vthistle.com

You are here: Home / Archives for VMware

FSLogix | Profile Containers |Excluding Directories

By

I was recently on a project where we used FSLogix for profile management in Citrix. During the design phase with the customer, it was discovered that the client only wanted to redirect specific “Common” directories. Those common directories that they wanted to redirect were: Desktop, Favorites, and Documents. Unfortunately, the documentation for FSLogix and excluding directories isn’t the most straight forward – this included support who struggled to figure it out.

For those not familiar with how FSLogix works, let me take a moment to explain. FSLogix Containers (Profile and Office365) creates a Virtual Hard Drive (VHD) file on a FileServer and stores the user profile including registry in the VHD file. For Profiles, this results in very fast login times as there is no data being copied to the non-persistent VDI session. It simply mounts the VHD to the OS and accesses the data as it was local.

With FSLogix, there is a “Redirections.XML” file, which controls what folders you want to include/exclude. This file needs to be shared and accessible to “everyone” in a read-only capacity. This allows the file to be read upon login and copied to the user’s profile. The FSLogix ADMX file, tells the FSLogix Service where to look for the file. [Computer Configuration /Administrative Templates /FSLogix /Profile Containers /Advanced / Provide RedirXML file to customize redirections]

In the above example, we implemented a Redirections.XML file with the contents listed below:

Where the “0” is listed, you have some options:

0 = No files copied in or out. (Note: the copy tag may be left out entirely and the action will be the same as setting to 0. Only the folder(s) are created on the local_<user_name> directory.)

1 = Copy files to base. Any existing file in an excluded folder will be copied to base.

2 = Copy files back to the virtual profile. Any modified file in the base will be copied back to profile on user logout.

3 = Files are copied from/to base. Combinations options 1 and 2.

FSLogix Profiles made the painful VDI Profile portion, much less painful, and was relatively easy to implement.

I’m excited to see how Microsoft will continue to enhance the different containers and what’s next!

Horizon View 7.5 Instant Clone Issues

By

I was working with someone recently who upgraded their Horizon View environment to 7.5.1 recently who also updated their vCenter to 6.7 – mistake #1.(to get off of the old vCenter Web Client). The customer wasn’t in a position to upgrade their ESXi hosts to 6.7 due to some vendor compatibility issues that needed to be resolved via firmware issues. (mistake #2)

When pushing a new version of a Horizon Instant Clone, they were receiving the error: “Error during provisioning: Cloning of VM Win10-Prod has failed: Fault type is SERVER_FAULT_FATAL – Runtime error: No full links for internal VMs found”

Did I mention that VMware signed off on the version information via an SR?

What did we do to fix the issue? The customer had a small enough VDI environment that it was easy enough to delete the VDI Pools and vCenter and start over (100 clients, 2 Pools).

What would fix the issue: Upgrade your hosts to vSphere 6.7

Moral of the story: Ensure your customers understand the software lifecycle and walk them through the process of ensuring all applications that are dependent on each other are FULLY ready for an upgrade.

Don’t pull a homer.

VMware Horizon View & LetsEncrypt

By

As most tech people, I like to build, destroy, rebuild and repeat. It’s what we do, its how we learn to do things. One of my latest deep-dives has been into Horizon View 7.X. A few years ago, I went down this path as well, and I bought a cert so that I could go through the setup.

Enter LetsEncrypt – Let’s Encrypt is a free, automated, and open certificate authority (CA), run for the public’s benefit. They provide certificates with a lifetime of 90 days and renewing a certificate is done within a couple of minutes, which is perfect for testing and home labs.

I started researching how I could use the LetsEncrypt certs with Horizon View and I couldn’t find much. Before we dive into how we make this happen, I first want to start out by saying using LetsEncrypt with Windows isn’t the simplest thing to do, So I used a CentOS Linux box – Super Small footprint for a cert generator. I’m not a Linux expert, so using and getting to know CentOS was also a learning experience.

So, in this article, I will go through the steps to get the cert, as well as applying them to Horizon View.

Installing LetsEncrypt

As mentioned above, I am using a CentOS machine to obtain the certs.

  • Log into the CentOS machine as root
  • First, we have to install and enable the EPEL repository
    • sudo yum install epel-release
  • Now, we can install certbot – certbot is just an application that goes out and gets the certs
    • sudo yum install certbot

Now that we have Certbot configured, we can now move on to Request the Certificate

Request a Certificate

*Note: change the items in red to match your needs

  1. Run the following command on your Linux box.
    • certbot certonly –manual –email xxxx@gmail.com -d server.vthistle.net –rsa-key-size 2048
  2. Agree to the ToS
  3. Decide if you want to share your email with LetsEncrypt
  4. Answer the question about “Are you ok with your IP being logged” as the IP requesting the cert
  5. Create a page on a web sever with the challenge key to prove you are in ownership of the site

  6. When the request has been validated, you will see a “CONGRATULATIONS“
  7. Browse to /etc/letsencrypt/live/site.domain.com/
    1. You will find the following files:
      • cert.pem —-> Server Certificate
      • chain.pem —> Root and Intermediate Certs
      • fullchaim.pem –> Server, intermediate and root chain
      • privkey.pem —> Private key for Server Certificate

Convert PEM to PFX with Private Key

  1. Copy the files listed above from your Linux box to a windows box and use OpenSSL
  2. Run: openssl.exe pkc12 -export -out view.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem
  3. You will then copy your “view.pfx” file that you can use on your Horizon View Server

Adding the new Cert to the Connection/Security Servers

  1. The process to replace the certs on the Connection Server and Security Servers are the same: open MMC.exe -> File -> Add/Remove Snap-in… -> Select Certificates -> Add:
  2. Change the “friendly name” of the default certificate to something other than vdm
  3. Go through the import wizard and ensure you check the box to “Mark this key as exportable“
  4. Change the “Friendly Name” to vdm and restart the “VMware View Connection Server” service

Complete – Your View Connection Server is now using you 90 day LetsEncrypt certificate. 

Horizon View 7.2 – Help Desk

By

I have been a fan of VMware Horizon View since I was introduced to it back in the 5.x days. There was something about the simplicity of its components. One thing I thought Horizon View was missing was a feature that Citrix has had in XenApp/XenDesktop, in Citrix Director since the early 7.X days. There hasn’t been a good way to see what is going on with a users session. Sure, you could use vRops, but it wasn’t real time.

With VMware Horizon View 7.2, VMware has added what it calls “Help Desk”

Now, before I go much further with this post, you should know that VMware has only enabled this AMAZING feature for Horizon licensing, Advanced and Enterprise. If you remember, they did the same thing when they introduced “Instant Clones”, which made sense because most use cases for Instant Clones would be seen in larger environments. With the Help Desk tool, this is something even the smallest Horizon View environment could see a huge benefit from. Ok, I will stop venting, I don’t make those decisions.

So, lets look at how to access the tool, as well as a few features.

How to Access:

  1. You can access the Help Desk tool by connecting to your access link: https://<FQDN>/helpdesk | You will be prompted to login with your credentials.
  2. Open the Horizon View Admin Page, and click Help Desk – Using this method will automatically sign you in with the credentials you signed into the admin page with

Features

  • Entitlements: I’ve seen in numerous environment where users are individually entitled to pools and applications. The Help Desk tool can quickly show you what a user is entitled to. 
  • Sessions Stats: Yes, you can now see session stats!
    • You can see how many sessions a user has open.You can click on the session and see the stats about that session. Note: If a user is logged into a desktop, you can also offer remote assistance from the tool.

Hopefully VMware decides to open this up to the Standard licensing in the upcoming versions.

Enjoy!

Nutanix – Data Protection to Remote Site- ESXi

By

Mike Dent (the “doctor”) over at Etherbacon did a great walk through on how to setup Data Protection when utilizing the Acropolis Hypervisor. I wanted to go walk through how to setup Data Protection when you are using ESXi as the hypervisor, and how to failover to another Nutanix Cluster (remote site).

 

  1. Setup the “Remote Site” in Prism.
    1. Prism | Data Protection
    2. Click on “Remote Site”
    3. Fill in the remote site name – I typically use “SiteName-DR” and remote cluster IP Address
    4. On the settings page, you are given the options for Bandwidth Throttling, compression and mappings. You will notice when utilizing ESXi, you are not given the option for Network Mapping. Once complete, click “save”.
  2. Create Protection Domain
    1. Click on “Protection Domain” and select “Async DR”
    2. Enter a Protection Domain Name – 
    3. On the Entities page, select the virtual machines you would like to protect. Two things to note on this page.  A). Make sure when you select your VM’s to scroll down 0n the screen and click “Protect Entities”. B) I would recommend installing Nutanix Guest Tools on the virtual machines that you machines if you are utilizing “application consistent snapshots” – NGT is a little more efficient when it comes to taking the snap of the VM – otherwise it will use the VMware Tools to snap the VM.
    4. On the Schedule Page, you can create the schedule for your Protection Domain. Currently (as of 01/27/2015) the shortest amount of time between snaps is 1 hour. Because we want to send this protection domain to our remote site, be sure to put a check mark in the remote site box. On the Retention Policy side of the box, select how many snaps you would like to keep local and how many you want on the remote side. 

 

Once configured a snapshot will be taken. You will also notice after the initial snapshot has been taken the replication to DR will begin.

Failover to DR

At some point, you will want/need to fail over to your DR environment. To do so, using ESXi, complete the following steps.

  1. Select “Data Protection” on the menu screen
  2. Select the Data Protection group you would like to migrate to the remote site | Click Migrate
    • Note: If this was a “TRUE” DR situation, you would log into the DR Cluster and click “Activate” – this will used the last snapshot available on the Remote Cluster
  3. Since Nutanix allows you to replicate to multiple sites, you can now choose which site you would like to migrate the VM to. 
  4. Once you click migrate, it will take a snapshot and replicate it to DR and bring up the VM at the DR Site. You will notice that the machines you migrated will now show up as “orphaned” in vCenter. This is expected.
  5. To bring the machine into production at DR, you will need to change the Network port group to the port group used at DR.
  6. To bring the machine back to Production, log into the DR cluster, Data Protection and select the Data Protection Group. You can now follow steps 2 and 3 from this section

When the DR situation is complete and you have migrated back to the production site, you will again notice that the VM is now orphaned at the DR site. At this point, since it has been migrated back to production, you can delete the orphaned VM.

The below video will show how to migrate a VM from one site to a remote site, and then back.

In this walk through, we have completed the following items:

  • Created a Remote Site under Data Protection
  • Protected Virtual Machines
  • Created a DR Schedule
  • Failed over to the Remote Site
  • Failed back to Production