Omnissa Horizon Archives

VMware Horizon Blank Screen

End User Computing, Omnissa Horizon, Remote Access, VDI, VMware 19 Responses »

Apr 042020

In all my years assisting and providing support with VMware Horizon, one of the most common problems that customers report with their VDI implementations, is the VMware Horizon Blank Screen.

When a user is presented with a blank or black screen when using the VMware Horizon Client, the problem can be caused by a number of different things. In this post, I will address and provide solutions for some of the common issues that cause the VMware Horizon blank screen.

This troubleshooting guide applies to VMware Horizon 8, VMware Horizon 7, as well as earlier versions of VMware Horizon.

VMware Horizon Blank Screen Causes

There’s a number of different causes of a blank or black screen when connecting and establishing a VDI session to Horizon View. Click on the item below to jump to that section of the post:

VMware Tools and Horizon Agent Installation Order
Network ports are blocked (Computer Firewall, Network Firewall)
DNS Issues
XDR, EDR, and AV Platform causing momentary blank screen at logon
Incorrectly configured Unified Access Gateway
GPU Driver Issue
NVIDIA vGPU Issues
VMware Tools
Horizon Agent
Video Settings (Video Memory (VRAM), Resolution, Number of Displays)
Master Image Resolution
Protocol
HTTPS Proxy and redirection issues
Login banner or disclaimer (PCoIP)
Old version of Horizon View
Blank Screen connecting to Physical PC running Horizon Agent

Now that we have a list, let’s dive in to each of these individually. Some of these will require you to do your own research and will only guide you, while other sections will include the full fix for the issue.

VMware Tools and Horizon Agent Installation Order

When deploying the VMware Horizon View agent, you are required to install the agent, along with VMware tools in a specific order. Failing to do so can cause problems, including a blank screen screen.

The installation order:

Install GPU/vGPU drivers (if needed)
Install VMware Tools Agent
Install the VMware Horizon Agent
Install the VMware User Environment Manager Agent (if needed)
Install the VMware App Volumes Agent (if needed)

It is important to also consider this when upgrading the agents as well. When upgrading VMware Tools, it is recommended to re-install the Horizon agent in versions up to and including Horizon 8 2103. As of Horizon 2106 and later, you no longer need to re-install the Horizon Agent when performing a VMware Tools upgrade.

For more information on the agent installation order for VMware Horizon, please visit: https://kb.vmware.com/s/article/2118048.

Network ports are blocked (Computer Firewall, Network Firewall)

For the VMware Horizon agent to function properly, ports must be accessible through your firewall, whether it’s the firewall on the VM guest, client computer, or network firewall.

The following ports are required for the VMware Horizon Agent when connecting directly to a View Connection Server.

Destination	Network Protocol	Destination Port	Details
Horizon Connection Server	TCP	443	Login, authentication, and connection to the VMware Connection Server.
Horizon Agent	TCP	22443	Blast Extreme
	UDP	22443	Blast Extreme
	TCP	4172	PCoIP
	UDP	4172	PCoIP
	TCP	3389	RDP (Remote Desktop Protocol)
	TCP	9427	Client Shared Drive redirection (CDR) and Multi-media redirection (MMR).
	TCP	32111	USB Redirection (Optional), can be incorporated in to the Blast Extreme connection.

Network Ports Required for VMware Horizon View to View Connection Server

The following ports are required for the VMware Horizon Agent when connecting through a VMware Unified Access Gateway (UAG).

Destination	Network Protocol	Destination Port	Details
Unified Access Gateway	TCP	443	Login, authentication, and connection to the Unified Access Gateway. This port/connection can also carry tunneled RDP, client drive redirection, and USB redirection traffic.
	TCP	4172	PCoIP via PCoIP Secure Gateway
	UDP	4172	PCoIP via PCoIP Secure Gateway
	UDP	443	Optional for Login traffic. Blast Extreme will attempt a UDP login if there are issues establishing a TCP connection.
	TCP	8443	Blast Extreme via Blast Secure Gateway (High Performance connection)
	UDP	8443	Blast Extreme via Blast Secure Gateway (Adaptive performance connection)
	TCP	443	Blast Extreme via UAG port sharing.

Network Ports Required for VMware Horizon View to VMware Unified Access Gateway (UAG)

You’ll notice the ports that are required for Blast Extreme and PCoIP. If these are not open you can experience a blank screen when connecting to the VMware Horizon VDI Guest VM.

For more information on VMware Horizon network ports, visit VMware’s Network Ports in VMware Horizon | VMware.

Certain types of IPS (Intrusion Prevention Service) can also intercept and block traffic. IPS may cause intermittent issues.

DNS Issues

While VMware Horizon View usually uses IP address for connectivity between the View Connection Server, guest VM, and client, I have seen times where DNS issues have stopped certain components from functioning properly.

It’s always a good idea to verify that DNS is functioning both internally and externally. DNS (forward and reverse) is required for VMware Horizon Linux guests VMs.

XDR, EDR, and AV Platform causing momentary blank screen at logon

When using an XDR (Extended Detection and Response), EDR (Endpoint Detection and Response), or special AV solution with non-persistent desktops, one may experience a momentary blank screen on user session logon. I have observed this with Sophos XDR as well as Cortex XDR, with blank screens varying from 10-30 seconds on user login.

Removal of the platform can reduce the momentary blank screen down to 1-5 seconds.

I highly recommend configuring and tweaking policies as much as possible to enhance and optimize your environment. There will always be a trade off of performance for security, and the decisions should be made by those in the organization who make cyber security related decisions.

Incorrectly configured Unified Access Gateway

A big offender when it comes to blank screens is an incorrectly configured VMWare Unified Access Gateway for VMware Horizon.

Sometimes, first-time UAG users will incorrectly configure the View Connection server and UAG.

When configuring a UAG, you must disable both “Blast Secure Gateway”, and “PCoIP Secure Gateway” on the View Connection Server, as the UAG will be handling this. See below.

Picture of the Secure Gateway settings on VMware Horizon View Connection Server when used with VMware UAG. — Secure Gateway Settings on View Connection Server when used with UAG

Another regular issue is when admins misconfigure the UAG itself. There are a number of key things that must be configured properly. These are the values that should be populated on the UAG under Horizon Settings.

Connection Server URL	https://ConnectionServerIP:443
Connection Server URL Thumbprint	sha1=SSLTHUMPRINT (Thumbprint of the SSL certificate your View Connection Server is using)
PCOIP External URL	UAG-EXTERNALIP:4172
Blast External URL	UAG-InternetFQDN:443
Tunnel External URL	UAG-InternetFQDN:443

You must also have a valid SSL certificate installed under “TLS Server Certificate Settings”. I’d recommend applying it to both the admin and internal interface. This is a certificate that must match the FQDN (internal and external) of your UAG appliance.

Once you’re good, you’re green!

Picture of the VMware UAG interface showing all green (functioning). — VMware Unified Access Gateway showing valid

You should always see green lights, all protocols should work, and the connections should run smooth. If not, troubleshoot.

GPU Driver Issue

When using a GPU with your VM for 3D graphics, make sure you adhere to the requirements of the GPU vendor, along with the VMware requirements.

Some vendors have display count, resolution, and other limits that when reached, cause Blast Extreme to fail.

An incorrectly installed driver can also cause issues. Make sure that there are no issues with the drivers in the “Device Manager”.

VMware documents regarding 3D rendering:

Blast Extreme log files can be found on the guest VM in the following directory.

C:\ProgramData\VMware\VMware Blast\

Looking at these log files, you can find information that may pertain to the H.264 or display driver issues that will assist in troubleshooting.

When using GPUs such as Nvidia GRID and AMD MxGPU, it is recommended to disable the VMware SVGA 3D Driver and adapter inside of Device Manager after you install the applicable GPU drivers.

NVIDIA vGPU Issues

You may be experiencing issues related to the NVIDIA vGPU platform, either inside of the VM guest, or on the VMware ESXi host.

Please check out my NVIDIA vGPU Troubleshooting Guide – How to troubleshoot vGPU on VMware for more information on how to troubleshoot, as well as a list of common issues experienced with VMware Horizon and NVIDIA vGPU.

VMware Tools

A corrupt VMware tools install, whether software or drivers can cause display issues. Make sure that the drivers (including the display driver) are installed and functioning properly.

It may be a good idea to completely uninstall VMware Tools and re-install.

If you’re experiencing display driver issues (such as a blank screen), before re-installing VMware Tools try forcibly removing the display driver.

Open “Device Manager”
Right click on the VMware Display adapter and open “Properties”
On the “Driver” tab, select “Uninstall”
Check the box for “Delete the driver software for this device”.

This will fully remove the VMware driver. Now re-install VMware Tools.

Horizon Agent

Often, re-installing the Horizon Agent can resolve issues. Always make sure that VMware Tools are installed first before installing the Horizon Agent.

Make sure that if you are running 64-bit Windows in the VM then you install and use the 64-bit Horizon Agent.

You may experience issues with the “VMware Horizon Indirect Display Driver”. Some users have reported an error on this driver and issues loading it, resulting in a blank screen. To do this, I’d recommend forcibly uninstalling the driver and re-installing the Horizon Agent.

To forcibly remove the “VMware Horizon Indirect Display Driver”:

Open “Device Manager”
Right click on the “VMware Horizon Indirect Display Driver” and open “Properties”
On the “Driver” tab, select “Uninstall”
Check the box for “Delete the driver software for this device”.

Now proceed to uninstall and reinstall the Horizon View Agent.

When running the Horizon Agent on Horizon for Linux, make sure that forward and reverse DNS entries exist, and that DNS is functioning on the network where the Linux VM resides.

Also, as a reminder, it is recommended that you re-install the Horizon agent in versions up to and including Horizon 8 2103 after upgrading VMware Tools. As of Horizon 8 2106, you no longer need to re-install the Horizon Agent when performing a VMware Tools upgrade.

Video Settings (Video Memory (VRAM), Resolution, Number of Displays)

When experiencing video display issues or blank screens on VMware Horizon View, these could be associated with the guest VM’s memory, video memory (VRAM), display resolution, and number of displays.

vSphere Video RAM (VRAM) configuration for VMware Horizon — vSphere Video RAM Configuration for VMware Horizon

If you do not have enough Video RAM (VRAM) allocated to the virtual machine and/or you have too many displays (multi-monitor), then you can experience the blank screen with Horizon.

Make sure you are adhering to the specifications put forth by VMware. Please see the following links for more information.

Master Image Resolution

While this isn’t likely to cause a blank screen issue (it can though), it’s always a good idea to set your image to a lower resolution before snapping or converting to a template for deployment.

It’s a lot easier for the VMs to start using lower resolution and VRAM (Video Memory) and then increase to what’s needed, instead of starting at a crazy high resolution and then getting adjusted down.

I consider it a good practice to reduce the graphics resolution before creating and deploying the image to the desktop pools.

Protocol

When troubleshooting blank screens with VMware Horizon, you need to try to identify whether it’s specific to the guest VM, or if it’s associated with the connection protocol you’re using (and the route it takes whether through a Connection Server, or UAG).

Always try different protocols to see if the issue is associated with all, or one. Then try establishing connections and find if it’s isolated direct to the Connection Server, or through the UAG.

If the issue is with a specific protocol, you can view the protocol log files. If the issue is with the UAG, you can troubleshoot the UAG.

Log files can be found in the following directory:

C:\ProgramData\VMware\

HTTPS Proxy and redirection issues

If you are connecting through a network that does passive and/or transparent HTTPS scanning or uses a proxy server, you may experience issues with inability to connect, or blank screens.

You’ll need to modify your firewall or proxy to allow the VMware connection and open the required ports for VMware Horizon and create an exception not to touch or manipulate the VMware Horizon related traffic.

I haven’t seen or heard of this one in some time, but when using VMware Horizon with PCoIP, sessions can fail or show a blank screen when the legal disclaimer login banner is used on the Windows instance (Windows 7, Windows 10, or Windows 11).

For more information on this issue, and how to resolve or workaround, visit https://kb.vmware.com/s/article/1016961.

Old version of VMware Horizon

It never stops surprising me how old some of the VMware Horizon View environments are that some businesses are running. VMware regularly updates, and releases new versions of VMware Horizon that resolve known issues and bugs in the software.

While it may be difficult, simply upgrading your VMware Horizon environment (VMware vSphere, View Connection Server, VMware Tools, VMware Horizon Agent) can often resolve many issues.

Blank Screen connecting to Physical PC running Horizon Agent

When you install the VMware Horizon Agent on a Physical PC, you may encounter issues with a blank screen.

This is usually caused by:

Port blocking and/or firewall
Running Windows 10 Pro instead of Windows 10 Enterprise (Enterprise edition is required on the Physical PC running the Horizon agent)
DNS Issues
Issues with the Horizon Agent and the “VMware Horizon Indirect Display driver”

After troubleshooting these issues, you should be able to resolve the issue.

Conclusion

As you can see there are a number of different things that can cause Horizon View to show a blank screen on login. It’s always best to try to understand how the technology works, and establish where the failure points are.

Let me know if this helped you out, or if you find other reasons and feel I should add them to the list!

Audio and hardware redirection issues with Horizon Agent installed on Physical PC

End User Computing, Omnissa Horizon, VDI, VMware 10 Responses »

Mar 192020

After installing the VMware Horizon Agent on a Physical PC, you may have noticed some issues with USB redirection, audio, and hardware redirection. These issues include not working, or not working in it’s entirety.

On a few occasions I’ve had readers reach out to inform me that they are experiencing these issues. Most recently a reader by the name of “Sascha” reached out and reported issues with audio, particularly the microphone not functioning or being redirected from the VMware Horizon View Client to the Physical PC.

The Fix

In Sascha’s case (along with the other readers), we troubleshot the issue and realized that in each and every case the problem was due to the use of a Windows 10 Profesional license being used. As per the VMware Horizon release notes, a Windows 10 Enterprise license must be used when installing the Horizon Agent on a Physical PC.

Once Sascha and the other users upgrades or installed a Windows 10 Enterprise license, the issues stopped immediately.

This is another reminder that you need an Windows 10 Enterprise license when installing the Horizon Agent on a Physical PC.

Video Editing and Encoding on VDI (with Nvidia GRID)

End User Computing, Homelab, Omnissa Horizon, VDI, VMware, Zero Clients/Thin Clients 1 Response »

Mar 052020

Picture of someone video editing on Laptop

Lately, I’ve been playing with video editing and encoding as a new hobby. It requires a powerful system for the production process for both editing, and encoding. While CPU power isn’t necessarily important, the CPU instruction sets and your GPU play a key part with editing and encoding.

For the last few weeks, I’ve been attempting to use my desktop rig with a couple of Nvidia GeForce cards and I’ve been struggling to be able to edit in real time, as well as encode completed video productions in a reasonable amount of time.

Well, there’s a happy ending to this story, my Nvidia Grid K1 and VDI environment saved the day!

My VDI setup

As part of my demo and homelab, I have an HPE ML310e Gen8 v2, with an Nvidia Grid K1 card. This setup is backed with an HPE MSA 2040 SAN for main storage and a Synology DS1813+ for backup and video storage.

Nvidia GRID K1 in ML310e without air baffle installed — Nvidia GRID K1 in ML310e w/o Air Baffle

On this rig, I’m running VMware Horizon 7.11 and connect to it via a 10ZiG 5948qv Zero Client.

It’s a beautiful desktop replacement as it’s silent, provides a desktop backed with a Intel Xeon Processor, and a high performance GPU.

VDI Video Editing and Encoding

For software, I’ve been using Cyberlink’s PowerDirector software. I’ve used this in the past for screen recording, as well as editing videos I use for demos.

On my physical desktop rig, even with two GPUs it struggles to allow me to preview in realtime the edits I’ve done on a project. The preview window is jolty with loss frames, and it’s hard to know what you’re doing. Also, when producing and encoding a finalized video project, it would take forever to complete even a small 5 minute video at 1080p.

When I first loaded this up on my VDI environment, the software instantly detected the Nvidia GRID card, and asked me if it could use it. From that point on the preview window was fluid, transitions and add-ins were rendered on the fly during previewing, and the final production encoding was literally over 20 times faster using 1080p. Keep in mind this VM only has one Nvidia K180q profile attached to it, so I’m only using less than 25% of the cards full capability.

VDI 3D Graphics and Game Demo – Horizon, GRID, vGPU

HPE, NVIDIA, Omnissa Horizon, VMware 4 Responses »

May 182019

VMware Horizon View Mobile Client Android Windows 10 VDI Desktop

Since I’ve installed and configured my Nvidia GRID K1, I’ve been wanting to do a graphics quality demo video. I finally had some time to put a demo together.

I wanted to highlight what type of graphics can be achieved in a VDI environment. Even using an old Nvidia GRID K1 card, we can still achieve amazing graphical performance in a virtual desktop environment.

This demo outlines 3D accelerated graphics provided by vGPU.

Demo Video

Please see below for the video:

Information

Demo Specifications

VMware Horizon View 7.8
NVidia GRID K1
GRID vGPU Profile: GRID K180q
HPE ML310e Gen8 V2
ESXi 6.5 U2
Virtual Desktop: Windows 10 Enterprise
Game: Steam – Counter-Strike Global Offensive (CS:GO)

Please Note

Resolution of the Virtual Desktop is set to 1024×768
Blast Extreme is the protocol used
Graphics on game are set to max
Motion is smooth in person, screen recorder caused some jitter
This video was then edited on that VM using CyberLink PowerDirector
vGPU is being used on the VM

How to configure DUO MFA 2FA on VMware Horizon View

Duo MFA, Omnissa Horizon, Remote Access 2 Responses »

May 072019

So you’ve started to use or test Duo Security’s MFA/2FA technology on your network. You’ve been happy so far and you now want to begin testing or rolling out DUO MFA on your VMware Horizon View server.

VMware Horizon is great at providing an end user computing solution for your business, a byproduct of which is an amazing remote access system. With any type of access, especially remote, comes numerous security challenges. DUO Security’s MFA solution is great at provided multi-factor authentication for your environment, and fully supports VMware Horizon View.

In this guide, I’ll be providing a quick how to guide on how to get setup and configured with DUO MFA on your Horizon Server to authenticate View clients.

If you are looking to only implement DUO 2FA on the VMware Unified Access Gateway (and not the connection server), head over to my colleague’s post here: https://securedpackets.com/?p=424

Here’s a video of DUO on VMware Horizon View in action! Scroll down for instructions on how to set it up!

Video Demonstration of DUO MFA 2FA on VMware Horizon View

Enabling DUO MFA on VMWare View will require further authentication from your users via one of the following means:

DUO Push (Push auth request to mobile app)
Phone call (On user’s pre-configured phone number)
SMS Passcode (Texted to users pre-configured phone number)
PIN code from a Hardware Token

For more information on the DUO technology and authentication methods, please visit
https://www.digitallyaccurate.com/blog/2018/06/12/secure-business-enterprise-it-systems-multi-factor-authentication-duo-mfa/

Prerequisites

VMware Horizon View Connection Server (Configured and working)
VMware View Client (for testing)
DUO Authentication Proxy installed, configured, and running (integrated with Active Directory)
Completed DUO Auth Proxy config along with “[ad_client]” as primary authentication.

Please Note: For this guide, we’re going to assume that you already have a Duo Authentication Proxy installed and fully configured on your network. The authentication proxy server acts as a RADIUS server that your VMware Horizon View Connection Server will use to authenticate users against.

Instructions

The instructions will be performed in multiple steps. This includes adding the application to your DUO account, configuring the DUO Authentication Proxy, and finally configuring the VMware View Connection Server.

Add the application to your DUO account

Log on to your DUO account, on the left pane, select “Applications”.
Click on the Blue button “Protect an Application”.
Using the search, look for “VMware View”, and then select “Protect this Application”.
Record the 3 fields labelled “Integration key”, “Security key”, and “API hostname”. You’ll need these later on your authentication proxy.
Feel free to modify the Global Policy to the settings you require. You can always change and modify these later.
Under Settings, we’ll give it a friendly name, choose “Simple” for “Username normalization”, and optionally configure the “Permitted Groups”. Select “Save”.

Configure the DUO Authentication Proxy

Log on to the server that is running your DUO Authentication Proxy.
Open the file explorer and navigate to the following directory.
```
C:\Program Files (x86)\Duo Security Authentication Proxy\conf
```
Before any changes I always make a backup of the existing config file. Copy and paste the “authproxy.cfg” file and rename the copy to “authproxy.cfg.bak”.
Open the “authproxy.cfg” file with notepad.
Add the following to the very end of the file:
```
;vmware-view
[radius_server_challenge]
ikey=YOUR_INTEGRATION_KEY
skey=YOUR_SECRET_KEY
api_host=YOUR-API-ADDRESS.duosecurity.com
failmode=safe
client=ad_client
radius_ip_1=IP-ADDY-OF-VIEW-SERVER
radius_secret_1=SECRETPASSFORDUOVIEW
port=1813
```
Using the values from the “Protect an Application”, replace the “ikey” with your “integration key”, “skey” with your “secret key”, and “api_host” with the API hostname that was provided. Additionally “radius_ip_1” should be set to your View Connection Server IP, and “radius_secret_1” is a secret passphrase shared only by DUO and the View connection server.
Save the file.
Restart the DUO Authentication Proxy either using Services (services.msc), or run the following from a command prompt:
```
net stop DuoAuthProxy & net start DuoAuthProxy
```

Configure the VMware View Connection Server

Log on to your server that runs your VMware View Connection Server.
Open the VMware Horizon 7 Administrator web interface and log on.
On the left hand side, under “Inventory”, expand “View Configuration” and select “Servers”.
On the right hand side in the “Servers” pane, click on the “Connection Servers” tab, then select your server, and click “Edit”.
On the “Edit Connection Server Settings” window, click on the “Authentication” tab.
Scroll down to the “Advanced Authentication” section, and change the “2-factor authentication” drop down, to “RADIUS”. Check both check boxes for “Enforce 2-factor and Windows user name matching”, and “Use the same user name and password for RADIUS and Windows Authentication”.
Below the check boxes you will see “Authenticator”. Open the drop down, and select “Create New Authenticator”.
In the “Add RADIUS Authenticator” window, give it a friendly name, friendly description, and populate the fields as specified in the screenshot below. You’ll be using the shared RADIUS/DUO secret we created above in the config file for the proxy auth.

Please Note that I changed the default RADIUS port in my config to 1813.
Click “Ok”, then make sure the newly created authenticator is select in the drop down. Proceed to click “Ok” on the remaining windows, and close out of the web interface.

That’s it!

You have now completely implemented DUO MFA on your Horizon deployment. Now when users attempt to log on to your VMware View Connection server, after entering their credentials they will be prompted for a second factor of authentication as pictured below.

DUO Security Login VMware View Client Dialog Box — DUO Security Login VMware View Client

DUO Security MFA authenticate VMware View Client dialog box — DUO Security MFA authenticate VMware View Client

VMware Horizon View is now fully using MFA/2FA.

The Tech Journal

VMware Horizon Blank Screen

VMware Horizon Blank Screen Causes

VMware Tools and Horizon Agent Installation Order