On May 24, 2021, I published the Building Webster’s Lab V2 article series that used vSphere/vCenter 7.0 original release and XenServer 8.2.0.

This is a follow-up on building the lab with vSphere/vCenter 7.0U3L and XenServer 8.2.1.

Why didn’t I use vSphere/vCenter 8? Neither my hardware nor Synology units support vSphere 8. There is a change I can make to an install file to bypass the hardware compatibility check, but I would rather not risk it. It took Synology a long time to add vSphere 7 support, so I have no idea how long before they add support for vSphere 8.

I need to rebuild the lab because something terrible happened after powering down the lab for an extended weekend. When I powered on the lab after returning to the lab the following Monday, the vSphere servers would not connect to local storage and NFS storage, nor connect to any switches or networking.

Read the rest in the PDF…

You can always find the most current PDF by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

I am NOT retiring. I jokingly say that my boss, the CEO of Flexxible, says he will let me retire when he gets a certified copy of my death certificate! LOL

Citrix Technology Professional (CTP) Neil Spellings and I are working on the details for him to host the downloads page. All the downloads are still available. The current download links should never expire unless ShareFile expires all my links again.

All the scripts and some other files are on GitHub, so you should have no problem accessing any of the PowerShell scripts.

I hope someone steps up and maintains at least the Citrix Virtual Apps and Desktops V3 and the Citrix Cloud documentation scripts. The other scripts have had no reported issues or feature requests in a long time, so I assume they are mature and stable.

I have enjoyed serving various computer, programming, and EUC communities for the past 47 years. The last week of March and the first week of April 2023 are my last planned in-person EUC community events. I have CTP meetings, followed by Citrix User Group Community (CUGC) Southwest (and my last planned in-person Active Directory (AD) Masterclass), followed by the EUC Masters Retreat, followed by IGEL Disrupt Nashville, and finally, CUGC Nashville. All those events make for a brutal 12 days.

If you see me at any of those events, please come up and say hi and let’s get our picture made one last time.

I want to thank everyone that mentored me over the past 47 years.

• Bob Welch (not that Bob Welch) had the unfortunate experience of taking me under his wing and teaching me about IBM System 360/370 mainframes.
• Mr. Spivey, probably THEE most senior IBM Field Engineer I watched working his magic on the insides of IBM Mainframes. He loaned me several books and audio training courses on how mainframe computers worked on a deep internal basis.
• Brad Choate is among the most gifted software developers I have ever met. He was 20+ years my junior, but his code-writing skills were something I admired. I was in awe of his skill and how fast he could type.
• Andrew S. Baker was the first person who helped me learn AD and DNS design.
• Brian Desmond, who probably answered hundreds of my emails since 2001 about AD and has forgotten more about AD than I ever knew or understood.
• Michael B. Smith, I consider my #1 mentor in AD, DNS, servers, design, PowerShell, SQL, and technical writing. I still abide by his first criticism of my first blog articles: “Don’t assume knowledge the reader may not have”.
• Jo Harder, a fellow CTP, helped me become a better public speaker and writer. She helped me reduce the verbal ticks used when speaking (basically, you know, right, and umm, among others).
• Guy Leech, the master of PowerShell, who, for some reason, doesn’t have an email rule to send my emails to /dev/null.

I have met some freakishly smart people in the EUC community.

• Andrew Morgan
• Benny Tritsch
• Claudio Rodrigues
• Hamilton Moore
• Jarian Gibson
• Jim Moyle
• Joe Nord
• Joe Shonk
• Nicholas Cookendorfer
• Patrick Coble
• Remko Weijnen
• Shane Kleinert
• Shawn Bass

I want to thank Laura Whalen for giving me a skill that has become a great asset in my Lions Clubs service, public speaking. In 2012, the CTPs were “forced” to submit session topics for Synergy 2012 in San Francisco. I submitted a topic I was 100% sure would not get accepted, 10 ways Active Directory can hurt XenDesktop or XenApp and how to fix them. When I received the acceptance email, I threw up! I immediately emailed Laura and told her to please rescind the acceptance and find someone else to speak. I didn’t know how to speak publicly, much less how to put together a slide deck. She refused and said I had to speak. Well, the rest is history. I have given that presentation at least 20 times since and at conferences and for customers in the United States, Belgium, Denmark, England, Germany, Italy, Norway, Oman, Portugal, Spain, Sweden, and the United Arab Emirates. Because of Laura, I have learned to travel and be comfortable outside my comfort zone and country. I may have hated you then, Laura, but thanks for forcing a skill on me that has changed my life. I also want to thank Brian Desmond, Jo Harder, Michael B. Smith, and Shawn Bass for helping me prepare for my first presentation.

I want to thank:

• Citrix for the CTP honor in 2009 and the CTP Fellow honor in 2017.
• Experts Exchange for more than I can count awards, honors, and titles since 2002.
• IGEL for the many awards and honors over the past few years.
• Parallels for seven years as a Very Important Parallels Professional.
• VMware for four years as a vExpert and vExpert EUC.

I have made more friends and memories than I can list. I have enjoyed working in and serving the Citrix, AD, and EUC communities for the past 33+ years. Now it is on to becoming a District Governor, maybe a Council Chair, and one day, maybe an International Director for Lions Club International.

Thanks for allowing me to serve you through my website, and I hope you found my articles, files, and PowerShell scripts useful.

Exit 0

1. Nothing is impossible for the one who doesn’t have to do the work.
2. The root cause of a problem is always something simple.
3. Never stress out about the things you have no control over.
4. You can only do what you can, given your time and resources.
5. When all else fails, blame Chuck.

Rule #1 came about when I was a software developer for a firm that serviced a niche market in accounting. My boss would come in and give me a new assignment and then get mad when I wasn’t finished in two days, three days, absolute max. He would always say, “It is just a couple of data entry screens and reports; how hard could it possibly be?”. I started writing Rule #1 on my whiteboard in my office, and my boss would come in every day and erase it. I can only assume he knew I wrote it for him. One day he told me very firmly and with much redness on his face to NEVER write that again. Well, here I am 35 years later, still writing and quoting Rule #1.

Rule #2. It doesn’t matter whether it is programming or network troubleshooting, the root cause of a problem is always something simple. It could be a missing “.” in COBOL, a missing “}” in C or PowerShell, a Cat5 cable not plugged in firmly, or a redundant power cable plugged into an overloaded UPS.

Rule #3. You have no control over many things. In a network environment, outsiders have no control over the wiring, cooling, is A/V software running and up-to-date, or, for the most part, how much time the salespeople built into the SOW for the project. There is no reason to shorten your life and make your team miserable by stressing out over the things you have no control over.

Rule #4. Whether it is unrealistic customer expectations or a salesperson who trimmed the hours assigned to the project, you can’t do anything about those items. You, and your team, can only do what you can do with the time and resources given to do the assignment. So what if the customer, salesperson, and SOW only give you 16 hours to do 64 hours of work? You do everything you can in 16 hours and let the salesperson deal with the heat. Rules # 3 and 4 go together.

Rule #5. Everyone has a “go-to” person they can depend on. I had Chuck. Chuck was a master multi-tasker (when he wasn’t IM’ing, playing games, and drinking a six-pack of extra-large Monster Energy Drinks). I came to rely on him when I needed something done NOW. A “Chuck” type person is also one who can take a lot of joking and kidding around. It is “Chuck’s” job to help relieve the stress you can’t show from Rule #3 and be good-natured about it. Even though we had relied upon Rule #2 to find a solution, we always blamed Chuck. Exchange server crashed? Chuck’s fault. Is a virus running rampant on the customer’s network? Chuck’s fault. Did everything get fixed, and is the network back to running smoothly? I don’t care! It was Chuck’s fault everything happened in the first place.

For 2022 and beyond, I will update Rule #5 to state: When all else fails, blame Joe Shonk or Guy Leech. They are both friends who can do almost anything and a lot of anything. You have my permission to blame Joe Shonk for anything that goes wrong in the EUC space. You can also blame Guy Leech for anything wrong with scripting, programming, or automation.

Thanks for reading.

Webster

With a little over 6 months, here’s what’s new:

Toolbox #012: Citrix UPM Reset Tool

• Blog: https://www.cloudsparkle.be/2020-10-31-PSHostInfo/
• GitHub: https://github.com/Cloudsparkle/PSHostInfo
• Summary: Citrix UPM reset framework

Toolbox #013: IISLogMonitor

• Blog: https://www.cloudsparkle.be/2021-03-17-CTXAutolaunch/
• GitHub: https://github.com/Cloudsparkle/CTXAutoLaunch
• Summary: A PowerShell tool to continuous IIS Log file monitoring

Toolbox #014: FAS-CertCheck

• Blog: https://www.cloudsparkle.be/2022-03-29-FAS-CertCheck/
• GitHub: https://github.com/Cloudsparkle/FAS-CertCheck
• Summary: Powershell scripts to check certificates for Citrix FAS

Toolbox #015: PS-ScheduleTask

• Blog: https://www.cloudsparkle.be/2022-06-08-ScheduledTasks/
• GitHub: https://github.com/Cloudsparkle/PS-ScheduleTask
• Summary: Scheduled Tasks done in a special way.

Toolbox #016: A simple provisioning tool

• Blog: https://www.cloudsparkle.be/2022-06-16-PSApplaunch/
• GitHub: https://github.com/Cloudsparkle/PS-AppLaunch
• Summary: A framework to launch published applications

Toolbox #016 was a big one for me, one that I look forward to in developing further in the future. Please get in touch with any questions or suggestions!

That’s it for now. Stay tuned for more and above all: stay safe.

Thank you

Bart Jacobs

CTP

So I guess an update was, to say the least, overdue.

Let’s jump right in:

Toolbox #007: PSHostInfo

• Blog: https://www.cloudsparkle.be/2020-10-31-PSHostInfo/
• GitHub: https://github.com/Cloudsparkle/PSHostInfo
• Summary: A PowerShell based version of the old tool HostInfo

Toolbox #008: CTXAutolaunch

• Blog: https://www.cloudsparkle.be/2021-03-17-CTXAutolaunch/
• GitHub: https://github.com/Cloudsparkle/CTXAutoLaunch
• Summary: A PowerShell tool to launch Citrix Published resources (automatically).

Toolbox #009: Citrix UPM fix

• Blog: https://www.cloudsparkle.be/2021-07-27-UPMFix/
• GitHub: https://github.com/Cloudsparkle/Citrix-UPM-FileFix
• Summary: Some PowerShell to fix file permissions on Citrix UPM.

Toolbox #010: Counting Session Logon and Logoff

• Blog: https://www.cloudsparkle.be/2021-09-30-CTXSessionActivity/
• GitHub: https://github.com/Cloudsparkle/CTXSessionActivityCounter
• Summary: Count those session logon and logoff events with PowerShell

Toolbox #011: A simple provisioning tool

• Blog: https://www.cloudsparkle.be/2021-10-13-PS-ADUserRoleProv/
• GitHub: https://github.com/Cloudsparkle/PS-ADUserRoleProv
• Summary: Provide a simple tool to provision application resources.

That’s it for now. Stay tuned for more and above all: stay safe.

Thank you

Bart Jacobs

CTP

I updated the PDF last on 22-Sep-2021.

You can always find the most current PDF by going to https://www.carlwebster.com/where-to-get-copies-of-the-documentation-scripts/

Thanks

Webster

If you have followed this series, we have learned a lot together. I started working on this series on 4-Apr-2021 and finished this, the last article, on 28-Jun-2021. Then, from 27-Aug-2021 through 29-Aug-2021, I updated all the articles for CVAD 2106 and Horizon 8 2106. I spent 706 hours learning, building, testing, playing around, destroying everything, rebuilding, retesting, playing around some more, writing, editing, and uploading the 1,334 pages and 1,633 screenshots to WordPress.

It was much effort, but it was also a lot of fun and an excellent learning experience.

Of all the experts I know, I do not know anyone who gets everything right the first time. That is why we have labs. That is why we test, mess up, start over, and keep at it until we understand and explain the process to others.

Unfortunately, I have met numerous people in IT who do not care to do any learning or testing outside of work hours. That is sad. If you desire to grow in your IT career, I believe you must spend your own time improving yourself, your knowledge, and your skills.

Advice

1. Always learn.
2. Always improve yourself.
3. Be a better person today than you were yesterday.
4. Learn good habits in the lab. What you do in practice becomes what you do in real life.
5. Learn to document your lab. Documenting your work and configurations is an excellent habit to learn. I have never known anyone who complained about having too much documentation.
6. Learn to document the changes you make in the lab. While you may not need a formal change control process for your lab, learning to document changes BEFORE you make them is an excellent habit to learn. Here are some basic examples of a change control document.
   1. Reason for the change
   2. What is wrong in the current environment that requires the change
   3. What is the change
   4. What is the impact of the change (i.e., all servers require a restart)
   5. Validation of change
   6. Is there a rollback plan
7. Do not practice stuff in the lab until you get it right once. Practice until you cannot possibly get it wrong.
8. Remember your physical health. We I.T. people have a reputation for sitting on our rear ends all day long. Get up, get some exercise, even if it is just walking up and down the stairs. Move.
9. Remember your physical health #2. We I.T. people have a reputation for eating junk food and rarely eating much if any, healthy food.
10. Remember your mental health. We I.T. people have a reputation as loners and loving isolation. Have friends. Spend time with your friends. TALK to your friends.
11. Remember your mental health #2. We I.T. people have stressful jobs. Keeping stress bottled up inside can lead to bad heart health and bad brain health. It is OK not to be or feel OK. TALK to someone.
12. Have a hobby that does not involve computers or technology. Take a mental break from computers and technology.
13. Don’t be afraid to make mistakes. Preferably make them in your lab and not on the job or at a customer site.
14. Learn to automate. Now that you know the basics of creating hosts, servers, virtual machines, virtual networks, virtual storage, and much more, you do not want to do this manually at scale.
15. Automation comes in many flavors. It would be best to read about software like Ansible, Chef, Jenkins, Puppet, and others. Many vendors offer commercial automation software—for example, Microsoft System Center Configuration Manager and Microsoft Deployment Toolkit.
16. Cloud is the future but is not cheap to use in a lab unless you become a Microsoft Most Valuable Professional (MVP) or get access to credits for Azure, AWS, Google Cloud, and other Cloud providers.
17. Start your lab small. You don’t need to go into thousands of Dollars/Euros/Pounds/Rupees of debt to build a lab. My first lab was an old computer built from many other computer parts thrown away by friends and customers. Back in 1984, it was amazing what you could do in 1 MB of RAM, a 30 MB hard drive, and a 12″ monitor at an incredible 80 characters by 25 lines display.
18. As we did in the article series, always think about security. That is why I left the Windows Firewall and Windows Defender enabled on every computer. Learn about TCP/UDP, Ports, Inbound and Outbound network traffic.
19. As we did in the article series, always do one thing at a time. Take your time, Be patient. If you make five changes at once and then test and the test fails, which of the five changes (or combination of the changes) caused the failure?
20. There is no one right way to do anything in technology. This is the old cliché of asking 25 consultants how to automate a process or design a Citrix/Microsoft/VMware infrastructure, and you receive 25 different proposals/viewpoints/opinions. And the 25 consultants tell you why the other 24 consultants are wrong or idiots.
21. Don’t neglect people skills. Soft skills are what helps you succeed in any career. Check out this video by the fine folks at Thrive-IT. Elevating Your Soft Skills.

I asked my fellow CTPs and vExperts what advice they would like to offer you.

CTPs:

Benjamin Crill:

Always be willing to TRY a solution.  You don’t know that it is bad/won’t work/not what you want/etc until you actually try something.

Manuel Winkel:

Work in the test environment according to the approach – trial and error – everything is possible and can be tested if it is not productive ^^

Guy Leech:

If you’ve got RAID arrays for some resilience against disk failure, have a hot spare where possible, and if not, at least set up alerting so you get notified on a disk failure.

Make sure you size a UPS correctly, although mine mainly protects against occasional Residual Current Device  (RCD) trips, so it only needs to provide a few minutes of power. [Webster. Check the detailed explanation of RCD at Site issues with Earth leakage.

Julian Mooren:

1.) Do small steps. Especially when automating because it can get quite overwhelming

2.) Maybe build the lab with a good friend or colleague. Together is better.

3.) Invest time in yourself = Better Skills and career opportunities

4.) You don’t need to have a 4000$ Home lab setup. Set yourself a budget and start with a tiny machine and build component by component. If you are still enjoying it after some months > upgrade.

5.) Watch your Credit Card bill when building your lab on Azure or another public cloud.

6.) Don’t be afraid to try/learn something completely new. Play with the solution and make yourself an impression of it. Even if it is a product from the competitor

Mads B. Petersen:

Controlling access to management, think jump host, MFA for windows logon and such, which I see many companies don’t do very well.

Leee Jeffries:

Invest in yourself, get some hardware to play around with, work on the fundamentals, and focus on what interests you. You’ll be surprised about how quickly you learn when you’re keen to get started. Ask questions to your peers in the community; they are all friendly folks. Lastly, share what you know.

vExperts:

Stephen Jesse:

“don’t be afraid to experiment,” meaning do dumb stuff here not in production, so you know why you don’t do it

Pawel Kubik:

If I may, I would add just one thing, Always try to keep it simple.

Mike Martino:

Aim to be 1% better every day – small chunks of effort adds up. Especially working on things in your home lab and/or when learning and studying for a cert when there can be so much to do that you need to focus on little bits at a time to get through it.

Conclusions

No one is perfect.

Don’t be afraid to start your own blog and document your learning experiences. If you have questions, someone else is asking the same questions. When you figure it out, document what you learned, the learning process, and the lessons learned along the way (also known as, oops, I made a mistake, and I don’t want you to make the same mistake.).

Learning something new can be stressful, challenging, and frustrating. But it is rewarding when you figure the new stuff out and feel that sense of accomplishment.

Lessons Learned

I already knew it, but writing detailed how-to articles with hundreds of screenshots is very time-consuming.

If you followed the series and built each VM as documented, you notice that I manually created each server certificate. Leee Jeffries, who reviewed almost every article, suggested another way to do this using a GPO.

Here are the email contents Leee sent.

<quote>

Here are the steps to enable your computer certificate to be replaced with a new one that Auto-Enrolls.

• Create a new template (I followed your instructions from your blog)
• Change the Superseded Templates and add the “Computer Template”
• Change the Security to allow Domain Computers to Enroll
• Under the main Certificate Authority, Certificate Template, Remove the “Computer” template.

One side note – I do not remove the “Client Authentication” from my certificates as I want the machines to use their cert in client auth.

My new template

Added the old Computer template to be superseded with this one

Amended the Domain Computers Object to allow AutoEnroll

Before a GPUpdate – showing only one-year validity

Then:

After a GPUPdate, showing two-year validity and the amended certificate template.

To confirm the GPO Config:

</quote>

I asked my primary AD/Certificate Authority mentor about the difference between what he taught me and what Leee suggested. He stated:

“The current mechanism allows for batch creation and generation of certificates, including for machines that are off the domain. It also generates a more secure certificate.”

Some Certificate Issues/Considerations:

[1] automatically requesting certificates via GPO is easy – and there is nothing wrong with that.

[2] the default Computer/Machine and the various Domain Controller/Kerberos/etc. templates have lots of capabilities. In a secure environment, they may have too many. For example, they have both Extended Key Usages (EKUs) for “Server Authentication” and “Client Authentication”. Arguably, they don’t need “Client Authentication”, and this can – in certain circumstances – cause major security issues. Supply in the Request Shenanigans

[3] In my clients, many devices aren’t members of the domain. Using  INF request files works for all of them. GPO doesn’t.

[4] In my clients, some certificates need different lifetimes than other certificates. Using a GPO makes that slightly more complicated. Using INF request files makes it easy. (This also applies to many other certificate attributes.)

[5] The default installation of Certificate Services is not particularly secure. Locking down CS isn’t difficult, but it requires more ongoing input from a CS admin. Certified Pre-Owned: Abusing Active Directory Certificate Services

Thank you for reading the series.

Up next, eventually, the Learning the Basics of VMware Horizon 8 series.

Webster

Landing page for the article series

The next step is to create an additional management server VM from the Server 2019 template. We use the VM built in this article for an additional infrastructure server. My Lab’s infrastructure VMs reside in my XenServer pool, as explained in the Introduction article. Building a server VM from the Server 2019 template was covered earlier.

From the introduction article, this is the VM we are building:

Before building the new server, we need to verify the hardware requirements for ControlUp.

Request Trial

ControlUp optimizes the digital experience with actionable insights captured through real-time observation. With accurate end-to-end analysis of the user’s digital journey, ControlUp enables IT admins to make faster decisions with actionable insights and enterprise-grade tools that troubleshoot and remediate user issues to deliver the best-in-class digital employee experience and productivity.

ControlUp monitoring uses three parts, the Real-time console, the Monitor node, and Agents.

• The ControlUp Real-Time console leverages the association and correlation logic of the real-time engine to generate aggregated views of multiple data sources. These powerful grids can be sorted by, grouped by, filtered by, or searched by any of the dozens of continuously updated real-time metrics.
• The ControlUp Monitor is a component principally equivalent to ControlUp Console, but without an interactive user interface. Once installed and started, ControlUp Monitor signs into your ControlUp organization and connects to your managed computers.

The Monitor starts receiving system information and performance updates from your organization, just like an additional ControlUp Console user. The primary difference between a Monitor and a Console is that the Monitor runs as a Windows Service 24/7, requiring no user interaction and allowing for continuous monitoring and auto-remediation of your environment.

• ControlUp agents allow communication with the Console and the Monitor.

To receive a free trial of ControlUp, use your internet browser and browse to https://ControlUp.com/ and click on Download Free Trial, as shown in Figure 1.

Click Start Download, as shown in Figure 2.

Here are the links needed with the information needed to build our ControlUp VM.

https://support.controlup.com/hc/en-us/articles/115005534205-ControlUp-Hybrid-Cloud-Implementation-Requirements

https://support.controlup.com/hc/en-us/articles/115001228945-Communication-Ports-Used-by-ControlUp-Hybrid-Cloud

https://support.controlup.com/hc/en-us/articles/360000728405-Setting-permissions-for-ControlUp-in-VMware-vCenter

https://support.controlup.com/hc/en-us/articles/206501579-Hypervisor-Monitoring-Requirements (Covers Citrix XenServer)

https://support.controlup.com/hc/en-us/articles/360000532477-AV-Exclusions-for-ControlUp

We are building a ControlUp server to handle the small number of VMs used for the future Citrix Virtual Apps and Desktops and VMware Horizon article series. Since the Lab will have minimal Citrix and VMware infrastructure servers and a minimal number of virtual desktops, the requirements are minimal for the ControlUp server VM.

From this information, we learn the following about the ControlUp server’s VM:

• It needs a static IP address
• Increase the RAM to 16GB
  • We run the Console and Monitor on one server. Since there is no local database, ControlUp caches monitoring results in the server’s RAM.
• Requires the installation of an additional internet browser
  • We don’t use Internet Explorer 11 for anything
• Requires Windows firewall configuration
• Requires Windows Defender configuration
• Needs service accounts for VMware vCenter and Citrix XenCenter
  • These service accounts are not required, but we use specific service accounts for specific purposes

Following the process used for the other lab servers built, create a new VM from the Server 2019 template and do not power it on.

Change RAM

VMware

In vCenter, right-click the LabControlUp VM, click Edit Settings…, and change the Memory settings, as shown in Figure 3.

Power on the VM, enter the required hostname, enter the required IP address information, and install Windows Updates. I also installed Google Chrome to use as my browser.

XenServer

Select the LabControlUp VM, click the Memory tab, and click Edit…, as shown in Figure 4.

Select Set a fixed memory of and change the value to 16.0, as shown in Figure 5.

Power on the VM, enter the required hostname, enter the required IP address information, and install Windows Updates. I also installed Google Chrome to use as my browser.

Active Directory

Join Active Directory

First, we need to create an OU.

If you remember, when we created Active Directory in Part 14, I placed all my infrastructure servers in a specific OU.

Lab

Infrastructure

The ControlUp server is placed in an OU to apply GPOs for Windows Firewall and Windows Defender configurations.

Lab

Infrastructure

ControlUp

From the Lab’s management computer, start an elevated PowerShell session and type in the following, as shown in Figure 6.

Get-ADOrganizationalUnit -filter {Name -eq "Infrastructure"}

Create the ControlUp OU.

Copy and paste the following into the elevated PowerShell session and press Enter, as shown in Figure 7.

Remember to set the values you need.

Note: Lines may wrap

#create the ControlUp OU

$ADDomain = "LabADDomain"
$TLD = "com"
$Protect = $True

New-ADOrganizationalUnit -Name "ControlUp" `
-Path "ou=Infrastructure,ou=Lab,dc=$ADDomain,dc=$TLD" `
-ProtectedFromAccidentalDeletion $Protect -verbose

Get-ADOrganizationalUnit -filter {Name -eq "ControlUp"}

Copy the DistinguishedName property to the clipboard.

LabControlUp Server Work

Verify that the server has a static IP address and uses the IP addresses of the domain controllers for the DNS servers, as shown in Figure 8.

Verify that the server has the correct hostname, as shown in Figure 9.

Use mstsc to remote into the VM that is our ControlUp server.

Exit Server Manager and start an elevated PowerShell session.

Copy and paste the following into the elevated PowerShell session and press Enter. The process took less than the blink of an eye to happen, which is why there is no screenshot.

Remember to set the values you need.

Note: Lines may wrap

#Join the computer to the domain

add-computer -Credential LabADDomain\Administrator `
-DomainName "LabADDomain.com" `
-OUPath "OU=ControlUp,OU=Infrastructure,OU=Lab,DC=LabADDomain,DC=com" `
-Force `
-Restart

#server reboots

After the VM restarts, log in using the domain’s Administrator account and password.

Now to install the server certificate from the CA.

Save the following to a file name c:\CertFiles\computer-request.inf.

I want to thank Michael B. Smith for creating this INF file for me.

Use the data needed for your environment.

LabControlUp              = the name of your ControlUp server
LabADDomain.com           = your domain name
"LabCA\LabDomain CA Root" = the name of your CA server and the name of your CA.

;----------------- computer-request.inf -----------------
; LabControlUp.LabADDomain.com
;
; certreq -new computer-request.inf computer-request.req
; certreq -submit -config "LabCA\LabDomain CA Root" computer-request.req computer-request.cer
; certreq -accept -config "LabCA\LabDomain CA Root" computer-request.cer
;

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=LabControlUp.LabADDomain.com" ; replace with the FQDN of the File Server
FriendlyName = "Computer (Machine) for LabControlUp.LabADDomain.com"
KeyLength = 2048
; Can be 1024, 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
KeySpec = 1                     ; AT_KEYEXCHANGE
Exportable = TRUE               ; private-key is exportable
MachineKeySet = TRUE            ; goes in machine store instead of user's personal store
SMIME = False                   ; cannot be used for signing S/MIME messages
PrivateKeyArchive = FALSE
HashAlgorithm = sha256          ; "certutil -oid 1 | findstr pwszName" -- gives a list (including sha1)
UserProtected = FALSE
UseExistingKeySet = FALSE       ; we are not renewing a key that already exists
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12               ; for ProviderName and ProviderType, see "certutil -csplist"
RequestType = PKCS10            ; if empty or set to "CERT" then a self-signed cert is created
KeyUsage = 0xa0                 ; 0xa0 - CERT_DIGITAL_SIGNATURE_KEY_USAGE + CERT_KEY_ENCIPHERMENT_KEY_USAGE

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication - PKIX_KP_SERVER_AUTH

[Extensions]
; Note: 2.5.29.17 is the OID for a SAN extension.

2.5.29.17 = "{text}"
_continue_ = "dns=LabControlUp.LabADDomain.com"

[RequestAttributes]
CertificateTemplate = "Server Template"

;-----------------------------------------------

Open an elevated command prompt.

Type in cd c:\CertFiles and press Enter.

The three commands we need to run are at the top of the computer-request.inf file.

Type in notepad computer-request.inf and press Enter.

Copy the line certreq -new computer-request.inf computer-request.req, paste it in the elevated command prompt, and press Enter.

Copy the line certreq -submit -config “LabCA\LabDomain CA Root” computer-request.req computer-request.cer, paste it in the elevated command prompt, and press Enter.

Note: If you get a warning similar to the following, you can ignore the warning. The warning tells you that the certificate request validity period is past the lifetime of the CA’s root certificate lifespan.

Certificate retrieved(Issued)Issued The certificate validity period will be shorter than the Server Template Certificate Template specifies because the template validity period is longer than the maximum certificate validity period allowed by the CA.  Consider renewing the CA certificate, reducing the template validity period, or increasing the registry validity period.

Copy the line certreq -accept -config “LabCA\LabDomain CA Root” computer-request.cer, paste it in the elevated command prompt, and press Enter.

Figure 10 shows the results of running the certificate request commands.

Create ControlUp Accounts

Additional vCenter Configuration

The vCenter Read-Only role created earlier is sufficient for all monitoring purposes. However, we want to use the built-in hypervisor-based VM power management functions. Therefore, we need to create a custom role based on the Read-Only role, adding the following permissions:

• In the Virtual Machine/Interaction category:
  • Power Off
  • Power On
  • Reset

First, we need to create an AD service account to assign the vCenter Custom Role.

From the Lab’s management computer, start an elevated PowerShell session, copy and paste the following into the elevated PowerShell session, and press Enter, as shown in Figure 11.

Remember to set the values you need.

Note: Lines may wrap

#Create the service account svc_VMwareControlUp for ControlUp vCenter permissions

$ADDomain = "LabADDomain"
$TLD = "com"
$Protect = $False

$UserPwd = Read-Host -AsSecureString -Prompt "Enter password"

New-ADUser -AccountPassword $UserPwd `
-CannotChangePassword $True `
-ChangePasswordAtLogon $False `
-Description "DO NOT CHANGE THE PASSWORD OR DELETE/DISABLE ACCOUNT" `
-DisplayName "svc_VMwareControlUp" `
-Enabled $True `
-GivenName "svc_VMwareControlUp" `
-Name "svc_VMwareControlUp" `
-PasswordNeverExpires $True `
-PasswordNotRequired $False `
-Path "OU=Service,OU=Accounts,OU=Lab,DC=$ADDomain,DC=$TLD" `
-SamAccountName "svc_VMwareControlUp" `
-UserPrincipalName "svc_VMwareControlUp@LabADDomain.com"

Log in to vCenter.

From the Menu dropdown, select Administration, as shown in Figure 12.

In Roles, click the Read-only role and click the Clone role action icon, as shown in Figure 13.

Enter a Role name, Description, and click OK, as shown in Figure 14.

Click the new role and click the pencil Edit icon, as shown in Figure 15.

In the left pane, scroll down to Virtual machine, and in the right pane, scroll down to Interaction, and click See more privileges, as shown in Figure 16.

In the right pane, scroll down and select Power off, Power on, Reset, and click Next, as shown in Figure 17.

Click Finish, as shown in Figure 18.

In Global Permissions, click the “+“, as shown in Figure 19.

Change the Domain to the AD domain, select the new ControlUp AD service account for User/Group, select the Custom Role, select Propagate to children, and click OK, as shown in Figure 20.

The new ControlUp account is added to the list, as shown in Figure 21.

Additional XenCenter Configuration

The XenCenter Read-Only role created earlier is sufficient for all monitoring purposes. However, we want to use the built-in hypervisor-based VM power management functions. Therefore, we need to create a custom role based on the Read-Only role, adding the VM Operators permission.

Start and, if required, connect or log in to XenCenter.

First, we need to create an AD service account to assign the XenCenter Custom Role.

From the Lab’s management computer, start an elevated PowerShell session, copy and paste the following into the elevated PowerShell session, and press Enter, as shown in Figure 22.

Remember to set the values you need.

Note: Lines may wrap

#Create the service account svc_CitrixControlUp for ControlUp XenCenter permissions

$ADDomain = "LabADDomain"
$TLD = "com"
$Protect = $False

$UserPwd = Read-Host -AsSecureString -Prompt "Enter password"

New-ADUser -AccountPassword $UserPwd `
-CannotChangePassword $True `
-ChangePasswordAtLogon $False `
-Description "DO NOT CHANGE THE PASSWORD OR DELETE/DISABLE ACCOUNT" `
-DisplayName "svc_CitrixControlUp" `
-Enabled $True `
-GivenName "svc_CitrixControlUp" `
-Name "svc_CitrixControlUp" `
-PasswordNeverExpires $True `
-PasswordNotRequired $False `
-Path "OU=Service,OU=Accounts,OU=Lab,DC=$ADDomain,DC=$TLD" `
-SamAccountName "svc_CitrixControlUp" `
-UserPrincipalName "svc_CitrixControlUp@LabADDomain.com"

In XenCenter, click the Resource Pool and in the right pane, click Users, click Add…, as shown in Figure 23.

Enter the name of the new Citrix ControlUp account and click Grant Access, as shown in Figure 24.

Click Close, as shown in Figure 25.

Select the Citrix ControlUp account and click Change Role…, as shown in Figure 26.

Select VM Operator and click Save, as shown in Figure 27.

The account is ready for use, as shown in Figure 28.

GPOs

Before installing and configuring ControlUp, we need four GPOs created.

1. One for the ControlUp server Windows Defender exclusions
2. One for the ControlUp server Windows Firewall ports
3. One for the monitored computers Windows Defender exclusions
4. One for the monitored computers Windows Firewall ports

On the Lab management computer, open the Group Policy Management Console (GPMC).

In the Group Policy Objects node, create and name four GPOs. For example, I named mine as follows:

• (C) ControlUp Agent Windows Defender Exclusions – linked at the domain level, Deny applied to LabControlUp
• (C) ControlUp Agent Windows Firewall Ports – linked at the domain level, Deny applied to LabControlUp
• (C) ControlUp Server Windows Defender Exclusions – linked to the ControlUp OU and applied only to the LabControlUp computer account
• (C) ControlUp Server Windows Firewall Ports – linked to the ControlUp OU and applied only to the LabControlUp computer account

Let’s work on the (C) ControlUp Server Windows Firewall Ports GPO first.

We need the following Windows Firewall ports configured for the server.

ControlUp Server

• TCP 53 open outbound for name resolution
• TCP 80 open outbound for communication to XenServer, XenDesktop, and NetScalers/ADCs
• TCP 135 – 139, 445, and 49152 – 65535 for Agent deployment and upgrades via the console and specific OOB actions, such as restarting the agent.
• TCP 389 open outbound for LDAP communication with domain controllers
• TCP 443 opened outbound for communication to vSphere, Horizon, ControlUp Cloud servers, and NetScalers/ADCs
• TCP 40705 open outbound for Console to agent communication via the WCF protocol.
• TCP 40706 open outbound for Console to Monitor management port.

A summary of these ports is 53, 80, 135 – 139, 389, 443, 445, 40705, 40706, 49152 – 65535.

In the GPMC, right-click the (C) ControlUp Server Windows Firewall Ports GPO in the Group Policy Object node and click Edit, as shown in Figure 29.

Expand Policies.

Expand Windows Settings.

Expand Security Settings.

Expand Windows Defender Firewall with Advanced Security.

Expand Windows Defender Firewall with Advanced Security.

Right-click Outbound Rules and click New Rule…, as shown in Figure 30.

Select Port and click Next, as shown in Figure 31.

Select TCP, select Specific local ports, enter 53, 80, 135-139, 389, 443, 445, 40705, 40706, 49152-65535, and click Next, as shown in Figure 32.

Note: There are no spaces before or after the dash in “135-139” and “49152-65535”. If you get an error message in the GPME about invalid characters, verify that the dash character (“-“) is not a copy and paste error from your browser and there are no spaces.

Select Allow the connection and click Next, as shown in Figure 33.

Click Next, as shown in Figure 34.

Enter a Name, an optional Description, and click Finish, as shown in Figure 35.

Exit the Group Policy Management Editor (GPME).

This GPO applies only to the ControlUp server.

In the middle pane, in Security Filtering, click on Authenticated Users and click Remove, as shown in Figure 36.

Click OK, as shown in Figure 37.

Click OK, as shown in Figure 38.

Click Add, as shown in Figure 39.

Click Object Types…, as shown in Figure 40.

Select only Computers and click OK, as shown in Figure 41.

Type in the name of the ControlUp server and click Check Names, as shown in Figure 42.

Once the computer name is verified, click OK, as shown in Figure 43.

Now onto the (C) ControlUp Server Windows Defender Exclusions GPO.

Here are the exclusions needed for the ControlUp server.

• ControlUp Server
  • Process Exclusions:
    • ControlUpConsole.exe
    • cuMonitor.exe

Right-click the (C) ControlUp Server Windows Defender Exclusions GPO in the left pane and click Edit.

Expand Policies.

Expand Administrative Templates.

Expand Windows Components.

Expand Windows Defender Antivirus.

Click on Exclusions.

Double-click Process Exclusions, as shown in Figure 44.

Select Enabled and click Show…, as shown in Figure 45.

Enter the values shown in Figure 46, and click OK.

Click OK, as shown in Figure 47.

Exit the GPME.

Follow the same process as shown in Figures 36 through 43 to remove Authenticated Users and add the ControlUp server, as shown in Figure 48.

Scroll to the top in the GPMC.

Expand Domains.

Expand your AD domain.

Expand the Lab OU.

Expand the Infrastructure OU.

Right-click the ControlUp OU and click Link an Existing GPO…, as shown in Figure 49.

Select both ControlUp server GPOs and click OK, as shown in Figure 50.

Now that we have the two ControlUp server GPOs created let’s move on to the GPOs for the monitored computers.

Let’s work on the (C) ControlUp Agent Windows Firewall Ports GPO first.

We need the following Windows Firewall ports configured for the monitored computers.

ControlUp Agent

• TCP 40705 open inbound for ongoing console/monitor communications. This is a permanent rule.
• TCP 49152 – 65535 for Agent deployment and upgrades via the console and specific OOB actions, such as restarting the agent. We need these ports temporarily for deploying the agent.

In the GPMC, right-click the (C) ControlUp Agent Windows Firewall Ports GPO in the Group Policy Object node and click Edit.

Expand Policies.

Expand Windows Settings.

Expand Security Settings.

Expand Windows Defender Firewall with Advanced Security.

Expand Windows Defender Firewall with Advanced Security.

First, we create the permanent rule for TCP port 40705.

Right-click Inbound Rules and click New Rule…, as shown in Figure 51.

Select Port and click Next, as shown in Figure 52.

Select TCP, select Specific local ports, enter 40705, and click Next, as shown in Figure 53.

Select Allow the connection and click Next, as shown in Figure 54.

Click Next, as shown in Figure 55.

Enter a Name, an optional Description, and click Next, as shown in Figure 56.

Next, we have to create the temporary rule for TCP ports 49152-65535 (the high RPC ports).

Right-click Inbound Rules and click New Rule…, as shown in Figure 57.

Select Port and click Next, as shown in Figure 58.

Select TCP, select Specific local ports, enter 49152-65535, and click Next, as shown in Figure 59.

Note: There are no spaces before or after the dash in “49152-65535”. If you get an error message in the GPME about invalid characters, verify that the dash character (“-“) is not a copy and paste error from your browser and there are no spaces.

Select Allow the connection and click Next, as shown in Figure 60.

Click Next, as shown in Figure 61.

Enter a Name, an optional Description, and click Next, as shown in Figure 62.

Exit the Group Policy Management Editor (GPME).

This GPO applies to the computers monitored by the ControlUp server.

Now onto the (C) ControlUp Agent Windows Defender Exclusions GPO.

Here are the exclusions needed for the monitored computers.

• VMs/Servers with Agents on them (For example, Citrix machines, VMware Horizon machines, VMs.)
  • Process Exclusions:
    • AppLoadTimeTracer.exe
    • cuAgentexe
    • cuAgentHelper.exe

In the left pane, right-click the (C) ControlUp Agent Windows Defender Exclusions GPO and click Edit.

Expand Policies.

Expand Administrative Templates.

Expand Windows Components.

Expand Windows Defender Antivirus.

In the left pane, click on Exclusions, and in the middle pane, double-click Process Exclusions, as shown in Figure 63.

Select Enabled and click Show…, as shown in Figure 64.

Enter the values shown in Figure 65, and click OK.

Click OK, as shown in Figure 66.

Exit the GPME.

Collapse the Lab OU.

These two GPOs do not apply to the ControlUp server. To do that, we configure a GPO Deny Policy. A Deny right is not something you should do as a normal course of working with GPOs as it complicates GPO troubleshooting.

Click on the (C) ControlUp Agent Windows Defender Exclusions GPO, and in the middle pane, click the Delegation tab and click Advanced, as shown in Figure 67.

Click Add…, as shown in Figure 68.

Click on Object Types…, as shown in Figure 69.

Select only Computers and click OK, as shown in Figure 70.

Type in the name of the ControlUp server and click Check Names, as shown in Figure 71.

When the server name is validated, click OK, as shown in Figure 72.

Verify that the ControlUp server is selected, and in the Permissions area, scroll down and select Deny for Apply group policy, as shown in Figure 73. Do NOT change any other permissions.

Click Yes, as shown in Figure 74.

Right-click the GPO and click Edit, as shown in Figure 75.

Right-click the top level of the GPO and click Properties, as shown in Figure 76.

Click the Comment tab. For the comment, type in Deny for the server <ControlUp server name>, and click OK, as shown in Figure 77. This comment makes it easier when troubleshooting the GPO later.

Exit the GPME.

Figure 78 shows the comment entered.

Repeat the process to add the Deny permission to the other GPO.

Scroll to the top in the GPMC.

Expand Domains.

Expand your AD domain.

Right-click the domain and click Link an Existing GPO…, as shown in Figure 79.

Select both ControlUp agent monitoring GPOs and click OK, as shown in Figure 80.

The two GPOs are now linked at the domain level, as shown in Figure 81.

To verify the GPOs work, log in to the file server and the ControlUp server.

Tip: If the GPOs do not work at first, either restart the VM or do a Right-click Start, Run, gpupdate. Then log off and back on to see if it took effect. Gpupdate is a command-line utility from Microsoft that comes with all versions of the Windows operating system to refresh the Group Policy engine on the client. There are many ways of running gpupdate. As an administrator, you can even force a group policy refresh remotely using PowerShell or the GPMC.

On the ControlUp server, right-click Start, Run, wf.msc, and Windows Defender Firewall with Advanced Security starts, as shown in Figure 82.

Click Outbound Rules and verify that the Outbound Firewall Rule configured by the GPO is there, as shown in Figure 83.

Exit Windows Defender Firewall with Advanced Security.

To verify the Windows Defender Exclusions, click Start, Settings, Update & Security, Windows Security, and Virus & threat protection, as shown in Figure 84.

Under Virus & threat protection settings, click Manage settings, as shown in Figure 85.

Scroll down to Exclusions and click Add or remove exclusions, as shown in Figure 86.

Figure 87 shows that the Exclusions are in place.

Follow the same process to validate the GPO settings on the file server, as shown in Figures 88 and 89.

Install ControlUp Performance Monitor

Extract the downloaded ControlUp.zip file to the ControlUp server to C:\ControlUp, as shown in Figure 90.

There is nothing to install for ControlUp. ControlUpConsole.exe is the ControlUp monitoring software.

Before continuing, install a modern internet browser. For example, I installed Google Chrome because I could not get the installer for the new Microsoft Edge to work from Internet Explorer 11 (IE11). ControlUp Insights and Solve require a modern browser.

Configuring ControlUp

First Time Launch

Click Create a new account, as shown in Figure 91.

Enter the requested information, select I agree to the Terms of Use and Privacy Policy, and click SIGN UP, as shown in Figure 92.

Verify that the email address is correct and click OK, as shown in Figure 93.

Enter the passcode emailed and click Continue, as shown in Figure 94.

Now you need to create a ControlUp organization. Enter a descriptive Organization Name and click Continue, as shown in Figure 95.

The ControlUp Real-Time Console starts, as shown in Figure 96.

Add Monitor

On the toolbar, click Add Monitor, as shown in Figure 97.

Click OK, as shown in Figure 98.

Click Add Domain, as shown in Figure 99.

Enter the AD domain’s FQDN, enter domain credentials, and click OK, as shown in Figure 100.

Click Add Credentials Set, as shown in Figure 101.

Enter the vCenter ControlUp account information, enter a Friendly Name, select Share credentials with authorized users, and click OK, as shown in Figure 102.

Repeat the process shown in Figures 101 and 102 to add the XenCenter ControlUp account.

The accounts are added. Click Next, as shown in Figure 103.

Click Next, as shown in Figure 104.

Click Next, as shown in Figure 105.

Click Next, as shown in Figure 106.

Click Next, as shown in Figure 107.

Click Finish, as shown in Figure 108.

Select the ControlUp server as the Monitor server and click Install, as shown in Figure 109.

Click Finish, as shown in Figure 110.

Wait a few minutes, click Refresh, and the Monitor should show Running-Master, as shown in Figure 111. If it doesn’t, either wait a few more minutes or contact ControlUp support.

Click OK.

Create Folders

As in Windows Explorer, Folders in the ControlUp console allow you to organize monitored devices into manageable groups. So far, in this article series, only infrastructure computers exist. Folders allow the grouping of servers by function, action, type, use, or any criteria needed. Folders can mimic an existing AD OU structure or any structure desired.

Right-click the Organization Name in the left pane of the ControlUp console, click Add, and click Folder, as shown in Figure 112.

Enter a name for the folder and press Enter, as shown in Figure 113.

Additional folders can exist at the same level or as sub-folders. I created additional sub-folders to mimic where servers reside in AD, as shown in Figure 114.

Add Hypervisors

In the toolbar, click Add Hypervisor, as shown in Figure 115.

Enter the following information and click OK, as shown in Figure 116.

• Type = VMware
• URL = https://vCenter.FQDN/sdk (For me, that is https://vCenter.LabADDomain.com/sdk)
• Name = vCenter
• Credentials = From the dropdown list, select the VMware ControlUp account (For me, that is svc_VMwareControlUp

Figure 117 shows vCenter added under the Hypervisors folder.

As shown in Figure 115, click Add Hypervisor.

Enter the following information and click OK, as shown in Figure 118.

• Type = XenServer
• URL = http://XenServerPoolMasterIPAddressorFQDN (For me, that is http://192.168.1.80)
• Name = Automatically filled
• Credentials = From the dropdown list, select the Citrix ControlUp account (For me, that is svc_CitrixControlUp

Figure 119 shows the Pool added under the Hypervisors folder.

Add Machines

In my Lab, the XenServer pool holds all my infrastructure VMs.

Right-click the hypervisor connection where the infrastructure machines reside and click Focus, as shown in Figure 120.

Click on Machines and select the machines to install the ControlUp agent, as shown in Figure 121.

Right-click a selected machine and click Deploy agent, as shown in Figure 122.

Click OK, as shown in Figure 123.

Click OK, as shown in Figure 124.

As shown in Figure 125, after a few seconds, the selected computers show in the console.

Now that computers are in the console, we can move them to the folders created earlier.

Select the two domain controllers, right-click and click Move to…, as shown in Figure 126.

Expand the top-level folder, select the folder created for the domain controllers, and click OK, as shown in Figure 127.

In the list of folders, expand the domain controller’s folder, and the domain controllers are now in their folder, as shown in Figure 128.

Move the other computers into their folders, as shown in Figure 129. You can also drag and drop computers into folders.

Note: Now that the ControlUp agent is deployed, the temporary Windows Firewall rule, ControlUp Monitored Computer Inbound TCP Ports 49152-65535, can be disabled within the GPMC.

Configure Security

We need to allow others access to the Shared Credentials created when configuring the Monitor and configure our security groups with Admin and Helpdesk access to the console.

On the bottom of the console, click Security Policy, as shown in Figure 130.

Expand Perform organization-wide actions, as shown in Figure 131.

Scroll down and expand Shared Credentials, as shown in Figure 132.

For Use Shared Credentials, in both the Helpdesk and ControlUp Admins columns, click on Not set, and click Allow from the popup, as shown in Figures 133 and 134.

Click Apply, as shown in Figure 135.

Click Manage Roles, as shown in Figure 136.

Click Helpdesk and then click Edit, as shown in Figure 137.

Click Add Users/Groups, as shown in Figure 138.

Since the AD security groups created for the helpdesk groups contain “helpdesk”, for the Search Filter, type in helpdesk, click Search, and all the helpdesk security groups appear, as shown in Figure 139.

Select all the helpdesk groups and click OK, as shown in Figure 140.

Click OK, as shown in Figure 141.

Click ControlUp Admins and then click Edit, as shown in Figure 142.

Click Add Users/Groups, as shown in Figure 143.

Since the AD security groups created for the admin groups contain “admins”, for the Search Filter, type in admins, click Search, and all the admins security groups appear, as shown in Figure 144.

Select the desired groups and click OK, as shown in Figure 145.

Click OK, as shown in Figure 146.

Click OK, as shown in Figure 147.

Verify Monitor Activity

Click My Organization on the bottom of the console, as shown in Figure 148.

Click Monitoring Status, as shown in Figure 149.

Click Refresh, and the Monitor should show a Last Upload status, as shown in Figure 150.

Note: Please see this article on Monitor Alerts from ControlUp if there is no upload activity.

Viewing the Console

Right-click the Infrastructure folder and click Focus.

What shows is the Default console view for the item in Focus. Figure 151 shows a partial view.

Drag the scroll bar to the far right, and you can see many columns available, as shown in Figure 152.

You can sort what you see by any column. For example, double-click the IP Addresses column heading to sort by IP Addresses, as shown in Figure 153.

You can add or remove columns from the display by clicking Manage Columns, as shown in Figure 154.

You can add or remove any column(s) you need, as shown in Figure 155.

You can also display many ControlUp defined preset column selections by clicking the dropdown Column Preset, as shown in Figure 156.

The console display changes to show columns (data) specific to the Preset selected, as shown in Figure 157.

Please schedule time with ControlUp to get a detailed look into what all the ControlUp Real-Time Console can show.

Uninstall Agents on Servers

To see only machines with the ControlUp agent, click Display, as shown in Figure 158.

Deselect Show Agentless Managed VMs and Show Agentless Managed Sessions, as shown in Figure 159.

Click on the Organization Name, right-click and select Focus, as shown in Figure 160.

Click Machines, as shown in Figure 161.

To uninstall the agents installed using the console, select the computers with the agents to uninstall, right-click, click Agent Control, and click Uninstall Remote Agent, as shown in Figure 162.

This process uninstalls the agent from the selected computers and removes the selected computers from the ControlUp console, as shown in Figure 163.

Up next: Update ESXi Hosts using VMware Lifecycle Manager

Landing page for the article series

The next step is to create an additional management server VM from the Server 2019 template. We use the VM built in this article for an additional infrastructure server. My lab’s infrastructure VMs reside in my XenServer pool, as explained in the Introduction article. Building a server VM from the Server 2019 template was covered earlier.

From the introduction article, this is the VM we are building.

Follow the process covered earlier to build the server above, but do not power on the server. Before we power on the new server, we must verify that the hardware meets IGEL’s system requirements.

For us non-German speakers, Germans pronounce IGEL as Eagle.

Note: Thanks to IGEL Community members David Prows (IGEL Fellow), Markus Zehnle, and René Bigler (IGEL Community Member of the Year and IGEL VIP) for taking the time to review and provide feedback on this article.

Request Trial

IGEL provides the Next-Gen Edge OS for cloud workspaces, the most secure, high-performance, managed endpoint operating system for today’s digital workspaces on any device.

To receive a free trial of IGEL devices, use your internet browser and browse to https://igel.com/ and click on FREE TRIAL, as shown in Figure 1.

Note: This article assumes you requested a Universal Desktop – Pocket (UDP) device.

Click DOWNLOAD THE IGEL SOFTWARE, as shown in Figure 2.

Fill in the requested information and click GET FREE LICENSES, as shown in Figure 3.

If you agree to the EULA, click I ACCEPT, as shown in Figure 4.

If you agree to the additional EULAs, click I ACCEPT, as shown in Figure 5.

If you agree to the Export Control notice, click I ACCEPT, as shown in Figure 6.

Now we wait on the email to arrive, as shown in Figure 7.

Click on FREE TRIAL again.

Click on REQUEST AN IGEL HARDWARE EVALUATION, as shown in Figure 8.

Fill in the requested information and click GET YOUR FREE EVALUATION UNIT, as shown in Figure 9.

You receive emails similar to the ones shown in Figures 10 and 11.

An IGEL representative emails you soon confirming your shipping address for the requested IGEL device.

To learn the system requirements for the IGEL server, click the link shown in Figure 12.

Click Installation Requirements, as shown in Figure 13.

We install the IGEL Universal Management Suite (UMS) on the IGEL management server. IGEL is working on a Web App console and plans to move from the “fat” UMS console to the Web App console. Currently, the Web App console is more suited for the Helpdesk and not a whole administrator experience. Since this article series is preparatory for implementing VMware Horizon and Citrix Virtual Apps and Desktops, we install both the UMS and Web App Consoles.

Scroll down the web page and find the section labeled UMS with UMS Console, Embedded Database, and UMS Web App, as shown in Figure 14.

There is no requirement shown for the number of CPUs, so the 4 vCPU template is acceptable. The template has 90 GB of hard drive space, so there is plenty of free space. The only change required is increasing the RAM. I prefer an even number for RAM, so we can choose to go with 10 GB or 12 GB. The amount chosen depends on the amount of RAM the virtualization host has available.

Change RAM

VMware

In vCenter, right-click the LabIGEL VM, click Edit Settings…, and change the Memory setting, as shown in Figure 15

Power on the VM, enter the required hostname, enter the required IP address information, and install Windows Updates.

XenServer

Click on the LabIGEL VM, click the Memory tab, and click Edit…, as shown in Figure 16.

Select Set a fixed memory of and change the value to either 10.0 or 12.0, as shown in Figure 17.

Power on the VM, enter the required hostname, enter the required IP address information, and install Windows Updates.

Active Directory

We need to join our IGEL server to the domain.

First, we need to create an OU.

If you remember, when we created Active Directory in Part 14, I placed all my infrastructure servers in a specific OU.

Lab

Infrastructure

We place the IGEL server in an OU to allow for applying any required GPOs, if any.

Lab

Infrastructure

IGEL

From the lab’s management computer, start an elevated PowerShell session and type in the following, as shown in Figure 8.

Get-ADOrganizationalUnit -filter {Name -eq "Infrastructure"}

Create the IGEL OU.

Copy and paste the following into the elevated PowerShell session and press Enter, as shown in Figure 19.

Remember to set the values you need.

Note: Lines may wrap

#create the IGEL OU

$ADDomain = "LabADDomain"
$TLD = "com"
$Protect = $True

New-ADOrganizationalUnit -Name "IGEL" `
-Path "ou=Infrastructure,ou=Lab,dc=$ADDomain,dc=$TLD" `
-ProtectedFromAccidentalDeletion $Protect -verbose

Get-ADOrganizationalUnit -filter {Name -eq "IGEL"}

Copy the DistinguishedName property to the clipboard.

LabIGEL Server Work

Verify that the server has a static IP address and uses the IP addresses of the domain controllers for the DNS servers, as shown in Figure 20.

Verify that the server has the correct hostname, as shown in Figure 21.

Use mstsc to remote into the VM that is our IGEL server.

Exit Server Manager and start an elevated PowerShell session.

Copy and paste the following into the elevated PowerShell session and press Enter. The process took less than the blink of an eye to happen, which is why there is no screenshot.

Remember to set the values you need.

Note: Lines may wrap

#Join the computer to the domain

add-computer -Credential LabADDomain\Administrator `
-DomainName "LabADDomain.com" `
-OUPath "OU=IGEL,OU=Infrastructure,OU=Lab,DC=LabADDomain,DC=com" `
-Force `
-Restart

#server reboots

After the VM restarts, log in using the domain’s Administrator account and password.

Now to install the server certificate from the CA.

Save the following to a file name c:\CertFiles\computer-request.inf.

I want to thank Michael B. Smith for creating this INF file for me.

Use the data needed for your environment.

LabIGEL                   = the name of your IGEL server
LabADDomain.com           = your domain name
"LabCA\LabDomain CA Root" = the name of your CA server and the name of your CA.

;----------------- computer-request.inf -----------------
; LabIGEL.LabADDomain.com
;
; certreq -new computer-request.inf computer-request.req
; certreq -submit -config "LabCA\LabDomain CA Root" computer-request.req computer-request.cer
; certreq -accept -config "LabCA\LabDomain CA Root" computer-request.cer
;

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=LabIGEL.LabADDomain.com" ; replace with the FQDN of the IGEL server
FriendlyName = "Computer (Machine) for LabIGEL.LabADDomain.com"
KeyLength = 2048
; Can be 1024, 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
KeySpec = 1                     ; AT_KEYEXCHANGE
Exportable = TRUE               ; private-key is exportable
MachineKeySet = TRUE            ; goes in machine store instead of user's personal store
SMIME = False                   ; cannot be used for signing S/MIME messages
PrivateKeyArchive = FALSE
HashAlgorithm = sha256          ; "certutil -oid 1 | findstr pwszName" -- gives a list (including sha1)
UserProtected = FALSE
UseExistingKeySet = FALSE       ; we are not renewing a key that already exists
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12               ; for ProviderName and ProviderType, see "certutil -csplist"
RequestType = PKCS10            ; if empty or set to "CERT" then a self-signed cert is created
KeyUsage = 0xa0                 ; 0xa0 - CERT_DIGITAL_SIGNATURE_KEY_USAGE + CERT_KEY_ENCIPHERMENT_KEY_USAGE

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication - PKIX_KP_SERVER_AUTH

[Extensions]
; Note: 2.5.29.17 is the OID for a SAN extension.

2.5.29.17 = "{text}"
_continue_ = "dns=LabIGEL.LabADDomain.com"

[RequestAttributes]
CertificateTemplate = "Server Template"

;-----------------------------------------------

Open an elevated command prompt.

Type in cd c:\CertFiles and press Enter.

The three commands we need to run are at the top of the computer-request.inf file.

Type in notepad computer-request.inf and press Enter.

Copy the line certreq -new computer-request.inf computer-request.req, paste it in the elevated command prompt, and press Enter.

Copy the line certreq -submit -config “LabCA\LabDomain CA Root” computer-request.req computer-request.cer, paste it in the elevated command prompt, and press Enter.

Note: If you get a warning similar to the following, you can ignore the warning. The warning tells you that the certificate request validity period is past the lifetime of the CA’s root certificate lifespan.

Certificate retrieved(Issued)Issued The certificate validity period will be shorter than the Server Template Certificate Template specifies because the template validity period is longer than the maximum certificate validity period allowed by the CA.  Consider renewing the CA certificate, reducing the template validity period, or increasing the registry validity period.

Copy the line certreq -accept -config “LabCA\LabDomain CA Root” computer-request.cer, paste it in the elevated command prompt, and press Enter.

Figure 22 shows the results of running the certificate request commands.

License the UDP

The UDP has a different licensing process than other IGEL devices. It is easier if you license the UDP before installing and configuring the UMS console. UDP devices use their Unit ID for their license, where other IGEL devices use their MAC address. This allows you to use the UDP with different devices without consuming additional licenses because the license is tied to the Unit ID instead of the changing MAC address.

Plug the UDP into a computer, power the computer on, and press whatever key or key combination allows the computer to boot from the UDP.

You should be at an IGEL desktop with a Licensing icon on the desktop when the UDP boots. Double-click the Licensing icon, as shown in Figure 23.

Click the button with Click Here to Register, as shown in Figure 24.

If you accept the End User License Agreement, click accept, as shown in Figure 25.

If necessary, scroll down and click GET STARTED, as shown in Figure 26.

Fill in the required information, select I agree to the terms + conditions and privacy policy, optionally select Subscribe to IGEL communications, and click ACTIVATE YOUR UD POCKET, as shown in Figure 27.

Figure 28 shows that the license for the UDP is ready and states to reboot the UDP. Also, IGEL sent an email with additional instructions to the email address provided during activation.

Reboot the UDP by clicking the menu icon in the lower-left corner and clicking the restart icon, as shown in Figure 29.

Click OK, as shown in Figure 30.

Boot your device into the now licensed UDP.

Install IGEL Management Console

Earlier, when we created Active Directory, we created several administrator accounts. One of the accounts created is for this server, the UMSAdmin admin account. That account must be a member of the local Administrators group on the IGEL server.

Start an elevated PowerShell session on the IGEL server, and enter the following command, as shown in Figure 31.

Add-LocalGroupMember -Group "Administrators" -Member "LabADDomain\UMSAdmin"

In the email received, copy the Download the Universal Management Suite (UMS) link to the IGEL server, as shown in Figure 32, and download the UMS installer on the IGEL server.

Double-click the downloaded installer, as shown in Figure 33.

Note: The filename may be different for you as the software is continually updated.

Click Run, as shown in Figure 34.

Click Next, as shown in Figure 35.

Select I accept the agreement and click Next, as shown in Figure 36.

Click Next, as shown in Figure 37.

Click Next, as shown in Figure 38.

Leave the defaults selected and click Next, as shown in Figure 39.

Click Next, as shown in Figure 40.

Click Next, as shown in Figure 41.

Enter the Username and Password, and click Next, as shown in Figure 42. The installer does not accept any special characters like “\” or “@”. Both the Username and Password are CaSe sEnsiTivE.

Leave the defaults selected and click Next, as shown in Figure 43. The installer automatically creates the necessary Windows Firewall rules on the IGEL server for the selected firewall settings.

Click Next, as shown in Figure 44.

Click Install, as shown in Figure 45.

As shown in Figure 46, the installation begins.

Deselect Open UMS Web app in browser and click FInish, as shown in Figure 47. We need to install SSL certificates first.

Figure 43 shows the required Windows Firewall ports. The installer configured the necessary firewall rules automatically on the IGEL server, as shown in Figure 48.

Install SSL Certificates

Start the UMS Console by double-clicking the UMS Console icon on the server’s desktop, as shown in Figure 49.

Type in the server’s name, enter the credentials exactly as in Figure 34, and click Connect, as shown in Figure 50.

Click Ok, as shown in Figure 51.

Click UMS Administration, as shown in Figure 52.

In the left pane, expand Global Configuration, expand Certificate Management, and click Device Communication, as shown in Figure 53.

In the right pane, click the Import key pair(s) icon, as shown in Figure 54.

For the  File Name, enter \<Name of CA Server\c$\<folder containing the CA’s P12 backup file> and press Enter, as shown in Figure 55. For me, this is \LabCA\c$\CACertFiles.

Click the CA’s P12 backup file and click Open, as shown in Figure 56.

Type in the password for the P12 file and click Ok, as shown in Figure 57.

Click Ok, as shown in Figure 58.

The CA’s key pair shows in the console, as shown in Figure 59.

In the left pane, click Web, as shown in Figure 60.

In the right pane, click the Import certificate chain from keystore icon, as shown in Figure 61.

Click the P12 file and click Open, as shown in Figure 62.

Type in the password for the P12 file and click Ok, as shown in Figure 63.

Click OK, as shown in Figure 64.

The CA’s key pair shows in the console, as shown in Figure 65.

Click the imported key pair entry and click the Import root certificate icon, as shown in Figure 66.

Click the CA’s Root certificate file and click Open, as shown in Figure 67.

Right-click the imported key pair entry (the one with a green checkmark under Private Key known) and click Create signed certificate, as shown in Figure 68.

Select Create one end certificate for all (known) servers and click Ok, as shown in Figure 69.

Enter the first five fields of information and click Manage hostnames, as shown in Figure 70.

Under Assigned hostnames, the only entry needed is the IGEL server’s FQDN. Remove any other entries. If the IGEL server’s FQDN is not there, under Add hostname manually, type in the name of the IGEL server, and click Add.

Once the only entry is the IGEL server’s FQDN, click Close, as shown in Figure 71.

Click Ok, as shown in Figure 72.

Figure 73 shows the new server certificate.

Right-click the new server certificate and click Assign server, as shown in Figure 74.

Assign the server and click Ok, as shown in Figure 75.

Click Assign Certificate to server(s), as shown in Figure 76.

The new server certificate is assigned and shows as Used, as shown in Figure 77.

Leave the UMS console open.

Access the Web App Console

Although there is a UMS Web App icon in the UMS console, we can’t use that without getting an SSL certificate error. That icon uses the hostname of the IGEL server, not the FQDN. The Create signed certificate wizard doesn’t allow the addition of a hostname entry. To work around the SSL certificate error, using your internet browser, browse to https://IGELServerFQDN:8443/webapp, as shown in Figure 78. For me, that is https://LabIGEL.LabADDomain.com:8443/webapp.

Enter the CaSe seNseTivE account information used in Figure 42 and click Log in, as shown in Figure 79.

Figure 80 shows the Web App console.

We use this Web App console more in the Horizon and CVAD series.

Configuring and Using Your IGEL Device

Do you want your new IGEL device(s) initially registered automatically in the UMS console? I recommend doing so for this lab.

There are two ways to prepare for auto-registration, DNS or DHCP. For this lab, I recommend using DNS.

For more information, please read Registering Devices Automatically.

From the lab’s management computer, start an elevated PowerShell session and type in the following, as shown in Figure 81.

Add-DnsServerResourceRecordA `
-AllowUpdateAny `
-ComputerName "Name of First DC" `
-CreatePtr `
-IPv4Address "IP Address of UMS Server" `
-Name "igelrmserver" ` #not case sensitive
-TimeToLive 01:00:00 `
-ZoneName "Your AD domain name"

For me, this is:

Add-DnsServerResourceRecordA `
-AllowUpdateAny `
-ComputerName "LabDC1" `
-CreatePtr `
-IPv4Address "192.168.1.209" `
-Name "igelrmserver" ` #not case sensitive
-TimeToLive 01:00:00 `
-ZoneName "LabADDomain.com"

In the UMS console, click UMS Administration, expand Global Configuration, and click Device Network Settings in the left pane, as shown in Figure 82.

In the right pane, select Enable automatic registration (without MAC address import), as shown in Figure 83.

Click the Save (floppy) icon on the toolbar, as shown in Figure 84, to save the Automatic Registration change.

Reboot the UDP.

In the left pane, click Server – <IGEL Server Name>, click Devices, and click the Refresh icon on the toolbar, as shown in Figure 85. Your IGEL device(s) appear in the right pane.

Double-click the device to see all the details in the middle pane, as shown in Figure 86. Notice the 90-day device license.

Update the Firmware

In the left pane, right-click Universal Firmware Update, and click Check for firmware updates, as shown in Figure 87.

UMS now checks for any firmware updates, as shown in Figure 88. The checking could take several minutes.

You see a list of firmware updates when the checking process completes, as shown in Figure 89. I widened the dialog box to show more details.

To view the Release Notes for each firmware update, click the link in the appropriate column for either HTML or Text.

To download the firmware update to the IGEL server, select the checkbox in the Include column, and the Download button becomes available. Click Download, as shown in Figure 90.

If the firmware update contains important changes, you may receive a notification. Click Ok after reading the content, as shown in Figure 91.

As shown in Figure 92, the firmware download starts. Click Ok.

The firmware download status is displayed, as shown in Figure 93.

It may take several minutes to download the firmware update file.

If there are any errors, check the Error box for an explanation. Resolve the issue and attempt the download again. If you need to re-download the firmware, make sure you delete the faulty firmware download and empty the recycle bin before trying it again.

Once the download completes, as shown in Figure 94, we are ready to update the firmware on the UDP.

In the right pane (Assigned objects), click the “+“, as shown in Figure 95.

Select the UDP device and click Ok, as shown in Figure 96.

Select Now and click Ok, as shown in Figure 97.

The firmware is updated, and the UDP reboots (make sure to press the key to boot from the UDP). Once the reboot completes, refresh the UDP in UMS, and the console shows the UDP’s firmware is updated, as shown in Figure 98.

There are many changes the console allows, and they are beyond the scope of this article. Here are some IGEL resources for you.

Join the excellent IGEL Slack Community

IGEL COMMUNITY Tech Videos

Step-by-Step Guides

IGEL Community on GitHub

Up next: Create a ControlUp Management Server

Landing page for the article series

The next step is to create an additional management server VM from the Server 2019 template. We use the VM built in this article for an additional infrastructure server. My lab’s infrastructure VMs reside in my XenServer pool, as explained in the Introduction article. Building a server VM from the Server 2019 template was covered earlier.

From the introduction article, this is the VM we are building.

Follow the process covered earlier to build the server above, but do not power on the server. Before we power on the new server, we need to verify that the hardware meets Goliath Technologies’ (Goliath) requirements.

Request Trial

Goliath offers end-user experience monitoring and troubleshooting software with embedded intelligence and automation that enables IT pros to anticipate, troubleshoot, and document performance issues regardless of the location of workloads, applications, or users.

To receive a free trial of Goliath, use your internet browser and browse to https://goliathtechnologies.com/ and click on Free Trial, as shown in Figure 1.

Click Get Start With Your GPM Trial, as shown in Figure 2.

Fill in the requested information and click Submit, as shown in Figure 3.

While waiting on the email to arrive, click Prerequisites, as shown in Figure 4.

Click the link for Goliath Performance Monitor POC Prereq & Installation Guide, as shown in Figure 5.

When the PDF opens, scroll down to Goliath Performance Monitor Prerequisites, as shown in Figures 6 and 7.

From this information, we learn the following about the Goliath server’s VM:

• It needs a static IP address
• Increase the vCPUs to 8
• Increase the RAM to 12GB
• Requires the installation of an additional internet browser
• Requires Windows firewall configuration
• Requires Windows Defender configuration

Further down the PDF, there are also Windows Defender exclusions for the computers the Goliath monitors.

Following the process used for the other lab servers built, create a new VM from the Server 2019 template and do not power it on.

Change CPU and RAM

VMware

In vCenter, right-click the LabGoliath VM, click Edit Settings…, and change the CPU and Memory settings, as shown in Figure 8.

Power on the VM, enter the required hostname, enter the required IP address information, and install all Windows Updates.

XenServer

In the Properties for the LabGoliath VM, change the CPU to 8, as shown in Figure 9.

Click the Memory tab and click Edit…, as shown in Figure 10.

Select Set a fixed memory of and change the value to 12.0, as shown in Figure 11.

Power on the VM, enter the required hostname, enter the required IP address information, and install all Windows Updates.

Active Directory

We need to join our Goliath server to the domain.

First, we need to create an OU.

If you remember, when we created Active Directory in Part 14, I placed all my infrastructure servers in a specific OU.

Lab

Infrastructure

We place the Goliath server in an OU to apply GPOs for Windows Firewall and Windows Defender configurations.

Lab

Infrastructure

Goliath

From the lab’s management computer, start an elevated PowerShell session and type in the following, as shown in Figure 12.

Get-ADOrganizationalUnit -filter {Name -eq "Infrastructure"}

Create the Goliath OU.

Copy and paste the following into the elevated PowerShell session and press Enter, as shown in Figure 13.

Remember to set the values you need.

Note: Lines may wrap

#create the Goliath OU

$ADDomain = "LabADDomain"
$TLD = "com"
$Protect = $True

New-ADOrganizationalUnit -Name "Goliath" `
-Path "ou=Infrastructure,ou=Lab,dc=$ADDomain,dc=$TLD" `
-ProtectedFromAccidentalDeletion $Protect -verbose

Get-ADOrganizationalUnit -filter {Name -eq "Goliath"}

Copy the DistinguishedName property to the clipboard.

LabGoliath Server Work

Verify that the server has a static IP address and uses the IP addresses of the domain controllers for the DNS servers, as shown in Figure 14.

Verify that the server has the correct hostname, as shown in Figure 15.

Use mstsc to remote into the VM that is our Goliath server.

Exit Server Manager and start an elevated PowerShell session.

Copy and paste the following into the elevated PowerShell session and press Enter. The process took less than the blink of an eye to happen, which is why there is no screenshot.

Remember to set the values you need.

Note: Lines may wrap

#Join the computer to the domain

add-computer -Credential LabADDomain\Administrator `
-DomainName "LabADDomain.com" `
-OUPath "OU=Goliath,OU=Infrastructure,OU=Lab,DC=LabADDomain,DC=com" `
-Force `
-Restart

#server reboots

After the VM restarts, log in using the domain’s Administrator account and password.

Now to install the server certificate from the CA.

Save the following to a file name c:\CertFiles\computer-request.inf.

I want to thank Michael B. Smith for creating this INF file for me.

Use the data needed for your environment.

LabGoliath                = the name of your Goliath server
LabADDomain.com           = your domain name
"LabCA\LabDomain CA Root" = the name of your CA server and the name of your CA.

;----------------- computer-request.inf -----------------
; LabGoliath.LabADDomain.com
;
; certreq -new computer-request.inf computer-request.req
; certreq -submit -config "LabCA\LabDomain CA Root" computer-request.req computer-request.cer
; certreq -accept -config "LabCA\LabDomain CA Root" computer-request.cer
;

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=LabGoliath.LabADDomain.com" ; replace with the FQDN of the File Server
FriendlyName = "Computer (Machine) for LabGoliath.LabADDomain.com"
KeyLength = 2048
; Can be 1024, 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
KeySpec = 1                     ; AT_KEYEXCHANGE
Exportable = TRUE               ; private-key is exportable
MachineKeySet = TRUE            ; goes in machine store instead of user's personal store
SMIME = False                   ; cannot be used for signing S/MIME messages
PrivateKeyArchive = FALSE
HashAlgorithm = sha256          ; "certutil -oid 1 | findstr pwszName" -- gives a list (including sha1)
UserProtected = FALSE
UseExistingKeySet = FALSE       ; we are not renewing a key that already exists
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12               ; for ProviderName and ProviderType, see "certutil -csplist"
RequestType = PKCS10            ; if empty or set to "CERT" then a self-signed cert is created
KeyUsage = 0xa0                 ; 0xa0 - CERT_DIGITAL_SIGNATURE_KEY_USAGE + CERT_KEY_ENCIPHERMENT_KEY_USAGE

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication - PKIX_KP_SERVER_AUTH

[Extensions]
; Note: 2.5.29.17 is the OID for a SAN extension.

2.5.29.17 = "{text}"
_continue_ = "dns=LabGoliath.LabADDomain.com"

[RequestAttributes]
CertificateTemplate = "Server Template"

;-----------------------------------------------

Open an elevated command prompt.

Type in cd c:\CertFiles and press Enter.

The three commands we need to run are at the top of the computer-request.inf file.

Type in notepad computer-request.inf and press Enter.

Copy the line certreq -new computer-request.inf computer-request.req, paste it in the elevated command prompt, and press Enter.

Copy the line certreq -submit -config “LabCA\LabDomain CA Root” computer-request.req computer-request.cer, paste it in the elevated command prompt, and press Enter.

Note: If you get a warning similar to the following, you can ignore the warning. The warning tells you that the certificate request validity period is past the lifetime of the CA’s root certificate lifespan.

Certificate retrieved(Issued)Issued The certificate validity period will be shorter than the Server Template Certificate Template specifies because the template validity period is longer than the maximum certificate validity period allowed by the CA.  Consider renewing the CA certificate, reducing the template validity period, or increasing the registry validity period.

Copy the line certreq -accept -config “LabCA\LabDomain CA Root” computer-request.cer, paste it in the elevated command prompt, and press Enter.

Figure 16 shows the results of running the certificate request commands.

Install Goliath Performance Monitor

You receive an email similar to the one shown in Figure 17.

Later you receive an email similar to the one shown in Figure 18 with links to download the software.

Extract the files to C:\Goliath, as shown in Figure 19.

Double-click GoliathServer.exe.

The install starts, as shown in Figure 20.

Click Next, as shown in Figure 21.

Select I agree to the terms of this license agreement and click Next, as shown in Figure 22.

If Goliath sent you a License Key, enter it here and then click Next, as shown in Figure 23. If you do not have a license key, click Next and stay with the 30-day evaluation period.

Verify the Static IP address is correct and click Next, as shown in Figure 24.

The installer verifies that the TCP Port entered for Enter Console is valid and available.

Click Next, as shown in Figure 25.

Select (Default) Embedded SQL Express and click Next, as shown in Figure 26.

Verify all the information is correct and click Next, as shown in Figure 27. If any information is not correct, click Back, correct the information and continue.

The installation starts, as shown in Figure 28.

After several minutes (ten minutes in my lab), the installation completes. Click Finish, as shown in Figure 29.

Before continuing, install an additional internet browser. I installed Google Chrome because I could not get the installer for the new Microsoft Edge to work from Internet Explorer 11 (IE11).

The backend Goliath monitor processes require IE11, but Goliath requires a modern browser to use the management console.

GPOs

Before configuring the Goliath Performance Monitor, we need four GPOs created.

1. One for the Goliath server Windows Firewall ports
2. One for the Goliath server Windows Defender exclusions
3. One for the monitored computers Windows Firewall ports
4. One for the monitored computers Windows Defender exclusions

On the Lab management computer, open the Group Policy Management Console (GPMC).

In the Group Policy Objects node, create and name four GPOs. For example, I named mine as follows.

• (C) Goliath Windows Defender Exclusions – linked at the domain level, Deny applied to LabGoliath
• (C) Goliath Windows Firewall Ports – linked at the domain level, Deny applied to LabGoliath
• (C) Goliath Server Windows Defender Exclusions – linked to the Goliath OU and applied only to the LabGoliath computer account
• (C) Goliath Server Windows Firewall Ports – linked to the Goliath OU and applied only to the LabGoliath computer account

Let’s work on the (C) Goliath Server Windows Firewall Ports GPO first.

We need the following Windows Firewall ports configured for the server from the Goliath Prereq and Install Guide PDF.

Goliath Server

• HTTPS 443*/TCP 47629 opened inbound and outbound for web console connection
• HTTPS 443* opened inbound for agent connection to agent location
• TCP 135, 445, 49164 open outbound for remote agent installation via web console

In the GPMC, right-click the (C) Goliath Server Windows Firewall Ports GPO in the Group Policy Object node and click Edit, as shown in Figure 30.

Expand Policies.

Expand Windows Settings.

Expand Security Settings.

Expand Windows Defender Firewall with Advanced Security.

Expand Windows Defender Firewall with Advanced Security.

Right-click Inbound Rules and click New Rule…, as shown in Figure 31.

Select Port and click Next, as shown in Figure 32.

Select TCP, select Specific local ports, enter 443,47629, and click Next, as shown in Figure 33.

Select Allow the connection and click Next, as shown in Figure 34.

Click Next, as shown in Figure 35.

Enter a Name and click Next, as shown in Figure 36.

Right-click Outbound Rules and click New Rule…, as shown in Figure 37.

Select Port and click Next, as shown in Figure 38.

Select TCP, select Specific remote ports, enter 135,443,445,47629,49164, and click Next, as shown in Figure 39.

Select Allow the connection and click Next, as shown in Figure 40.

Click Next, as shown in Figure 41.

Enter a Name and click Finish, as shown in Figure 42.

Exit the Group Policy Management Editor (GPME).

This GPO applies only to the Goliath server.

In the middle pane, in Security Filtering, click on Authenticated Users and click Remove, as shown in Figure 43.

Click OK, as shown in Figure 44.

Click OK, as shown in Figure 45.

Click Add, as shown in Figure 46.

Click Object Types…, as shown in Figure 47.

Select only Computers and click OK, as shown in Figure 48.

Type in the name of the Goliath server and click Check Names, as shown in Figure 49.

Once the computer name is verified, click OK, as shown in Figure 50.

Now on to the (C) Goliath Server Windows Defender Exclusions GPO.

From the Prereq & Install Guide PDF, here are the exclusions needed for the Goliath server.

• Main Goliath Server
  • Directory Exclusions:
    • \Program Files (x86)\MonitorIT\** – This is the install directory of the Goliath Server, the local Agent, and relevant files (please include all subfolders/files)
    • \Windows\System32\inetsrv\** – This is the install directory of the IIS Web Server
  • Process Exclusions:
    • exe – This is the process launched by the Agent’s Service
    • exe – This is the process launched by the Server’s Service
    • exe – Process supporting the Agent’s Windows Service
    • exe – Supports hypervisor API communication
    • exe – This is the process for the IIS Web Server
    • exe – Process supporting the Goliath Server’s Windows Service
    • exe – (Optional component) Used to support sending alerts and notifications via SSL/TLS enabled mail servers
    • exe – (Optional component) Used if GAAM is running locally

In the left pane, right-click the (C) Goliath Server Windows Defender Exclusions GPO and click Edit.

Expand Policies.

Expand Administrative Templates.

Expand Windows Components.

Expand Windows Defender Antivirus.

In the left pane, click on Exclusions, and in the middle pane, double-click Path Exclusions, as shown in Figure 51.

Select Enabled and click Show…, as shown in Figure 52.

Enter the following, as shown in Figure 53, and click OK.

Click OK, as shown in Figure 54.

Double-click Process Exclusions, as shown in Figure 55.

Select Enabled and click Show…, as shown in Figure 56.

Enter the following, as shown in Figure 57, and click OK.

Click OK, as shown in Figure 58.

Exit the GPME.

Follow the same process as shown in Figures 43 through 50 to remove Authenticated Users and add the Goliath server, as shown in Figure 59.

Scroll to the up in the GPMC.

Expand Domains.

Expand your AD domain.

Expand the Lab OU.

Expand the Infrastructure OU.

Right-click the Goliath OU and click Link an Existing GPO…, as shown in Figure 60.

Select both Goliath server GPOs and click OK, as shown in Figure 61.

Now that we have the two Goliath server GPOs created, on to the GPOs for the monitored computers.

Let’s work on the (C) Goliath Windows Firewall Ports GPO first.

From the Goliath Prereq and Install Guide PDF, we need the following Windows Firewall ports configured for the monitored computers.

Goliath Intelligent Agent

• HTTPS 443* opened outbound for agent connection to the Goliath Server
• TCP 135, 445, 49164 open inbound for remote agent installation via web console

In the GPMC, right-click the (C) Goliath Windows Firewall Ports GPO in the Group Policy Object node and click Edit.

Expand Policies.

Expand Windows Settings.

Expand Security Settings.

Expand Windows Defender Firewall with Advanced Security.

Expand Windows Defender Firewall with Advanced Security.

Right-click Inbound Rules and click New Rule…, as shown in Figure 62.

Select Port and click Next, as shown in Figure 63.

Select TCP, select Specific local ports, enter 135,443,49164, and click Next, as shown in Figure 64.

Select Allow the connection and click Next, as shown in Figure 65.

Click Next, as shown in Figure 66.

Enter a Name and click Next, as shown in Figure 67.

Right-click Outbound Rules and click New Rule…, as shown in Figure 68.

Select Port and click Next, as shown in Figure 69.

Select TCP, select Specific remote ports, enter 443, and click Next, as shown in Figure 70.

Select Allow the connection and click Next, as shown in Figure 71.

Click Next, as shown in Figure 72.

Enter a Name and click Finish, as shown in Figure 73.

Exit the Group Policy Management Editor (GPME).

This GPO applies to the computers monitored by the Goliath server.

Now on to the (C) Goliath Windows Defender Exclusions GPO.

From the Prereq & Install Guide PDF, here are the exclusions needed for the monitored computers.

• VMs/Servers with Agents on them (Citrix machines, VMware Horizon machines, VMs, etc)
  • Directory Exclusions:
    • Path: “\Program Files\MonitorIT” & “C:\Users\All Users\Goliath”
    • Ensure recursive exclusions for the subfolders is allowed
  • Process Exclusions:
    • exe – This is the process launched by the Agent’s Service
    • exe – Process supporting the Agent’s Windows Service

In the left pane, right-click the (C) Goliath Windows Defender Exclusions GPO and click Edit.

Expand Policies.

Expand Administrative Templates.

Expand Windows Components.

Expand Windows Defender Antivirus.

In the left pane, click on Exclusions, and in the middle pane, double-click Path Exclusions, as shown in Figure 74.

Select Enabled and click Show…, as shown in Figure 75.

Enter the following, as shown in Figure 76, and click OK.

Click OK, as shown in Figure 77.

Double-click Process Exclusions, as shown in Figure 78.

Select Enabled and click Show…, as shown in Figure 79.

Enter the following, as shown in Figure 80, and click OK.

Click OK, as shown in Figure 81.

Exit the GPME.

Collapse the Lab OU.

These two GPOs do not apply to the Goliath server. To do that, we configure a GPO Deny Policy. A Deny right is not something you should do as a normal course of working with GPOs as it complicates GPO troubleshooting.

Click on the (C) Goliath Windows Defender Exclusions GPO, and in the middle pane, click the Delegation tab and click Advanced, as shown in Figure 82.

Click Add…, as shown in Figure 83.

Click on Object Types…, as shown in Figure 84.

Select only Computers and click OK, as shown in Figure 85.

Type in the name of the Goliath server and click Check Names, as shown in Figure 86.

When the server name is validated, click OK, as shown in Figure 87.

Verify that the Goliath server is selected, and in the Permissions area, scroll down and select Deny for Apply group policy, as shown in Figure 88. Do NOT change any other permission.

Click Yes, as shown in Figure 89.

Right-click the GPO and click Edit, as shown in Figure 90.

Right-click the top level of the GPO and click Properties, as shown in Figure 91.

Click the Comment tab. For the comment, type in Deny for the server <Goliath server name>, and click OK, as shown in Figure 92. This comment makes it easier when troubleshooting the GPO later.

Exit the GPME.

In the middle pane, click the Details tab, and the comment you enter shows in Figure 93.

Repeat the process to add the Deny permission to the other GPO.

Scroll to the top in the GPMC.

Expand Domains.

Expand your AD domain.

Right-click the domain and click Link an Existing GPO…, as shown in Figure 94.

Select both Goliath monitoring GPOs and click OK, as shown in Figure 95.

The two GPOs are now linked at the domain level, as shown in Figure 96.

To verify the GPOs work, log in to the file server and the Goliath server.

Tip: If the GPOs do not work at first, either restart the VM or do a Right-click Start, Run, gpupdate. Then log off and back on to see if it took effect. Gpupdate is a command-line utility from Microsoft that comes with all versions of the Windows operating system to refresh the Group Policy engine on the client. There are many ways of running gpupdate. As an administrator, you can even force a group policy refresh remotely using PowerShell or the GPMC.

On the Goliath server, right-click Start, Run, wf.msc, and Windows Defender Firewall with Advanced Security starts, as shown in Figure 97.

Click Inbound Rules and verify that the Inbound Firewall Rule configured by the GPO is there, as shown in Figure 98.

Do the same verification for the Outbound Rules, as shown in Figure 99.

Exit Windows Defender Firewall with Advanced Security.

To verify the Windows Defender Exclusions, click Start, Settings, Update & Security, Windows Security, and Virus & threat protection, as shown in Figure 100.

Under Virus & threat protection settings, click Manage settings, as shown in Figure 101.

Scroll down to Exclusions and click Add or remove exclusions, as shown in Figure 102.

Figure 103 shows the Exclusions are in place.

Follow the same process to validate the GPO settings on the file server, as shown in Figures 104 through 106.

Configuring Goliath Performance Monitor

Configure IIS

Before we continue, we need to add the Goliath server’s SSL certificate to Internet Information Services (IIS).

Start IIS Manager.

Click Start, expand Windows Administrative Tools, and click Internet Information Services (IIS)…, as shown in Figure 107.

In the left pane, expand <Goliath server name>, expand Sites, click GoliathWeb, in the middle pane click SSL Settings, and in the right pane, click Bindings…, as shown in Figure 108.

Click Add…, as shown in Figure 109.

Select https from the Type dropdown list, as shown in Figure 110.

From the SSL certificate dropdown, select the Goliath server’s certificate, as shown in Figure 111.

Click OK, as shown in Figure 112.

Select the http binding and click Remove, as shown in Figure 113.

Click Yes, as shown in Figure 114.

Click Edit, as shown in Figure 115.

Select the IP address of the Goliath server from the dropdown, as shown in Figure 116.

Click OK, as shown in Figure 117.

Click Close, as shown in Figure 118.

Exit the IIS Manager console.

Add vCenter and the XenServer Pool

From either the Goliath server or the management computer, from your non-IE11 internet browser, browse to https://GoliathServerFQDN, as shown in Figure 119. For me, that is https://LabGoliath.LabADDomain.com.

Note: For the configuration steps, I am using the Goliath server.

Notice that the padlock shows that our SSL certificate is working.

Click Settings, as shown in Figure 120.

Click Configure VMware Virtual Environment, as shown in Figure 121.

Click Add, as shown in Figure 122.

Enter the FQDN for vCenter, enter the User Name and Password for the Read-only service account created earlier, select VMware vCenter Server from the Type dropdown, and click Connect, as shown in Figure 123.

After a successful connection, click Apply, as shown in Figure 124.

The vCenter server is added. Click Add to add the XenServer Pool, as shown in Figure 125.

Enter the FQDN for the XenServer Pool, enter the User Name and Password for the Read-only service account created earlier, select Citrix XenServer Pool Master from the Type dropdown, and click Connect, as shown in Figure 126.

After a successful connection, click Apply, as shown in Figure 127.

The XenServer Pool is added. Click Next, as shown in Figure 128.

Select all hosts and click the >>, as shown in Figure 129. Notice the license information.

All the hosts are licensed. Click Next, as shown in Figure 130.

Click Finished, as shown in Figure 131.

Click Inventory, as shown in Figure 132.

After several minutes, the inventory starts building and shows in the browser, as shown in Figure 133.

Click Dashboard to get an overview of the virtual hosting environments, as shown in Figure 134.

Configure Security

Click Settings, as shown in Figure 135.

In the left pane, click Security and User Accounts, as shown in Figure 136.

We need to add our admin and helpdesk users. First up are the admins.

Click New, as shown in Figure 137.

Select Use Active Directory and click the “…“, as shown in Figure 138.

Browse, find and select one admin account, and click OK, as shown in Figure 139.

Use the following settings, and click Save, as shown in Figure 140.

• Enter an optional Description
• Select Allow Administrator and select Full Rights
  • Provides full Administration rights.
• Select Allow Analysis and select Full Rights
  • Provides full Analyst rights to view, edit, and create Graphs, Reports and start/stop Monitoring.
• Select Allow Server/Device Maintenance and select Full Rights
  • Is allowed to manage Server/Device Maintenance Schedules via the Server/Device Maintenance function.
• Select Allow Agent Install Download
  • Is allowed to initiate an Agent download installation via the InstallAgent.htm page.

Repeat the process shown in Figures 137 through 140 to add additional full admins. In addition, you may want to add the domain’s Administrator account.

Now for the helpdesk accounts.

Click New, select Use Active Directory, click the “…“, browse, find and select one helpdesk account, and click OK, as shown in Figure 141.

Use the following settings, and click Save, as shown in Figure 142.

• Enter an optional Description
• Select Allow Administrator and select Limited Rights
  • Provides full Administration rights EXCEPT no access to Configure->Security, Utilities->Database Maintenance, SMTP Server Parameters for All Email & Email Group Delete, and assigning ownership for Reports or Graphs, assigning them to All users or their logon Name.
• Select Allow Analysis and select View Only
  • Provides restricted Analyst rights to view only on Graphs, Reports and not permitted to schedule reports or start/stop monitoring.
• Select Allow Server/Device Maintenance and select View Only
  • Is allowed to view Server/Device Maintenance Schedules via the Server/Device Maintenance function.
• Select Allow Agent Install Download
  • Is allowed to initiate an Agent download installation via the InstallAgent.htm page.

Under Global Security Settings, select Enable Security, and click Apply as shown in Figure 143. Enabling security means access to the GPM Console requires log-in credentials.

Click OK, as shown in Figure 144.

The next connection to GPM requires a log-in.

Install Agents on Servers

Note: For this process, I am using the management computer.

From the management computer, from your non-IE11 internet browser, browse to https://GoliathServerFQDN. For me, that is https://LabGoliath.LabADDomain.com.

If the Configuration Wizard doesn’t start (as it did for me), click Settings, as shown in Figure 145.

Click Configuration Wizard, as shown in Figure 146.

Select Application and click Next, as shown in Figure 147.

Because I intend to install the agent on every server, including the domain controllers, enter the domain’s administrator account credentials, and click Next, as shown in Figure 148.

Select Active Directory and click Next, as shown in Figure 149.

Browse through the OU tree, select which computers to install the Goliath agent, and click Next, as shown in Figure 150.

After the agent installs on the selected computers, click Next, as shown in Figure 151.

Select which applications you wish to monitor. I selected the following:

• Active Directory
• Microsoft IIS
• Microsoft SQL Server
• SSL & Communication Errors
• User Logon Problems
• VMware vCenter
• Windows Health
• Windows Security Auditing

Once you have selected applications, click Next, as shown in Figure 152.

Click Finish, as shown in Figure 153.

The Goliath server is ready for use. You can contact Goliath to schedule a time to have someone review the console in detail with you.

Uninstall Agents on Servers

To uninstall the agents we installed using the console, click Configure, click Inventory, select the computers with the agents to uninstall, and click Delete, as shown in Figure 154.

This process uninstalls the agent from the selected computers and removes the selected computers from the Goliath console.

Click OK to uninstall the agents, as shown in Figure 155.

The selected computers no longer appear in the console, as shown in Figure 156.

Log into each selected computer and delete the MonitorIT folder located by default in the “C:\Program Files” parent folder if desired.

Up next: Create an IGEL Management Server

Landing page for the article series

The next step is to create an additional management server VM from the Server 2019 template. We use the VM built in this article for an additional infrastructure server. My lab’s infrastructure VMs reside in my XenServer pool, as explained in the Introduction article. Building a server VM from the Server 2019 template was covered earlier.

From the introduction article, this is the VM we are building.

Follow the process covered earlier to build the server above. Then, power on the VM, enter the required hostname, enter the required IP address information, and install all Windows Updates.

You may wish to download a modern browser to keep from using Internet Explorer 11. I downloaded Google Chrome.

Request Trial

10ZiG Technology provides cutting-edge Thin Clients and Zero Clients for the latest virtual desktop infrastructure solutions. Their VMware, Citrix, and Microsoft-ready hardware is designed to suit all user types, from those requiring low-level application support such as Microsoft Office, right through to power users requiring HD Video/Audio, Flash/HTML5, video conferencing, 3D, CAD, and 4K resolution.

To receive a free trial of 10Zig devices, use your internet browser and browse to https://10zig.com/ and click on TEST DRIVE OUR DEVICES, as shown in Figure 1.

As shown in Figures 2 through 5, fill in the requested information and click Submit.

To request the download link for the 10ZiG Management Software, click FREE ENTERPRISE MANAGEMENT, as shown in Figure 6.

Scroll down the page, fill in the requested information, and click Submit, as shown in Figure 7.

While we wait on the email to arrive, let’s continue with work on the server.

Active Directory

We need to join our 10ZiG server to the domain.

First, we need to create an OU.

If you remember, when we created Active Directory in Part 14, I placed all my infrastructure servers in a specific OU.

Lab

Infrastructure

We place the 10ZiG server in an OU to allow for applying any required GPOs if any.

Lab

Infrastructure

10ZiG

From the lab’s management computer, start an elevated PowerShell session and type in the following, as shown in Figure 8.

Get-ADOrganizationalUnit -filter {Name -eq "Infrastructure"}

Create the 10ZiG OU.

Copy and paste the following into the elevated PowerShell session and press Enter, as shown in Figure 9.

Remember to set the values you need.

Note: Lines may wrap

#create the 10ZiG OU

$ADDomain = "LabADDomain"
$TLD = "com"
$Protect = $True

New-ADOrganizationalUnit -Name "10ZiG" `
-Path "ou=Infrastructure,ou=Lab,dc=$ADDomain,dc=$TLD" `
-ProtectedFromAccidentalDeletion $Protect -verbose

Get-ADOrganizationalUnit -filter {Name -eq "10ZiG"}

Copy the DistinguishedName property to the clipboard.

Lab10ZiG Server Work

Verify that the server has a static IP address and uses the IP addresses of the domain controllers for the DNS servers, as shown in Figure 10.

Verify that the server has the correct hostname, as shown in Figure 11.

Use mstsc to remote into the VM that is our 10ZiG server.

Exit Server Manager and start an elevated PowerShell session.

Copy and paste the following into the elevated PowerShell session and press Enter. The process took less than the blink of an eye to happen, which is why there is no screenshot.

Remember to set the values you need.

Note: Lines may wrap

#Join the computer to the domain

add-computer -Credential LabADDomain\Administrator `
-DomainName "LabADDomain.com" `
-OUPath "OU=10ZiG,OU=Infrastructure,OU=Lab,DC=LabADDomain,DC=com" `
-Force `
-Restart

#server reboots

After the VM restarts, log in using the domain’s Administrator account and password.

Now to install the server certificate from the CA.

Save the following to a file name c:\CertFiles\computer-request.inf.

I want to thank Michael B. Smith for creating this INF file for me.

Use the data needed for your environment.

Lab10ZiG                  = the name of your 10ZiG server
LabADDomain.com           = your domain name
"LabCA\LabDomain CA Root" = the name of your CA server and the name of your CA.

;----------------- computer-request.inf -----------------
; Lab10ZiG.LabADDomain.com
;
; certreq -new computer-request.inf computer-request.req
; certreq -submit -config "LabCA\LabDomain CA Root" computer-request.req computer-request.cer
; certreq -accept -config "LabCA\LabDomain CA Root" computer-request.cer
;

[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=Lab10ZiG.LabADDomain.com" ; replace with the FQDN of the 10ZiG server
FriendlyName = "Computer (Machine) for Lab10ZiG.LabADDomain.com"
KeyLength = 2048
; Can be 1024, 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
KeySpec = 1                     ; AT_KEYEXCHANGE
Exportable = TRUE               ; private-key is exportable
MachineKeySet = TRUE            ; goes in machine store instead of user's personal store
SMIME = False                   ; cannot be used for signing S/MIME messages
PrivateKeyArchive = FALSE
HashAlgorithm = sha256          ; "certutil -oid 1 | findstr pwszName" -- gives a list (including sha1)
UserProtected = FALSE
UseExistingKeySet = FALSE       ; we are not renewing a key that already exists
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12               ; for ProviderName and ProviderType, see "certutil -csplist"
RequestType = PKCS10            ; if empty or set to "CERT" then a self-signed cert is created
KeyUsage = 0xa0                 ; 0xa0 - CERT_DIGITAL_SIGNATURE_KEY_USAGE + CERT_KEY_ENCIPHERMENT_KEY_USAGE

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication - PKIX_KP_SERVER_AUTH

[Extensions]
; Note: 2.5.29.17 is the OID for a SAN extension.

2.5.29.17 = "{text}"
_continue_ = "dns=Lab10ZiG.LabADDomain.com"

[RequestAttributes]
CertificateTemplate = "Server Template"

;-----------------------------------------------

Open an elevated command prompt.

Type in cd c:\CertFiles and press Enter.

The three commands we need to run are at the top of the computer-request.inf file.

Type in notepad computer-request.inf and press Enter.

Copy the line certreq -new computer-request.inf computer-request.req, paste it in the elevated command prompt, and press Enter.

Copy the line certreq -submit -config “LabCA\LabDomain CA Root” computer-request.req computer-request.cer, paste it in the elevated command prompt, and press Enter.

Note: If you get a warning similar to the following, you can ignore the warning. The warning tells you that the certificate request validity period is past the lifetime of the CA’s root certificate lifespan.

Certificate retrieved(Issued)Issued The certificate validity period will be shorter than the Server Template Certificate Template specifies because the template validity period is longer than the maximum certificate validity period allowed by the CA.  Consider renewing the CA certificate, reducing the template validity period, or increasing the registry validity period.

Copy the line certreq -accept -config “LabCA\LabDomain CA Root” computer-request.cer, paste it in the elevated command prompt, and press Enter.

Figure 12 shows the results of running the certificate request commands.

Install 10ZiG Management Console

You receive an email similar to the one shown in Figure 13 to download the 10ZiG Manager software. Attached to the email is a PDF for 10ZiG Web Console Quick Start Guide.

Click the link provided in the email or browse to https://www.10zig.com/resources/10-zig-manager/10zig-manager-download-instructions.

Click INSTALLATION PACKAGE, as shown in Figure 14.

Double-click the downloaded installer, as shown in Figure 15.

Note: The filename may be different for you as the software is continually updated.

Click Run, as shown in Figure 16.

Type in the password given in the email and click OK, as shown in Figure 17.

Click Next, as shown in Figure 18.

Leave all components selected and click Next, as shown in Figure 19.

Click Install, as shown in Figure 20.

The installation begins, as shown in Figure 21.

Because we have a computer certificate from the domain’s Certificate Authority, select Use an existing certificate and click Choose…, as shown in Figure 22.

Click OK, as shown in Figure 23.

Click Next, as shown in Figure 24.

Click Next, as shown in Figure 25.

Click Install, as shown in Figure 26.

Click Yes, as shown in Figure 27.

The installation continues, as shown in Figure 28.

After several minutes, the installation is almost complete. Click Next, as shown in Figure 29.

Type in C:\ImageStore for the Share Path, enter the domain’s administrator credentials and click Create, as shown in Figure 30.

Click Yes to create the C:\ImageStore folder, as shown in Figure 31.

The C:\ImageStore folder and share are created. Click OK, as shown in Figure 32.

Click Yes, to allow 10ZiG to create a DNS record making your life easier, as shown in Figure 33.

Click Next, as shown in Figure 34.

Select Reboot now and click Finish, as shown in Figure 35.

Let’s verify that the installation created a DNS SRV record.

Note: What is a DNS SRV record? An SRV record is a type of information record in DNS that maps the name of a service to a server’s DNS name that offers that service. Domain controllers advertise their capabilities by publishing SRV records in DNS.

On the lab management computer, open the DNS console, expand the DNS server, expand Forward Lookup Zones, expand your DNS domain, and click on _udp­, as shown in Figure 36. We should see in the right pane an SRV record with the name _tzmgr_discovery.

OOPS, it’s not there. There is nothing to worry about, as creating the SRV record is simple.

If you click the _tcp node, the SRV record is also not there.

Right-click the _udp­ node in the DNS console and click Other New Records…, as shown in Figure 37.

Scroll down, click Service Location (SRV), and click Create Record…, as shown in Figure 38.

Type in the following information and click OK, as shown in Figure 39.

• Service: _tzmgr_discovery
• Protocol: _udp
• Priority: 0
• Weight: 100
• Port number: 52500
• Host offering this service: LabADDomain.com (the FQDN of your 10ZiG server)

Click Done, as shown in Figure 40.

The SRV record is now in DNS, as shown in Figure 41.

Repeat the process for the _tcp node, but use _tcp for the Protocol.

Of course, you can also do the same thing in PowerShell, as shown in Figure 42.

Add-DnsServerResourceRecord `
-Srv `
-ZoneName LabADDomain.com `
-Name _tzmgr_discovery._udp `
-DomainName LabADDomain.com `
-weight 0 `
-priority 100 `
-port 52500 `
-Computername LabDC1

Add-DnsServerResourceRecord `
-Srv `
-ZoneName LabADDomain.com `
-Name _tzmgr_discovery._tcp `
-DomainName LabADDomain.com `
-weight 0 `
-priority 100 `
-port 52500 `
-Computername LabDC1

Configuring 10ZiG Devices

Once you receive the 10ZiG device(s), connect them to your network and start the 10ZiG Manager Console by double-clicking the 10ZiG Manager Console icon on the server’s desktop, as shown in Figure 43.

You can see the two devices 10ZiG sent me in the console, as shown in Figure 44.

The top device uses WiFi, and the bottom device connects via an ethernet cable.

If your devices do not show, click the wrench icon on the toolbar, as shown in Figure 45.

Click the Discovery tab and click the “+” symbol, as shown in Figure 46.

Enter the IP Range to search and click Save, as shown in Figure 47. I am using the scope range from my DHCP server since all thin clients receive an IP address from the DHCP server, as shown in Figure 48.

The first thing I want to do is make sure the devices have the current firmware.

You can browse to 10ZiG.com and search for “firmware” or browse to https://www.10zig.com/resources/firmware, as shown in Figure 50.

I downloaded the NOS Zero Client for Citrix 64-Bit firmware update.

Click the firmware update needed, and another page is displayed. Click the link to download the Current Firmware Version, as shown in Figure 51.

Note: 10ZiG continually updates firmware, so the version numbers can differ.

Right-click the device and click Firmware update, as shown in Figure 52.

Click Install…, as shown in Figure 53.

Select the just downloaded firmware file and click Open, as shown in Figure 54.

The firmware file was copied to C:\ImageStore and installed in the console, as shown in Figures 55 and 56.

The new firmware is now in the Firmware file list. Select the new firmware file and click Apply, as shown in Figure 57.

Click OK, as shown in Figure 58.

The firmware update installs, the 10ZiG device reboots, and the console shows the updated firmware version, as shown in Figure 59.

To update the client on a 10ZiG Windows 10 IoT thin client, browse to https://www.10zig.com/resources/10-zig-manager/10zig-manager-download-instructions.

Click XTC AGENT, as shown in Figure 60.

After the XTC Agent downloads, right-click the Windows 10 IoT thin client, click XTC Agent update, and click Manage packages…, as shown in Figure 61.

Click Add, as shown in Figure 62.

Browse to the folder containing the XTC Agent download, click the file, and click Open, as shown in Figure 63.

Note: File version numbers can differ.

The file is copied to C:\ImageStore\XtaPackages, as shown in Figure 64.

The file shows in the list of XTC Agent installer packages. Click Exit, as shown in Figure 65.

Right-click the Windows 10 IoT thin client, click XTC Agent update, and click Update to latest, as shown in Figure 66.

Verify that the agent version displayed in the popup is the same as the downloaded file and click OK, as shown in Figure 67.

The firmware update installs, the 10ZiG device reboots, and the console shows the updated agent version, as shown in Figure 68.

Using the 10ZiG Web Console

As part of the 10ZiG Management Console installation, the new Web Console was part of the installation.

From the Lab Management computer, browse to https://<10ZiG Server FQDN>. For me, that is https://Lab10ZiG.LabADDomain.com, as shown in Figure 69.

Enter the domain’s administrator credential and click Login, as shown in Figure 70.

Decide whether to take the “First-time use tour”, as shown in Figure 71. I took the tour, and it was thorough.

The web console loads, as shown in Figure 72.

I prefer web consoles, as they allow management from any network-connected device with a browser installed.

Play around with the 10ZiG Web Console. I did not find anything I could do in the full console in my testing that I could not do in the Web Console.

The 10ZiG server and thin clients are ready for use.

Up next: Create a Goliath Technologies Management Server

Landing page for the article series

See what I did there? Some sneaky clickbait. But just keep reading; I promise the rest of the article is not.

It’s not THE truth either. It doesn’t even want to be. It’s my own view on the world EUC today.

Initially, I was about to write something just on Citrix. While correct, it would only be part of the story. There are other EUC vendors out there, and they are all facing similar issues. 

We’ve all been there. The end-user reports that his Business Application is not working to their liking by some form of communication.

That kind of message can go two ways:

• “I’ve got a Citrix problem because of Application X malfunctions.”*
• “Application X does not work, so it has to be a Citrix problem.”*

*Replace Citrix with EUC Vendor of choice

EUC vendors have been innovating at an extraordinary pace. Gone are the days when we have to wait for a significant OS release to get some shiny new code bits. It’s always changing; to that extent, it can be a real struggle to keep up.

But does this matter to the end-user? Not really; they just want their Business App. They don’t care if the technology provides a watermark, prevents them from taking a screenshot, etc. They wish to use their application to get their job done.

When the application doesn’t work, however, the application rarely gets the blame. It will be EUC technology. Even the original developers of the application can be reluctant to accept responsibility and just blame “Citrix” or whatever. 

As EUC admins, operators, specialists, (insert fancy job title here), … we’re often caught in the middle of this. We will be called upon to explain “why” it doesn’t work. And we always have been, since the dawn of EUC technology. You could even say, EUC engineers were the very first DevOps engineers. 

Let me unpack that.

DevOps originates from 2 words:

• Development: the creation of new stuff
• Operations: making sure that (new) stuff keeps running

 So, why am I calling EUC engineers DevOps Engineers then?

• Operations: we need to make sure things keep running. It can be as a day to day job or to come up with a design that maximizes this simple fact: the App needs to be available.
• Development: we don’t write “real” code. Not the application code itself anyway. We might need to write scripts to mitigate some application shortcomings. But more than anything, we develop the solution. The solution to the end-users problem: get that working Business Application.

So, let’s reconsider for a moment. EUC engineers will need to answer the question of why it doesn’t work. So why “operations” of the application is impacted. And we’ll be asked to fix it or to put in another way: to develop the solution.

Technology will and can help us with both of those tasks. But technology by itself will never be the solution. It will help us get there. Sometimes so fast we don’t realize it. But it will always be “the tool” that will help us get there, not the endpoint of the journey of fixing something.

To wrap up this blog post, this is a question to all EUC vendors out there: if you can’t explain why (new) technology will help us solve issues or make it better in general, go back to the drawing board and come back when you can.

Technology doesn’t matter; it’s about the people knowing how to make the most of it.

This is the 9th major update to Webster’s Lab since I started this website in November 2008.

[Look for the March 2021 updates in bold]

As of October 2020, there are now four physical servers running XenServer 8.2 and six running VMware vSphere 6.7u3.

The equipment in the lab consists of:

• • • 1 Synology NAS DS1817 with eight 1TB SSDs
    • 1 Synology NAS DS1817+ with eight 1TB SSDs
    • 2 Western Digital 6TB External USB hard drives
    • 1 NetGear 48-port Managed 10Gig switch
    • 1 NetGear 48-port Managed 1Gig switch
    • 10 Lab Servers
    • 1 Writing PC
    • 1 MacBook Pro
    • 2 Windows 10 Laptops
    • 1 Windows 10 “RemotePC” [March 2021]
    • 1 Apple iPad Pro 10.5 inch
    • 1 iGel UD7 Thin Client
    • 1 iGel UD3 Thin Client
    • 1 iGel UD Pocket
    • 2 10ZiG 6000q Series Thin Clients

Most of the lab equipment is not free. iGel sent me three evaluation pieces for the lab, some money comes from script donations, and the rest comes from my awesome advertisers. The two 10ZiG devices are brand new and arrived as I wrote this article. All donations made for the scripts and money from the advertisers are used for lab equipment.

Synology NAS #1:

Synology 1817 NAS.

This NAS is used for backups and my ever-growing ISO repository.

This NAS was upgraded to 8GB RAM and has seven Crucial MX300 1TB SSDs configured in Synology Hybrid RAID and one Crucial MX500 1TB for SSD Cache, as shown in Figures 1 and 2.

The NAS has two 1Gb network ports that are not used.

There are two 10Gb network ports configured in a bond for performance, as shown in Figure 3.

Synology NAS #2:

Synology 1817+ NAS. This NAS is used for lab Virtual Machine (VM) disks.

This NAS was upgraded to 16GB RAM and I added a Synology 10Gb Ethernet Adapter with 2 RJ45 Ports. There are eight Crucial MX500 1TB SSDs configured in Synology Hybrid RAID, as shown in Figures 4 and 5.

The NAS has four 1Gb network ports that are not used.

There are two 10Gb network ports configured in a bond for performance, as shown in Figure 6.

Western Digital 6TB External USB Drives:

With all the stuff that is now stored on the two Synology devices, I needed to make sure everything on them was backed up.

The two WD 6TB drives are configured to use the Synology Hyper Backup utility to back up all shared folders and LUNs on a daily schedule.

NETGEAR 48-port Managed 10Gb Switch:

This switch has really sped things up in the lab. All of the lab servers have 10G NICs along with both Synology NAS units. My Writing PC also has a 10G NIC and it is also connected to this switch.

NETGEAR 48-port Managed 1Gb Switch:

One of the newest additions to the lab is a NETGEAR GC752X 1Gig switch.

The switches, the two NAS units, and their 6TB external drives are shown in Figure 7. The 1Gb NETGEAR switch is the white one on top of the 10Gb switch.

The blue cables are 1Gb server connections, the black cables are 1Gb IPMI server connections, the white cables are 10Gb connections, and the two green cables are the connections to the Internet router and the Writing PC.

Lab Server Group 1:

The lab servers were ordered from TinkerTry.Com/WiredZone.com.  I e-mailed Bruno at WiredZone, gave him my specifications and he custom built the servers for me.  If you are interested, contact:

The servers run XenServer 8.2 in headless mode.

March 2021: I would NEVER buy these 12-core servers again. All but one has gone in for RMA replacement. I have had zero issues with the 8-core servers, but these 12-core servers are nothing but a major PITA! I must check the networking status of the pool every morning to make sure the 10Gb NICs still work. If they don’t, I have to shut down the non-working host, remove the power cord, wait a few seconds, plug the power cord back in, power on the host, pray the 10Gb NICs to come back alive, and finally power on the VMs. PITA.

Recently, I attempted to update the BIOS from 2.0a to 2.1. The first host had no issues. The second host (and the Remote PC computer) was bricked. I sent the unit back to Supermicro for RMA work. They couldn’t fix it, so they replaced the unit. That made four of the five 12-core servers that SuperMicro has replaced.

• 5028D-TN4T Mini Tower Intel Xeon processor D-1567 12-Core System-on-Chip
• 64GB DDR4 PC4-19200 (2400MHz) 288-pin RDIMM ECC Registered
• Dual 10 GbE – bonded for VM traffic
• Dual 1 GbE – bonded for management
• Samsung 970 EVO 500GB – NVMe
• Samsung SSD 860 EVO 1TB 2.5 Inch SATA III Internal SSD

All VMs run from local SSD since I never use XenMotion on these VMs. The 10 GbE ports are bonded for VMs and the 1 GbE ports are bonded for management.

I run my permanent VMs (one running Windows Server 2016 and the rest all running Windows Server 2019) on XenServer as shown in Figure 8.

Lab Servers Group 2:

These six servers were also purchased from Bruno at WiredZone.com.

March 2021: When I first ordered these servers, one was DOA on arrival. Supermicro replaced it, no questions asked. Since then, these 8-core servers have given me no problems. They have never had a problem with the 10Gb NICs suddenly going dead. What is strange is the 12-core and 8-core servers use the same motherboard, but the 12-core servers are nothing but trouble.

The servers in Group 2 system components are:

• 5028D-TN4T Mini Tower Intel Xeon processor D-1541 8-Core System-on-Chip
• 64GB DDR4 PC4-19200 (2400MHz) 288-pin RDIMM ECC Registered
• Dual 10 GbE
• Dual 1 GbE
• Intel 520 Series 240GB SSD (reused from a previous server)
• Samsung 970 EVO 500GB – NVMe

All servers run in headless mode.

Right now, all servers run vSphere 6.7 u3, as shown in Figure 9.

The ten servers are shown in Figure 10.

APC Smart-UPS:

Another of the newest additions to the lab is an APC Smart-UPS 2200. This UPS is plugged into a dedicated 30-amp circuit.

I have numerous power issues probably because my house is about .5 miles (as the crow flies) from a manufacturing plant. I bought this to help with the sometimes long power outages. The lab also has five APC XS 1500 UPS units (in the “server room”) and those plug into the back of the Smart-UPS 2200. I still get frequent power blips and the Smart-UPS 2200 goes into battery mode, but with all the equipment plugged into the XS 1500 units, none of the equipment has had an abrupt power off.

The two groups of servers, the two NAS units, the two external drives, and switches share five APC XS 1500 UPS. Every piece of matching equipment is plugged into a different UPS.

Figure 11 is the best picture I could get of the six UPS units.

Mitsubishi Electric/Trane Mini-Split System:

With all the equipment in the “server room”, it was getting quite toasty in there, and the computer equipment doesn’t like temps over 90F/32C.

I get the thermostat set at 72F/22C which is a tradeoff of the cooling and electric bill. I can now close the door to the “server room” and not hear all the server and switch fans screaming like B52 jet engines.

For those that care about these things, the model number is NTXWST12A112AA. The HVAC contractor had to add another breaker to the breaker box and run a dedicated power line between the inside unit and the outside box.

Figure 12 shows the inside unit.

The “server room” is now so crowded with ten servers and six UPSes that it was hard to get an overall picture.  Figure 13 is the best shot I could get.

Secretlab Chair:

The newest addition to the lab is a chair from Secretlab. I got one of their TITAN chairs (Figure 14) because their TITAN XL chair was on backorder for so long, I gave up waiting for it. If you like firm chairs, you will like this chair. I find the chair forces me to sit properly.

Writing PC:

This computer is used for doing customer work, writing articles, and running XenCenter and the vSphere client to connect to the lab servers.  This computer was bought from Dell.

• XPS 8930
• Intel(R) Core(TM) i9 9900K (8-Core/16-Thread, 16MB Cache, Overclocked up to 4.7GHz on all cores)
• 2TB PCIe SSD + 2TB 7200RPM HDD
• 64GB, DDR4, 2666MHz
• NVIDIA(R) GeForce(R) GTX 1080 8GB GDDR5X

I added the following:

• Three ASUS PB278Q 27″ monitors
• Western Digital 2TB external USB3 drive
• Logitech Wireless MK710 keyboard and M705 mouse
• StarTech.com 1 Port PCI Express 10GBase-T/NBASE-T Ethernet Network Card (Dell sales recommended this card and it is working flawlessly)

The software used on this computer:

• Microsoft Windows 10 Workstation x64
• Adobe Acrobat DC Professional
• Beyond Compare
• Carbonite
• Devolutions Remote Desktop Manager
• Dropbox
• Citrix ShareFile
• Grammarly Premium
• Notepad++ (what I use for all my PowerShell scripting)
• Office 365
• XenCenter

I use both Citrix ShareFile and Dropbox to share PDFs and PowerShell scripts.

I use a Realspace Magellan Performance Electric Height-Adjustable Wood Desk. This desk allows me to have preset sitting and standing positions. This allows me to not sit on my big fat lazy butt all day long. My office is too messy to take a current picture, so this is the picture from last August. I sure do miss Simon.

MacBook Pro:

Almost every customer’s Citrix Farm I have worked on since 2008 has Mac clients.  I was tired of having to tell customers that I knew nothing about Macs.  In January 2009, I finally bought a 15” MacBook Pro and loved it.  In October 2010, I upgraded to a 17” MacBook Pro.  In July 2012, I upgraded to a 15” MacBook Pro with Retina Display, 16GB RAM, and 768GB SSD. I rarely use this device any longer. It is now used mainly for my huge iTunes music collection and testing customer issues with the Mac Workspace app.

The software currently being used:

• OS X 10.15.7
• Carbonite
• iTunes

Windows Laptop #1:

I bought this little laptop just to use for PowerPoint presentations.  It runs Windows 10, PowerPoint 2016, and nothing else.  I bought it at a close-out sale at a local electronics store.

• HP Model 14
• Intel Core i5 1.6GHz processor
• 8GB RAM
• 14-inch screen
• 500GB hard drive
• Enough battery life to last for about 7 hours

Windows Laptop #2:

I bought this laptop to allow me to do Active Directory, Group Policy, and scripting work at customer sites.

• Dell XPS 15 7590
• 9th Generation Intel(R) Core(TM) i9-9980HK (16MB Cache, up to 5.0 GHz, 8 cores)
• 32GB DDR4-2666MHz, 2x16G
• 2TB PCIe Solid State Drive
• NVIDIA(R) GeForce(R) GTX 1650 4GB GDDR5
• 15.6″ 4K UHD (3840 x 2160) InfinityEdge Anti-Reflective Touch IPS 100% AdobeRGB 500-Nits display

The main software is Notepad++, VMware Workstation 16, and Office 365.

Apple iPad Pro:

This is an iPad Pro 10.5 inch, 256GB 4G/WiFi model. Mainly used for Twitter, Facebook, Netflix, email, and testing for customers.

Physical Computer for “RemotePC”:

This is a server that I had issues with the 10Gb NICs, so I use it when I need something to test accessing a physical device (aka RemotePC).

March 2021: This server was bricked when I attempted to update the BIOS from 2.0c to 2.1. I sent the server back to Supermicro for RMA repair since this was a server Supermicro had already replaced under an RMA replacement. Supermicro said the server was now out of warranty and wanted $1,150 (953 Euro) to replace the dead chips on the motherboard or pay $1,654 (1371 Euro) for a new motherboard. I took Option C and had the dead server returned to me. The RAM and CPU are still good. Maybe I can find a use for them later.

• 5028D-TN4T Mini Tower Intel Xeon processor D-1567 12-Core System-on-Chip
• 64GB DDR4 PC4-19200 (2400MHz) 288-pin RDIMM ECC Registered
• Dual 10 GbE – disabled in the BIOS
• Dual 1 GbE – only one is used
• Samsung SSD 850 EVO 1TB 2.5 Inch SATA III Internal SSD

• This unit is used for testing physical access for Citrix Virtual Apps and Desktops, VMware Horizon, and Parallels RAS. I run Windows 10 Enterprise 1909 on it.

IGEL UD7 and UD3:

IGEL sent me a UD7 and a UD3 for the lab. I want to thank my fellow CTP Fellow Steve Greenberg and his company Thin Client Computing for providing me with the initial set of free product licenses. After Steve provided me with free licenses at his expense, IGEL provided me additional licenses, and now as an IGEL INSIDER, I can get additional licenses if I need them.

I love the IGEL company, its people, its software, and its hardware. If you are also an IGEL fan, make sure to join the free IGEL Slack Community.

Here is a picture of the UD7, UD3, and the three 17″ monitors I bought for them.

Since the two 10ZiG units arrived as I was finishing this article, they are not configured or in use yet. 10ZiG sent me two units, one with WiFi access.

Before you leave, I have one other picture for you.  Everyone who follows me on Twitter, LinkedIn, and Facebook should know about my bud Simon (Sir Simon of Searcy is his registered AKC name).  Simon is a hardcore extreme daddy’s boy!  He wants to be with me almost all of the time.  He sits on my desk and moves from left to right to left to middle to right repeated all day long.  He is constantly laying his head down on my mouse, on my keyboard and every time he moves, his hips hit the power switch on a monitor and turn it off.  As much as I love that boy, he can make it hard to get work done at times.

Simon is a Bichon Frise (aka Chick Magnet) and will be 14-years old on Halloween 2019. Simon is no longer in great health (he has several seizures a day) and now spends most of his time taking naps in the guest bedroom. When he comes to the lab, he sleeps on his pillow on the floor.  I hope he makes it to his 14th birthday.

In Memorium: Sir Simon, The Keeper of Webster’s Lab: October 31, 2005 – October 11, 2019

Well, as you can probably tell, Simon did not make it to his 14th birthday. I was in Kansas City at a customer site and Simon waited until I got home so I could say goodbye, and then he passed away peacefully four hours after I got home.

We brought Simon home a couple of days after Christmas 2005. This is a picture taken a day or two after we got home.

By the way, that is the blanket we brought him home in, that was his lab “blanky”, and that is what I wrapped him in when I buried him.

When we first got “that dog”, I wanted nothing to do with “it”. I didn’t want a fluffy froo-froo dog. I wanted a manly outside dog. When my two daughters were looking at what to name “that dog”, they started reading names for male Bichons. When they read out the name Simon, “that dog” perked up his head and barked. Simon was his name.

Side note: When I went to register Simon with the American Kennel Club (AKC), the rule is that no breed can have more than five dogs with the same name. That is why you see weird names for some registered dogs. Simon’s AKC registered name is Sir Simon of Searcy.

Shortly after that, my wife left to go grocery shopping and my kids wanted to go out to eat. I asked them what they were going to do with “that dog”. My daughter Magen told me I was keeping him. I said no way, I didn’t want anything to do with “that dog”. It didn’t take “that dog” long to show me I was his and he was mine. Simon and I were inseparable buds ever since he was literally dumped in my lap by Magen. That boy grabbed my heart and never let go.

Simon has been my lab buddy for a long time. Here is a picture of when he was just over 1.5 years old.

Simon would get excited when I came home from work, he loved to go on walks with me. Over the years, we worked up from a short walk around the block to six-mile-long walks. When I got my car keys, he wanted to go with me.

Simon knew when I was going to travel and was not happy when he saw me get the suitcase out. He wanted to go with me no matter where in the world I was headed.

When I say Simon was constantly by my side, I mean it. He slept with me, he woke up with me, he went walking with me, and he stayed in the lab with me all day/night long. I couldn’t go to the potty without that boy by my side. I was not allowed to take a shower with the bathroom door closed, or Simon would bark until I opened the door so he could keep an eye on me.

Simon was VERY OCD, and like me was used to a set schedule. I am an early morning person, so I go to bed early. Simon soon learned when it was 8 PM and bedtime. Soon at 7:45 PM, he would start woofing at me and staring me down. Like, dude, it’s bedtime, let’s go! As he aged, 7:45 became 7:30, which became 7:15, which became 7:00. I still head to bed at 7:00 with lights out at 8:00.

Until around the time he turned 12, Simon loved to travel in the car with me. Even on the 19-hour round trips to see my parents, Simon wanted to go. After he turned 12, you could tell he was slowing down. He no longer wanted to travel and he no longer liked taking walks in the neighborhood. He just wanted to stay home and sleep.

I could go on and on about my buddy Simon and what he meant to me, but I am sure most of you already know how much he meant to me and how much I miss him.

Here is the last picture I have of Simon right after I got home from that trip to Kansas City.

Simon died shortly after that picture and I am not ashamed to admit that I cried harder than I thought a person could cry. The next morning, I woke up, wrapped Simon up in the blanket we brought “that dog” home in. I then cried, and cried, and cried and buried my buddy.

Annette planted flowers on his grave.

It is amazing how attached a human can become to a dog. One of these days, I may be able to read The Rainbow Bridge. But first, I have to get this huge lump out of my throat.

I sure do miss you Simon. RIP good buddy.

All articles related to the following products are in the process of removal from my site. If you are still using these products, you probably don’t need these articles. If you need these articles, I still have almost every article in Word format. Email me, and I will send you the Word doc if I have it.

• Citrix Secure Gateway, all versions
• Old ICA Clients
• Old Java versions
• Old NetScaler versions
• Provisioning Services 5.x
• Web Interface, all versions
• Windows Server 2003
• Windows Server 2008
• XenApp 5 for Windows Server 2003
• XenApp 5 for Windows Server 2008
• XenApp 6.x
• XenDesktop 4.x
• XenDesktop 5.x
• XenServer 5.x

Maybe this cleanup will help keep my hosting costs from increasing and simplify the backups my hosting provider takes frequently.

69 articles were removed.

This cleanup DOES NOT include ANY scripts or scripting related articles.

Whew, that was a lot to cover in over 400 screenshots and 450 pages. After completing your Horizon testing, there is a step-by-step process to undo all the work done in Chapters 1 through 15. Others may prefer their order, but I am sure we all accomplish the same end goal, returning the lab to the pre-Horizon 7.12 state.

Tearing Down the Horizon Lab

After the testing of Horizon 7.12 is over, you may want to remove all the components, pieces, and parts.

1. Verify that there are no users logged in to any published resource.
2. Remove the Application Pool(s).
3. Remove the Desktop Pool(s).
4. Remove the RDS Farm(s).
5. Remove the Parent VMs, Replica VMs, Internal Templates, Sync VMs, and the Folders created by the Instant Clone process.
6. Remove the Connection Server.
7. Remove the SQL account and database.
8. Uninstall the DEM Management Console
9. Remove the DEM Configuration and Profile shares and folder trees.
10. Remove the Horizon stuff from UMS
11. Cleanup ControlUp
12. Remove Snapshots or Master Images
13. Remove any Group Policies created.
14. Remove any User Accounts created.
15. Remove any Security Groups created.
16. Remove any Organizational Units created.
17. Remove the DEM and Horizon agents from any physical computers.
18. Revoke any issued certificates for any Horizon-related computer accounts from the domain CA.
19. Remove any remaining Horizon-related computer accounts in Active Directory.
20. Delete any remaining Horizon-related Lease records from DHCP.

Verify that there are no users logged in to any published resource.

From the Connection Server, log in to the Horizon 7 Console. Under Monitor, click on Dashboard from the left frame and verify the session count is 0, as shown in Figures 1 and 2.

If there are any sessions active, find and end the sessions or restart the RDS hosts or VDI desktops.

Remove the Application Pool(s).

In the left frame of the Horizon Console, under Inventory, click Applications, as shown in Figure 3.

Select all applications and click Delete, as shown in Figure 4.

Click OK, as shown in Figure 5.

The Application Pools are deleted, as shown in Figure 6.

Remove the Desktop Pool(s).

In the left frame of the Horizon Console, under Inventory, click Desktops, as shown in Figure 7.

Only one Desktop Pool can be deleted at a time.

Select one Desktop Pool and click Delete, as shown in Figure 8.

Click OK, as shown in Figure 9.

Repeat until all Desktop Pools are deleted.

It can take several minutes until the Desktop Pool(s) and all VMs are deleted, as shown in Figure 10.

Remove the RDS Farm(s).

In the left frame of the Horizon Console, under Inventory, click Farms, as shown in Figure 11.

Only one Farm can be deleted at a time.

Select one Farm and click Delete, as shown in Figure 12.

Click OK, as shown in Figure 13.

It can take several minutes until the Farm(s) and all VMs are deleted, as shown in Figure 14.

After a period, both vCenter and Active Directory should have been cleaned up of items created during the Instant Clone processes, as shown in Figures 15 through 20.

Remove the Parent VMs, Replica VMs, Internal Templates, Sync VMs, and the Folders created by the Instant Clone process.

Deleting the Desktop Pools and RDS Farms should have deleted all Parent VMs, replica VMs, internal templates, sync VMs, and the folders created for the Desktop Pools and RDS Farms. All that should be left are four folders plus any top-level folders you may have created for the Desktop Pools and RDS Farms.

The four folders are:

1. ClonePrepInternalTemplateFolder
2. ClonePrepParentVmFolder
3. ClonePrepReplicaVmFolder
4. ClonePrepResyncVmFolder

These folders are protected and require a special process to remove.

On the Connection Server, open an elevated Command Prompt.

Change to the c:\Program Files\VMware\VMware View\Server\tools\bin folder.

Run icunprotect -vc <vcenter FQDN or IP> -uid <vcenter admin>

For example, as shown in Figure 21:

icunprotect -vc vcenter.labaddomain.com -uid administrator@vsphere.local

You are prompted for the password for administrator@vsphere.local.

Run icunprotect -vc <vcenter FQDN or IP> -uid <vcenter admin> -includeFolders [Note: includeFolders is Case Sensitive]

For example, as shown in Figure 22:

icunprotect -vc vcenter.labaddomain.com -uid administrator@vsphere.local -includeFolders

You are prompted for the password for administrator@vsphere.local.

Exit the command prompt.

In vCenter, you can Remove from Inventory the four Instant Clone Folders and any folders created for the Desktop Pools and RDS Farms, as shown in Figures 23 and 24.

Click Yes, as shown in Figure 25.

Repeat until all folders are removed from inventory, as shown in Figure 26.

Remove the Connection Server.

Shut down the Connection Server.

Right-click the Connection Server in vCenter, and click Delete from Disk, as shown in Figure 27.

Click Yes, as shown in Figure 28.

Finally, delete the computer account from Active Directory.

Remove the SQL account and database.

In the SQL Management Studio, delete the SQL sa account and database.

Expand Databases, right-click the Connection Server Event database, and click Delete, as shown in Figure 29.

Select Delete backup and restore history information for databases and Close existing connections, then click OK, as shown in Figure 30.

Expand Security, expand Logins, right-click the account created, and click Delete, as shown in Figure 31.

Click OK, as shown in Figure 32.

Click OK, as shown in Figure 33.

Exit the SQL Management Studio.

Uninstall the DEM Management Console

On the computer(s) where the DEM Management Console is installed, depending on how your system is configured:

Right-click Start, then click Run, then type in Control, as shown in Figure 34.

Click Uninstall a program, as shown in Figure 35.

Or right-click Start, then click Run, then type in Control, as shown in Figure 34.

Click Programs and Features, as shown in Figure 36.

Scroll down to VMware Dynamic Environment Manager, click it, and click Uninstall, as shown in Figure 37.

Click Yes, as shown in Figure 38.

If UAC is enabled, click Yes.

Remove the DEM Configuration and Profile shares and folder trees.

From the file server, delete the folder trees created for the DEM Configuration and Profile shares, as shown in Figures 39 and 40.

Note: If you have any permissions errors deleting either folder, use the free SetACL Studio from Helge Klein (one of the smartest AND nicest people on the planet)  to delete the problem folder tree.

Remove the Horizon Stuff from UMS

From the UMS Console, right-click the profile created for VMware Horizon and click Delete, as shown in Figure 41.

Select the profile and click OK, as shown in Figure 42.

Select Next Reboot and click OK, as shown in Figure 43. There are two more updates before applying the changes to the IGEL device(s).

Under Files, right-click the SSL certificate for the Connection Server and click Delete, as shown in Figure 44.

Select the certificate file and click OK, as shown in Figure 45.

Select Next Reboot and click OK, as shown in Figure 46. There is one update left.

Right-click Recycle Bin and click Clear recycle bin, as shown in Figure 47.

Click OK, as shown in Figure 48.

Select Now and click OK, as shown in Figure 49.

You can exit the UMS console.

Cleanup ControlUp

In the ControlUp console, right-click a folder containing Horizon computers and click Remove, as shown in Figure 50.

Click Yes, as shown in Figure 51.

Repeat for any other Horizon folders created.

Expand EUC Environments, right0click your Horizon environment, and click Remove, as shown in Figure 52.

Click Yes, as shown in Figure 53.

You can exit the ControlUp console.

Remove Snapshots or Master Images

If you plan to reuse the master images, remove the snapshots created for this lab.

Select a master image in vCenter, right-click the master image, move the mouse over Snapshots and click Delete All Snapshots, as shown in Figure 54.

Click OK, as shown in Figure 55.

Repeat for the other master images.

If you do not plan to reuse the master images, delete the master images from disk in vCenter.

Select a master image in vCenter, right-click the master image, click Delete From Disk, as shown in Figure 56.

Click Yes, as shown in Figure 57.

Repeat for any other master images to remove.

Optional Items

The following items are optional. You may remove any or all or none of these items.

• Remove any Group Policies created.
• Remove any User Accounts created.
• Remove any Security Groups created.
• Remove any Organizational Units created.
• Remove the DEM and Horizon agents from any physical computers.
• Revoke any issued certificates for any Horizon-related computer accounts from the domain CA.
• Remove any remaining Horizon-related computer accounts in Active Directory.
• Delete any remaining Horizon-related Lease records from DHCP.
• Delete any remaining Horizon-related records from the DNS Forward and Reverse Lookup Zones.

I hope you enjoyed our brief look at VMware Horizon 7.12.

With the DEM Management Console installed and configured, you tested accessing the various published applications for multiple users. In this Part, we learn how to use the DEM Helpdesk Support Tool.

Configure the DEM Helpdesk Tool

From the DEM Management Console, click the Star in the upper left corner, and click  Configure Helpdesk Support Tool, as shown in Figure 1.

Click Add, as shown in Figure 2.

For the Profile archive path, enter \<fileserver>\<DEM Profile Share>[UserFolder]\Archives. i.e., \LabFS\DEMProfiles[UserFolder]\Archives

Select Profile archive backup path and Log file path. Both are automatically populated with information from the Profile archive path.

Click OK, as shown in Figure 3.

Click Save, as shown in Figure 4.

The Immidio Flex+ Helpdesk Support Tool.xml configuration file is created in the DEM configuration share, as shown in Figure 5.

Create a DEM Helpdesk Group Policy

The Group Policy we are creating contains user settings. In the GPMC, create a GPO at the location where your Horizon USER accounts are located, as shown in Figure 6.

Name the Policy, as shown in Figure 7.

In the new GPO, configure the following settings, as shown in Figure 8.

User Configuration:

• Policies/Administrative Templates/VMware DEM/Helpdesk Support Tool
  • Allow editing profile archives: Enabled
    • NOTE: Read the warning about this setting
  • Allow showing profile archives in Windows Explorer: Enable
  • Allow overriding the FlexEngine log level: Enable
  • Allow resetting multiple profile archives at the same time: Enable
  • DEM configuration share: Enabled, replace <YOUR CONFIGURATION SHARE> with the DEM Config share. i.e., \\LabFS\DEMConfig

Remove Authenticated Users from the Security Filtering and add the VMwHelpdesk security group, as shown in Figure 9.

On the Delegation tab, add Domain Computers with Read Permissions, as shown in Figures 10 and 11.

Install the DEM Helpdesk Tool

Do the installation on a computer in an OU linked to the VMware Helpdesk Group Policy. This installs on the computer for every member of the VMware Helpdesk security group or a central management computer in production. I am installing this on my Horizon 7 management computer.

In the DEM files downloaded, there is an Optional Components folder. Right-click the DEM Helpdesk Support Tool installer in that folder and click Install, as shown in Figure 12.

Click Next, as shown in Figure 13.

Select I accept the terms in the License Agreement and click Next, as shown in Figure 14.

Click Next, as shown in Figure 15.

Click Install, as shown in Figure 16.

If UAC is enabled, click Yes.

Click Finish, as shown in Figure 17.

Using the DEM Helpdesk Tool

Log in as your test users to the various endpoints and launch various published resources.

On a computer in the OU where the DEM Helpdesk Group Policy is linked, login as a member of the VMwHelpDesk security group and launch the Helpdesk Support Tool, as shown in Figures 18, 19, and 21.

Or from:

Note: If you receive the error shown in Figure 20, you probably have the DEM Helpdesk GPO linked to the wrong OU in the GPMC. Not that I know anything about that. I heard about it from a friend.

Click Search to get a list of all users, as shown in Figure 22.

Click on a user, as shown in Figure 23.

Select an item in the right frame to either Reset or Restore. Figure 24 shows Reset, and Figure 25 shows Restore.

You can also view the various log files available for the selected user, as shown in Figure 26.

You can exit the Helpdesk Support Tool.

Using the Horizon Help Desk Tool

VMware Horizon has a Help Desk tool, a web application to get the status of user sessions and perform troubleshooting and maintenance operations.

On the Connection Server, from the Horizon Console, expand Settings and click Administrators in the left frame, as shown in Figure 27.

Click Add User or Group, as shown in Figure 28.

Click Add, as shown in Figure 29.

Search for the VMwHelpDesk security group, select the group, and click OK, as shown in Figure 30.

Select the VMwHelpDesk group and click Next, as shown in Figure 31.

Click Help Desk Administrator and click Finish, as shown in Figure 32.

The VMwHelpDesk group is added as a Horizon Help Desk Administrator, as shown in Figure 33.

From an elevated command prompt, change to the c:\Program Files\VMware\VMware View\Server\tools\bin folder. As shown in Figure 34, run the following command:

vdmadmin -I -timingProfiler -enable

This command enables the timing profiler to allow the viewing of logon segments.

Log in the test users into the various published resources to see activity in the Horizon Help Desk Tool.

To launch the Horizon Help Desk Tool, from a domain-joined computer, use an internet browser and browse to https://connectionserver.fqdn/admin. i.e., https://h7connection.labaddomain.com/admin, as shown in Figure 35.

Note: This is admin, NOT Admin. Using Admin will get you a 404 Error Page Not Found. My friend told me that.

Click LAUNCH under Horizon Console (HTML5), as shown in Figure 36. You can also select Always use this option since the Flex client is deprecated.

Sign in as a member of the VMwHelpDesktop group, as shown in Figure 37.

Enter a user’s name in the search bar and press Enter, as shown in Figure 38.

Click to select the user, as shown in Figure 39.

As shown in Figure 40, you can also enter a partial username. I had to enter a minimum of two characters.

There are four options available; you can click on Sessions or Desktops or Applications or Activities, as shown in Figures 41 through 44.

While in the Activities area, set Help Desk Event Only to No to see additional events, as shown in Figure 45.

Figure 46 shows that you can select additional time intervals to see events in those time ranges.

Back in Sessions, select a Session to see details, as shown in Figure 47

Figures 48 through 52 show the information for the selected session.

Note: In Figure 49, the More dropdown gives you a Logoff option. If Logoff is the only other option, why not have the button say Logoff instead of More? The button would be the same size.

Up next: Tearing down the Horizon lab

With the preparations out of the way, it’s time to install the DEM FlexEngine, install the DEM Management Console, configure DEM, and test with users accessing the published applications.

Install DEM

You must install the FlexEngine component of DEM on each master image and physical computer used for Horizon.

In the vCenter console, power on the Server 2019 and Windows 10 master image VMs.

I collapsed all the Horizon folders before starting.

Select the cluster and, in the right frame, click VMs, as shown in Figure 1.

Select the two master images, right-click the two master images, click Power, and click Power On, as shown in Figure 2.

Copy the DEM installation file to the master images and the physical computer.

Right-click the DEM installation file and click Install, as shown in Figure 3.

Click Next, as shown in Figure 4.

Select I accept the terms in the License Agreement and click Next, as shown in Figure 5.

Click Next, as shown in Figure 6.

Click Typical, as shown in Figure 7.

The Typical install option installs the DEM FlexEngine, Application Migration, and Self-Support tool. It does not install the Management Console.

Click  Next, as shown in Figure 8.

No DEM license file is required because the installer detected the Horizon Agent.

Click Install, as shown in Figure 9.

If UAC is enabled, click Yes.

Click Finish, as shown in Figure 10.

Follow the process from Part 11 (Image Updating) to update the desktop pools and farm.

Note: Do NOT try logging in to any machines with DEM installed until you install the DEM Management Console and complete the initial configuration. This is why we lab. So we don’t learn painful or embarrassing lessons in front of a customer. If you attempt to log in to a machine where you installed the DEM FlexEngine, the user immediately logs off. Why? There is a FlexEngine policy setting named Paths unavailable at logon. The policy setting help text states, “By default, VMware Dynamic Environment Manager logs users out in case the Flex config files path is not available at logon.” We haven’t installed or configured the DEM Management Console yet. Hence, there is no config files path available (the GENERAL folder doesn’t exist), so the user immediately logs off. Not that I know anything about this. I heard it from a friend.

Install the DEM Management Console

The DEM Management Console can be installed on any computer if the console user has full rights to the DEM Configuration share. As shown in previous Chapters, I have a Horizon 7 management computer. That is where I install the DEM Management Console.

Copy the DEM installation file to the management computer.

Right-click the DEM installation file and click Install, as shown in Figure 11.

Click Next, as shown in Figure 12.

Select I accept the terms in the License Agreement and click Next, as shown in Figure 13.

Click Next, as shown in Figure 14.

Click Custom, as shown in Figure 15.

Click VMware DEM FlexEngine and click Entire feature will be unavailable, as shown in Figure 16.

Click VMware DEM Management Console and click Entire feature will be installed on local hard drive, as shown in Figure 17.

Click Next, as shown in Figure 18.

Click Install, as shown in Figure 19.

If UAC is enabled, click Yes.

Click Finish, as shown in Figure 20.

DEM Management Console Initial Configuration

Launch the Management Console, as shown in Figure 21.

Or, as shown in Figure 22, from:

Enter the path to the DEM configuration share and click OK, as shown in Figure 23.

Select or deselect any options desired and click OK, as shown in Figure 24.

After clicking OK, look in the DEM configuration share, you see the general folder and configuration XML file, as shown in Figure 25.

To get an easy start for a basic profile configuration, click Easy Start, as shown in Figure 26.

Select the desired Office product(s) and click OK if you want configuration items for Microsoft Office, as shown in Figure 27.

Click OK, as shown in Figure 28.

As seen in Figure 29, there are sample items available.

After the initial configuration set created by Easy Start, the DEM configuration share has more folders and files, as shown in Figures 30 through 33.

Once the update to the pools completes, as we did in Chapter 10, I logged in as each user on a different device. I launched the various published resources to build user-based application profiles and configurations. Test the applications by moving them to various positions in the HTML5 client window and making configuration changes.

As was mentioned in Part 10, I never saw the expected published application icons. This time I did, as shown in Figure 34.

I still have no idea why I see different icons for the published applications each time I log in.

I set Calculator to either Scientific, Programmer, or Statistics mode for each of my three test users. For Notepad, I enabled Word Wrap and changed the font and font size. I then logged off and back on to verify that my application settings were saved. As shown in Figure 29, DEM Quick Start saves settings for the four published applications used for this lab: Calculator, Notepad, Paint, and WordPad.

Next, I restarted both RDS servers to make sure none of the applications stored their settings locally. I then logged in as each user to verify the changes made in each application were still there. They were.

Figures 35 through 38 show the folders and files created for one of the users in the DEM Profile share.

Each of the Zip files contains a registry (.reg) file named Flex Profiles.reg. Figure 39 shows the contents of the file for vmwuser1’s Calculator.zip.

Continuing looking at folders in the DEM Profile share.

Each of these Zip files contains a folder structure and within each folder is an XML and a reg file.

Looking back at Figure 36, the Backups folder tree has a similar structure and content as the Archives folder tree.

The Logs folder contains log files, as shown in Figure 41.

You can use these log files to understand what happens with the profiles or troubleshoot issues like why a user immediately logs off after trying to log in, as shown in Figure 42.

There are many other things that DEM can do for Horizon admins and users. Showing you all of its capabilities is probably a 16-part series by itself.

Leave the DEM Management Console open. We need it for the next Part.

Up next: DEM Helpdesk Support Tool

VMware Dynamic Environment Manager (DEM) is a multiple-purpose product. DEM can manage profiles and policies across virtual, physical, and cloud-based Windows desktops. DEM can also handle mappings such as drives, networks, and printers. DEM can also dynamically apply end-user policies and personalization based on a wide variety of conditions.

In this article and the two following articles, we only scratch the surface of the capabilities of DEM. We only look at saving application settings.

In this article, we do the environment preparation work for DEM. In the following two articles, we install DEM, configure the DEM Management console, configure the DEM Helpdesk Support Tool, and finally test everything with our users and the Instant Clone desktops and published applications.

Configuration Share

Create a file share for the DEM configuration share. I named mine DEMConfig.

For the Share permissions, Everyone must have Change, as shown in Figure 1.

The VMwHelpDesk security group needs Read access on the Share, as shown in Figure 2. and NTFS permissions.

I also disable Caching, as shown in Figure 3.

Now on to NTFS Permissions.

As shown in Figure 4, the DEMAdmins security group must have Full Control permissions applied to This folder, subfolders, and files.

As shown in Figure 5, the DEMUsers security group must have Read & execute permissions applied to This folder, subfolders, and files.

As shown in Figure 6, the Domain Computers security group must also have Read & execute permissions applied to This folder, subfolders, and files.

As shown in Figure 7, the VMwHelpDesk security group needs Read & execute permissions applied to This folder, subfolders, and files.

Profile Share

Create a file share for DEM profiles share. I named mine DEMProfiles.

For the Share permissions, Everyone must have Change, as shown in Figure 8.

VMwHelpDesk needs Change permissions, as shown in Figure 9.

I also disable Caching, as shown in Figure 10.

Now on to NTFS Permissions.

As shown in Figures 11 and 12, DEMAdmins and VMwHelpDesk must have Full Control permissions applied to This folder, subfolders, and files.

As shown in Figure 13, DEMUsers must have Create folders / append data applied to This folder only.

As shown in Figure 14, Domain Computers must have Create folders / append data applied to This folder only.

As shown in Figure 15, Creator Owner must have Full Control applied to Subfolders and files only.

Access to Regedit.exe or Reg.exe must not be disabled through Group Policy.

Ensure User Configuration/Policies/Administrative Templates/System/Prevent access to registry editing tools is either Not Configured or Disabled, as shown in Figure 16.

The FlexEngine uses Regedit.exe to add user-specific settings to the registry. Depending on the User Account Control (UAC) settings on Windows 7 or later, FlexEngine might use Reg.exe.

Note: What is FlexEngine? It is an Agent component installed on the virtual or physical machines you want to manage.

Registry Access Requirements

Group Policy Setup

In the extracted file for DEM is folder Administrative Templates (ADMX), as shown in Figure 17.

Copy the DEM ADMX/ADML files, shown in Figure 17 to the correct location. The location of this folder might vary, but often the location is C:\Windows\PolicyDefinitions. If you use the central store for administrative templates, you should instead copy the files to the Sysvol share on the primary domain controller, in the following location: \<PDCName>\SYSVOL\<DomainName>\Policies\PolicyDefinitions

I use the Group Policy Central Store in my lab, as shown in Figure 18.

In the Group Policy Management Console (GPMC), create a GPO at the location where your Horizon machine accounts are located, as shown in Figures 19 and 20.

VMware requires a logoff script and that the policy setting Always wait for the network at computer startup and logon is enabled.

In the new GPO, configure the following settings, as shown in Figure 21:

Computer Configuration:

• Policies/Administrative Templates/System/Logon/Always wait for the network at computer startup and logon: Enabled

User Configuration:

• Policies/Administrative Templates/VMware DEM/FlexEngine
  • Flex config files: Enabled, replace <YOUR CONFIGURATION SHARE> with the DEM Config share. i.e., \\LabFS\DEMConfig
  • FlexEngine logging: Enabled, replace <YOUR PROFILE ARCHIVES SHARE> with the DEM Profile share. i.e., \\LabFS\DEMProfiles
  • Profile archive backups: Enabled, replace <YOUR PROFILE ARCHIVES SHARE> with the DEM Profile share. i.e., \\LabFS\DEMProfiles
  • Profile archives: Enabled, replace <YOUR PROFILE ARCHIVES SHARE> with the DEM Profile share. i.e., \\LabFS\DEMProfiles
  • Run FlexEngine as Group Policy Extension: Enabled
• Windows Settings/Scripts/Logoff: Add, Script Name: C:\Program Files\Immidio\Flex Profiles\FlexEngine.exe, Script Parameters: -s

Because we are applying User settings to a Computer, link the Loopback GPO to the location where your Horizon machine accounts are located, as shown in Figure 22.

Up next: Dynamic Environment Manager Installation and Configuration

Shortly after learning VMware Horizon, I used Update Manager to apply VMware updates to my cluster. I was shocked when my hosts would never enter Maintenance Mode. I asked a question on Twitter about this issue, and a friend directed me to look at https://kb.vmware.com/s/article/2144808.

That KB article explains the process to follow on how to use Update Manager with Instant Clones. Unfortunately, my Update Manager shows no updates of any kind to ESXi 6.7U3 since 27-Apr-2020. Even though there are no updates to apply, I’ll still walk through the process for you because it isn’t that hard.

Using Update Manager

From the vSphere HTML Client, from the toolbar, click Menu, then click VMs and Templates, as shown in Figure 1.

To see all the Instant Clone Parent VMs, expand all the Instant Clone folders, as shown in Figure 2.

Switch to Hosts and Clusters view. From the toolbar, click Menu, then click Hosts and Clusters, as shown in Figure 3. You can also click the Hosts and Clusters icon, as shown in Figure 4.

Select the host that you want to put into Maintenance Mode. Look up Annotations in the host’s Summary tab, Custom Attributes, and see that InstantClone.Maintenance is set to 0, as shown in Figure 5.

Click Edit, as shown in Figure 6.

 Change InstantClone.Maintenance to 1, and click OK, as shown in Figure 7.

Repeat for every Host in the cluster.

After a brief amount of time, less than 10 seconds in my lab, all the Parent VMs are deleted, as shown in Figures 8 and 9.

The InstantClone.Maintenance value is changed to 2, as shown in Figure 10.

You can now put the Host into Maintenance Mode, as shown in Figure 11, or let Update Manager handle putting each Host in and out of Maintenance Mode  (my preference, but I have no updates).

Click OK, as shown in Figure 12.

The Host is placed in Maintenance Mode, as shown in Figure 13.

When Update Manager is complete, all Hosts should be out of Maintenance Mode. As Figure 14 shows, the value for InstantClone.Maintenance is still set to 2.

For each host, edit the InstantClone.Maintenance value and set it to 0, as shown in Figure 15.

As new provisioning happens, parent VMs and then instant clones are created again.

Figure 16 shows that even though the hosts are out of Maintenance Mode and the InstantClone.Maintenance value is no longer 1 or 2; the original Parent VMs did not recreate.

As you can tell, updating a host or all the hosts in a cluster with or without Update Manager is not that hard.

Creating Additional Machines

Since vCenter (or some VMware internal process) deleted the Parent VMs, now is a good time to create additional machines.

Back in Chapter 10, when we tested accessing published resources, we only had one Windows 10 virtual desktop and one Server 2019 RDS server. Let’s go through creating two additional Windows 10 machines and one additional Server 2019 RDS machine.

Back on the Connection Server, log in to the Connection Server console.

In the left frame, under Inventory, click Desktops, as shown in Figure 17.

Select the VDI Pool and click Edit, as shown in Figure 18.

Click Provisioning Settings, as shown in Figure 19.

Change the Max Number of Machines to 3 and click OK, as shown in Figure 20.

After a few seconds, Figure 21 shows the Parent VMs created.

After a brief interval, you will see the two additional Windows 10 VDI machines in vCenter, as shown in Figure 22.

Click on the VDI Pool, as shown in Figure 23.

Click on Machines, then Machines (Instant Clone Details), as shown in Figure 24, and then Figures 25 and 26 show Machine details.

Now to add the additional RDS server.

In the left frame, under Inventory, click Farms, as shown in Figure 27.

Select the RDS Farm and click Edit, as shown in Figure 28.

Click Provisioning Settings, as shown in Figure 29.

Change the Max Number of Machines to 2 and click OK, as shown in Figure 30.

After a few seconds, you will see the additional Parent VMs and the additional RDS Server show in vCenter, as shown in Figure 31.

Click on the RDS Farm, as shown in Figure 32.

Click on RDS Hosts, as shown in Figure 33.

Figure 34 shows details on the RDS Hosts.

There are now additional machines if you wish to go back through Chapter 10 Accessing Resources and verify that each test user can access a Windows 10 virtual desktop.

ControlUp

With additional Instant Clone machines available, the desktop pool machines add to the ControlUp console.

In the ControlUp console, click the Home tab and click Add Machines, as shown in Figure 35.

Click Search, select the updated desktop pool machines, and click Add, as shown in Figure 36.

Click OK, as shown in Figure 37.

The machines are added to the console, as shown in Figure 38.

If you want, move the machines to your Horizon folder.

Note: The machines are automatically placed in the selected folder if you select the Horizon folder before clicking Add Machines.

Figure 39 shows the updated machines with a Ready status, which means ControlUp is now getting detailed monitoring data. We will use the desktop pool machines in Part 14.

Up next: Dynamic Environment Manager

In this article, we update the Server 2019 RDS and Windows 10 master image, shut down the machines, take a snapshot, and roll out the updated snapshots to the desktop pools. We also make the same updates to the physical Windows 10 computer.

Image Updating

In the vCenter console, power on the Server 2019 and Windows 10 master image VMs.

I collapsed all the Horizon folders before starting.

Select the cluster and, in the right frame, click VMs, as shown in Figure 1.

Select the two master images, right-click the two master images, click Power, and click Power On, as shown in Figure 2.

The first thing to do is check for any Windows and application updates. If there are any updates, go ahead and install them for this lab and restart the computers if required. In a production environment, you should only install updates that are tested and approved.

You should also install the same updates to any physical computers used for Horizon.

Install the ControlUp Agent

Now we finally get around to installing the ControlUp agent.

There are two ways to install the ControlUp agent: MSI package and deploy the agent from the console.

For physical computers and VMs that are not provisioned using a provisioning technology like Linked Clones, Instant Clones, and Citrix Machine Creation Services and Provisioning services, use the console’s ability to deploy the agent. For provisioned machines, ControlUp recommends installing the agent from the MSI package.

How to Deploy the Agent on Your Master Image for PVS/MCS/Linked/Instant Clones

Add Managed Computers

First, we will do the physical computer.

In the ControlUp console, click on the Home tab and Add Machines in the toolbar, as shown in Figure 3.

Click Search, select the physical computer(s), and click Add, as shown in Figure 4.

Click OK, as shown in Figure 5.

Figure 6 shows the selected computers are now in the ControlUp console (what looks to this color-blind person as yellow/orange), showing the ControlUp agent is in the process of installing.

After the agent is successfully installed, the color turns green, as shown in Figure 7.

If any of the computers have a color other than green, the ControlUp console will tell you what issue prevents installation.

Here are two ControlUp support articles that should help you solve any agent installation issues you may have.

Relevant ControlUp Agent Error Messages

General Troubleshooting

If, like me, you created a folder to contain the Horizon-related computers, you can select the computer(s) and drag and drop them into your Horizon folder, as shown in Figures 8, 9, and 10.

Another way is the select the Horizon computers, right-click and click Move to…, as shown in Figure 11.

Select the folder and click OK, as shown in Figure 12.

As shown in Figure 10, the selected computers are placed in the folder.

There are two ways to get the MSI package.

1. Browse to https://www.controlup.com/products/controlup/agent/ and download the appropriate agent. For this lab, since we are using Server 2019, Windows 10 x64, and the latest release of ControlUp, download ControlUp Agent 64-bit for .NET Framework 4.5.
2. From the ControlUp console toolbar, click the Settings tab, Agent, and then click Download Agent MSI, as shown in Figure 13. Download the same file as mentioned in step 1 above.

Save the downloaded MSI package to a location available to your master images.

You can install the MSI package using your preferred installation method or manually, as shown below.

Copy the MSI package to your master image(s).

For this example, I am using the Windows 10 master image.

Either double-click the MSI package or right-click the MSI package and click Install, as shown in Figure 14.

If prompted, click Run, as shown in Figure 15.

Click Next, as shown in Figure 16.

Select I agree to the Terms of Use and Privacy Policy, and click Next, as shown in Figure 17.

Click Next, as shown in Figure 18.

Click Install, as shown in Figure 19.

If UAC is enabled, Click  Yes.

Click Finish, as shown in Figure 20.

If you like, you can double-click on any of the physical Horizon computers to see details.

You have a decision to make regarding the provisioned master images. Should you add them to the ControlUp console or not? Any computer that is online and connected, added to the console, consumes a license. Since the master images are powered off most of the time, and if you leave them powered on, they are not in use by users, so there is nothing that requires monitoring.

I am not adding my master images to my ControlUp console.

Desktop Pool

In the vCenter console, shut down the Windows 10 master image VM and take a snapshot, as shown in Figure 21. Make sure to give the snapshot a useful Name.

Back on the Connection Server, log in to the Connection Server console.

In the left frame, under Inventory, select Desktops, as shown in Figure 22.

Click the VDI Desktop Pool to update, as shown in Figure 23.

Click Maintain, Schedule, as shown in Figure 24.

Select the updated snapshot and click Next, as shown in Figure 25.

Select the appropriate scheduling options and click Next, as shown in Figure 26.

Click Finish, as shown in Figure 27.

Figure 28 shows you can monitor the progress in the console.

After some time (20 minutes in my lab), the process completes, and the console shows the image is now based on the new snapshot, as shown in Figure 29.

RDS Farm

In the vCenter console, shut down the Server 2019 master image VM and take a snapshot, as shown in Figure 30. Make sure to give the snapshot a useful Name.

In the Connection Server console, in the left frame, under Inventory, select Farms, as shown in Figure 31.

Click the Farm to update, as shown in Figure 32.

Click Maintain, Schedule, as shown in Figure 33.

Select Immediate, select Start Now, and click Next for the desired Schedule, as shown in Figure 34.

Deselect Use current parent VM image, select the desired snapshot, and click Next, as shown in Figure 35.

Select the desired log off option and click Next, as shown in Figure 36.

Click Finish, as shown in Figure 37.

Scroll down in the Farm Summary to monitor the progress, as shown in Figure 38.

After some time (23 minutes in my lab), the process completes, and the console shows the image is now based on the new snapshot, as shown in Figure 39.

ControlUp

With the agent installed in the master images and the Instant Clone machines updated, the desktop pool machines should be added to the ControlUp console.

In the ControlUp console, click the Home tab and click Add Machines, as shown in Figure 40.

Click Search, select the updated desktop pool machines, and click Add, as shown in Figure 41.

Click OK, as shown in Figure 42.

The machines are added to the console, as shown in Figure 43.

If you want, move the machines to your Horizon folder.

Figure 44 shows the updated machines with a Ready status, which means ControlUp is now getting detailed monitoring data.

Up next: Using Update Manager with Instant Clones