topic Re: What is the preferred way to monitor vmware view environments for User- in General Topics

What is the preferred way to monitor vmware view environments for User-ID?

Sec101 — Sat, 07 Dec 2019 20:00:24 GMT

How are others monitoring their Vmware view / horizon environments for user-id?

I see there is a terminal services agent you can use, (looks like you can only install on windows and citrix) but I haven't found specifics on actually monitoring the vmware view environment/and what permissions that account would need in vmware. Can anyone point me in the right direction for monitoring a vmware view environment for user-id?

There is a vm information sources area, but I'm thinking that that is only for obtaining VM tags for use in security policy and DAG - NOT for user-id user to ip mapping specifically.

The below link talks about it - but doesn't give clear direction on how/what to look at for vdi view environments:

https://www.paloaltonetworks.com/solutions/initiatives/virtual-desktop-infrastructure

Re: What is the preferred way to monitor vmware view environments for User-ID?

BPry — Sun, 08 Dec 2019 06:03:38 GMT

@Sec101,

Can you explain how you actually have VMWare Horizon configured within your environment, because there are quite a few different ways you could be using this that would change how you would collect the user information. A lot of the time I see companies simply granting a user entitlement to a vm host and you can continue to pull user-id information directly from Active Directory as you are now. Again though, there are a lot of different ways you can configure Horizon and we need a bit more information on how you've actually got things configured.

Horizon itself though is generally not something I collect information from unless I'm using it as a user-id source or feeding login events in through the API. Generally, people are using it to allow a user access directly to a machine or a TS. You really only need to do things differently if you've enabled ThinApp.

Re: What is the preferred way to monitor vmware view environments for User-ID?

Sec101 — Sun, 08 Dec 2019 20:10:24 GMT

let me check and get back to you on the exact application here. Should have the answer shortly. Thank you for the quick reply!

Re: What is the preferred way to monitor vmware view environments for User-ID?

Sec101 — Tue, 10 Dec 2019 18:17:07 GMT

Turns out the backend is mostly Windows. Terminal services agent it is. Hoping this solves the problem.

Re: What is the preferred way to monitor vmware view environments for User-

GlennSJ — Wed, 20 May 2020 15:08:40 GMT

If "turns out backend is mostly Windows" = remote desktop services on a terminal server, then the terminal server agent is the way to go. If "turns out the backend is mostly Windows" = users gaining access to full clone or linked clone or instant clone virtual machines, then your existing user-id infrastructure which monitors AD logins will work without installing the terminal server agent.