USB Redirection Administrative Policy Interface in View

USB R edirection A dministrative P olicy I nterface i n V iewThe interface for configuring redirection of USB devices to the View virtual desktop from the host system is greatly improved, with settings configurable through administrative policies. A comprehensive and expanded filtering mechanism now exists in the administrative user interface. For example, you may want to disallow redirection of USB mass storage (such as a USB flash drive), but allow headphones or a microphone. Configuration of USB device filtering is broader and easier than in prior versions of View.This new interface for configuring USB devices is currently supported only for the View Agent and for the Windows View Client. With the new View USB device filtering mechanism, you can:•Block unwanted USB devices•Block USB devices (such as keyboards or smart cards) forwarded by other means•Split functions between Client and Agent for composite devices (such as terminating a mouse locally, but forwarding audio and special buttonpresses)•Define custom filter settings for specific devices•Most USB devices are forwarded by default. Some devices are blocked by default:ü✓K eyboardü✓M ouseü✓S mart cardü✓A udio-out-only devices, such as speakersAdministrators configure USB devices in the admin (ADM) policy templates on the View Client and the View Agent. If these settings differ, rules of precedence determine which take effect.The administrator configures USB devices on the View Agent through the vdm_agent.adm administrative template. Install the vdm_agent.adm template on the Agent side, either:• On a parent, template, or other desktop source virtual machine. Then use the Local Group Policy Editor to configure USB policies.• On the Active Directory server, where you use the Group Policy Object EditorThe vdm_agent.adm template includes some client-downloadable-only settings. The client downloads these settings from the desktop at connection time. These allow an administrator to use the Global Policy Editor to configure unmanaged clients (such as a client that is not a member of Active Directory).The administrator configures USB device redirection on the View Client side through the vdm_client.adm administrative template. You install thevdm_client.adm template on the Client and then use the Local Group Policy Editor to configure.By default, most USB devices are filtered in. A specific setting can block a device. You can change this so that all devices are blockedunless specifically allowed by setting the following configuration: ExcludeAllDevices = trueThis can be set on either the View Client or the View Agent. Setting the value to true on either side activates it for both sides.For more details on VMWare View policy configuration, see the Configuring Policies chapter in the VMware View Administration guide. To focus on the topic of setting USB policies, search for USB in that chapter.Evaluation TasksUSB redirection takes careful configuration, but most organizations have only one or two USB devices to configure for their users. A few key points will help you before you practice with three evaluation tasks, from simple to more complex. Where to Configure the PoliciesWe will configure USB redirection on the Agent on the Active Directory server for these exercises. If you prefer, you can configure the settings on the Agent for a particular desktop source machine, in which case you use the Local Group Policy Editor after you import the vdm_agent.adm template. Or you can configure the settings on a Client machine with the vdm_client.adm template and the Local Group Policy Editor. If you configure on the Client, you must be more aware of the rules for conflict resolution between the Agent and Client. For rules ofAgent-Client conflict resolution for USB redirection configurations, carefully read the Configuring Policies chapter of the VMware View Administration guide.In all cases, if you are configuring USB redirection, you need to understand rules of precedence between:•USB settings. For example, the Exclude Vid/Pid Device filter policy setting takes precedence over the Include Vid/Pid Device filter policy setting forthe View Agent. Both the View Agent and the View Client have rules ofprecedence for USB settings. See Configuring Device Splitting PolicySettings for Composite USB Devices and Configuring Filter Policy Settings for USB Devices in the Configuring Policies chapter of the VMware ViewAdministration guide.•The View Agent and the View Client. For example, the View Agent Exclude Family filter policy setting always takes precedence over the same settingon the View Client.•USB settings on the Agent and Client that involve the Merge or Override modifier. For example, if you use the Override modifier with a devicesplitting policy setting on the View Agent, View Client uses the ViewAgent device splitting policy setting instead of the View Client devicesplitting policy setting. If you use the Merge modifier with a devicesplitting policy setting on the View Agent, View Client adds the ViewAgent setting to the equivalent View Client setting.•Global, desktop-pool-level, and user-level policies. User-level policies take precedence over the equivalent desktop-level policy settings and globalpolicy settings. Desktop-level policies take precedence over globalpolicies. T o understand these rules of precedence, read the ConfiguringPolicies chapter in the VMware View Administration guide. Finding theVendor ID and The Product ID for a USB Device Y ou can find the VIDand PID for a USB device in one of several ways:• In the Windows DeviceManager, after the View Client is installed on the client, and if the device is not already automatically redirected t o the View desktop. In the DeviceManager, browse to the connected device, right-click, and select Properties.• On the Internet, through a search on the product name combined with ‘vid’ and ‘pid’•In a log for VMware View after you have plugged in the USB device to the View Client (search for ‘vid’). Two of these logs follow. - The debug log:•Windows XP: C:\Documents and Settings\AllUsers\ApplicationData\VMware\VDM\logs\debug-<yyyy-mm- dd-nnnnnn>.log•Windows Vista / Windows 7: C:\Users\AllUsers\VMware\VDM\logs\debug-<yyyy-mm-dd-nnnnnn>.log- The vdm-sdct > vdm-sdct-<date_time> vdm-logs >debug-<date_time>.txt log placed on the Client desktop after you •choose Options > Support Information from the menu bar of the View Client•Translating Interfaces of Composite USB Devices into Their Functions•An important concept for composite USB devices is that of ‘interface’.Each composite device has various interfaces, or device functions. Forexample, the Philips SpeechMike dictation device used in Task 3 has sixinterfaces. In Task 3, you will split the interfaces of the SpeechMike device so that some functions like the trackball are kept local, and other functions,like audio in and out, are redirected to the View desktop.•You can get the interface numbers for a USB device from the same log where you got the VID and PID numbers for the device.•Translating the interface numbers into their functions for any composite device is not straightforward and may require some trial and error, as wellas Internet searches and communication with device vendor supportrepresentatives.Task 1Block the redirection of all USB devices, except storagedevices, from the client to the View desktop. Test to makesure y ou h ave a ccomplished t his t ask.Import the View Agent policy file to the Active Directory server so you can configure USB devices at the domain level.1. Create an Organizational Unit (OU) for your View desktops, create a GPO for View group policies, and link the GPO to the OU, according to Active Directory Group Policy Example in the Configuring Policies chapter of the VMware View Administration guide.2.Copythevdm_agent.admViewAgentconfigurationtemplatefilefromthefollowingdi rectoryontheViewConnectionServerhost:<install_directory>/VMware/VMwareView/Server/extras/GroupPolicyFilesCopy the vdm_agent.adm file to the desktop of the Active Directory server.3.OntheActiveDirectoryserver,followtheinstructionstonavigatetotheGroupPolicyO bjectEditorinAddViewADMTemplatestoa G PO in the Configuring Policies chapter of the VMware View Administration guide.4.Navigate to Computer Configuration > Administrative Templates.5.Right-clickAdministrativeTemplates.6. ClickAdd/RemoveTemplates,andclickAdd.7. Navigate to the Desktop, where you placed the vdm_agent.adm template file and click Open.8. ClosetheAdd/RemoveTemplateswindow.The View Agent group policy settings are now added to the Active Directory environment and are available for configuration.I nclude USB storage devices.1. Reopen the Group Policy Object Editor.2.IntheGroupObjectPolicyEditor,navigatetoComputerConfiguration>Administrativ eTemplates>ClassicAdministrative Templates (ADM) > VMware View Agent Configuration > View USB Configuration.3. SelectIncludeDeviceFamily.4. Click Edit policy setting.5. EnabletheIncludeDeviceFamilysettingandtype: o:storagein the Include Device Family text box.This includes storage devices such as USB flash drives for redirection, with the override modifier, which causes this View Agent setting to override the equivalent View Client USB setting.6. ClickOK.E xclude all other devices besides the included storage devices.1.In the Group Policy Object Editor, select the Exclude All Devices setting andclick Edit policy setting.2.EnabletheExcludeAllDevicessetting.3. ClickOK.This blocks all devices other than storage devices, as designated in the Include Device Family setting. In the order of precedence rules for USB device filtering, the Include Device Family setting takes precedence over the Exclude All Devices policy so that storage devices are allowed.Any Client USB setting for Exclude All Devices is overridden. The Agent Exclude All Devices setting overrides any setting for Exclude All Devices on the Client.Any Client setting for Include Device Family is overridden because the Agent setting has the Override (‘o’) modifier.T est your setup. USB storage devices should be enabled for redirection to the View desktop, but other USB devices should not be redirected. One way to test this is to examine the Connected USB Device dropdown menu on the View Client to make sure it includes any connected USB storage devices.Task 2Disable redirection of all storage devices except the IronKey e ncrypted s torage d evice.As in Task 1, import the View Agent policy file to the Active Directory server so you can configure USB devices at the domain level.Include the IronKey storage device.1. In the Group Police Object Editor, select the Include Vid/Pid Device setting and click Edit policy setting.2. EnabletheIncludeVid/PidDevicesetting.3.IntheIncludeVid/PidDevicetextfield,typetheVendorIDandProductIDfortheIronKe ystoragedevice.3.Click OK.This allows redirection of the IronKey Secure Drive USB Device.N ow, e xclude a ll o ther U SB d evices b esides t he I ronKey d evice.1. In the Group Policy Editor, select the Exclude All Devices setting and click Edit policy setting.2. EnabletheExcludeAllDevicessetting.3. ClickOK.This blocks all devices other than the IronKey device, as designated in the Include Vid/Pid Device setting. In the order of precedence rules for USB device filtering, the Include Vid/Pid Device setting takes precedence over the Exclude All Devices policy so that the IronKey storage device is allowed.Any Client USB setting for Exclude All Devices is overridden. The Agent Exclude All Devices setting overrides any setting for Exclude All Devices on the Client.Any Client setting for Include Vid/Pid Device is overridden because the Agent setting has the Override (‘o’) modifier.Test your setup. The IronKey USB storage device should be enabled for redirection to the View desktop, but other USB devices should not be redirected.One way to test this is to examine the Connect USB Device dropdown menu on the View Client to make sure it includes the IronKey storage device.Task 3Split a composite USB device (here we use the Philips SpeechMike d ictation d evice), a nd s et a udio i nterfaces a nd the dictation keys to be redirected to the View desktop, while keeping the mouse local to the client. Test to make sure y ou h ave a ccomplished t his t ask.You can get the Vendor ID and Product ID from client logs, from the Internet, or from device documentation. The following line is from the debug log on the View Client after the SpeechMike device was plugged in:2012-05-01T10:58:39.343+01:00 DEBUG (0094-00A8)<vmware-usbd> [vmware-view-usbd] DevFltr: Device id:Vid-0911_Pid-149aTo configure the device functions separately for the composite SpeechMike device, find the interface numbers in a client log, on the Internet, or in the device documentation. The following lines are from the debug log on the View Client after the SpeechMike device was plugged in. The log lists the six SpeechMike interfaces, numbered 0 to 5: audio in and out (0-2), a trackball (3), and keys specific to the dictation process, such as Play and Rewind (4 and 5).2012-05-01T10:58:39.343+01:00 DEBUG (0094-00A8)<vmware-usbd> [vmware-view-usbd] DevFltr:Interface count: 62012-05-01T10:58:39.343+01:00 DEBUG (0094-00A8)<vmware-usbd> [vmware-view-usbd] DevFltr:Interface [0] - Family(s): audio2012-05-01T10:58:39.343+01:00 DEBUG (0094-00A8)<vmware-usbd> [vmware-view-usbd] DevFltr:Interface [1] - Family(s): audio,audio-in2012-05-01T10:58:39.359+01:00 DEBUG (0094-00A8)<vmware-usbd> [vmware-view-usbd] DevFltr:Interface [2] - Family(s): audio,audio-out2012-05-01T10:58:39.359+01:00 DEBUG (0094-00A8)<vmware-usbd> [vmware-view-usbd] DevFltr:Interface [3] - Family(s): mouse2012-05-01T10:58:39.359+01:00 DEBUG (0094-00A8)<vmware-usbd> [vmware-view-usbd] DevFltr:Interface [4] - Family(s): mouse2012-05-01T10:58:39.359+01:00 DEBUG (0094-00A8)<vmware-usbd> [vmware-view-usbd] DevFltr:Interface [5] - Family(s): hidAs i n T ask 1, i mport t he V iew A gent p olicy f ile t o t he A ctive D irectory s erver s o y ou can c onfigure U SB d evices a t t he d omain l evel.Enable t he S peechMike d evice f or U SB r edirection. I t i s e xcluded b y d efault b ecause it c ontains a n H ID (the t rackball).1.In the Group Policy Object Editor, select the Include Vid/Pid Device settingand click Edit policy setting.2.EnabletheIncludeVid/PidDevicesetting.3.IntheIncludeVid/PidDevicetextfield,typetheVendorIDandProductIDfortheSpeech Mikestoragedevice: o:vid-0911_pid-149aThis sets the SpeechMike USB device redirection enablement to override anyequivalent setting on the View Client.4. ClickOK.This allows redirection of the SpeechMike USB device, when it would otherwise be disabled from redirection by default.S plit the composite device so that the trackball remains local and the other interfaces a re r edirected t o t he V iew d esktop. Y ou d o t his a ll i n o ne s tep.1.In the Group Policy Object Editor, select the Split Vid/Pid Device setting andclick Edit policy setting.2. EnableSplitVid/PidDeviceandtypeintheSplitVid/PidDevicetextfield:o:vid-0911_pid-149a(exintf:03)w here ‘o’ means that this View Agent setting will override any Split Vid/PidDevice setting on the View Clientand e xintf:03 excludes interface 3 (the trackball) from being redirected to the View desktop.3. ClickOK.Test your settings. Only the trackball should remain local. All other SpeechMikeinterfaces should be redirected to the View desktop. A quick test of enablementis to check the choices in the Connect USB Device dropdown menu at the top of the View Client window. The trackball should not be in the list, but the otherfunctions of the SpeechMike such as audio in and out and the dictation keysshould be available for redirection. Actual audio device functionality may takefurther d evice s etup i n t he C ontrol P anel.。