VMware vCenter Server is the central management component for ESXi servers, allowing administrators to manage multiple ESXi hosts and virtual machines (VMs) from a single console. It provides essential management capabilities, including resource allocation, performance monitoring, and centralized access control, making it the cornerstone for managing a VMware virtualized infrastructure.

In a load balanced Horizon POD with three Connection Servers, there are 450 active Blast sessions connected. If one of these Connection Servers runs into an unplanned outage, only the active sessions from the failed Connection Server are disconnected, because HTTPS Secure Tunnel is disabled. This means that the other two Connection Servers can still handle the remaining sessions without interruption.

The HTTPS Secure Tunnel is a feature that allows Horizon Client devices to establish secure connections to virtual desktops and applications through the Connection Server. When this feature is enabled, all the display protocol traffic is tunneled through the Connection Server, which acts as a proxy between the client and the desktop.This increases the security and simplifies the network configuration, but also adds some overhead and dependency on the Connection Server availability1.

When this feature is disabled, the Horizon Client devices connect directly to the desktops using their IP addresses or hostnames, bypassing the Connection Server.This reduces the load and dependency on the Connection Server, but also requires more network configuration and firewall rules to allow direct access to the desktops2.

The Blast Secure Gateway is a similar feature that allows Horizon Client devices to establish secure connections to virtual desktops and applications using the Blast Extreme protocol through the Connection Server. When this feature is enabled, the Blast Extreme traffic is tunneled through the Connection Server, which acts as a gateway between the client and the desktop.When this feature is disabled, the Horizon Client devices connect directly to the desktops using Blast Extreme3.

In this scenario, both HTTPS Secure Tunnel and Blast Secure Gateway are disabled, which means that the Horizon Client devices connect directly to the desktops using Blast Extreme. Therefore, if one of the Connection Servers fails, only the sessions that were authenticated by that Connection Server are affected.The other sessions can continue without interruption, as long as they can reach their desktops directly4.

The other options are not correct for this scenario:

All 450 active sessions are disconnected, and have to re-connect again by the end-user. This would be true if HTTPS Secure Tunnel or Blast Secure Gateway were enabled, and all the display protocol traffic was tunneled through the Connection Server.In that case, any failure of a Connection Server would disconnect all the sessions that were using it as a proxy5.

All active sessions will stay connected, because HTTPS Secure Tunnel and Blast Secure Gateway are disabled. This would be true if there was no dependency on the Connection Server after authentication. However, even with HTTPS Secure Tunnel and Blast Secure Gateway disabled, there is still some communication between the Horizon Client and the Connection Server for session management and heartbeat monitoring. If a Connection Server fails, these communications are lost and the sessions are terminated.

All 450 active session are logged off immediately. This would be true if there was a global setting in Horizon Console to log off users when a Connection Server fails. However, there is no such setting in Horizon Console. The default behavior is to disconnect users when a Connection Server fails, not log them off.

Configuring HTTPS Secure Tunnel

Configuring Network Ports for Direct Connections

Configuring Blast Secure Gateway

Load Balancing Across Multiple Pods

Horizon 7: Monitoring health of Horizon Connection Server using Load Balancer

[Horizon 7 Pods]

[Global Settings for Client Sessions in Horizon Console]

[VMware Horizon Architecture Planning]

Windows golden image optimization is the process of reducing the size and improving the performance of the Windows OS image that is used as the base for the desktop pools. Some of the best practices for Windows golden image optimization are:

Disable unnecessary services: Services that are not required for the desktop functionality or user experience should be disabled to reduce the resource consumption and potential security risks. For example, services such as Windows Search, Windows Defender, Windows Update, and Superfetch can be disabled for better performance and stability.

Disable power options: Power options such as hibernation and sleep mode should be disabled to free up disk space and avoid potential issues with the desktop state. Hibernation can consume a large amount of disk space by creating a hiberfil.sys file that stores the system memory contents when the desktop is powered off. Sleep mode can cause problems with network connectivity and user sessions when the desktop is resumed from a low-power state.

Other best practices for Windows golden image optimization include:

Activate Windows OS paging: Paging is a mechanism that allows the OS to use a portion of the disk as virtual memory when the physical memory is insufficient. Paging can improve the performance and stability of the desktops by preventing out-of-memory errors and reducing memory contention. However, paging can also increase disk I/O and wear, so it should be configured with caution and monitored regularly.

Turn off automatic Windows maintenance (scheduled tasks): Automatic Windows maintenance is a feature that runs various tasks such as disk defragmentation, disk cleanup, security scanning, and system diagnostics in the background. These tasks can consume a lot of CPU, memory, and disk resources and interfere with the user experience and desktop performance. Therefore, it is recommended to turn off automatic Windows maintenance and run these tasks manually or on a scheduled basis when the desktops are not in use.

Turn off automatic Windows Updates: Automatic Windows Updates is a feature that downloads and installs updates for the OS and other Microsoft products in the background. These updates can consume bandwidth, disk space, and CPU resources and cause compatibility issues with some applications or drivers. Therefore, it is recommended to turn off automatic Windows Updates and manage the updates manually or through a centralized tool such as VMware Update Manager or Microsoft WSUS.Reference: [Optimizing Your VMware Horizon View 7.x Golden Image] and [VMware Horizon 8.x Professional Course]

For instant-clone operations in Active Directory, the user account used by VMware Horizon needs specific permissions to manage computer objects effectively. These include the ability to create and delete child objects and computer objects, as well as read and write all properties of those objects. These permissions ensure that Horizon can create, modify, and clean up computer accounts associated with instant clones, facilitating seamless desktop provisioning and management.

VMware Horizon Cloud on Microsoft Azure is the only deployment solution that meets all the requirements.VMware Horizon Cloud on Microsoft Azure supports Windows 10 Enterprise multi-session desktops, which are a new Remote Desktop Session Host exclusive to Azure Virtual Desktop on Azure1. It also supports App Volumes, which is a real-time application delivery system that enables IT to instantly provision applications to users or desktops. VMware Horizon Cloud on Microsoft Azure supports centralized brokering, which means that the Horizon Cloud Service acts as a single point of entry for end users to access their virtual desktops and applications. VMware Horizon Cloud on Microsoft Azure also supports automatic routing of end-users to the most appropriate virtual workspace, using the Universal Broker feature. Universal Broker is a cloud-based brokering service that provides a unified user experience across multiple Horizon pods and clouds.

VMware vSphere Desktop Edition does not support Windows 10 Enterprise multi-session desktops, as they are only available on Azure Virtual Desktop1. VMware Workspace ONE Unified Endpoint Management does not support App Volumes, as it is a different solution for managing devices and applications. VMware Horizon On-Premises does not support automatic routing of end-users to the most appropriate virtual workspace, as it requires manual configuration of load balancing and global entitlements.Reference:

Profile production applications in Azure with Application Insights Profiler1

Using Application Profiler - VMware Docs2

First look at profiling tools - Visual Studio (Windows)3

App Volumes Overview

Horizon Cloud Service on Microsoft Azure Architecture

Universal Broker Overview

Workspace ONE UEM Overview

Load Balancing Across Pods and Sites in a Cloud Pod Architecture Environment