Lab 1: Manage Horizon desktops and apps with Workspace ONE UEM

Objective and Tasks

In this lab, a Horizon pod is already deployed and a Windows 11 golden image VM with the Horizon Agent installed is powered off and waiting for you. Your Workspace ONE UEM customer organization group has been created but is otherwise empty. You will prepare Workspace ONE UEM to manage Horizon workloads, install the Workspace ONE Intelligent Hub into the golden image so that it survives Sysprep and defers enrollment, configure a desktop pool to enroll its clones automatically, and then remediate a running clone without recomposing the pool.

  1. Log in to the Workspace ONE UEM console and create an organization group for Horizon workloads.
  2. Create a tag and a smart group for the Horizon desktops.
  3. Configure the staging user and streamline the enrollment experience.
  4. Install the Workspace ONE Intelligent Hub in the Horizon golden image.
  5. Configure the Horizon desktop pool for automated Workspace ONE UEM enrollment.
  6. Launch a desktop and verify that enrollment flips to the logged-on user.
  7. Deliver a remediation to running clones without recomposing the pool.

For more information and guidance on integrating the two platforms, see the Omnissa Tech Zone guide, Omnissa Workspace ONE Unified Endpoint Management Integration with Horizon.

 

Expand or collapse content Task 1: Log in to the Workspace ONE UEM console and create an organization group for Horizon workloads
  1. Open the Workspace ONE UEM console.
    • On your ControlCenter desktop, open Google Chrome.
    • From the bookmarks bar, click Workspace ONE UEM.
    • Alternatively, enter https://cn1605.awmdm.com/AirWatch in the address bar.
  2. Log in with your assigned administrator account.
    • Username: StudentAdmin<labid>, where <labid> is the lab ID shown on the Instructions bar.
    • Click Next.
    • Password: Pa$$w0rd
    • Click Log In.
  3. Complete the first-login prompts.
    • If Chrome offers to save the password, click Never.
    • Read and accept the Omnissa General Terms.
    • Set a recovery question and answer, and set 1234 as your four-digit PIN.
    • Click Save.
  4. Confirm which organization group you are working in.
    • Select the account drop-down menu in the top-right corner of the console.
    • Confirm that the organization group shown is Student<labid>.

Check the organization group in the account drop-down menu before you change any setting, in this and in every following task. A setting applied at the wrong level affects every device below it.

  1. Open the organization group details.
    • Navigate to Groups & Settings > Groups > Organization Groups > Organization Group Details
  2. Create a child organization group for Horizon workloads.
  3. Click Add Child Organization Group.
    • In the Name text box, enter Horizon-VDI.
    • In the Group ID text box, enter HorizonVDI.
    • From the Type drop-down menu, select Container.
    • Click Save.
  4. Switch your console context to the new organization group.
    • Select the organization group picker at the top of the console.
    • Select Horizon-VDI.
    • Confirm that Horizon-VDI now appears in the account drop-down menu

Your customer OG already isolates you from the other students in this shared tenant. The child OG you just created models what you would do in a real deployment, where Horizon workloads sit alongside physical endpoints in the same tenant and need their own policy scope.

In production, give non-persistent pools their own child OG as well. Non-persistent VMs enroll with a unique device record each time they are created, and those records are orphaned when the VM is deleted. A dedicated OG lets you point a scheduled Omnissa Intelligence workflow at exactly those records and prune them on whatever cadence suits you.

Expand or collapse content Task 2: Create a tag and a smart group for the Horizon desktops

Smart groups are the assignment mechanism in Workspace ONE UEM  you cannot assign a profile, baseline, or application without one. Tags are a lightweight way to tell Horizon workloads apart from physical endpoints in reports and dashboards. You create both now so that everything you assign later has a target.

  1. Create a tag for Horizon workloads.
    • Navigate to Groups & Settings > Devices & Users > Advanced > Tags.
    • Click Create Tag.
    • In the Name text box, enter Horizon-VDI.
    • From the Tag Type drop-down menu, select Device.
    • Click Save.
  2. Open the assignment groups list.
    • Navigate to Groups & Settings > Groups > Assignment Groups.
  3. Create the smart group.
    • Click Add Smart Group.
    • In the Name text box, enter Horizon-Win11-Desktops.
    • Select Criteria rather than Devices or Users.
  4. Define the smart group criteria and save it.
    • From the Platform drop-down menu, select Windows Desktop.
    • From the Operating System drop-down menu, select the Windows 11 entry that matches your golden image.
    • Confirm that the Organization Group is Horizon-VDI.
    • Click Save.

Resist the urge to build one smart group covering every Horizon desktop. Separating by operating system version, feature update, and model gives you the granularity you need when you assign baseline templates, which are version-specific.

Expand or collapse content Task 3: Configure the staging user and streamline the enrollment experience

A staging account is what lets a Horizon clone enroll itself with no user present and no credentials stored on the endpoint. The lab has already created a basic user in your organization group; you enable device staging on it. You then disable two first-run prompts, because on a non-persistent desktop those prompts reappear at every single logon.

  1. Open the users list.
    • Navigate to Accounts > Users > List View.
  2. Open the pre-created basic user account.
    • Locate the user StudentUser<labid>.
    • Click the pencil icon to edit the user.
  3. Enable device staging for the account.
    • Select the Advanced tab.
    • Set Enable Device Staging to Enabled.
    • Set Single User Devices to Enabled.
    • Set Standard to Enabled.
    • Click Save.

Enable Device Staging is disabled by default, and enrollment fails later with an unhelpful error if you skip it. Note also that the Multi User Devices setting does not apply to Windows devices, despite what the name suggests  leave it alone.

  1. Disable the post-enrollment onboarding experience.
    • Navigate to Groups & Settings > Settings > Devices & Users > General > Enrollment.
    • Select the Optional Prompt tab.
    • Select Override.
    • Select the Windows tab.
    • Set Enable Post-Enrollment Onboarding Experience to Disabled.
    • Click Save.
  2. Disable analytics collection.
    • Navigate to Groups & Settings > Settings > Devices & Users > Microsoft > Windows > Intelligent Hub Settings.
    • Select Override.
    • Select the Privacy tab.
    • Set Collect Analytics to Disabled.
    • Click Save.

In production, use an Active Directory service account rather than a basic account for staging. A service account is easier to secure and far less likely to be deleted by accident. This lab uses the basic account that the lab environment provisions for you.

Expand or collapse content Task 4: Install the Workspace ONE Intelligent Hub in the Horizon golden image

This is the step that makes a golden image safe to clone. Two command-line parameters do the work. DEFERENROLLMENT=Y caches the enrollment details when there is no interactive Windows session and holds enrollment back until a user logs in. PROVISIONHUB=Y allows the Intelligent Hub to survive Sysprep. Without them, every clone inherits the golden image identifiers and the console cannot tell your desktops apart.

  1. Open the vCenter admin console.
    • On your ControlCenter desktop, open a new tab in the Google Chrome browser.
    • Click the bookmark on the bookmark bar for vcenter-01.
  2. Log in to the vCenter admin console.
  3. Power on the golden image VM and open a console.
    • Browse to and select the VM W11GoldenImg.
    • From the Actions top menu, select Power On.
    • When the VM is powered on, click LAUNCH WEB CONSOLE.
    • Log in to Windows as Administrator with the password Pa$$w0rd.
  4. Locate the Intelligent Hub installer.
    • Use Start > File Explorer.
    • Browse to S:\Software\WorkspaceONE.
    • Confirm that AirwatchAgent.msi is present.
  5. Open an elevated command prompt.
    • Right-click the Windows Start icon and select Terminal (Admin).
  6. Install the Intelligent Hub with the deferred enrollment parameters.
Msiexec.exe /i "S:\Software\WorkspaceONE\AirwatchAgent.msi" /q DEFERENROLLMENT=Y PROVISIONHUB=Y
Click to copy
  1. Confirm that the Intelligent Hub installed but did not enroll.
    • Open the Workspace ONE Intelligent Hub application from the Start menu.
    • Confirm that the Hub reports the device as not enrolled.
    • Close the Intelligent Hub.
  2. Shut down the golden image.
    • Use Windows Start > Power button > Shut down.
  3. Take a snapshot of the golden image.
    • Switch to the vSphere tab in Google Chrome.
    • Browse to and select the VM W11GoldenImg.
    • Confirm that the Power Status is Powered off.
    • Select the Snapshots tab and click TAKE SNAPSHOT.
    • In the Name field, enter Hub-Installed.
    • Click CREATE.

Only three things are strictly required on the golden image: the Windows operating system, the Horizon Agent, and the Intelligent Hub installed with these two parameters. Everything else  applications, policies, configurations, optimizations  can be delivered by Workspace ONE UEM afterwards. That is what lets you collapse a sprawl of special-purpose golden images down to one or two vanilla ones.

Expand or collapse content Task 5: Configure the Horizon desktop pool for automated Workspace ONE UEM enrollment

Historically this integration meant embedded installers, PowerShell scripts, and a scheduled task that had to delete itself so that staging credentials were not left on disk. You now configure it on a tab in the pool wizard, and the credentials never touch the endpoint.

  1. Open the Horizon admin console.
    • On your ControlCenter desktop, open a new tab in the Google Chrome browser.
    • Click the bookmark on the bookmark bar for horizon-01a.
  2. Log in to the Horizon admin console.
    • Username: administrator
    • Password: Pa$$w0rd
    • Domain: OmnissaTraining
  3. Start the desktop pool wizard.
    • Navigate to Inventory > Desktops.
    • Click Add to create a new desktop pool.
    • Select Automated Desktop Pool and click Next.
    • Select Instant Clone and click Next.
  4. Work through the pool wizard using the golden image you prepared.
    • For Golden Image, select W11GoldenImg and the snapshot Hub-Installed.
    • On the Desktop Pool Identification screen, enter the ID Win11-BetterTogether.
    • Accept the defaults on the remaining screens until you reach the Workspace ONE UEM step.

<Confirm the exact wizard screen order and the label of the Workspace ONE UEM step against the Horizon build in the Skillable image, then replace this note with the precise substeps and a screenshot.>

  1. Enable Workspace ONE UEM management for the pool.
    • On the Workspace ONE UEM step, select the option to manage this pool with Workspace ONE UEM.
  2. Enter the enrollment details.
    • In the Server URL field, enter ds1605.awmdm.com.
    • In the Organization Group ID field, enter HorizonVDI.
    • In the Staging username field, enter StudentUser<labid>.
    • In the Staging password field, enter Pa$$w0rd.

VALIDATE THIS!!! The Server URL is the device services address, not the address you use to administer the console. Do not enter omnissatraining.awmdm.com here. That vanity address fronts the cn1605 tenant, and device services for a SaaS tenant is the same host with the cn prefix changed to ds  so the value you need is ds1605.awmdm.com. Entering the console address here is the most common reason enrollment silently fails, and it produces no useful error.

  1. Complete the wizard.
    • Click Next and review the Ready to Complete screen.
    • Click Submit to create the pool.
  2. Confirm that the pool is marked as managed.
    • Navigate to Inventory > Desktops.
    • Select the pool Win11-BetterTogether.
    • Confirm that the UEM Managed label appears under the pool name.
  3. Entitle the student group to the pool.
    • On the menu bar, click ENTITLEMENTS > Add entitlement.
    • Search for and select the Horizon-Students group.
    • Click OK.

Automated enrollment from the pool wizard is available on Horizon Cloud, and on Horizon 8 2512 for persistent pools only. Horizon 8 2603 extends it to non-persistent pools as well. On Horizon 8 2506 and earlier you must fall back to the legacy scheduled-task method, which creates a task that deletes itself so that staging credentials are not left on disk.

Expand or collapse content Task 6: Launch a desktop and verify that enrollment flips to the logged-on user

The staging account enrolls the virtual machine, but the device record does not stay with the staging account. When a user logs in through Horizon, the Intelligent Hub reassigns the device to that user with no action from the user or the administrator. This is the mechanism behind per-user policy and application assignment on a shared golden image, and it is worth watching happen.

  1. Wait for the pool to finish provisioning.
    • In the Horizon admin console, select the pool Win11-BetterTogether.
    • Select the Machines (Instant Clone Details) tab.
    • Wait until the Status column shows Available.

While the pool provisions, switch to the Workspace ONE UEM console and open Devices > List View. Leave it open  you will watch the device record appear and then change hands.

  1. Launch the Omnissa Horizon Client.
  2. Log in and launch the desktop.
    • Username: Student1
    • Password: Pa$$w0rd
    • Click Login.
    • Double-click the tile for Win11-BetterTogether.
  3. Observe enrollment completing inside the desktop.
    • Wait for the Windows desktop to finish loading.
    • Open the Workspace ONE Intelligent Hub application.
    • Confirm that the Hub now reports the device as enrolled and managed.
  4. Confirm the device record in the Workspace ONE UEM console.
    • Switch back to the ControlCenter desktop and the Workspace ONE UEM console.
    • Navigate to Devices > List View.
    • Locate the new device record, refreshing the page if it has not yet appeared.
    • Confirm that the User column shows Student1, not StudentUser<labid>.
  5. Confirm smart group membership.
    • Select the device record to open Device Details.
    • Confirm that the device is a member of the Horizon-Win11-Desktops smart group.
    • Note the organization group shown for the device.

If a second student logged in to a different clone from this same pool, they would get their own device record and their own assigned policies and applications, from the same golden image. One image, per-user configuration.

Expand or collapse content Task 7: Deliver a remediation to running clones without recomposing the pool

This is the difference the integration makes. The traditional response to a vulnerability is to update the golden image and recompose the pool  slow, admin-initiated, dependent on a maintenance window, and destructive for persistent desktops. With the clones enrolled, you push the remediation to the running desktops immediately and apply the same policy to the golden image so the fix survives the next refresh.

You first configure a Managed Resources profile, then deploy a remediation to the running clone.

  1. Create a Managed Resources device profile.
    • In the Workspace ONE UEM console, navigate to Resources > Profiles & Baselines > Profiles.
    • Click Add > Add Profile.
    • Select Windows > Windows Desktop > Device Profile.
    • In the General payload, enter the name Horizon-Keep-Managed-Resources.
    • In the Assigned Groups field, select Horizon-Win11-Desktops.
  2. Configure the Managed Resources payload.
    • Select the Managed Resources payload and click Configure.
    • Set Applications, Profiles, Baselines, and Workspace ONE Intelligent Hub to be retained.
    • Click Save & Publish, then click Publish.

This payload matters more for Horizon than for physical endpoints. Creating a new golden image causes the image to unenroll, and if these four resources are not set to be retained, every application you delivered is discarded and re-downloaded to every desktop after the image update. Note also that the payload is configured separately for Windows Desktop and Windows Server, and the defaults differ between the two.

  1. Deploy a remediation to the running clone.
    • Navigate to Resources > Scripts.
    • Click Add > Windows.
    • Enter the name Zero-Day-Remediation and select PowerShell as the language.
    • Paste the contents of Invoke-ZeroDayRemediation.ps1 from the lab files share.
    • Set the execution context to System and the trigger to run on demand.
    • Set the timeout to 30 seconds.
    • Click Save.

The supplied script disables the SMBv1 server and client  a real, well-known mitigation that completes in seconds and needs no reboot to be observable. It writes a receipt to C:\ProgramData\Omnissa\Remediation and drops a copy on the public desktop so the result is visible without opening a console. If the tenant has Granular Patch Management enabled, push an emergency patch here instead  it maps directly onto the zero-day story in the deck.

  1. Assign the remediation to the Horizon smart group.
    • Open the script you created and click Assign.
    • In Smart Groups, select Horizon-Win11-Desktops.
    • Click Save & Publish, then click Publish.
  2. Verify the remediation on the running desktop.
    • Switch to the Horizon session you launched in Task 6.
    • Open the Workspace ONE Intelligent Hub and force a sync if the change has not yet arrived.
    • Confirm that Remediation applied.txt is now on the desktop, and open it to read the receipt.
    • Optionally, run Get-SmbServerConfiguration in a PowerShell console and confirm that EnableSMB1Protocol is now False.
  3. Confirm that the pool was not recomposed.
    • Switch to the Horizon admin console.
    • Select the pool Win11-BetterTogether and review the Machines (Instant Clone Details) tab.
    • Confirm that the clones were never recomposed and that no user was logged off.

The same assignment that remediated the running clones also applies to the golden image when it is enrolled for maintenance, so the fix is both immediate and permanent. You are not choosing between fixing it now and fixing it properly.

This concludes this lab.

0 Comments

Add your comment

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.