Wednesday, May 12, 2010

Turn an existing Windows XP system into a VMWare View only terminal...using nothing but Group Policy

I'm going to break this post into a few parts, and if my previous blogging experience is any indication, I'll finish it in 9 years when we've all got WiFi directly to our brains and none of it will matter.

We're giving a serious look to VDI (Virtual Desktop Infrastructure). In keeping with my minimalist workstation management goals, I want to essentially make the local workstations nothing but a thin client, with nothing to manage. Once the workstation is doing nothing but running the View client (as a non-admin user), it becomes pretty much irrelevant what patches, updates, or anything else are installed on it.

This gets broken down into 4 different steps:
  1. Modify the VMWare View Client installer MSI to contain your default settings (for us, disable the single signon feature and plug in the default View server).
  2. Push this modified MSI out to applicable workstations via Group Policy
  3. Build a limited access user with a roaming user profile. This profile will have the View client set as the default Shell (replacing explorer.exe), so nothing else can be run.
  4. Enable AutoAdminLogon on the applicable workstations (again, via group policy) to force workstations to log in as this limited access user.

Step 1 is a pain...but I'll provide the detail you need in the post on the topic. Step 3 could actually be done via group policy as well, but I found it easier to just build the roaming profile.

No comments: