allow the launch of the desktop computers only with the view-client CLI commands

Hello

It is possible to restrict desktop graphical clients (web and non-web) launch and the launch of single command line interface?

what I want to achieve this, is to restrict access to desktop computers to view associated with a physical location, while allowing "ALL users" to connect to desktop computers only when you get close to those and not distance.

Looks like using the Kiosk mode to make the broker, authentication and connection of office and then disable the SINGLE sign-on and have instead users connect manually inside the VM, adapt to your usecase?

Tags: VMware

Similar Questions

  • Connect menu USB devices does not appear in the view Client 4.0

    Hello world

    I am facing a problem with the display Client 4.0, in some facilities does not display the menu to connect USB devices on the top of the Menu bar.

    This situation occurs in some computers that are running Windows Vista or Windows 7.

    Is that what someone has experienced this problem?

    I think it's a problem of display compatibility customer with some component installed on the operating system, but I have not identified which we.

    Any help, pls.

    Kind regards

    Carlos Luna

    You are right, that the view Client 4.0 does not install USB drivers on 64-bit computers.  64-bit is coming.

  • Allowing the VPN Clients to the management network - nat woes

    Try to allow the VPNClient IPSEC access to the management network.  packet trace stops on the vpn encrypt even through phase 7 States it's NAT EXEMPT, he said his tent still NAT by a static.  The only thing I can think to put a rule of nat exempted for the subnet on the external interface.

    Please notify.  Thank you.

    Phase: 1
    Type: ACCESS-LIST
    Subtype:
    Result: ALLOW
    Config:
    Implicit rule
    Additional information:
    MAC access list

    Phase: 2
    Type: FLOW-SEARCH
    Subtype:
    Result: ALLOW
    Config:
    Additional information:
    Not found no corresponding stream, creating a new stream

    Phase: 3
    Type:-ROUTE SEARCH
    Subtype: entry
    Result: ALLOW
    Config:
    Additional information:
    in 0.0.0.0 0.0.0.0 outdoors

    Phase: 4
    Type: ACCESS-LIST
    Subtype: Journal
    Result: ALLOW
    Config:
    Access-group MANAGEMENT-IN in the management interface
    access-list MANAGEMENT-IN-scope ip allowed any one
    Additional information:

    Phase: 5
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional information:

    Phase: 6
    Type: FOVER
    Subtype: Eve-updated
    Result: ALLOW
    Config:
    Additional information:

    Phase: 7
    Type: NAT-FREE
    Subtype:
    Result: ALLOW
    Config:
    match ip MANAGEMENT 10.10.10.0 255.255.255.0 outside 172.18.0.32 255.255.255.240
    Exempt from NAT
    translate_hits = 3, untranslate_hits = 33
    Additional information:

    Phase: 8
    Type: NAT
    Subtype:
    Result: ALLOW
    Config:
    static (MANAGEMENT, outside) 203.23.23.75 10.10.10.10 netmask 255.255.255.255
    MANAGEMENT ip 10.10.10.10 host game OUTSIDE of any
    static translation at 203.23.176.75
    translate_hits = 0, untranslate_hits = 1
    Additional information:

    Phase: 9
    Type: NAT
    Subtype: host-limits
    Result: ALLOW
    Config:
    static (MANAGEMENT, outside) 203.23.23.75 10.10.10.10 netmask 255.255.255.255
    MANAGEMENT ip 10.10.10.10 host game OUTSIDE of any
    static translation at 203.23.23.75
    translate_hits = 0, untranslate_hits = 1
    Additional information:

    Phase: 10
    Type: VPN
    Subtype: encrypt
    Result: DECLINE
    Config:
    Additional information:

    Result:
    input interface: MANAGEMENT
    entry status: to the top
    entry-line-status: to the top
    output interface: OUTSIDE
    the status of the output: to the top
    output-line-status: to the top
    Action: drop
    Drop-reason: flow (acl-drop) is denied by the configured rule

    -EXCERPT FROM CONFIG-

    CorpVPN to access extended list ip 10.10.10.0 allow 255.255.255.0 172.18.0.32 255.255.255.240
    Access extensive list ip 172.18.0.32 CorpVPN allow 255.255.255.240 10.10.10.0 255.255.255.0

    mask 172.18.0.33 - 172.18.0.46 255.255.255.240 IP local pool CorpVPN

    access-list MANAGEMENT-extended permitted tcp 172.18.0.32 255.255.255.240 host 10.10.10.11 eq ssh
    access-list MANAGEMENT-extended permitted tcp 172.18.0.32 255.255.255.240 host 10.10.10.10 eq ssh
    access-list MANAGEMENT-extended permitted tcp 172.18.0.32 255.255.255.240 host 10.10.10.13 eq 3389

    access-list 101 extended allow ip 10.10.10.0 255.255.255.0 172.18.0.32 255.255.255.240

    NAT 0 access-list (MANAGEMENT) No.-NAT-DU-MGMT
    access-list no.-NAT-DU-MGMT scope ip 10.10.10.0 allow 255.255.255.0 172.18.0.32 255.255.255.240

    CorpVPN to access extended list ip 10.10.10.0 allow 255.255.255.0 172.18.0.32 255.255.255.240
    Access extensive list ip 172.18.0.32 CorpVPN allow 255.255.255.240 all

    internal CorpVPN group strategy
    attributes of Group Policy CorpVPN
    value of server DNS 203.23.23.23
    VPN - connections 8
    VPN-idle-timeout 720
    Protocol-tunnel-VPN IPSec l2tp ipsec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list CorpVPN
    the address value CorpVPN pools

    type tunnel-group CorpVPN remote access
    attributes global-tunnel-group CorpVPN
    address pool CorpVPN
    Group Policy - by default-CorpVPN
    IPSec-attributes tunnel-group CorpVPN
    pre-shared key

    First of all, there is overlap crypto ACL with the VPN static L2L:

    crypto ASA1MAP 10 card matches the address 101

    access-list 101 extended allow ip 10.10.10.0 255.255.255.0 172.18.0.32 255.255.255.240
    access-list 101 extended allow ip 172.18.0.32 255.255.255.240 10.10.10.0 255.255.255.0

    I would remove the 2 lines of ACL 101 above because it is incorrect.

    Secondly, from the output of ' cry ipsec to show his ", you seem to be getting the ip address of the"jdv1.australis.net.au", not"CorpVPN"pool pool. Therefore, the No. NAT ACL on the management interface is incorrect. I would just add a greater variety of education no. NAT so that it covers all your ip pool:

    access-list no.-NAT-DU-MGMT scope ip 10.10.10.0 allow 255.255.255.0 172.18.0.0 255.255.255.0

    Thirdly, even with your dynamic ACL 'OUTSIDE_cryptomap_65535.65535' crypto map, it only covers the 172.18.0.32/28, so I just want to add a wider range since it seems you get the ip address of the different pool:

    OUTSIDE_cryptomap_65535.65535 list of allowed ip extended access all 172.18.0.0 255.255.255.0

    Then I would disable the following group of access for purposes of test first:

    no access-group MANAGEMENT - OUT Interface MANAGEMENT

    Finally, please clear all the SA on your ASA and xlate, then reconnect to your vpn client and test it again:

    delete the ipsec cry his

    clear the isa cry his

    clear xlate

    Please let us know how it goes after the changes. If it still doesn't work, please please send again the last configuration and also to send the output of the following:

    See the isa scream his

    See the ipsec scream his

    and a screenshot of the page of statistics on your vpn client. Thank you.

  • Based on the roles of the views of CLI with AAA method

    Hello

    I'm configuration based on the roles of views CLI on a router to limit access to users.

    My criteria:

    -There should be a local user account on the router that has the view of 'service' in the annex

    -If the router is online and can reach the radius server, people in the right group are assigned to the view 'service '.

    My configuration:

    AAA new-model

    Select the secret 1234

    username view service secret service 1234

    !

    AAA my_radius radius server group
    private-server 10.1.1.1 auth-port 1645 acct-port 1646 timeout 3 retransmit 2 0 1234 key
    private-server 10.1.1.2 auth-port 1645 acct-port 1646 timeout 2 relay 1 0 1234 key

    !

    authorization AAA console
    AAA authentication login my_radius local group mgmt
    AAA authorization exec mgmt my_radius local group

    !
    Line con 0
    authorization exec mgmt
    Synchronous recording
    login authentication mgmt
    line vty 0 4
    authorization exec mgmt
    Synchronous recording
    login authentication mgmt
    entry ssh transport

    THE ERROR

    Now, I want to go set up the cli view "service"...

    # mode

    Password: 1234

    * 08:00:02.991 Jun 1: AAA/AUTHENTIC/SEE (0000000 D): method of picking list "mgmt".
    * Jun 1 08:00:02.991: RADIUS / ENCODE (0000000D): ask "" password: ".
    * Jun 1 08:00:02.991: RADIUS / ENCODE (0000000D): upload the package. GET_PASSWORD
    * 08:00:21.011 Jun 1: RADIUS: receipt id 1645/13 10.1.1.1:1645, Access-Reject, len 20

    Questions

    Why the view "enable" trying to choose a list of method when you need to provide secrecy to enable it to access the root view?

    You can change this behavior to always use the key to activate it?

    The TEMPORARY Solution

    If you are connected to the router via telnet or SSH, the solution or workaround for this problem is:

    local VIEW_CONFG AAA authentication login

    !

    line vty 0 4

    authentication of the connection VIEW_CONFG

    Make your view configuration and reconfigure the line to use the correct (desired) authentication method.

    ________________________________

    Thanks a lot for the suggestions

    / ENTOMOLOGIST

    Hello

    You have configured the following:

    AAA authentication login my_radius local group mgmt
    AAA authorization exec mgmt my_radius local group

    Line con 0
    authorization exec mgmt
    Synchronous recording
    login authentication mgmt
    line vty 0 4
    authorization exec mgmt
    Synchronous recording
    login authentication mgmt

    entry ssh transport

    So every time you try to connect to the console or ssh authentication will travel to the server radius because of the following command 'connection authentication mgmt '.

    You can get there. What is set on the method list mgmt first will take precedence.

    activate seceret is defined locally. but you have configured the following:

    AAA authorization exec mgmt my_radius local group

    Line con 0
    authorization exec mgmt

    line vty 0 4
    authorization exec mgmt

    So exec mode is also via the radius server.

    When you set up:

    local VIEW_CONFG AAA authentication login

    !

    line vty 0 4

    authentication of the connection VIEW_CONFG

    You do local authentication, so it works the way you want.

    In short, regardless of authentication is set 1 on the list method will take priority. the relief will be checked only if the 1st aaa server is not accessible.

    I hope this helps.

    Kind regards

    Anisha

    P.S.: Please mark this thread as answered if you feel that your query is resolved. Note the useful messages.

  • How is the View Client to connect to the server has failed?

    Hello

    I have already set up the laboratory of Horizon view. But when I was about to connect to VM via View Client, an error message appeared.

    Pls check the photos attached. It seems that view Client connected to the server, but the recovery failed sources to the broker. And the average while servers introduced a healthy state in administrator mode.

    Step:

    1. launch View Client and login entry server IP address.

    2. a box will appear that him want to make sure that the server cannot be trusted. Then click on "continue".

    3. Enter the credentials, and then click "connect" button

    4. the error: "error: invalid server URL.

    What happened there? I have worked all day, still can not understand.

    No matter which help out me? Thank you.

    Step 1:

    View-1.png

    Step 2:

    view-2.png

    Step 3:

    view-3.png

    Don't know if "_" is valid in a FULL domain name, try something else which corresponds to the period of investigation.

    Linjo

  • Lip Sync works only with Side View trigger

    Hello

    I tried to set up a character with a trigger for side view and the Lip Sync does not work, when the trigger is pulled.

    Whenever I press the trigger (1 in my case for the view on the right side) all States to mouth appear at a time instead of switching corresponding to the sound.

    The animation of mouth of façade still works fine.

    I tried to configure the character as a full view (whole body in + before and + folder on the right side) and the head, but none of these approaches do not work.

    Any idea?

    Hi Kai... You will have to remove face and lip of the puppet of top-level sync behavior and add them to each subpuppet specific display. See how the puppet of Wendigo is implemented in the project of character animator examples .

  • I have 2 desktop computers installed with creative cloud. Now I have a laptop. I'm trying to implement so 1 desktop and 1 laptop as creative cloud but

    Initially, I installed programs and permits for 2 workstations. I now have 1 laptop. Trying one of the desktop computer is disconnected while the portable computer and 1 desktop, can have access to the creative cloud. the laptop is running, but when it's on, and I try to put on the desktop I get an error saying I am at max? How is that possible? I have the other disconnected office cc?  I am in Adobe Premiere Pro, and when I go into help I don't see an option to deactivate, so I'm not sure how to in this regard?

    you're welcome and good holidays to you, too.

    Thought Adobe.com have signed you snap on a computer, you were not seen.  out of all resets them all the sign-ins connected.

    (p.s when you use the adobe forums, check useful/correct, if there is.)

  • This Application do not support the requested display protocol - application on the view 6 Horizon Pools

    Hi all

    I am happy to report that I had a positive experience the 5.3 to Horizon view 6 view upgrade last night.  With PCoIP RDS Server connection works like a charm.  However, I get the following error message when you try to access any application that I published in the Admin to view:

    This Application does not support the requested display protocol

    I tried many applications and they all cause the same error.  Any ideas?

    I solved this problem.  Given that I've improved 5,3-6, closed have already been created for me (because I was already using a few RDS servers).  Although I left the default as RDP Protocol, I chose the option allowing users to choose PCoIP or RDP (AFAIK, publishing applications cannot run on PCoIP).  However, it is not enough.  Please make sure that the default protocol is PCoIP.

    To explain further: I have a connection standard RDS users at all as a Server Terminal Server Services, except that they use the view Client and RDP Protocol.  I'm not changing it after the upgrade, so it would not effect all users who have not upgraded to the 3.0 client.  However, I would like to publish some of the applications of this same server, instead of spinning upward another server RDS only for applications.

    In this scenario, the only way to achieve this is to make the default connection protocol PCoIP.  If left like RDP, apparently the application attempts to use RDP as the connection instead of PCoIP Protocol.

  • View Client remembers the last connection protocol (even another computer)

    Currently, the customer discovers learns this last protocol used when connecting to a desktop computer from the view connection server.  It is a big problem.

    EXAMPLE - I have a user who has a PC at work and a PC at home.  I put the default protocol of pool to PCoIP.  They connect at work (pcoip).  They go home and have move to RDP.  They return to work and have move to PCoIP.  They go home and have to swith RDP...

    Why would you transfer an environment setting like that from one computer to another with no ability to override?  This will cause the use moving between computer and protocols to constantly change their protocol settings.  If the client view would ignore the configuration of the server protocol, then they could leave PCoIP together at work and RDP set at home and be able to quickly connect.

    This post explains where the settings is saved on the login server (POST).

    Is it possible with view 4.5 to replace it?

    VMWARE please correct this by adding a parameter to the client view each Protocol user setting from the server connection or ignore it and use the last protocol used by the client to view software.

    I agree it is a bit strange, but you can set a parameter at the launch of the View client to specify whether to use PCoIP or RDP.

    desktopProtocol - XXX will attempt to use the specified protocol desktop display.

    ____________

    blog.eeg3.net | Useful links related to VMware

    If you have found this device or any other post useful, please consider the use of buttons useful/correct for award points.

  • Need a guide to configure the VPN Client

    Hello...

    I vpn in my 506th pix and I have ver.4.0.1 software vpn client installed on the other pc (on the outside). In the firewall, there are two types of vpn; VPN site to site and remote vpn access. We use vpn for remote access to allow the vpn client to access our server right?

    This is all new to me and could you give an example how to configure vpn inside my firewall in CLI or PDM command and how to configure the software vpn client.

    Please help us beginners cisco

    Tonny

    Tony,

    Try chanigng a cisco and see if it solves... but otherwise, since you changed the PIX outside IP now, you will be able to make VPN connections to the new public IP address now, if it is routed on the internet.

    can you please try to connect now and let us know what is happening?

  • Why show black screen for some of my users with a view to the horizon?

    Hello

    I installed horizon view 6.0. now, I just have a problem sometimes some of my users connect to their desktop with vmware view client horizon just see a black screen and cannot do everything even when I'm this office openconsole in vsphere client no show and a black screen for solve the problem I have to restart this desktop computer and its not ok how can I prevent black screen

    now I see that my status of vmware tools was obsolete is so important?

    What di I do?

    Best regards

    Babak

    As often occurs when the wrong VGA driver is installed.  This occurs when the view Agent is installed on the desktop, and then the VMware Tools is updated after the fact.  The result is the driver included with the Agent to view VGA is replaced with the VGA driver in VMware Tools.  You can see some advantages to the relocation of the Agent of the view, or update the VMware Tools and then install the Agent from the view.

  • VMware View Client 2.2: Location of the setting parameters display vDesktop

    Hi all

    from now on the view Client 2.2 allows set dedicated display settings for each vDesktop I wonder where to find this configuration to predefine an individual configuration after the initial deployment of the client.

    Unfortunately, I could not find the configuration files or registry keys?

    Hope someone can help on this?

    10-01-2014 12-42-52.jpg

    2.2 customer use xml file to store individual configuration, C:\Users\\AppData\Roaming\VMware\VMware Horizon View Client\prefs.txt, you should see the attribute base on the vDesktop.

  • Horizon View Client 2.2 cannot solve the short hostname to connect to the server

    Not sure if it worked in previous versions, but version 2.2 client view Horizon doesn't seem to be able to resolve the short hostnames to connect to the server.  The FULL domain name or the IP address works fine however.  Here is my config:

    VMware vCenter 5.1. U1 (Build 1064983)

    VMware ESXi 5.1 U1 (Build 1065491)

    VMware View 5.3.0 build-1427931 (1 connection to the server)

    (currently without using composer)

    The servers view and vCenter are virtual machines running on Windows Server 2008 R2 Ent. SP1 64-bit

    My laptop is running Windows 7 Ent. SP1 64-bit (6.1.7601) and I am running View Client 2.2.0 build-1404668.

    DNS seems to work very well on my office and all VMware servers above.  I do a nslookup the hostname of short-sighted connection to the server from the cmd prompt.  The field is defined and in the list of search suffix on each device and the short host name seems to work in all of the other apps on my desktop.  Not facing DNS problems with other applications.  Even the vSphere client accepts a short hostname for the vCenter server.  I know that I can use the FULL domain name or IP address, but I'm just curious to know which prevents the short host name to work in the view client and can it be resolved?

    -Chris

    Yes, the issue was identified internally. View Client used a 3rd party library and it has limitation which results in this problem. Up to now, we are not sure that the fix will be involved in which version. But we follow the problem and get back to you as soon as we have a few farm update.

    Thank you

    Felix

  • Discover the Mac Client. Redirect disks and printers

    Breast of VMware View, I created a Pool of Terminal servers.

    I want that my clients OSx to connect to this pool by using the VMware View client.

    View customer use DRC to start a session. It connects via the port of 127.0.0.1:random

    Correct me if I'm wrong?

    I want disks and printers (all) to be redirected to the session of the view.

    The bad is that I can make these settings, but only for a specific connection.

    As the view Client creates sessions at random, that these settings are useless.

    Whenever a printer and no discs are redirected.

    How can I redirect all printers and local drives using the VMware View client to connect to a Terminal Server Pool?

    Any help is more than welcome!

  • The view connection server connection failure - and that's it.

    Hi all

    I use a box of 10 Windows with Horizon View Client 5.4.1. Our connections are enabled smart cards. When I run the view of the Horizon, I get the login server and hit connect. I am asked to choose a certificate; I choose the right pair, enter my PIN and then get an error message saying "connection to the view connection server failed." And that's the entire message. When I choose the right certificate, get "the connection to the view connection server is not. " No user could not be found for your certificate." That tells me that it's to reach the server, but without more info, I can not find the problem.

    I opened a session with a view to the Horizon with other machines and can I use my chip card with other sites on this computer. There are ports should I open to view Horizon? What else can I try?

    I started poking around outside the view of the Horizon and found the problem, I'll leave it here in case anyone else has this problem. I had to go to Internet Options-> content in-> certificates-> Select Certificate-> advanced and enable authentication of the Client.

Maybe you are looking for