User manual

Table 3‑5. Horizon Client Configuration Template: Security Settings
Setting Description
Allow command line credentials
(Computer Configuration setting)
Determines whether user credentials can be provided with Horizon Client
command line options. If this setting is disabled, the smartCardPIN and
password options are not available when users run Horizon Client from the
command line.
This setting is enabled by default.
The equivalent Windows Registry value is AllowCmdLineCredentials.
Servers Trusted For Delegation
(Computer Configuration setting)
Specifies the View Connection Server instances that accept the user identity and
credential information that is passed when a user selects the Log in as current
user check box. If you do not specify any View Connection Server instances, all
View Connection Server instances accept this information.
To add a View Connection Server instance, use one of the following formats:
n
domain\system$
n
system$@domain.com
n
The Service Principal Name (SPN) of the View Connection Server service.
The equivalent Windows Registry value is BrokersTrustedForDelegation.
Certificate verification mode
(Computer Configuration setting)
Configures the level of certificate checking that is performed by Horizon Client.
You can select one of these modes:
n
No Security. View does not perform certificate checking.
n
Warn But Allow. A self-signed certificate is provided by View. In this case,
it is acceptable if the certificate name does not match the View Connection
Server name provided by the user in Horizon Client.
If any other certificate error condition occurs, View displays an error dialog
and prevents the user from connecting to View Connection Server.
Warn But Allow is the default value.
n
Full Security. If any type of certificate error occurs, the user cannot
connect to View Connection Server. View displays certificate errors to the
user.
When this group policy setting is configured, users can view the selected
certificate verification mode in Horizon Client but cannot configure the setting.
The SSL configuration dialog box informs users that the administrator has
locked the setting.
When this setting is not configured or disabled, Horizon Client users can select
a certificate verification mode.
To allow a View server to perform checking of certificates provided by
Horizon Client, the client must make HTTPS connections to the View
Connection Server or security server host. Certificate checking is not supported
if you off-load SSL to an intermediate device that makes HTTP connections to
the View Connection Server or security server host.
If you do not want to configure this setting as a group policy, you can also
enable certificate verification by adding the CertCheckMode value name to one
of the following registry keys on the client computer:
n
For 32-bit Windows: HKEY_LOCAL_MACHINE\Software\VMware,
Inc.\VMware VDM\Client\Security
n
For 64-bit Windows: HKLM\SOFTWARE\Wow6432Node\VMware,
Inc.\VMware VDM\Client\Security
Use the following values in the registry key:
n
0 implements No Security.
n
1 implements Warn But Allow.
n
2 implements Full Security.
If you configure both the group policy setting and the CertCheckMode setting in
the Windows Registry key, the group policy setting takes precedence over the
registry key value.
NOTE In a future release, configuring this setting using the Windows registry
might not be supported. A GPO setting must be used.
Chapter 3 Configuring Horizon Client for End Users
VMware, Inc. 43