Deploy the OVF Template

Right-click on a VM folder, host, or cluster and select Deploy OVF Template.

4. Select the OVF Template You Just Exported

  1. Select Local file.
  2. Click on Browse and select all files you have just downloaded when exporting to OVF.
  3. Click NEXT.

5. Complete the Location and Compute Resource Pages

Click NEXT, choosing desired targets until you come to the Select Storage page.

6. Specify a Storage Option That Uses Thin Provisioning

  1. When using storage without Storage Policies, select Thin Provision; otherwise, select a VM Storage Policy that has Thin Provisioning.
  2. Click NEXT on this page and on the Select Networks page, and click FINISH on the Ready to Complete page.

7. Verify the Storage Savings

For example, in this screenshot, the value for Storage usage is 7.72 GB. The VM Summary tab from the screenshot at the beginning of this section, before the VM underwent the export/import process, showed 44.02 GB.

Preparation for Deployment

Take a VM Snapshot

To create a desktop pool of cloned VMs, or to create a farm of cloned RDSH server VMs, you need to create a frozen state, or base image, from which the clone can be derived.

  • For instant-clone pools and server farms, and for linked-clone pools, you achieve this state by taking a VM snapshot of the master VM.
  • For full-clone pools, you achieve this state by cloning the master VM to a VM template.

This procedure describes taking a VM snapshot. For information about cloning a VM to a VM template, see Clone a Virtual Machine to a Template.

Prerequisites for Taking a Snapshot

Although it is possible to take a snapshot of a VM that is powered on, for the purposes of creating a base image for a Horizon 7 desktop pool or server farm, the VM must be shut down and powered off.

1. Open the Take Snapshot Dialog Box

  1. Using vSphere Web Client, right-click the VM in the inventory list, and select Snapshots.
  2. Select Take Snapshot.

2. Take the Snapshot

  1. Provide a descriptive name; for example, the name might include the date of the snapshot.
  2. Click OK.

Create OUs and User Groups in Active Directory

Much of the initial configuration and ongoing management of virtual desktops, RDSH server farms, feature enablement, and end-user experience is performed by creating and applying group policies in Active Directory. Some standard Microsoft Group Policy Object settings are required to configure virtual desktops and applications, as described later in this guide.

If you use Horizon 7, you can also use VMware-provided GPO administrative templates for fine-grained control of access to features. See Using Horizon 7 Group Policy Administrative Template Files.

OUs for VMs

You should create an organizational unit (OU) specifically for your virtual desktops and an OU for your RDSH server VMs. An OU is a subdivision in Active Directory that contains users, groups, computers, or other OUs.

To prevent group policy settings from being applied to other Windows servers or workstations in the same domain as your desktops or server farms, you can create a GPO for group policies and link it to the OU that contains your VMs. 

You can also delegate control of the OU to subordinate groups, such as server operators or individual users.

User Groups

You should also create groups for different types of users in Active Directory. For example, you can create a group called  End Users for your end users and another group called Horizon Administrators for users that will administer virtual desktops and applications.

Later in this guide, you will add a user group containing end users to the local Remote Desktop Users group in AD. Then members of the group will be able to connect to any VM that is joined to the domain.

Set Other Common Group Policies

For both virtual desktop VMs and RDSH server VMs, create a GPO for the OU in Active Directory, and use the Group Policy Management Editor to apply the following GPO settings.

Setting Value
Computer Configuration > Policies > Administrative Templates > System
     Display highly detailed status messages 
Enabled
Computer Configuration > Policies > Administrative Templates > System > Group Policy
Configure user Group Policy loopback processing mode
Enabled
Set Mode to Replace
 
Configure Logon Script Delay
Disabled
Computer Configuration > Policies > Administrative Templates > System > Logon
Show first sign-in animation
Disabled
Always wait for the network at computer startup and logon
Enabled

Disable the Local Administrator User Account

Next, edit the GPO to disable the local administrator account.

2. Create a New Policy for a Local User Account

  1. Click New.
  2. Click Local User.

3. Specify New Properties for the Administrator Account

  1. Select Administrator (built-in).
  2. De-select User must change password at next logon.
  3. Select Account is disabled.
  4. Click  OK.

If you use Horizon 7, you can also use VMware-provided GPO administrative templates for fine-grained control of access to features. See Using Horizon 7 Group Policy Administrative Template Files.

Set Policies for RDSH Server VMs

If you plan to use the image for creating RDSH server VMs, create a GPO for the RDSH server OU in Active Directory, and use the Group Policy Management Editor to apply the following GPO settings.

Setting Value
Computer Configuration > Policies > AdministrativeTemplates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Licensing
 
Use the specified Remote Desktop license server
Enabled
(Comma-separated list of license servers to use)
 
Set the Remote Desktop license mode
Enabled
(Choose the correct Per Device or Per User mode for your CALs)
Computer Configuration > Policies > Administrative Templates > System > User Profiles
Delete cached copies of roaming profiles
Enabled

If you use Horizon 7, be sure to review the VMware-provided administrative templates for RDSH server management. See Using Remote Desktop Services Group Policies.

Add Users to the Local Remote Desktop Users Group

To connect to a remote desktop or RDSH server, users must belong to the local Remote Desktop Users group of the virtual desktop or RDSH server. You can use the Restricted Groups policy in Active Directory to add users or groups to the Remote Desktop Users group.

The members of the Remote Desktop Users group are always added to the local Remote Desktop Users group of every virtual desktop or RDSH server that is joined to your domain. When adding new users, you need only add them to the Remote Desktop Users group.

Prerequisites for Adding Users to the Restricted Groups Policy

Before you can perform the procedure in this article, you must have created one or more user groups in Active Directory that contain the end users who will connect to the virtual desktops and RDSH servers.

1. Open Group Policy Management

On the domain controller (AD machine), click the Start button, and navigate to Windows Administrative Tools > Group Policy Management.

2. Edit the Default Domain Policy

  1. Expand your domain.
  2. Right-click Default Domain Policy.
  3. Select Edit.

3. Open the Add Group Dialog Box

  1. In the Group Policy Management Editor, expand Computer Configuration.
  2. Expand Windows Settings.
  3. Expand Security Settings.
  4. Right-click Restricted Groups.
  5. Select Add Group.

4. Add the Remote Desktop Users Group

  1. In the Add Group dialog box, enter Remote Desktop Users.
  2. Click OK.

5. Add User Groups to the Remote Desktop Users Group

  1. Right-click the Remote Desktop Users group that you just added to Restricted Groups.
  2. Select Properties.
  3. Click Add.
  4. Add a group of end users.
  5. Click OK in the Add Member dialog box.
  6. Click OK in the Remote Desktop Users Properties dialog box.

Turn Off Hardware Graphics Acceleration in Commonly Used Applications

If the VMs are not using a physical GPU in the ESXi hosts, you can reduce CPU usage by not emulating hardware graphics in applications. We recommend using Dynamic Environment Manager configuration files to control these application settings.

For more information about having VMs use physical GPUs, see Deploying Hardware-Accelerated Graphics with VMware Horizon 7.

1. Internet Explorer

  1. To turn off hardware graphics acceleration for Internet Explorer, open the Internet Options dialog box by clicking the Tools icon and selecting Internet Options.
  2. Click the Advanced tab.
  3. From the Accelerated graphics list, select Use software rendering instead of GPU rendering.
  4. Click OK.

2. Microsoft Office

  1. To turn off hardware graphics acceleration for Microsoft Office, open the Options dialog box by selecting File > Options in the application (in this example, Microsoft Word).
  2. Select Advanced.
  3. Scroll down to the Display section.
  4. Select Disable hardware graphics acceleration.

3. Adobe Reader

  1. To turn off hardware graphics acceleration and disable other CPU-intensive display options for Adobe Reader, open the Preferences dialog box by selecting Edit > Preferences.
  2. Select Page Display.
  3. In the Rendering section, deselect the following options:  
    • Smooth imaging
    • Smooth line art
    • Use page cache
    • Enhance thin lines
  4. In the Page Content and Information section, deselect Use smooth zooming.

For more information, see the Adobe documentation about General Application Settings in the Windows Registry.

4. Google Chrome

  1. To turn off hardware graphics acceleration for Chrome, navigate to chrome://settings.
  2. Scroll down to the System section, and turn off Use hardware acceleration when available.

Day-2 Updates

Update VMware Tools

When new versions of VMware Tools are released, use this procedure to update VMware Tools in the master image. The advanced options mentioned in the last step are the same ones you used when installing VMware Tools for the first time.

1. Open the Edit VM Settings Dialog Box

Make sure the VM is powered off and then use vSphere Web Client to:

  1. Right-click  the VM.
  2. Select Edit Settings.

2. Add a Virtual CD/DVD Drive Back to the VM

  1. Click ADD NEW DEVICE.
  2. Select CD/DVD Drive.
  3. Click OK.

3. Power On the VM

  1. Right-click  the VM.
  2. Select Power.
  3. Select Power On.

4. Click Upgrade VMware Tools on the Summary Tab

On the Summary tab for the VM, click Upgrade VMware Tools.

5. Use the Automatic Upgrade with Advanced Options

  1. Select Automatic Upgrade.
  2. Type the line in the block below as Advanced Options.
  3. Click on UPGRADE.
/s /v" /qb REBOOT=R ADDLOCAL=ALL REMOVE=Hgfs,SVGA,VSS,AppDefense,NetworkIntrospection"

This command uses the REMOVE option to remove the following modules:

  • Hgfs is the module for VMware shared folder drivers, which is not used with Horizon.
  • (Conditional) SVGA is the VMware SVGA driver, but a newer version will be installed by the Horizon Agent.
    Important: If this VM is to be used without installing the Horizon Agent, do not remove the SVGA module.
  • VSS is a driver used for Virtual Shadow Copies, which is not used with Horizon.
  • AppDefense is a driver/service used for AppDefense integrity monitoring, which is not used with Horizon.
  • (Conditional) NetworkIntrospection is a driver that sends network events to VMware NSX.
    Important: If you use NSX, do not remove the NetworkIntrospection module.

Update Windows

If you have followed the instructions in this guide and used the OSOT as directed, some of the Windows Update facilities have been disabled. Before you can update Windows, you must re-enable Windows Update. After you update Windows, the best practice is to run the OSOT again.

1. Re-enable Windows Update

On the guest operating system of the master image, open a command prompt as administrator and run the following commands:

REG DELETE HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate /f
SC CONFIG wuauserv start= demand
SC START wuauserv
gpupdate
usoclient StartScan

2. Update Windows

To update Windows, follow the same instructions you used in the Update Windows procedure, from the Initial VM Creation chapter.

Conclusion

In Conclusion

With the image optimization procedures in this guide, you are able to achieve a significant reduction in the amount disk space, CPU, and memory used by virtual desktop and RDSH server VMs and their vSphere hosts. The result is a corresponding savings in initial deployment time, user logon times, and IOPS.

Image optimization techniques included:

  • Disabling unneeded Windows services and features
  • Deleting unnecessary files and folders, such as event logs and temporary files
  • Compressing OS files
  • Zeroing out free disk space and shrinking the disk

Using the VMware OS Optimization Tool fling greatly simplifies many of these tasks.

This guide also provided step-by-step instructions for configuring the Windows image to perform optimally in a virtual environment, where CPU cores are shared among many VMs, and where users might be accessing a new VM every time they log in, though they probably will not realize it.

Nineteen discreet versions of the Windows OS were tested using the procedures in this guide, including 15 versions of Windows 10.

The procedures in this guide help you create an optimized Windows image that you can use in a VMware Horizon implementation or in other types of deployments. End users will have a great experience, whether they access their personalized virtual desktops or remote applications from company laptops, their home PCs, thin client devices, Macs, tablets, or smartphones.

Additional Resources

Changelog

The following updates were made to this guide.

Date Description of Changes
2020-01-30
  • Removed Windows 7/8.1, Server 2012R2, Windows 10 1709/1803 Pro from the list of tested operating systems.
  • Added Windows Server 2019 and .Net Framework 3.5.
  • Retested all operating systems with 2020-01-14 updates.
  • Added a new chapter for day-2 updates for VMware Tools and Windows Update.
  • Added new sections that correspond to the Generalize and Finalize tabs of the OS Optimization Tool (January 2020 release), and removed the procedures that told how to do these tasks manually.
2019-10-10
  • Removed mention of Windows mandatory profiles because this feature does not work reliably when used with Windows 10 version 1809 and later. Also, we found that login times are nearly equivalent if you use default user profiles instead of mandatory user profiles.
  • Removed the section "Configure Local Group Policies" because this task is now done by the OS Optimization Tool (as of the September 2019 release).
  • Renamed User Environment Manager to Dynamic Environment Manager.
  • Updated links to product documentation topics.

Authors and Contributors

Hilko Lantinga is a Staff End-User Computing Architect in VMware Technical Marketing, with a focus on 3D, Horizon Windows Desktops and RDSH, Linux, and Applications. Previously, he was a Senior Consultant in VMware Professional Services, leading large-scale EUC deployments in EMEA and has over 18 years of experience in end-user computing.

Caroline Arakelian is a Senior Technical Marketing Manager, End-User-Computing Technical Marketing, VMware.

The following people contributed to the review of this paper:

  • Graeme Gordon, Senior Staff End-User-Computing (EUC) Architect in End-User-Computing Technical Marketing, VMware
  • Jim Yanik, Senior Manager, End-User-Computing Technical Marketing, VMware

To comment on this paper, contact VMware End-User-Computing Technical Marketing at euc_tech_content_feedback@vmware.com.

Filter Tags

  • Horizon
  • Intermediate
  • Operational Tutorial
  • Document
  • Horizon 7
  • Horizon Apps
  • Horizon Cloud Service
  • Windows 10
  • Deploy
  • App & Access Management
  • Modern Management
  • Windows Delivery