2V0-51.23 VMware Horizon 8.x Professional Questions and Answers

In VMware Horizon, predefined roles such as Inventory Administrators and Desktop Pool Administrators are designed to provide granular access control within the Horizon Console. Inventory Administrators typically have permissions related to managing the overall inventory of virtual desktops and applications, whereas Desktop Pool Administrators are specifically focused on managing and configuring desktop pools, including their settings, assignments, and provisioning.

When configuring a virtual machine to use an NVIDIA graphics card, issues such as the VM not starting can occur if there is no suitable host available that meets the requirements for 3D graphics, or if not all memory required by the 3D graphics card has been reserved for the VM. Ensuring that the host has the necessary 3D graphics capabilities and that the VM is configured with reserved memory can resolve these issues.

One of the benefits of using virtual machines is that they are independent of physical hardware. This means that they can run on any compatible host machine, regardless of the underlying hardware components. This also enables them to be migrated, moved, or copied easily from one host to another, without requiring any reconfiguration or installation. This enhances the flexibility and portability of virtual machines, as well as their availability and disaster recovery.

Another benefit of using virtual machines is that they are faster to provision than physical machines. This is because they can be created from templates or snapshots, which contain preconfigured operating systems and applications. This reduces the time and effort needed to install and configure software on each machine. Moreover, virtual machines can be cloned or duplicated quickly, allowing for rapid scaling and deployment of multiple identical instances.

References :=

• Virtual Machines Overview
• Creating and Provisioning Virtual Machines
• Migrating Virtual Machines

To correctly sequence the TLS Certificate Configuration Steps:

• Get a new signed TLS certificate from a CA. Before making any modifications or importing the certificate, you'll first need to obtain a new signed TLS certificate from a Certificate Authority (CA). So, this should be Step 1.
• Import the TLS certificate into the Windows local computer certificate store. After obtaining the new signed TLS certificate, the next logical step is to import this certificate into the Windows local computer certificate store. This would be Step 2.
• Modify the certificates/ friendly names to vdm and reflect the current active certificate. Once the certificate is imported, the next step is to modify its friendly names to ensure the Horizon Service recognizes and uses this certificate. This becomes Step 3.
• Restart Horizon Service. Finally, after all the modifications and configurations are done, you should restart the Horizon Service to apply the changes. This is Step 4.

In summary:

To entitle users and groups to pools, you need to perform the following steps:

• During pool creation in the entitlement pane, click on add, search for users and groups in the Active Directory, continue and finish the pool creation. This option allows you to entitle users and groups to a desktop or application pool at the same time as you create the pool3.
• Navigate to Inventory > Desktops > check mark a pool > click on Add Entitlement. This option allows you to add entitlements to an existing desktop or application pool after you create the pool4.
• Navigate to Users and Groups > Entitlements > click on Entitlements > click on Add Entitlements, search for users and groups in the Users pane and add the desired desktop pool in the next pane Desktop Pools. This option allows you to review and manage the entitlements for users and groups from a single location5.

The other options are not required or valid for entitling users and groups to pools. Running the Active Directory entitlement script in the golden master is not necessary as Horizon 8 automatically synchronizes with Active Directory domains that are configured in Horizon Console6. Specifying the desired Active Directory OU for the VMs during pool creation does not automatically add the preconfigured associated user group to the Horizon entitlements as you still need to select the users or groups from the search results7. References := 3: VMware Horizon 8 Documentation: Add Entitlements During Pool Creation 4: VMware Horizon 8 Documentation: Add Entitlements After Pool Creation 5: VMware Horizon 8 Documentation: Review and Manage Entitlements 6: VMware Horizon 8 Documentation: Active Directory Requirements for Horizon Connection Server 7: VMware Horizon 8 Documentation: Create an Automated Desktop Pool

The two options that are available for the administrator to make the shortcut available to all desktop pool users, while minimizing ongoing administrative effort, before updating the desktop pool golden image are:

• Copy the shortcut to c:\users\Public\Desktop. This option will place the shortcut in the public desktop folder, which is shared by all users who log on to the same computer. The public desktop folder is normally a hidden folder, so the administrator needs to enable the option to show hidden files and folders in File Explorer1. This option does not require any additional software or configuration, but it will only work for the existing desktops in the pool. If new desktops are added or refreshed, the shortcut will not be copied automatically.
• Configure a Shortcut with DEM (Dynamic Environment Manager). This option will use the DEM console to create a shortcut configuration that will apply the shortcut to the user’s desktop during logon2. The administrator needs to install and configure DEM on the Horizon environment, and create a configuration share and a profile archive share for storing the DEM settings3. This option requires more initial setup, but it will work for any desktop in the pool, regardless of whether it is new or refreshed. It also allows more flexibility and control over the shortcut properties and conditions.

The other options are not valid or feasible because:

• Copying the shortcut during user provisioning to a non-writeable App Volume will not work because App Volumes are used to deliver applications, not shortcuts. App Volumes are virtual disks that are attached to the virtual machines at runtime, and they contain application files, registry entries, and settings4. Copying a shortcut to an App Volume will not make it appear on the user’s desktop.
• Copying the shortcut to the Windows Default Domain Controller Policy will not work because this policy is used to configure settings for domain controllers, not desktops. The Default Domain Controller Policy is a Group Policy Object (GPO) that is linked to the Domain Controllers organizational unit (OU) in Active Directory, and it contains security settings that are applied to all domain controllers in the domain5. Copying a shortcut to this policy will not affect any desktops in the Horizon environment.
• Configuring a Shortcut with Horizon View Client will not work because Horizon View Client is used to connect to remote desktops and applications, not to create shortcuts. Horizon View Client is a software application that runs on various devices and platforms, and it allows users to access their virtual desktops and applications through a secure connection6. Configuring a shortcut with Horizon View Client will not make it appear on the user’s desktop.

References:

• How to make a desktop shortcut available for all users in Windows 101
• VMware Dynamic Environment Manager (DEM) 2306 – Carl Stalhood2
• VMware Tech Zone Antivirus Considerations in a VMware Horizon Environment: exclusions for Horizon View, App Volumes, User Environment Manager, ThinApp3
• App Volumes Overview
• Default Domain Controller Policy5
• VMware Horizon Clients Documentation6

JPEG/PNG - Still images.

H.264: Rapidly moving content and motion graphics such as streaming video, video editing, and gaming.

HEVC: Rapidly moving content on a low bandwidth resource.

Proprietary Blast codec: Low-motion graphics, high-quality graphics such as Photoshop, and AutoCAD.

VMware Horizon's Dynamic Environment Manager (DEM) allows for the creation of Horizon Smart Policies with conditions that can be applied based on various criteria, including time of day. By utilizing DEM, an administrator can create policies that restrict certain actions, such as saving data to client devices, outside of specified business hours (5PM to 9AM in this case), thus achieving the desired control over user activities based on the time of day.

The minimal level of Horizon Console access that the IT support center would need to help with Horizon desktop user issues is the Help Desk Administrators role. This role allows the IT support center to view and troubleshoot user sessions, reset user passwords, send messages to users, and perform other help desk tasks. The Help Desk Administrators role can be assigned to users or groups on any access group that contains the desktop pools or farms that the IT support center needs to support.

The other options are not the minimal level of Horizon Console access for this scenario:

• Local Administrators: This role allows full administration rights on a specific access group and its sub-access groups. This role can perform all the tasks of the Help Desk Administrators role, as well as create, edit, and delete desktop pools, farms, applications, entitlements, and other objects. This role is more than what the IT support center needs to help with user issues.
• Global Help Desk Administrators: This role allows full administration rights on all access groups in the Horizon environment. This role can perform all the tasks of the Local Administrators role, as well as create, edit, and delete access groups and global entitlements. This role is more than what the IT support center needs to help with user issues.
• Inventory Administrators: This role allows limited administration rights on a specific access group and its sub-access groups. This role can view and manage desktop pools, farms, applications, entitlements, and other objects, but cannot create or delete them. This role can also perform some help desk tasks, such as viewing user sessions and sending messages to users, but cannot reset user passwords or troubleshoot sessions. This role is not sufficient for what the IT support center needs to help with user issues.
• Administrators: This role allows full administration rights on all access groups in the Horizon environment, as well as global settings, licensing, roles and permissions, events configuration, and other system-wide settings. This role can perform all the tasks of the other roles, as well as configure and manage the Horizon infrastructure. This role is more than what the IT support center needs to help with user issues.

References: Understanding Permissions and Access Groups and [VMware Horizon 8.x Professional Course]

To enable the Senior Administrator's team, which is part of the "Horizon View Operators" AD group, to connect to vCenter and update the golden image, the Senior Administrator needs to assign the appropriate permissions in the vSphere Client. By adding the group to the vCenter Server with the necessary roles and privileges, members of the "Horizon View Operators" group will be able to access and modify the VMs required for maintaining the desktop pools in the VMware Horizon environment.

C:\Users\Waqas Shahid\Desktop\Mudassir\Untitled.jpg

VMware Horizon's Dynamic Environment Manager (DEM) is designed to provide a consistent and personalized desktop experience for users across different sessions and desktops. DEM manages user profiles and policies dynamically, ensuring that user settings, preferences, and application configurations are consistent no matter which desktop a user connects to, thus meeting the requirement for a uniform desktop experience.

VMware vCenter Server is the central management component for ESXi servers, allowing administrators to manage multiple ESXi hosts and virtual machines (VMs) from a single console. It provides essential management capabilities, including resource allocation, performance monitoring, and centralized access control, making it the cornerstone for managing a VMware virtualized infrastructure.

A black screen when connecting to a Horizon virtual desktop can be caused by various reasons, such as network issues, hardware issues, Horizon tunnel issues, or underlying guest operating system issues. Based on the options given, the following could be the cause of the issue:

• A vRAM shortage on the Horizon virtual machine. This can affect the display performance and cause a black screen or a disconnect. To resolve this issue, you should configure the pool to provide enough video memory for the resolutions you plan to present to the clients1.
• The incorrect video driver version installed on the Horizon virtual machine. This can cause compatibility issues and prevent the display protocol from working properly. To resolve this issue, you should verify that the View desktop is using the correct video driver and that it is compatible with the VMware Tools and Horizon Agent versions installed23.
• An incorrect firewall configuration. This can block or misroute the display protocol traffic and cause a connection failure. To resolve this issue, you should verify that the required ports are open between the client, UAG/Security server/Connection server, and VDI machine4 .

The other options are not likely to cause a black screen when connecting to a Horizon virtual desktop:

• The client machine video memory is too high. This should not affect the display protocol performance or cause a black screen. The client machine video memory is only used to render the display on the local device, not on the remote desktop.
• The Horizon virtual machine video memory is too high. This should not cause a black screen or a disconnect either. The Horizon virtual machine video memory is used to allocate resources for the display protocol on the server side, not on the client side.

References:

• Dual monitors configured using PCoIP does not span both the monitors for VMware View and Connecting to a VDI desktop with PCoIP displays a black screen and disconnects after 10 seconds
• Error attaching to SVGADevTap, error 4000: EscapeFailed reported by PCoIP server
• Interoperability Matrices
• Configuring PCoIP Secure Gateway in VMware View
• [Network Ports in VMware Horizon]

On a VMware vCenter managed virtual machine, the VMware Horizon Agent knows which Connection Server it should register with during the Instant Clone pool creation process by querying VMware Tools for a Guestlnfo Variable during the cloning process. The Guestlnfo Variable is a custom property that is set on the parent virtual machine and contains the FQDN of the Connection Server. When the parent virtual machine is cloned, the Guestlnfo Variable is copied to the clone and read by the Horizon Agent. The Horizon Agent then registers with the Connection Server specified in the Guestlnfo Variable12.

The other options are not correct for this scenario:

• Administrator provides this information in the “Add Pool” creation wizard. This option is not correct because the administrator does not need to provide the Connection Server information in the “Add Pool” creation wizard. The administrator only needs to select the vCenter Server, data center, cluster, resource pool, datastore, network, and snapshot of the parent virtual machine. The Connection Server information is already embedded in the parent virtual machine as a Guestlnfo Variable3.
• Horizon Agent retrieves this information from an DNS SRV record. This option is not correct because the Horizon Agent does not use DNS SRV records to find the Connection Server during the Instant Clone pool creation process. DNS SRV records are used by Horizon Client devices to discover Connection Servers when they connect to a Horizon environment. DNS SRV records are optional and can be configured by the administrator to simplify client connections4.
• Administrator provides this information in the Horizon Agent Installation Wizard on the master image. This option is not correct because the administrator does not need to provide the Connection Server information in the Horizon Agent Installation Wizard on the master image. The administrator only needs to select the features and options that are required for the desktop pool, such as VMware Horizon Instant Clone Agent, VMware Dynamic Environment Manager, VMware App Volumes, and so on. The Connection Server information is set on the master image after it is converted to a parent virtual machine by using a PowerShell script5.

References:

• Instant Clones: How Does It Work?
• Instant Clone Domain Administrator Account
• Create an Automated Instant-Clone Desktop Pool
• Configuring DNS Service Records for Horizon Connection Server
• Install Horizon Agent on a Virtual Machine
• [VMware Horizon 8.x Professional]
• [VMware Horizon Architecture Planning]

Roles and permissions are a way of controlling the access and actions of administrators and users in Horizon. By default, Horizon provides two predefined roles: Administrators and Read Only Administrators. However, a high-level administrator can create custom roles with specific privileges to suit different needs and scenarios. To create a custom role, the administrator needs to follow these steps:

• In the navigation pane under the Settings section, click on Administrators > Roles and Permissions.
• In the Roles and Permissions page, click on Add.
• In the Add Role pane, enter a name for the role in the Role Name text box.
• In the Privileges section, select the checkboxes for the privileges that you want to assign to the role. You can expand or collapse the categories to view or hide the sub-privileges. You can also use the Select All or Deselect All buttons to select or clear all the privileges in a category.
• Click on Save to create the custom role.

The custom role will appear in the Roles and Permissions page, where you can edit or delete it as needed. You can also assign the custom role to users or groups in the Users and Groups page. References: [Create Custom Roles] and [VMware Horizon 8.x Professional Course]

To deploy a RDS desktop pool with the new standard of Windows Server 2019, the steps should be ordered as follows:

• Prepare the Windows Server 2019 golden image. This is the first step because you'll need a prepared OS image to base your RDS desktop pool on.
• Add an Automated Farm. Once your golden image is ready, you can set up an automated farm for the RDS desktop pool.
• Add a RDS desktop pool. Using the automated farm and the prepared golden image, you can now add the RDS desktop pool.
• Entitle AD users and/or groups. With the RDS desktop pool in place, the next step is to give Active Directory (AD) users and groups the necessary entitlements to access the desktops.
• Launch Horizon Client and verify access to RDS desktop. As the final verification step, launch the Horizon Client to ensure that you can access the newly created RDS desktop pool and that everything is functioning as expected.

So, the sequential order is: Prepare the Windows Server 2019 golden image -> Add an Automated Farm -> Add a RDS desktop pool -> Entitle AD users and/or groups -> Launch Horizon Client and verify access to RDS desktop.

Global Entitlements in VMware Horizon allow for the aggregation of resources across multiple pods and sites into a single entitlement. This feature is particularly beneficial when publishing applications that are hosted across different pods, as it ensures that users see only one icon for the application, regardless of which pod it is hosted on, simplifying the user experience and administration of applications in a multi-pod Horizon environment.

C:\Users\Waqas Shahid\Desktop\Mudassir\Untitled.jpg

The issue described indicates that the Horizon Connection Server is incorrectly handling traffic that should be directed to the Unified Access Gateway (UAG) and then to the VDI desktops. Disabling the Tunnel and Gateways settings on the Horizon Connection Server forces the UAG to handle the Blast traffic directly, ensuring that the connections are made to the VDI desktops' IP addresses, thus resolving the black screen and disconnection issue.