[True SSO - Causing Internal CA Certificate Database Growth]

We noticed that the True SSO certs used via Workspace One Access is causing massive Database bloat on our Internal CA servers.  The DB grew to 15 GB per server, 80% of it from expired True SSO certs.  We manually purged 80,000 True SSO certs from January to July.

Is this normal?   My CA Admin is obviously not thrilled, as he now has to take the Server offline and clean/shrink the database monthly, where it was never an issue before True SSO was implemented.

"CertUtil -deleterow 8/9/2024 Cert"   --> cleaned up 20,000 certs in a 3 day period.  That's alot of certs.    We have 12,000 Physicians logging in, sometimes multiple times per day in case you were wondering about the load.

[Windows OS Optimization Tool 1.2.1 - Permissions to Download]

Yep.  I can download it now as well! 

Thanks to all that assisted with this issue.  I know a divestiture will cause minor issues like this, as everything is separated from VMware/Broadcom.  I appreciate the team effort, and hope that us customers don't come across as complainers! 

[Windows OS Optimization Tool 1.2.1 - Permissions to Download]

Omnissa Support replied to my detailed ticket with the same URL to download it...  *sigh*

 

[Windows OS Optimization Tool 1.2.1 - Permissions to Download]

Thanks for letting me know.  I also opened a Support ticket, and will see what happens...

[Windows OS Optimization Tool 1.2.1 - Permissions to Download]

Windows OS Optimization Tool 1.2.1 was released on 08/01/2024.  I can download all of the versions except for the new 1.2.1 version.

Is this a bug on the backend? Or is this specific to my account?  Just wondering if others are seeing similar issues.

ref: Windows OS Optimization Tool for VMware Horizon - VMware Customer Connect (omnissa.com)

[Microsoft Teams 2.1]

Not at this time. 

Microsoft explained in the Teams 2.1 Tap Program that for Omnissa Horizon, it needs to popup in the foreground as it establishes the back optimization channels, and then will move to the background once completed. 

Not a great solution.  I hope it improves in future builds.

[Horizon Client - Install Link broken (again)]

UPDATE: 

The URL was updated to point directly to the Omnissia.com website in the Workspace One Access August 5th upgrade.

 

[DEM published shortcuts are blank]

@vap0r  Thank You for sharing that with the Community!  

[New Teams - DirectFlex Fix]

I have tried this setup, set REG_DWORD value DirectFlex to 2, but now AutoStart no longer functions.  It worked just fine when DEM ran on login.

I'm wondering if I need to add something other than ms-teams.exe as the DirectFlex trigger. Or if that's just something that will not with with New Teams and DirectFlex.

I use FSLogix in a couple other pools and it works fine.  But I leverage DEM for our main Clinical pool.  I don't have enough storage for 30,000 FSLogix VMDK files!

[New Teams - DirectFlex Fix]

I'd noticed that DirectFlex no longer worked for "New Teams" and it has been causing login delays for my customers due to the ever-increasing size of the ZIP.  I just read the release notes for DEM 2406 and saw mention of a fix!  I figured I'd start a thread on this issue to ensure others are aware of it.  I'll be testing it today. 

The Fix from the 2406 Release Notes:

• DEM-188: New Microsoft Teams does not trigger DirectFlex processing
  Launches of the new Microsoft Teams are performed by the AppInfo service. In older versions of Dynamic Environment Manager, AppInfo starting a DirectFlex-enabled executable triggered DirectFlex processing. With the default DEM configuration, this behavior does not exist.
  Workaround: To enable the old behavior, set REG_DWORD value DirectFlex to 2 in the HKLM\SOFTWARE\Immidio\Flex Profiles key (for Group Policy-based setups), or in the HKLM\SOFTWARE\VMware, Inc.\VMware UEM\Agent\Configuration key (for NoAD).

• 2870360: COM servers do not trigger DirectFlex processing
  In older versions of Dynamic Environment Manager, instantiating an out-of-process COM object hosted by a DirectFlex-enabled executable triggered DirectFlex processing. With the default DEM configuration, this behavior does not exist.
  Workaround: To enable the old behavior, set REG_DWORD value DirectFlex to 1 in the HKLM\SOFTWARE\Immidio\Flex Profiles key (for Group Policy-based setups), or in the HKLM\SOFTWARE\VMware, Inc.\VMware UEM\Agent\Configuration key (for NoAD).
  
  Note: To enable the workarounds of DEM-188 and 2870360 at the same time, DirectFlex must be set to 3.

[Installing Printer Drivers]

We have about 20 different printer drivers and I installed all of them in the master image.

I use the "PrintBrmUi.exe" for Printer Migration, inside Windows\System32 folder in Windows 10/11.
You can back up the printers, including queues, ports, and printer drivers, to a printerExport file, which can then be used to import that printer to another computer running Windows 10/11 master.

This will greatly speed up the printer mapping, as well as reduce all that unnecessary network traffic and Disk I/O!

[DEM published shortcuts are blank]

I read somewhere that the July Windows update was the cause of this...and only if the icon image was in a remote network share.  You could try copying down the Icons via DEM Files/Folders and changing it to point locally.

[Horizon Client - Install Link broken (again)]

It looks like Broadcom has fixed the URL redirect (again) for https://www.vmware.com/go/viewclients, it now goes to https://customerconnect.omnissa.com/downloads/info/slug/desktop_end_user_computing/vmware_horizon_clients/horizon_8

Rob - I was referring to the builtin shortcut in Workspace One Access in the Account section. We have instructions for our customers to leverage that for the local install of the Horizon Client. Or are you saying that the SAAS offering queries my connection servers and alters that URL?

I'm still not sure why Omnissa is relying on Broadcom to redirect the URL. It is STILL the vmware.com address.  You'd think swapping out a URL would be relatively easy.  This is the second time this has broken since the divestiture, and it probably won't be the last.

 

[Horizon Client - Install Link broken (again)]

I did the right thing, and opened an Omnissa Support Case. 

Reply was as follows:   "Our R&D team is working on getting that link updated."

[Horizon Client - Install Link broken (again)]

It looks like the Horizon Client Install URL is broken.  It points to https://www.vmware.com/go/viewclients

It would be Super if it was updated to point to an Omnissa.com URL.

 

This URL works: Download VMware Horizon Clients - VMware Customer Connect (omnissa.com)

Our customers use the embedded URL from within Workspace ONE Access for their setup. It was working a couple days ago, but I guess Broadcom is performing cleanup of all EUC from their websites.

 

 

[OS Optimization tool and MS Teams 404]

Robin - Try deleting the IfIso registry key.  (see thread above).  It is the root of the issue.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso

[Clarification on KB 1000590 (Already Used VM)]

I'll open a Support ticket and share my findings.

[Clarification on KB 1000590 (Already Used VM)]

That's all I ever add as well.  That's why that KB article confused me, as I'd never heard of adding Polling timeouts.  And I cannot find ANY other mention of those polling values anywhere on the Internet.

[Demystifying VMware Horizon Instant Clones: A Deep Dive]

What I'd like to know is what the future holds for Instant Clones.  Now that Omnissa is split off from Broadcom, and the future of "free" vSphere licensing is still in question...what's next.  Will Omnissa try to recreate Instant Clones on other platforms?  We are heavily invested in Instant Clones, and love the technology!

[OS Optimization tool and MS Teams 404]

Your 404 errors could be due to this odd bug from one of the Windows updates.  Deleted a few Registry Keys for the Windows Firewall will resolve that issue.  The issue is that the local firewall is blocking the Auth App from reaching out to Microsoft , thus the 404 error.  See the thread below.

Delete: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso

[PowerBI - Any suggestions?]

Since Microsoft switched over to using Webview2 (like New Teams, etc) the DEM size is now HUGE.

I'd like to narrow it down a bit, but I'm not real sure what all is needed for PowerBI to function properly. 

The "\LocalAppData\Microsoft\Power BI Desktop\WebView2\EBWebView\Default\WebStorage" folder is like 300MB alone.

 

Any helpful ideas?

[MS Azure Auth Issues after rolling out the Microsoft February patch and beyond (KB5034763)]

We DELETED the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso\ and all of its contents on the parent image.

This has resolved the Authentication issues for our users.  No complaints since, and it's been a few weeks.

[Clarification on KB 1000590 (Already Used VM)]

I'm looking for clarification on KB 1000590 --> The View virtual machine is not accessible and the View Administration console shows the virtual machine status as Already Used (1000590) (omnissa.com)

We are having random issues where a user cannot connect to a non-persistent desktop.  When investigated, the desktop state is "already used".  The pool is already set with the pae-DirtyVMPolicy=2: Automatically refresh virtual machines.  The KB mentions adding some timeout values that I'd never seen published before.

cs-suspendpolltimeout=90000
and
cs-suspendpolltime=1000

Has anyone added these values before?  This does not happen very often, but when it does, it involves the Clinical worker calling the Support Desk to delete the VM and causes disruption. I'd like the VM to just automatically delete as per the DirtyVMPolicy.  

[New Teams as an application in Omnissa Horizon]

I publish the following:  ms-teams.exe msteams:work

 

[nVidia - To Disable or Not to Disable, that is the question]

For those or you running nVidia GRID cards in you Horizon environment, I was wondering if you disabled the VGA or IDD display drivers.

I've always disabled my VGA display adapter, and then used the Horizon Direct agent to manage the master VM for updates. 

Do any of you leave it enabled?  Just curious how others manage their nVidia master images.